Conformity Assessment Bodies (CABs)
Conformity Assessment Bodies (CABs) play a fundamental role in certification schemes, such as the EUCC, by ensuring that information and communication technology (ICT) products meet established security requirements.
For notification purposes, CABs should be aware that the applicable procedures vary depending on the level of assurance they wish to operate under (high/substantial). In all cases, accreditation is an essential prerequisite, and the designated National Accreditation Body (NAB) is responsible for evaluating and granting this accreditation.
Furthermore, depending on the desired level of assurance, additional notification requirements may differ. In particular, when CABs wish to operate under a "high" level of assurance, in addition to the accreditation prerequisite, they must undergo an additional authorization process that demonstrates their capacity to operate in accordance with that level of requirement. Conversely, at guarantee levels other than high, this authorization process will not be necessary, and the CAB may directly request notification once the corresponding accreditation has been obtained.
The accreditation process ensures that the CAB meets regulatory requirements and has the necessary competence to carry out conformity assessments.
- Application: The CAB submits its application to the National Accreditation Body (NAB), including its structure, processes, and evidence of compliance with standards such as ISO/IEC 17025.
- Documentary Assessment: The NAB reviews the documentation submitted by the CAB to verify that it meets the technical and organizational requirements.
- On-Site Audit: The NAB inspects the CAB's facilities to check the proper implementation of processes and technical competence.
- Accreditation Decision: If all requirements are met, the NAB issues an accreditation certificate, validating the CAB's capacity to carry out conformity assessments.
Once accredited, the CAB must be authorized to carry out assessments within a specific framework (such as the EUCC) if the CAB is going to operate at a high level.
- Authorization Request: The accredited CAB requests authorization from the ANCC, specifying the scope of its activities within the framework.
- Application Review: The ANCC evaluates the application, ensuring that the CAB is aligned with the specific requirements of the certification framework.
- Issuance of Authorization: If the CAB meets the requirements of the framework, the ANCC issues the authorization to carry out conformity assessments within the EUCC framework or another.
Once accredited, the CAB must be notified to carry out evaluations within a specific framework (such as the EUCC).
- Notification Request: The accredited CAB requests notification from the ANCC , specifying the scope of its activities within the framework.
- Review of the Request: The ANCC evaluates the request, ensuring that the CAB is aligned with the specific requirements of the certification framework.
- Issuance of Notification: If the CAB meets the requirements of the framework, the ANCC issues the notification to the CE to carry out conformity evaluations within the EUCC scheme or another in accordance with EXECUTION REGULATION (EU) 2024/3143.
Summary of the Processes
* The authorization process will only be necessary if a high level of guarantee is requested.
These processes ensure that the CAB is competent and authorized to carry out conformity assessments of ICT products, contributing to the trust and validity of the certificates issued.
Notified and authorized CABs
EUCC Scheme
Certification bodies (CB)
Substantial level notifications
| Name | Contact | Notification status | |
| DEKRA TESTING AND CERTIFICATION S.A.U. | Calle Severo Ochoa 55, Planta 2, Parque Tecnológico de Andalucía, 29590, Campanillas Málaga |
Active |  |
| LGAI Technological Center, S.A. (Applus+) | Ronda de la Font del Carme, s/n, Campus UAB, 08193, Bellaterra Barcelona, España. |
Active |  |
High level authorizations
| Name | Contact | Notification status | |
| Centro Criptológico Nacional. Organismo de Certificación | Calle Argentona, 30 28023, Madrid, España. |
Active |  |
Laboratories (ITSEFs)
Substantial level notifications
| Name | Contact | Notification status | |
| DEKRA TESTING AND CERTIFICATION S.A.U. | Calle Severo Ochoa 55, Planta 2, Parque Tecnológico de Andalucía, 29590, Campanillas Málaga |
Active | |
| LGAI Technological Center, S.A. (Applus+) | Ronda de la Font del Carme, s/n, Campus UAB, 08193, Bellaterra Barcelona, España. |
Active | |
High level authorizations
| Name | Contact | Notification status | |
| DEKRA TESTING AND CERTIFICATION S.A.U. | Calle Severo Ochoa 55, Planta 2, Parque Tecnológico de Andalucía, 29590, Campanillas Málaga |
Active | |
| Layakk Seguridad Informática S.L. | Ronda de la Química 26, Planta 6, 46980 Paterna, Valencia, España. |
Active |  |
| LGAI Technological Center, S.A. (Applus+) | Ronda de la Font del Carme, s/n, Campus UAB, 08193, Bellaterra Barcelona, España. |
Active | |
| SGS Brightsight Barcelona S.L. (Unipersonal) | Plaça de Xavier Cugat, 2, Edificio A, Planta 2B, 08174 Sant Cugat el Valles, Barcelona, España. | Active |  |
