Commission Implementing Regulation (EU) 2025/2462 of 8 December 2025 amending Implementing Regulation (EU) 2024/482 as regards definitions, ICT product series certification, assurance continuity and state-of-the-art documents

‘3 A certification body may allow the certification of a product series.’

‘1 Upon request of the holder of the certificate or for other justified reasons, the certification body may decide to review an EUCC certificate for a protection profile. The review shall be carried out in accordance with Annex IV. The certification body shall determine the extent of the review. Where necessary for the review, the certification body shall request the ITSEF to perform a re-evaluation of the certified protection profile.’

‘2 The information referred to in paragraph 1 shall be made available at least in English. For that purpose, certification bodies shall provide ENISA with the original language versions of the certification reports and security targets, and in addition they shall also provide the English version of such documents without undue delay.’

‘4 Unless specified otherwise in Annex I or II, state-of-the-art documents shall apply to certification processes, including reassessment and re-evaluation, initiated from the date of application of the amending act by which the state-of-the-art documents have been incorporated in Annex I or II.’

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.