What it asks for. Member States may require essential and important entities to use particular ICT products, services and processes that are certified under European cybersecurity certification schemes adopted under the Cybersecurity Act, to demonstrate compliance with Article 21. Member States should also encourage the use of qualified trust services.
In practice. The Commission may adopt delegated acts specifying categories of essential and important entities that must use certified products or obtain a certificate, and may request ENISA to prepare a candidate scheme where none exists. In practice, organisations should track national requirements and the progress of EU schemes such as EUCC, include certification requirements in procurement where they apply, and keep a register of certified products and their certificate status. Evidence includes procurement criteria, certificate records and supplier attestations.
Common gaps. Organisations often overlook national certification mandates, fail to check whether certificates remain valid, or treat certification as a substitute for their own risk assessment.