News

The ICCC 2026 conference, held in Rome, brought together representatives of certification bodies, testing laboratories, public administration and technology manufacturers from many countries. Among them was a team from NASK’s Centre for Standardisation and Certification. The aim of the event was to discuss the development of cybersecurity certification systems and the challenges associated with assessing the security of digital products and services in a rapidly changing regulatory and technological environment.

Common Criteria, EUCC and the Cyber Resilience Act

The event programme covered a wide scope of issues relating to Common Criteria, the European EUCC certification scheme and the requirements arising from the Cyber Resilience Act (CRA). Participants debated, amongst other things, the role of certification in supporting compliance with new regulations, vulnerability analysis, certificate maintenance throughout the product lifecycle, the use of existing certification schemes for the purposes of the CRA, as well as the potential applications of artificial intelligence and large language models (LLMs) in cybersecurity assessment and certification processes.

“A key and inevitable trend in the development of cybersecurity certification is the growing role of AI in the assessment and certification of ICT products.
The greatest impact on the development of cybersecurity certification relates to the use of AI in the automation of evaluation processes, the design and execution of penetration testing, and continuous certification throughout the product lifecycle based on vulnerability analysis.”

Krzysztof Teresiński, Head of the Conformity Assessment Team, OSiC, NASK PIB

Why was OSiC NASK’s participation substantial?

For OSiC NASK, participation in the conference was a substantial opportunity to gain up-to-date knowledge on the development of European and international certification schemes, to exchange experiences with representatives of foreign certification bodies, and to learn about the practical challenges faced by organisations conducting assessments and certification of ict products. Discussions on the relationship between CRA requirements and the EUCC scheme, as well as presentations showcasing the practical experiences of other certification bodies and laboratories, were particularly valuable.

Certification as the foundation of trust

The conclusions drawn from the conference will support the further development of OSiC NASK’s expertise in the field of cybersecurity conformity assessment and certification. The event also confirmed the growing importance of certification as one of the key tools for building trust in products with digital elements and for supporting organisations in meeting the requirements set by new European regulations.