Article 24Use of European cybersecurity certification schemes
1. In order to demonstrate compliance with particular requirements of Article 21, Member States may require essential and important entities to use particular ICT products, ICT services and ICT processes, developed by the essential or important entity or procured from third parties, that are certified under European cybersecurity certification schemes adopted pursuant to Article 49 of Regulation (EU) 2019/881. Furthermore, Member States shall encourage essential and important entities to use qualified trust services.
2. The Commission is empowered to adopt delegated acts, in accordance with Article 38, to supplement this Directive by specifying which categories of essential and important entities are to be required to use certain certified ICT products, ICT services and ICT processes or obtain a certificate under a European cybersecurity certification scheme adopted pursuant to Article 49 of Regulation (EU) 2019/881. Those delegated acts shall be adopted where insufficient levels of cybersecurity have been identified and shall include an implementation period.
Before adopting such delegated acts, the Commission shall carry out an impact assessment and shall carry out consultations in accordance with Article 56 of Regulation (EU) 2019/881.
3. Where no appropriate European cybersecurity certification scheme for the purposes of paragraph 2 of this Article is available, the Commission may, after consulting the Cooperation Group and the European Cybersecurity Certification Group, request ENISA to prepare a candidate scheme pursuant to Article 48(2) of Regulation (EU) 2019/881.
NIS2, the European Union directive on network and information security, Article 24
To demonstrate compliance with particular requirements of Article 21, Member States may require essential and important entities to use ICT products, services and processes, whether developed in-house or bought in, that are certified under a European cybersecurity certification scheme adopted under the Cybersecurity Act. Member States must also encourage use of qualified trust services.
The Commission is empowered to adopt delegated acts specifying which categories of entity must use certain certified products, services or processes, or obtain a certificate. Those acts are to be adopted where insufficient levels of cybersecurity have been identified, must include an implementation period, and follow an impact assessment and consultation. Where no suitable scheme exists, the Commission may ask ENISA to prepare a candidate scheme.
Certification here is a way of demonstrating compliance with particular requirements; it does not replace the measures themselves. Whether it is required depends on the Member State’s choice, or on a delegated act if one is adopted. A reader should check which of those applies to their entity rather than assume either way.
Text: Directive (EU) 2022/2555, OJ L 333, 27.12.2022, p. 80, as corrected by Corrigendum OJ L, 2023/90206, 22.12.2023 (Article 19(1): “by 17 January 2025”, replacing “on”), from EUR-Lex. Only the Official Journal text is authentic.