European Cybersecurity Certification Scheme for Cloud Services (EUCS)

EUCS (European Cybersecurity Certification Scheme for Cloud Services) is the draft EU scheme for certifying the cybersecurity of cloud services, prepared by ENISA (European Union Agency for Cybersecurity). The Commission handed the scheme to ENISA at the end of 2019, under Regulation (EU) 2019/881, the Cybersecurity Act. The first draft, published in December 2020, took up the regulation's assurance levels, basic, substantial and high, with requirements spread over some twenty control categories. The fight came in 2022, when working versions added to the high level criteria modeled on SecNumCloud. Those criteria: headquarters in the Union, control by European capital, immunity from foreign laws with extraterritorial reach, the US CLOUD Act (Clarifying Lawful Overseas Use of Data Act) first among them. US providers and several member states opposed them, France defended them. The 2024 drafts removed those criteria, and the scheme had still not been adopted by mid-2025. For an underwriter, the interest of the file lies in what was taken out. A high-level EUCS certification without immunity criteria will attest to technical controls; it will say nothing about the chance that a US judge orders the disclosure of data hosted in Frankfurt. That is political risk sitting inside a cyber contract, and it cannot be read on the certificate. The scheme will also weigh indirectly. NIS2 (the EU directive on the security of network and information systems) allows member states to require European certification from certain entities. A client's questionnaire will cite an EUCS level the way it cites ISO 27001 today, with the same question about the scope actually audited: one service, one region, or the provider's whole offering.