What is EUCC? The EU Common Criteria cybersecurity certification scheme explained
EUCC is the first EU-wide cybersecurity certification scheme under the Cybersecurity Act, based on Common Criteria. Learn its assurance levels, how it relates to national Common Criteria certificates, and how to look up EUCC certificates from your AI assistant.
Add the Security Certifications brain to your AI assistant
EUCC, the European Common Criteria-based cybersecurity certification scheme, is the first certification scheme adopted under the EU Cybersecurity Act (Regulation (EU) 2019/881). It was established by Implementing Regulation (EU) 2024/482 and has applied since February 2025. Products are still evaluated against Common Criteria (ISO/IEC 15408) by accredited labs, but the certificate is an EU certificate, valid in every member state, and is published by ENISA.
How EUCC differs from national Common Criteria
- One EU scheme instead of national ones: inside the EU, EUCC takes over from national Common Criteria certification and the SOG-IS agreement between national schemes.
- Two assurance levels: "substantial", for evaluations with vulnerability analysis AVA_VAN.1 or AVA_VAN.2, and "high", for AVA_VAN.3 to AVA_VAN.5. The Common Criteria EAL is still stated on the certificate.
- Limited validity: EUCC certificates are issued for at most five years and can be renewed.
- Vulnerability handling: certificate holders must monitor, handle and disclose vulnerabilities in certified products, and certificates can be suspended or withdrawn.
- Public register: ENISA publishes each certificate with its certification report and security target.
Common Criteria certificates issued under the international CCRA stay relevant outside the EU. A product can hold both a CCRA certificate and an EUCC certificate.
Who needs it
EUCC is voluntary unless EU or national law requires certification for a product type. It matters most for smart cards and secure elements, hardware security modules, network and security appliances sold to public sector buyers, and products that may later need to show conformity under the Cyber Resilience Act.
Questions to try
- "List all EUCC certificates issued so far, with vendor and assurance level."
- "Which smart card controllers hold an EUCC certificate at EAL6?"
- "Does this vendor have both a Common Criteria certificate and an EUCC certificate for the same product?"
- "Which German scheme certificates were reissued under EUCC?"
Certificate data comes from sec-certs.org, built by the Centre for Research on Cryptography and Security (CRoCS) at Masaryk University from NIST CMVP, the Common Criteria Portal and ENISA (EUCC). KBrain refreshes it weekly and links it to the CVE brain.
Add the Security Certifications brain to your AI assistant
Check FIPS 140-3, Common Criteria and EUCC certificates, products still in certification, post-quantum algorithms, and the CVEs that may affect certified products from Claude, ChatGPT, or any MCP compatible assistant. Hosted and refreshed weekly from sec-certs.org, with nothing to set up.
Questions people ask.
Is EUCC the same as Common Criteria?
EUCC uses Common Criteria and its evaluation methodology, but it is an EU certification scheme with its own rules on assurance levels, validity, vulnerability handling and recognition across the EU.
What are the EUCC assurance levels?
Substantial and high. Substantial covers evaluations with vulnerability analysis at AVA_VAN.1 or AVA_VAN.2, high covers AVA_VAN.3 to AVA_VAN.5. The Common Criteria EAL is also stated.
Where does the KBrain EUCC data come from?
From sec-certs.org, which collects the EUCC certificates ENISA publishes. KBrain refreshes it weekly and links each certificate to its official documents.