EUROPEAN COMMISSION
Strasbourg, 20.1.2026
COM(2026) 11 final
ANNEXES
to the
Proposal for a Regulation of the European Parliament and of the Council
on the European Union Agency for Cybersecurity (ENISA), the European cybersecurity certification framework, and ICT supply chain security and repealing Regulation (EU) 2019/881 (The Cybersecurity Act 2)
{SEC(2026) 11 final} - {SWD(2026) 11 final} - {SWD(2026) 12 final}
ANNEX I
REQUIREMENTS TO BE MET BY CONFORMITY ASSESSMENT BODIES
1.A conformity assessment body shall be established under national law and shall have legal personality.
2.A conformity assessment body shall not be a high-risk supplier.
3.A conformity assessment body shall be a third-party body that is independent of the entity or the ICT products, ICT services, ICT processes or managed security services that it assesses. A body belonging to a business association or professional federation representing undertakings involved in the design, manufacturing, provision, assembly, use or maintenance of ICT products, ICT services, ICT processes or managed security services that it assesses, may, on condition that its independence and the absence of any conflict of interest are demonstrated, be considered to be such a third-party body.
4.A conformity assessment body, its top-level management and the personnel responsible for carrying out conformity assessment tasks shall not be the designer, manufacturer, supplier, installer, purchaser, owner, user or maintainer of the ICT products, ICT services, ICT processes, managed security services or entities that they assess, nor the authorised representative of any of those parties. This shall not preclude the use of the ICT products, ICT services, ICT processes or managed security services assessed that are necessary for the operations of the conformity assessment body or the use of such ICT products, ICT services, ICT processes or managed security services for personal purposes.
5.A conformity assessment body, its top-level management and the personnel responsible for carrying out conformity assessment tasks shall not be directly involved in the design, manufacture or construction, the marketing, installation, use or maintenance of the ICT products, ICT services, ICT processes, managed security services or entities they are assess, or represent parties engaged in those activities. They shall not engage in any activity that may conflict with their independence of judgement or integrity in relation to their conformity assessment activities. This shall in particular apply to consultancy services.
6.Conformity assessment bodies shall ensure that the activities of their subsidiaries and subcontractors do not affect the confidentiality, objectivity or impartiality of their conformity assessment activities.
7.If a conformity assessment body is owned or operated by a public entity or institution, independence and absence of any conflict of interest shall be ensured between the national cybersecurity certification authority and the conformity assessment body, and shall be documented.
8.Conformity assessment bodies and their personnel shall carry out conformity assessment activities with the highest degree of professional integrity and the requisite technical competence in the specific field, and shall be free from all pressures and inducements, particularly of a financial nature, that might influence their judgement or the results of their conformity assessment activities, especially as regards persons or groups of persons with an interest in the results of those activities.
9.A conformity assessment body shall be capable of carrying out all the conformity assessment tasks assigned to it under this Regulation, regardless of whether those tasks are carried out by the conformity assessment body itself or on its behalf and under its responsibility. Any subcontracting to, or consultation of, external staff shall be properly documented, shall not involve any intermediaries and shall be subject to a written agreement covering, among other things, confidentiality and conflicts of interest.
10.At all times and for each conformity assessment procedure and each type, category or sub-category of ICT products, ICT services, ICT processes, managed security services or entities, a conformity assessment body shall have at its disposal the necessary:
(a)personnel with technical knowledge and sufficient and appropriate experience to perform the conformity assessment tasks;
(b)descriptions of procedures in accordance with which conformity assessment is to be carried out, ensuring the transparency of and ability to reproduce those procedures; the conformity assessment body shall have appropriate policies and procedures in place that distinguish between tasks that it carries out as a body notified pursuant to Article 93 and its other activities;
(c)procedures for the performance of activities that take due account of the size of an undertaking, the sector in which it operates, its structure, the degree of complexity of the technology of the ICT product, ICT service or ICT process in question and the mass or serial nature of the production process.
11.A conformity assessment body shall have the means necessary to perform the technical and administrative tasks connected with the conformity assessment activities in an appropriate manner, and shall have access to all necessary equipment and facilities.
12.A conformity assessment body shall not use, install or otherwise integrate ICT components or components that include ICT components in key ICT assets identified pursuant to Article 102 from high-risk suppliers, for conformity assessment activities under Title III.
13.The personnel responsible for carrying out conformity assessment activities shall have the following:
(a)sound technical training covering all conformity assessment activities for which the conformity assessment body has been accredited and, where applicable, authorised;
(b)satisfactory knowledge of the requirements of the conformity assessments they carry out and adequate authority to carry out those assessments;
(c)appropriate knowledge and understanding of the applicable requirements and standards, and of the relevant provisions of Union harmonisation legislation and of its implementing acts;
(d)the ability to draw up certificates, records and reports demonstrating that conformity assessments have been carried out.
14.Conformity assessment bodies, their top-level management, the personnel responsible for carrying out conformity assessment activities, and any subcontractors shall be impartial.
15.The remuneration of the top-level management and assessment personnel shall not depend on the number of conformity assessments carried out or on the results of those assessments.
16.Conformity assessment bodies shall take out liability insurance unless liability is assumed by their Member State in accordance with national law, or the Member State itself is directly responsible for the conformity assessment.
17.The personnel of a conformity assessment body shall observe professional secrecy with regard to all information obtained in carrying out their tasks under this Regulation or any provision of Member State law giving effect to it, except where disclosure is required by Union or Member State law to which such persons are subject, and except in relation to the competent authorities of the Member States in which they carry out their activities. Proprietary rights shall be protected. The conformity assessment body shall have documented procedures ensuring compliance with this point.
18.Conformity assessment bodies shall operate in accordance with a set of consistent, fair, proportionate and reasonable terms and conditions, while avoiding unnecessary burden for economic operators, taking into account the interests of microenterprises and small to medium-sized enterprises in relation to fees.
19.Conformity assessment bodies that issue certificates shall meet the requirements of the relevant harmonised standard, as defined in Article 2, point (9), of Regulation (EC) No 765/2008 for the accreditation of conformity assessment bodies performing certification of ICT products, ICT services, ICT processes, managed security services or cyber posture of entities.
20.Conformity assessment bodies that perform evaluation activities shall meet the requirements of the relevant harmonised standards for the accreditation of conformity assessment bodies performing these activities.
21.Where a conformity assessment body subcontracts specific tasks connected with conformity assessment or has recourse to a subsidiary, it shall ensure that the subcontractor or the subsidiary meets the requirements set out in this Annex and, where applicable, the additional or specific requirements set out in a European cybersecurity certification scheme. The conformity assessment body shall inform the national cybersecurity certification authority accordingly.
22.Conformity assessment bodies shall take full responsibility for the tasks performed by subcontractors or subsidiaries wherever these are established.
23.Conformity assessment bodies may subcontract their activities or have them carried out by a subsidiary only with the agreement of the manufacturer or provider.
24.Conformity assessment bodies shall keep at the disposal of the national cybersecurity certification authority the relevant documents concerning the assessment of the qualifications of the subcontractor or the subsidiary and the work carried out by them under this Regulation.
ANNEX II
Key ICT assets for mobile and fixed electronic communications networks
|
Critical infrastructure
|
Key ICT assets
|
|
1. 5G electronic communications networks (non-standalone and standalone)
|
Core network functions of mobile communications networks
|
|
|
Network function virtualisation (NFV) and management and network orchestration (MANO)
|
|
|
Radio access network
|
|
2. Fixed electronic communications networks
|
Core network functions of fixed electronic communications networks
|
|
|
Network management system
|
|
|
Transport and transmission network
|
|
|
Access network
|
|
3. Satellite electronic communications networks
|
Core network function of satellite electronic communications networks
|
|
|
Network management system
|
|
|
Cryptographic products for the protection of telecommand/telemetry
|
|
|
Ground stations and complementary ground stations
|
ANNEX III
CORRELATION TABLE