- The EUCS, or European Cybersecurity Certification Scheme for Cloud Services, is the European cybersecurity certification scheme for cloud services, prepared by ENISA since 2020.
- It stems from the Cybersecurity Act (EU Regulation 2019/881), which establishes a common framework for cybersecurity certification across the Union.
- The scheme defines three assurance levels, Basic, Substantial and High, with the High level being the one of interest to sensitive operators and public administrations.
- Final adoption has been the subject of prolonged debate over whether to include sovereignty requirements (capital control, extraterritorial immunity), which has delayed the original timetable.
What is the EUCS?
The EUCS, or European Cybersecurity Certification Scheme for Cloud Services, is a European cybersecurity certification scheme specifically designed for cloud services. It is being prepared by ENISA, the European Union Agency for Cybersecurity, under the Cybersecurity Act adopted in 2019.
The scheme offers three graduated assurance levels. Basic and Substantial rely on conventional technical and organisational criteria, aligned with ISO 27001 and ISO 27017. The High level targets the most sensitive services and has been the subject of in-depth political discussion since 2021.
The heart of the debate is whether the High level should include so-called sovereignty requirements: European capital control, immunity from extraterritorial orders, strict data location. Member States’ positions diverge, which explains the slippage in the adoption timetable.
From the Cybersecurity Act to political trade-offs
- April 2019Entry into force of the Cybersecurity Act (EU Regulation 2019/881), which mandates ENISA to prepare European certification schemes.
- December 2020ENISA publishes a first proposal for the EUCS scheme, structured in three levels: Basic, Substantial and High.
- 2021-2022Several working versions are published. Discussion focuses in particular on the sovereignty requirements of the High level: extraterritorial immunity and capital control.
- 2023A new version removes or relaxes the strictest sovereignty requirements, prompting public opposition from ANSSI, CNIL and several Member States.
- 2024The European Commission and ENISA continue the political trade-offs. The adoption timetable is pushed back to allow a consensus on the High level.
- 2025-2026Final-stretch discussions. Several Member States are pushing for EUCS High to include requirements aligned with SecNumCloud, while others oppose this to preserve the market’s attractiveness.
What the EUCS will change, or not
Six expected effects for European organisations, subject to final adoption of the text.
Three assurance levels
Basic corresponds to basic assurance, Substantial to an enhanced level and High to a high level of assurance. The technical criteria are drawn from existing standards (ISO 27001, ISO 27017, ENS, ENISA Cloud Computing Risk Assessment).
Interplay with national frameworks
Once adopted, the EUCS will coexist with national frameworks (SecNumCloud in France, BSI C5 in Germany, ENS in Portugal and Spain). The mutual recognition mechanism has yet to be settled.
Sovereignty at stake at the High level
The main controversy concerns whether the High level includes data location requirements and immunity from extraterritorial laws. Member States’ positions remain divergent.
Impact on public procurement
If the High level includes sovereignty requirements, the EUCS will become a structuring tool for European public procurement. If not, its adoption will be broader but its sovereignty value weaker.
Compliance cost
For providers, aiming for the High level involves a major effort in documentation, audit and governance. The return on investment depends on actual recognition in public and regulated tenders.
Unclear timetable
Formal adoption has been postponed several times since 2022. As of the date of this page, the scheme is not yet in force, but providers are already preparing their applications on the basis of the working versions.
Three common confusions
“The EUCS is already in force.”
The EUCS has not yet been adopted. Several working versions have circulated since 2020, but the final text is still under discussion between ENISA, the Commission and the Member States.
“EUCS High will replace SecNumCloud.”
The EUCS will coexist with national frameworks under arrangements still being discussed. As long as the High level does not include all SecNumCloud requirements, the French qualification will remain useful for sensitive data.
“The hyperscalers will automatically obtain the High level.”
If the final text keeps sovereignty requirements at the High level, their access will depend on specific legal structures. If these requirements are removed, access will be more open, but the label’s sovereignty value will be weakened.
Further reading
- ENISA, EUCS page (enisa.europa.eu)
- Regulation (EU) 2019/881 on cybersecurity (Cybersecurity Act), consolidated text (eur-lex.europa.eu)
- ANSSI, statements on the EUCS and the retention of sovereignty requirements (cyber.gouv.fr)
- European Commission, Cybersecurity and certification page (digital-strategy.ec.europa.eu)
- BSI, C5 framework and its interplay with the EUCS (bsi.bund.de)