Concerns Arise Over Proposed EU Cloud Cybersecurity Certification Scheme

A joint statement from a coalition of business associations worldwide is urging the European Union to reconsider the adoption of the draft European Cybersecurity Certification Scheme for Cloud Services (EUCS), proposed by the EU Agency for Cybersecurity (ENISA). The statement, backed by 13 signatories representing cloud users and vendors in the EU Digital Single Market, highlights apprehensions regarding the potential impact of the scheme on cloud computing services in Europe.

The current draft of the EUCS is perceived to potentially limit the range of available cloud computing services in Europe. Specifically, there are concerns that it might hinder companies with global operations from using certain cloud services and delay the adoption of new technologies, potentially affecting cybersecurity effectiveness. The draft includes certain requirements perceived as restrictive for non-EU cloud suppliers, thereby potentially impacting the ability of European businesses and governments to engage with global cloud service providers. Notably, the “immunity requirements” proposed under the EUCS could restrict cybersecurity certification primarily to cloud providers with headquarters in the EU, potentially excluding others based on their location or the nationality of their investors.

The coalition, comprising associations from Japan, Latin America, North America, and the United Kingdom, calls on the EU’s national governments, the European Commission, and the European Parliament to reconsider the inclusion of these requirements in the EUCS. They argue that such exclusionary policies, especially in the current geopolitical context, could be counterproductive. The business associations emphasize the importance of access to a broad range of cloud technologies for European entities, underscoring that diverse and innovative cloud solutions are vital for competitiveness in the global market.

Alexandre Roure, Public Policy Director of CCIA Europe, has expressed that the proposed requirements by ENISA could restrict competition and limit customer choice in cloud services, potentially undermining cybersecurity in Europe. He advocates for a fair competitive environment where market participants are judged on merit without bias towards the location of their headquarters or the nationality of their shareholders.

The global coalition involved in this initiative includes ACT | The App Association, American Chamber of Commerce to the European Union (AmCham EU), Coalition of Services Industries (CSI), Computer & Communications Industry Association (CCIA Europe), Internet and Competitive Networks Association (INCOMPAS), Information Technology Industry Council (ITI), Japan Association of New Economy (JANE), Latin American Internet Association (ALAI), National Foreign Trade Council (NFTC), Software & Information Industry Association (SIIA), techUK, U.S. Chamber of Commerce, and United States Council for International Business (USCIB).