Article 26 establishes Union testing facilities to be operated by or designated by the European Union Agency for Cybersecurity (ENISA). These facilities provide independent testing capacity that national market surveillance authorities can use to assess products, investigate compliance, and conduct enforcement activities. Union testing facilities enhance the EU's capacity to identify non-compliant products in the market and provide neutral, high-quality technical assessments to support enforcement.
Purpose and Role of Union Testing Facilities
Article 26 addresses a practical capacity constraint in CRA enforcement: national market surveillance authorities need access to high-quality, independent cybersecurity testing to challenge non-compliant products. Without dedicated testing facilities, authorities must commission tests from commercial labs that may not have sufficient capacity or whose independence could be questioned.
Union testing facilities are specifically established to support market surveillance activities — they are not commercial conformity assessment bodies and do not issue CE marking certificates. Their role is investigative and enforcement-oriented: testing products that authorities suspect may not comply with CRA requirements, generating evidence to support corrective action orders, and providing technical expertise to national authorities that may lack in-house cybersecurity assessment capability.
The designation of ENISA as the coordinator or operator of these facilities reflects ENISA's central role in the CRA's technical and enforcement architecture and its existing expertise in cybersecurity testing and certification.
Testing Activities Supported by Union Facilities
Union testing facilities can conduct a range of testing activities relevant to CRA enforcement, including:
Compliance verification: Testing whether specific products meet the essential requirements in Annex I, particularly when manufacturers' self-declarations are disputed by authorities.
Incident analysis: Analysing products involved in cybersecurity incidents to determine whether vulnerabilities resulted from non-compliance with CRA requirements.
Standard validation: Assessing whether specific harmonised standards adequately cover the essential requirements they purport to address, supporting Article 9 proceedings.
Capacity building: Providing technical expertise and training to national authorities to improve their capability to assess CRA compliance independently.
Results from Union testing facilities carry significant weight in enforcement proceedings, given the independent and publicly accountable nature of the facilities.
Designation of Testing Facilities
Article 26 allows the Commission to designate existing testing facilities — including those at national cybersecurity agencies, national metrology institutes, and accredited research institutions — as Union testing facilities, rather than requiring construction of entirely new infrastructure.
This pragmatic approach allows the EU to leverage existing technical capacity across member states. National cybersecurity agencies with established testing laboratories, such as the BSI in Germany or ANSSI in France, may be designated to provide Union testing services in addition to their national roles.
For manufacturers, the designation of Union testing facilities means that enforcement testing of their products could be conducted by ENISA-coordinated bodies with high levels of technical expertise and institutional independence. The quality of enforcement testing is likely to be high, reducing the scope for manufacturers to dismiss technical findings on competence grounds.
Funding and Resource Allocation
Article 26 contemplates that Union testing facilities will be funded through EU budget allocations, given their public enforcement function. ENISA's budget under the Cybersecurity Act includes provisions for technical activities that would encompass Union testing facility operations.
The availability of EU funding for Union testing facilities ensures that national authorities can access testing services without bearing the full cost themselves — a particularly important provision for smaller member states with limited national cybersecurity testing infrastructure.
For manufacturers, this funding model means that enforcement testing is more likely to be comprehensive and technically rigorous than it might be if authorities needed to commission tests from their own limited budgets. The availability of well-resourced testing capacity should incentivise manufacturers to ensure genuine compliance rather than relying on resource constraints limiting enforcement.
CVD Portal helps you comply with Article 26 automatically.
Public submission portal, 48-hour acknowledgment tracking, Article 14 deadline alerts, and CSAF advisory generation. Free forever.
Start your free portalFrequently asked
Can a manufacturer request that a Union testing facility test their product to support their compliance claim?+
Union testing facilities are primarily established for enforcement and market surveillance purposes, not for commercial conformity assessment services. Manufacturers seeking compliance evidence should use accredited notified bodies or independent testing laboratories. However, if a manufacturer's compliance is disputed by an authority, Union testing facility results could play a role in resolving the dispute.
What happens to a manufacturer's product after it is tested by a Union testing facility?+
Products tested for market surveillance purposes are typically held by the authority or testing facility until the enforcement proceedings are complete. If the product is found compliant, it should be returned. If non-compliant, it may be retained as evidence or destroyed, depending on national procedures. Manufacturers may request the return of tested products once proceedings conclude.
Are Union testing facility results published?+
Market surveillance findings — including testing results that lead to enforcement action — are typically published in the EU's Safety Gate database and ENISA's communications. However, the full technical detail of testing methodologies may not be published to avoid providing a roadmap for circumventing testing. Manufacturers subject to enforcement action will typically receive the specific findings that apply to their products.
How does Article 26 interact with national testing laboratories?+
National testing laboratories and Union testing facilities complement each other. National labs handle the majority of day-to-day market surveillance testing within their jurisdiction, while Union testing facilities provide capacity for complex cases, cross-border investigations, or situations where specialist expertise beyond national capacity is needed. ENISA coordinates between national facilities to avoid duplication and build joint expertise.
Need a CVD policy that satisfies Article 26?
Download a free CRA-compliant template and deploy it in minutes.