EU Draft Proposal Standardized Cybersecurity Certification
A new proposal aims to replace 27 national certification systems with a single mandatory EU framework for hardware.
Updated on Oct. 8, 2026 in Cybersecurity
Live Poll
Should the EU mandate technology certification to improve cybersecurity standards across all member states?
Rapporteur Markéta Gregorová presented draft reports on October 8, 2026, proposing a unified EU-wide cybersecurity certification mandate. The move would replace 27 disparate national systems with one consolidated framework.
Why it matters
The proposal seeks to streamline incident reporting and reduce supply-chain risks across Europe by harmonizing rules for critical technology. It aims to eliminate administrative fragmentation and plug existing loopholes involving intermediaries.
The draft proposes a single entry point for incident reporting, replacing 27 individual national systems. It specifically targets high-risk equipment including inverters, smart meters, home routers, port cranes, and medical imaging devices.
The players
Markéta Gregorová
The rapporteur responsible for drafting the new reports on European cybersecurity legislative alignment.
ITRE Committee
The European Parliament committee focused on industry, research, and energy policy that received the draft reports.
The details
The proposed framework aims to close security gaps caused by licensing, white-label product distribution, and the use of intermediaries to circumvent rules. By aligning the NIS2 Directive and Cybersecurity Act 2, the report introduces mandatory certification by default for hardware. It also shifts high-risk supplier assessments from generalized categories to individual case-by-case evaluations.
Timeline
January 2026: The European Commission presented the original Cybersecurity Act 2 proposal.
October 8, 2026: Markéta Gregorová presented her draft reports to the ITRE Committee.
The Tech Race
The draft updates reporting logic to align with the NIS2 Directive and Cybersecurity Act 2, creating a cohesive regulatory structure. This effort marks a significant push to replace fragmented national oversight with a unified EU-wide technical certification standard.
Technology manufacturers and suppliers will face mandatory certification requirements for essential equipment like smart meters and routers. While these changes target large-scale supply-chain security, the new unified notification entry point aims to simplify compliance workflows for impacted companies.
The takeaway
The EU is moving toward a centralized certification regime to address systemic supply-chain vulnerabilities. Stakeholders should track upcoming legislative sessions to see how the proposed mandatory certification impacts specific high-risk hardware classifications.
Further reading
For broader context on evolving standards, visit the Cybersecurity section.
Source note: This article includes information reported by Agence Europe.
Live Poll
Should the EU mandate technology certification to improve cybersecurity standards across all member states?
