EUCS (European Cybersecurity Certification Scheme for Cloud Services) is a proposed European Union cybersecurity certification scheme for cloud services. It is being developed by the European Union Agency for Cybersecurity (ENISA) under the European cybersecurity certification framework established by the Cybersecurity Act (European Union).^[1]

ENISA published the first candidate scheme in December 2020. Its public consultation described the scheme as covering cloud services including Infrastructure as a Service (IaaS), Platform as a Service (PaaS) and Software as a Service (SaaS). The certification model itself uses the three assurance levels provided for by the Cybersecurity Act: Basic, Substantial and High.^[2]

The EUCS became afterwards part of a wider political debate over digital sovereignty. Drafts developed after 2020 included requirements concerning data localisation, corporate ownership and control, establishment in the European Union and protection from non-EU extraterritorial regulations. Member states and industry groups disagreed over whether such requirements should form part of a cybersecurity certification scheme.^[3][4]

A March 2024 draft removed the main sovereignty requirements.^[5] The scheme was not adopted following the revision and remained under development. In 2025 and 2026 the European Commission developed separate measures addressing cloud sovereignty, including a Cloud Sovereignty Framework and the proposed Cloud and AI Development Act (CADA). CADA links the higher levels of its proposed cloud-sovereignty framework to European cybersecurity certification and refers to a European certification scheme covering cloud computing services that remains to be established under the Cybersecurity Act.^[6] As of August 2026^[update], ENISA lists EUCS among the European cybersecurity certification schemes under development.^[7]

Cloud security certification initially developed through national schemes in several European countries.

France developed a security qualification for cloud providers through the Agence nationale de la sécurité des systèmes d'information (ANSSI), later known as SecNumCloud. Germany developed the Cloud Computing Compliance Criteria Catalogue (C5) through the Federal Office for Information Security (BSI).

France and Germany tried to bring their approaches closer together. In 2016, ANSSI and BSI presented the European Secure Cloud (ESCloud) initiative, drawing on SecNumCloud and C5.^[8] Research on European cloud policy has identified these French and German initiatives as precursors to later efforts to establish European approaches to cloud certification.^[9]

On 17 April 2018, the European Commission convened two Digital Single Market cloud stakeholder working groups. One dealt with switching cloud providers and porting data and subsequently developed the SWIPO codes of conduct. The other, known as CSPCERT, worked on cloud security certification.^[10]

The groups continued to meet during 2018. At a meeting in Rome in October, CSPCERT was working on detailed security objectives and a comparative analysis of existing conformity-assessment methodologies.^[11] ENISA later identified CSPCERT among the sources of expert input used in preparing the European cloud certification scheme.^[12]

The Cybersecurity Act (European Union), Regulation (EU) 2019/881, established a European cybersecurity certification framework for ICT products, services and processes.^[13]

Under the framework, ENISA prepares candidate certification schemes following a request from the European Commission. The Cybersecurity Act provides for three assurance levels, Basic, Substantial and High, corresponding to increasing levels of risk and assurance.^[13]

ENISA established an Ad Hoc Working Group under Article 48(2) of the Cybersecurity Act to prepare the cloud candidate scheme.^[1]

The European Cybersecurity Certification Group (ECCG), composed of representatives of national cybersecurity certification authorities, has a formal role in the process. It advises and assists ENISA in preparing candidate schemes and issues an opinion before a candidate scheme is transmitted to the Commission.^[14]

ENISA published version 1.0 of the candidate EUCS scheme on 22 December 2020 and opened it to external review.^[1]

The consultation described EUCS as applying to cloud services independently of service or deployment model and referred to IaaS, PaaS and SaaS. It sought to harmonise cloud-security requirements with EU legislation, international standards, industry practices and existing certifications in member states.^[2]

The candidate scheme contains security objectives and requirements for cloud services. ENISA states that these requirements are based on international standards including ISO/IEC 27001, ISO/IEC 27002 and ISO/IEC 27017 and on controls previously defined in national schemes including C5 and SecNumCloud.^[15]: 17

The certification model uses cloud capability types rather than relying on the IaaS, PaaS and SaaS categories. It distinguishes infrastructure, platform and application capabilities.^{[15]: 6, 10}

Annex A groups the security requirements into areas including information-security organisation, personnel security, asset management, physical security, operational security, identity and access management, cryptography and key management, communication security, portability and interoperability, change and configuration management, development and procurement, incident management, business continuity, compliance and supplier relationships.^{[15]: 81–158}

Requirements are associated with assurance levels and include both organisational and technical measures.^{[15]: 19–26, 81–158}

The candidate scheme also distinguishes cybersecurity certification from restrictions on the location of data or the law applicable to a cloud service. Its introductory provisions do not impose restrictions on the location of data or on applicable law, while requiring information on these matters to be transparent.^[15]: 11

The candidate scheme defines the three assurance levels established by the Cybersecurity Act: Basic, Substantial and High.^{[15]: 19–26}

At Basic, the evaluation includes inspection of documentation concerning processes and design, together with automated testing for known basic vulnerabilities and automated compliance checks. Evidence is submitted to a conformity assessment body.^{[15]: 19–26}

The scheme does not permit a cloud service provider to issue an EU declaration of conformity, including at the Basic level. The Basic assessment therefore includes a provider self-assessment but is not a provider-issued statement of conformity.^{[15]: 27–28}

The Substantial level is intended to minimise known cybersecurity risks and risks from attackers with limited skills and resources. The High level addresses attacks by actors with significant skills and resources and requires a higher degree of assurance in the implementation and effectiveness of the applicable requirements.^{[15]: 19–26}

Later drafts discussed an additional category commonly called High+. By 2023, this category had become associated with requirements concerning the legal and corporate control of providers, data localisation and protection from third-country law.^[16][3]

The candidate scheme specifies requirements for conformity assessment bodies (CABs). Under the Cybersecurity Act, CABs are accredited by national accreditation bodies under Regulation (EC) No 765/2008.^{[15]: 29–30}

Assessment procedures differ by assurance level. The scheme defines the assessment activities applicable at Basic and more extensive audit and evaluation requirements at Substantial and High.^{[15]: 19–30}

The assessment model also addresses services that depend on internal or external subservice organisations. Where the carve-out method is used, evaluators examine the assurance documentation available for the relevant subservices, including the type and validity of certificates or assurance reports, the applicable framework and mappings to EUCS requirements.^{[15]: 159–172}

The candidate scheme contains provisions for the transition from national certification schemes to EUCS.^{[15]: 76–78}

ENISA proposed that existing national certification projects could be completed or converted into EUCS projects. Certificates already issued under national schemes would remain valid until the end of their validity period, but could not be extended under the national scheme after transition.^{[15]: 76–78}

The scheme also provides for reuse of evidence and evaluation results from national certifications in EUCS conformity assessments. The Ad Hoc Working Group recommended a transition period of one year after the first EUCS certificates were issued.^{[15]: 76–78}

The development of EUCS became contentious over requirements addressing the legal and corporate control of cloud services.

Rone describes the negotiations as involving divergent national preferences and disagreement over institutional competence in European cloud policy.^[3] The European Union Institute for Security Studies described the scheme's evolution as a technical harmonisation initiative that developed into a political debate over digital sovereignty and the position of American cloud providers in the European market.^[4]

Successive drafts considered conditions concerning data location, the establishment and ownership of cloud providers, the jurisdiction governing their operations and protection from legal demands originating outside the European Union.^[3][16]

A November 2023 analysis of the draft reported four certification levels: Basic, Substantial, High and High+. Additional requirements associated with the highest level included conditions concerning data localisation and the legal and corporate control of providers.^[16]

The requirements changed during successive drafts and negotiations.^[3][4]

Member states did not maintain a common position on the sovereignty requirements, and some national positions changed during the negotiations.^[3][4]

France supported requirements intended to limit exposure to non-European legal control. France, Germany, Italy and Spain supported additional sovereignty requirements for the highest level during an earlier phase of the negotiations.^[3][9]

Other member states opposed including such conditions in EUCS.

In 2022, a group of member states circulated a non-paper entitled Perspective on cloud certification and data sovereignty under the Cybersecurity Act. A revised version dated 2 December 2022 was supported by Denmark, Estonia, Finland, Greece, Ireland, Latvia, Lithuania, Poland, Slovakia, Sweden and the Netherlands.^[17]

The signatories questioned the inclusion of data-sovereignty and localisation requirements in a cybersecurity certification scheme and raised concerns about competition and international trade.^[17]

Germany's position changed during the negotiations. Rone identifies Germany as initially supporting the French position before subsequently moving away from it.^[3]

European business organisations also took different positions.

The French digital-user association Cigref and the German user association VOICE called for the highest EUCS level to guarantee immunity from non-European regulations with extraterritorial effect.^[18]

Other business groups opposed ownership and localisation requirements. In May 2023, a joint industry statement supported by organisations including AmCham EU, BSA, CCIA, ITI, techUK and the U.S. Chamber of Commerce argued for a scheme centred on cybersecurity and international standards and criticised the proposed sovereignty conditions.^[19]

In April 2024, various European companies called for sovereignty requirements to be retained. Reuters reported that the companies argued that EU-headquarters and European-control requirements were necessary to reduce the risk of access to European data under foreign laws.^[20] The signatories included Airbus, Deutsche Telekom, Orange, EDF, OVHcloud, Aruba, Dassault Systèmes, Ionos, Telecom Italia, Exoscale, Capgemini and Eutelsat.^[20]

In June 2024, 26 industry organisations took the opposite position. They supported an EUCS without ownership controls or requirements described as Protection against Unlawful Access or Immunity to Non-EU Law and argued for access to a diverse range of cloud technologies.^[21]

The dispute also became part of transatlantic economic and technology-policy relations.^[4]

AmCham EU argued that EUCS should remain technical and standards-based and opposed sovereignty requirements concerning ownership, localisation and exposure to non-EU law.^[19]

The Office of the United States Trade Representative discussed EUCS in its 2025 National Trade Estimate Report on Foreign Trade Barriers. It noted that the latest publicly available draft had removed sovereignty criteria and EU data-storage requirements from the conditions for certification at the highest cybersecurity level.^[22]

A draft dated 22 March 2024 removed the sovereignty requirements that had been included in earlier versions. Providers were instead required to disclose information including where customer data were stored and processed and which laws applied to the service.^[5]

The revision did not end the disagreement. Companies supporting sovereignty requirements called for their restoration in April, while another group of industry organisations supported their removal in June.^[20][21] A vote by national cybersecurity experts scheduled for April 2024 was postponed.^[23]

Separately, the ECCG has a formal role in the adoption process. In July 2024, the European Commission stated that EUCS remained in its preparatory stage and would be further discussed by member-state experts in the ECCG. Once the ECCG issues its formal opinion, ENISA transmits the candidate scheme to the Commission, which can then prepare an implementing act under the examination procedure.^[24]

In September 2024, the Council pressed the Commission to accelerate work on European cybersecurity certification, including the stalled cloud scheme.^[4]

ENISA's 2024 annual activity report records a change of course in the ECCG during the first quarter of 2024. ENISA provided the group with an updated candidate scheme in May, taking account of ECCG guidance on digital sovereignty. At the end of the reporting period, the ECCG had not issued its opinion.^[25]: 50

The same report records the adoption of two technical specifications supporting EUCS: CEN/TS 18026:2024, Three-level approach for a set of cybersecurity requirements for cloud services, and CEN/CLC/TS 18072, Requirements for Conformity Assessment Bodies certifying Cloud Services.^[25]: 55 The latter was published as CEN/CLC/TS 18072:2025.^[26]

ENISA described the draft candidate scheme as remaining an "open question" and said that it was unlikely to be adopted in the near term.^[25]: 48 The European Union Institute for Security Studies reported in November 2025 that the scheme had still not been adopted and linked the impasse to disagreements between member states over sovereignty and the treatment of non-European providers.^[4]

EUCS has also been referenced in the compliance framework developed by Gaia-X.

The Gaia-X Policy Rules and Architecture of Standards, published in June 2020, referred to EUCS in its cybersecurity provisions. For infrastructure services, the document listed European cloud security certification at Basic, Substantial and High levels and referred to ENISA guidance, SecNumCloud and C5.^[27]

Later Gaia-X compliance documentation explicitly associated Label Level 3 cybersecurity assessments with the process for EUCS High, while using interim arrangements pending availability of that process.^[28]

The Gaia-X framework also contains separate requirements concerning European control, including provider establishment and control, data location and safeguards concerning legal demands originating outside the EU or EEA.^[28] Such requirements are mandatory to achieve Gaia-X label level 3 "European Control".

During the 2024 EUCS debate, European companies supporting sovereignty requirements referred to the Gaia-X approach when calling for stronger requirements in EUCS.^[20]

CISPE also called in April 2024 for the final EUCS text to align with European regulation and voluntary initiatives including Gaia-X labelling. Its statement referred to protection from extraterritorial laws and to cases in which very high levels of certification would be required.^[29]

In 2025, the European Commission DG DIGIT developed a Cloud Sovereignty Framework for procurement of cloud services by European Union institutions, bodies, offices and agencies.^[30]

The framework evaluates cloud services against eight sovereignty objectives and introduced Sovereignty Effectiveness Assurance Levels (SEAL). The Commission applied the framework to a €180 million procurement for sovereign cloud services.^[30]

In April 2026, the Commission announced the results of that procurement. Eligibility required at least SEAL-2, described by the Commission as Data Sovereignty, while most of the selected providers achieved SEAL-3, Digital Resilience.^[31]

On 3 June 2026, the European Commission proposed the Cloud and AI Development Act (CADA), formally a proposal for a regulation establishing a framework of measures for strengthening Europe's cloud and AI ecosystem.^[6]

The proposal includes a Union-wide framework for assessing the sovereignty of cloud computing services supplied in public procurement. It defines four Union assurance levels. Level 1 is based on conformity self-assessment, while providers seeking recognition at levels 2, 3 or 4 undergo independent third-party audit.^[6]

The proposal also links the higher sovereignty levels to European cybersecurity certification. For Union assurance levels 2 and 3, the audited service must obtain a European cybersecurity certificate of at least assurance level Substantial under a European scheme covering cloud computing services once such a scheme has been established. Level 4 requires assurance level High. Until the European scheme is available, national cybersecurity certification schemes apply where they exist.^[6]

The Commission's proposal refers expressly to a European cybersecurity certification scheme covering cloud computing services "to be established" under Regulation (EU) 2019/881.^[6]

Legal analysis of the proposal has connected these provisions with the earlier EUCS dispute. Bird & Bird described CADA as bringing back sovereignty requirements that had previously been debated in EUCS and later removed, this time as requirements linked to public-sector procurement.^[32]

Lawfare similarly described the proposal as establishing four levels of sovereignty assurance for public-sector cloud procurement, with progressively stronger restrictions concerning data location and third-country control.^[33]

Before the proposal was published, a group of European cloud-company executives called for CADA to include requirements concerning European control, legal protection, procurement and resilience.^[34]

CADA remains a legislative proposal subject to consideration by the European Parliament and the Council.^[6]

• European Union Agency for Cybersecurity
• Cloud computing security
• SecNumCloud
• Digital sovereignty
• EU–US Data Privacy Framework
• Gaia-X

• Candidate EUCS Scheme v1.0 at ENISA
• European cybersecurity certification framework at ENISA