← Hiring CRA experts
When do you need an EUCC evaluation lab for the Cyber Resilience Act?
An EUCC evaluation lab is needed when an Annex IV critical product must hold European cybersecurity certification, or when an important product uses a qualifying European certification scheme as its Article 32 conformity route.
Key takeaways
- EUCC is the European Common Criteria-based certification scheme, adopted by Commission Implementing Regulation (EU) 2024/482 under the Cybersecurity Act.
- An EUCC evaluation is done by an IT security evaluation facility (ITSEF) accredited to ISO/IEC 17025 with ISO/IEC 23532-1, and assurance level high also needs authorisation by the national certification authority.
- An EUCC certificate covers only its target of evaluation, so the rest of the product needs separate evidence of CRA conformity.
- For Annex IV products, a Commission delegated act under Article 8(1) decides when certification is required, so check whether one covers your product.
Last reviewed 17 October 2026
Published by Porta Regulus B.V. No paid placement. No provider is named or ranked.
Which CRA requirements does this service give evidence for?
- Article 32 conformity route through a European cybersecurity certification scheme
Which credentials should the provider hold?
| Credential | Held by | What it shows |
|---|---|---|
| IT security evaluation facility (ITSEF) for EUCCNational cybersecurity certification authority, under Implementing Regulation (EU) 2024/482 | Laboratory | The lab holds ISO/IEC 17025 accreditation, complemented by ISO/IEC 23532-1, for EUCC evaluations. For assurance level high the national cybersecurity certification authority must also authorise it. |
What should you ask the provider for?
- The assurance level, substantial or high.
- The target of evaluation, and whether it includes the update mechanism.
- Whether a protection profile exists for your product type.
- A timeline in months and the certification body the lab works with.
Which red flags should stop the hire?
- A lab that equates an EUCC certificate with CRA conformity of the whole product.
- A target of evaluation that leaves out the update mechanism or the cloud service.
Which checks apply to every CRA expert?
- Professional liability insurance that covers the work, with the amount in writing.
- Independence from your own developers and from any supplier whose component is in scope.
- A fixed price for a written scope with a defined end.
- Names and credentials of each person who does the work.
- A deliverable you may share with a notified body and a market surveillance authority.
- Data handling inside the EU, or a written basis for any transfer.
Find out which of these services your product needs
CVD Portal lists the open Annex I gaps for each product and names the kind of expert that closes each one.
This page is part of the EU Cyber Resilience Act guide, which explains Regulation (EU) 2024/2847 article by article.