EU Cybersecurity Act
A 2019 regulation that gave the EU cybersecurity agency a permanent mandate and created a cybersecurity certification framework for products, services and processes valid throughout the Union.
Regulation (EU) 2019/881, the Cybersecurity Act, pursues two objectives. It gives the European Union Agency for Cybersecurity a permanent mandate and broader tasks: support for member states, operational cooperation, exercises, awareness. And it creates a European cybersecurity certification framework, allowing common schemes to be developed for categories of digital products, services and processes, with basic, substantial and high assurance levels. A certificate issued in one member state under a European scheme is recognized throughout the Union, gradually replacing the patchwork of national certifications. The first scheme adopted, based on the common criteria, was established by an implementing regulation of January 2024 and has applied since 2025; others are in preparation, notably for cloud, where debate over sovereignty criteria has delayed adoption. For insurance, certification offers a readable, comparable signal of a product's or provider's security, useful in underwriting and in assessing dependencies, and it works together with the Cyber Resilience Act, which makes certain requirements mandatory for products with digital elements.
Textbook case: a smart card manufacturer obtains a high-level European certificate based on the common criteria for its product, recognized in all twenty-seven member states. Where it previously had to collect national certifications, a single certificate opens the Union's public and private markets to it.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.