EUCC Migration Tracker: 30 Certificates In, How Many Are Real Migrations?

EUCC has been issuing certificates for 14 months, since 2 April 2025. With 30 certificates in the catalog and 13 landing in the first four months of 2026, there is now enough data to say something beyond “the scheme exists.” First in a quarterly EUCC progress check.

Issuance velocity: still small, but not flat

Thirteen issuances in the first four months puts 2026 on a pace of about three per month, faster than 2025’s average of 1.4 per month. Trajectory is up, absolute volume remains small. For comparison, CCRA published 207 new certifications in 2026 so far. EUCC is producing roughly 6 percent of CCRA’s volume.

Monthly cadence is bursty in a way that mirrors CCRA:

Two months (December 2025 and February 2026) account for 14 of the 30 EUCC certificates. The other 12 months range from 0 to 3, and May 2026 added none. Treat any single-month EUCC count with the same skepticism you would treat a CCRA monthly count: publication is bursty, evaluation is not.

Issuing-body distribution: ANSSI is doing most of the work

EUCC certificate IDs follow the format EUCC-<NCCA-code>-<year>-<seq>. The codes break down as follows:

All 30 issuances come from these four bodies. ANSSI is the operational center of gravity, with more than half the catalog. TrustCB issued the entire 2026 NXP secure-element batch. Italy, Sweden, and the Nordic countries are not yet visible.

How many EUCC certificates are actual CCRA migrations?

This is the question that matters. Vendors can put an EUCC certificate on a brand-new product, or they can re-certify a product they had already certified under a national CCRA scheme. Only the second case represents the regulatory transition the scheme was designed to enable, and the data is lopsided toward it.

We compared all 30 EUCC certificates against the 1,914 certificates in the CCRA catalog to see how many cover a product that was already certified under CCRA.

So 28 of the 30 EUCC certificates, over 90 percent, re-certify a product that already holds a CCRA certificate. That is the opposite of what you might expect from a “new scheme”: EUCC issuance to date is overwhelmingly re-certification of already-certified silicon and platforms, not new products entering certification for the first time.

The overlap runs across the catalog’s core silicon and platforms. STMicroelectronics’ ST54J / ST54K NFC controller, the Thales Smart Tachograph G2 on MultiApp V4.0.1, and the Cisco Intersight Virtual Appliance 1.0.9 carry the same product name in both catalogs. The Samsung secure-element families (S3SSE1A, S3NSEN6, S3NSN6H, the S3D series), the NXP JCOP platforms on SN300 and SE310, the Infineon IFX_CCI security controllers, the Nuvoton NPCT7xx TPM 2.0 batch, IDEMIA’s CombICAO on Cosmo X squared and SCE900U, STMicroelectronics ST31P450, Cisco Nexus 9000, Huawei ATN routers, EFR’s Secure Smart Grid Hub, and Kernkonzept’s L4Re Secure Separation Kernel each appear as a CCRA certificate too, often at the same version. In every case the product sits in the CCRA catalog under an ANSSI, BSI, or other national-scheme certificate.

Only two EUCC certificates have no CCRA counterpart: GMV’s GNSS Cryptographic Module and Distromel’s Waste Container Identification System. Distromel’s is the genuinely novel one, an EAL1 industrial product from a vendor with no prior CC history. Everything else is a known product wearing a second badge.

Notable 2026 EUCC certificates

The 13 EUCC certificates issued in 2026 span a wider product mix than most readers might expect:

• NXP JCOP 8.x on SE310 A0 and JCOP 8.x/9.x on SN300 B2 (TrustCB, January 2026, EAL5+). Java Card platforms for eUICC and identity.
• CombICAO v3.1 on Cosmo X squared in four configurations (ANSSI, February 2026, EAL5+). eID and SSCD smart cards.
• NPCT7xx TPM2.0 rev 1.59 in three configurations (ANSSI, February 2026, EAL4+). Trusted Platform Modules.
• L4Re Secure Separation Kernel CC 1.0.2 (BSI, April 2026). A separation-kernel OS, a notable departure from the silicon-heavy norm.
• Distromel Waste Container Identification System (DEKRA, April 2026, EAL1). The lowest assurance level in the EUCC catalog and the most surprising product. We took it apart in Anatomy of an EUCC Certificate.
• EFR Secure Smart Grid Hub (SGH-S) (BSI, March 2026). Energy infrastructure.

Honest assessment

After 14 months EUCC is operational, but it has not displaced the CCRA pipeline at any meaningful scale. The clearest signal in the data is that the transition is asymmetric: 28 of the 30 EUCC certificates re-certify a product that already holds a CCRA certificate, and in the cases we checked (ST54J, L4Re, the Samsung S3SSE1A) that CCRA certificate is still active, not withdrawn. EUCC is functioning as an additive layer, not a replacement, even for vendors with a clear regulatory motivation to migrate.

Three things to watch over the next quarter:

• Does any single month cross 10 EUCC issuances? December 2025 and February 2026 both hit 7.
• Does any non-French, non-Dutch, non-German NCCA enter the data?
• Do any of the 28 dual-certified products see their original CCRA certificates withdrawn? That would be the cleanest signal of true migration rather than additive layering.