AI Act CRA
AI Act and CRA
An AI system that is also a product with digital elements falls under both. Article 12 of the CRA provides that high-risk AI systems that meet the CRA essential requirements are deemed to meet the cybersecurity requirements of Article 15 of the AI Act, to the extent the EU declaration of conformity covers them. For the cybersecurity requirements, one security engineering effort can serve both; accuracy and robustness remain AI Act matters, and the conformity assessment follows Article 43 of the AI Act as a rule (CRA Article 12(2)), with exceptions for certain important and critical products (Article 12(3)).
EUCC CRA
EUCC and CRA
Under Article 27 of the CRA, a certificate or EU statement of conformity issued under a European cybersecurity certification scheme gives a presumption of conformity with the CRA essential requirements it covers, and the Commission can specify, by delegated act, which schemes can be used to demonstrate conformity. Where the scopes align, EUCC evidence, such as the security target and the evaluation results, can be reused in the CRA technical documentation.
EUCS NIS2
EUCS and NIS2
Article 24 of NIS2 lets Member States require entities to use ICT products, services and processes certified under European schemes. Cloud certification gives NIS2 entities comparable evidence when they select and supervise cloud providers, and clarifies who is responsible for each security measure.
EUMSS NIS2
EUMSS and NIS2
Medium and large managed security service providers are in NIS2 scope themselves (Annex I, ICT service management), and they are part of their customers' supply chain. Once the scheme is adopted, EUMSS certification would give customers evidence for the supply chain security measures NIS2 requires.
EUMSS DORA
EUMSS and DORA
For a financial entity, a managed security provider is an ICT third-party service provider. Once the scheme is adopted, EUMSS certification would support the due diligence and ongoing monitoring that DORA requires for ICT third-party risk.
AI Act EUMSS
AI Act and EUMSS
Managed security services increasingly use AI for detection and response. EUMSS addresses the security of the service. The AI Act applies to the AI components according to their risk classification; obligations such as transparency or human oversight apply only where the component falls in the relevant category.
AI Act EUCC
AI Act and EUCC
Under Article 42(2) of the AI Act, high-risk AI systems that are certified, or for which a statement of conformity has been issued, under a cybersecurity scheme pursuant to Regulation (EU) 2019/881 whose references are published in the Official Journal are presumed to comply with the cybersecurity requirements of Article 15, in so far as the certificate or statement covers them. An EUCC certificate can therefore provide part of the Article 15 evidence. The presumption reaches only as far as the certificate: AI-specific threats named in Article 15(5), such as data poisoning, model poisoning and adversarial examples, need their own evidence unless the evaluation covered them.
CRA NIS2
CRA and NIS2
NIS2 entities buy the products the CRA regulates. The measures in Article 21(2) of NIS2 include supply chain security and security in acquisition, development and maintenance, including vulnerability handling and disclosure, and Article 21(3) requires entities to take into account the overall quality of their suppliers' products and their secure development procedures. CRA conformity gives buyers evidence for that assessment, and recital 13 of the CRA confirms that Member States can still impose stricter requirements on the use of ICT products by essential and important entities. Reporting is also linked: under Article 14 of the CRA, manufacturers notify actively exploited vulnerabilities and severe incidents to the CSIRT designated as coordinator under Article 12(1) of NIS2, through the single reporting platform established by ENISA.
