EUCS and C5: what the status of the EU scheme means for your attestation planning

What is EUCS?

EUCS stands for European Cybersecurity Certification Scheme for Cloud Services, a European scheme for certifying the cybersecurity of cloud services. The European Commission has asked the EU Agency for Cybersecurity, ENISA, to prepare a candidate scheme for it. According to ENISA, such a draft only takes effect once it has been adopted as an EU implementing act; after that, the Member States have time to prepare the operation of the scheme before certificates are issued.

This makes EUCS a different instrument from C5. There is no certification procedure for C5; the evidence is an attestation by an independent auditor under ISAE 3000 (Revised) or IDW PS 860 (see C5 attestation). EUCS is designed as a certification under the European Cybersecurity Act.

What is the status of the procedure on 1 November 2026?

EUCS has not been adopted. On 1 November 2026 we checked the pages of the two responsible bodies; the result:

None of these pages mentions an adopted implementing act for EUCS. The revised Cybersecurity Act is described there as a proposal. Whether and when EUCS will come, and with which requirements, cannot be read from these sources. We have deliberately left out press reports on the state of negotiations.

How are C5:2026 and EUCS related?

Closely in substance, not legally. The BSI describes the link in section 1.1 of the catalogue: C5:2020 served as the basis for the development of the security requirements of the “planned EUCS Substantial level”, and the requirements developed in this process and by CEN/CENELEC form the substantive basis of C5:2026. The BSI thus intends to ensure compatibility with EUCS Substantial.

• Structure: Following the EUCS model, the criteria consist of subcriteria that are clearly delineated from one another in terms of content (section 1.1).
• Sources: Among the standards taken into account, the catalogue lists CEN/TS 18026:2024, the technical specification that was created for EUCS (section 2.3).
• Binding effect: A C5 attestation is not an EUCS certificate, and compatibility does not imply recognition in a future EUCS procedure. How an adopted EUCS would take a C5 attestation into account is not regulated.

What else C5:2026 changes compared with C5:2020 is covered on C5:2026.

What does the status mean for your planning?

Plan the C5 attestation as if EUCS did not exist, and keep an eye on the procedure. According to section 1.1, C5:2026 is based on the requirements from the EUCS process, so a C5 project started today builds on the same groundwork. Depending on your situation:

Whether you need a type 1 or type 2 attestation and how to plan backwards from the customer deadline is shown on C5 type 1 or type 2 and C5 audit process.

Example: a tender with an EUCS requirement

Fictitious example, not a client. A provider of a telemedicine platform is planning its first C5 attestation for mid-2027. In autumn 2026 it receives a tender from a hospital group that requires “a certificate under EUCS or equivalent”. Management asks whether to pause the C5 project and replan for EUCS.

Our assessment: no. EUCS has not been adopted, and no certificate is available. For the hospital group, Section 393 SGB V may also come into play, which requires a C5 attestation for the basic criteria or evidence under the C5 Equivalence Ordinance; neither provision mentions EUCS. How this applies in the individual case needs a legal assessment. The provider answers the bidder question with reference to the checked status, offers the C5 attestation as evidence and in the meantime presents its timeline for obtaining the attestation. The C5 project continues unchanged.

How will you recognise that the status is changing?

An EUCS certificate can only exist after an implementing act. Watch for the following:

• Implementing act of the Commission: publication in the Official Journal of the EU. Until then, every text is a draft.
• ENISA: a new draft scheme or an adopted scheme in ENISA’s library.
• Cybersecurity Act: whether, and with what content, the proposal of 20 January 2026 is adopted, since it is meant to reorganise the procedure for all schemes.
• German law: changes to Section 393 SGB V or to the C5 Equivalence Ordinance that add EUCS as evidence.
• BSI: statements on the relationship between C5 and an adopted EUCS.

We recommend checking these sources quarterly and recording the check date in your compliance planning. We update this page when the status changes; the date shown above applies.

How we support C5 projects against this background

We plan the route to the C5 attestation with you and take into account which evidence your customers and tenders require. The starting point is a C5 readiness assessment. Blackfort Technology does not issue attestations; the attestation is issued by an independent auditor.