EU Cybersecurity Act
Amended European Union · In force Jun 27, 2019 · no upcoming deadlines
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
Gives ENISA a permanent mandate and sets up the EU framework for voluntary cybersecurity certification schemes for ICT products, services and processes, such as the EUCC scheme. On 2026-01-20 the Commission proposed a replacement, the Cybersecurity Act 2 (COM(2026) 11), adding an ICT supply chain security framework aimed at high-risk suppliers.
- Who it applies to
- ENISA, national cybersecurity certification authorities, and manufacturers or providers of ICT products, services and processes that seek EU certification.
- Penalties
- Member States set penalties for infringements of the certification title and of certification schemes.
- Enforced by
- ENISA and national cybersecurity certification authorities.
- Official name
- Regulation (EU) 2019/881 on ENISA and on information and communications technology cybersecurity certification (Cybersecurity Act)
- Citation
- Regulation (EU) 2019/881, amended by Regulation (EU) 2025/37
- Topics
- cybersecurity
Research notes
Regulation (EU) 2025/37 of 2024-12-19 added managed security services to the certification scope. A companion proposal COM(2026) 13 would amend NIS2 to align with CSA2. The CSA2 proposal is not law as of 2026-09-25.
Related
Questions about EU Cybersecurity Act
- What are the EU Cybersecurity Act compliance deadlines?
- Jun 27, 2019: Cybersecurity Act enters into force. Jun 28, 2021: Certification enforcement articles apply. Jan 20, 2026: Cybersecurity Act 2 proposed.
- When does EU Cybersecurity Act take effect?
- EU Cybersecurity Act took effect on Jun 27, 2019.
- Who does EU Cybersecurity Act apply to?
- ENISA, national cybersecurity certification authorities, and manufacturers or providers of ICT products, services and processes that seek EU certification.
- What are the penalties under EU Cybersecurity Act?
- Member States set penalties for infringements of the certification title and of certification schemes.