in force 2024-05-20 INSERTED+1,943 −0§
Amended by Regulation (EU) 2024/1183 32024R1183
applies from: unknown (an inserted provision states its own application date only in prose)
Sources disagree — the text comparison and the amending act's instructions found this change; the EU's own amendment metadata does not list it. All are shown; none is overruled.
This is a newly inserted article setting out that conformity of notified electronic identification schemes with the Regulation's cybersecurity requirements, including those tied to assurance levels under Article 8(2), is to be certified by conformity assessment bodies designated by Member States.
The new text specifies that such certification is carried out under a cybersecurity certification scheme under Regulation (EU) 2019/881, is valid for up to five years subject to biennial vulnerability assessments with cancellation if a vulnerability is not remedied within three months, allows Member States to request additional information, exempts certified schemes from the peer review process referred to in Article 12(5), and requires Member States to communicate the names and addresses of the relevant conformity assessment bodies to the Commission.
Cited: Art. 12a, v2
text before / after
inserted text (02014R0910-20240520)
Article 12a Certification of electronic identification schemes 1. The conformity of electronic identification schemes to be notified with the cybersecurity requirements laid down in this Regulation, including conformity with the cybersecurity relevant requirements set out in Article 8(2) regarding the assurance levels of electronic identification schemes, shall be certified by conformity assessment bodies designated by Member States. 2. Certification pursuant to paragraph 1 of this Article shall be carried out under a relevant cybersecurity certification scheme pursuant to Regulation (EU) 2019/881 or parts thereof, insofar as the cybersecurity certificate or parts thereof cover those cybersecurity requirements. 3. Certification pursuant to paragraph 1 shall be valid for up to five years, provided that a vulnerability assessment is carried out every two years. Where a vulnerability is identified and not remedied within three months of such identification, certification shall be cancelled. 4. Notwithstanding paragraph 2, Member States may request, in accordance with that paragraph, additional information from a notifying Member State about electronic identification schemes or part thereof certified. 5. The peer review of electronic identification schemes referred to in Article 12(5) shall not apply to electronic identification schemes or parts of such schemes certified in accordance with paragraph 1 of this Article. Member States may use a certificate or a statement of conformity, issued in accordance with a relevant certification scheme or parts of such schemes, with the non-cybersecurity-related requirements set out in Article 8(2) regarding the assurance level of electronic identification schemes. 6. Member States shall communicate to the Commission the names and addresses of the conformity assessment bodies referred to in paragraph 1. The Commission shall make that information available to all Member States.