May 2026 in Common Criteria: 32 New Certifications Across Five Schemes

May 2026 was a quiet-to-moderate month in Common Criteria and adjacent schemes. We logged 32 new certifications across five of the seven schemes we track, led this time not by the usual chip-and-crypto wave but by a large batch of French electronic-identity work, with smart card silicon, multifunction printers, and a steady eUICC trickle filling in behind it. This is the latest in our monthly recap series; the previous instalment is April 2026 in Common Criteria.

Five-year context

A single month is too short to read a trend, especially with monthly counts in the low tens for most schemes. To anchor May 2026 against history, here is the same month in each of the previous four years, and the year-to-date through end of May for each year.

Two things to read out of these. One, May 2026’s CCRA cadence (23) is the slowest May since 2022, well below the 41 of May 2025, but that follows February’s 125-issuance publication cluster, so the year is still ahead: CCRA’s year-to-date of 209 is the highest reading in the five-year window. Two, ESA and EUCC have both moved decisively off their near-zero historical baselines, ESA to 16 year-to-date and EUCC to 13, consistent with the EU regulatory shift pulling more work into the European schemes. With per-scheme cadence still in the low tens, any single month will swing widely on publication timing, so one slow May should not be over-read.

The numbers

Top vendors by May certification count: IN SMART IDENTITY FRANCE (11), STMicroelectronics (5), Thales DIS France (3). The rest were one-shots and pairs from a long tail of vendors.

What dominated: French electronic identity

The single biggest thread in May was electronic-identity work from IN SMART IDENTITY FRANCE, which accounted for 11 of the month’s 32 certifications. These cover the Combicao applet (versions 2.1 and 2.2) running on the ID-One Cosmo V9 and ID-One Cosmo X platforms, in the various configurations a national identity programme needs: EAC with PACE, BAC and CA, and SSCD (the qualified signature configuration). A separate ID-A applet on ID-One Cosmo X rounded out the set. Most landed at EAL5+ with ALC_DVS.2 and AVA_VAN.5, the assurance profile expected of identity-document chips.

A batch like this is how identity programmes show up in the data: one vendor, one platform, many separately certified configurations, because each deployment profile (border control, qualified signature, contactless travel document) is a distinct evaluated target.

Smart card silicon from STMicroelectronics

The other familiar thread was secure-element and cryptographic-library work from STMicroelectronics. May brought the NesLib 6.11.3 cryptographic library on the ST31N600 at EAL5+ (ALC_DVS.2, ALC_FLR, AVA_VAN.5), plus two entries for the ST31R480 secure element, one at EAL5+ and one at a lower configuration. This is the bread and butter of the smart card supply chain: chip and crypto-library certifications that sit underneath the cards, passports, and eUICCs everyone else builds on.

Mobile, print, and network on the CCRA side

CCRA also picked up its usual mix of non-chip entries. Google Pixel devices on Android 16 were certified under the mobile-device profile, the annual cadence for Pixel platform certifications. Office hardware was well represented, with Fujifilm Apeos multifunction printers and a Ricoh multifunction family both certified against the hardcopy-device protection profile. On the network side, the Nokia 1830 Photonic Service Switch took an EAL3+ certificate, and Galleon Embedded Computing certified two encryption-layer products aimed at rugged and defence deployments. Symantec’s Data Center Security Server Advanced rounded out the software side at EAL2+.

ESA and the eUICC line

ESA, the GSMA eUICC Security Assurance scheme, contributed four certifications, three of them from Thales DIS France: the Helium R1.05 and two MSM IoT eUICC products, with the fourth from a withheld vendor. ESA’s year-to-date of 16 is already well above its full historical pace, tracking the growth of remote SIM provisioning in IoT.

PSA, SESIP, and MIFARE

PSA Certified added three IoT-focused entries: a PixArt multi-protocol RF MCU family, the STMicroelectronics STM32H5 microcontroller series, and a Shanghai Fudan Microelectronics product family. The STM32H5 also appears on the SESIP side, certified at SESIP assurance level 3, a good example of one product carrying complementary certifications under different schemes. MIFARE contributed a single entry: an NXP secure element with MIFARE DESFire EV2, the first MIFARE issuance since March.

On the EUCC line

The EUCC scheme line recorded no new certificate in May specifically, but the year-to-date picture is the real story: 13 EUCC certificates through the end of May, against 2 at this point in 2025 and zero in the three years before. The scheme has moved from a standing start to a steady, if still small, flow in well under two years. We walked through one EUCC certificate end to end in Anatomy of an EUCC Certificate.

Year so far in one paragraph

Through the end of May 2026, our catalogue records 280 certifications issued in calendar year 2026, distributed CCRA 209, PSA 32, ESA 16, EUCC 13, SESIP 8, MIFARE 2. The monthly cadence has been anything but smooth: January 64, February 125 (a publication cluster on the CCRA portal, likely tied to the sunset of European national schemes as EUCC takes over), March 24, April 35, and May 32. Monthly counts reflect certificates published and recorded as of early June and can edge up slightly as late filings are added. We dig into the year-to-date numbers more carefully in Common Criteria in 2026 So Far.

What we are watching in June

A few things on our radar going into June:

• Whether CCRA’s spring slowdown (24, 35, 23 across March to May) holds, or whether another publication cluster lands
• ESA’s momentum: 16 year-to-date already beats its recent full-year pace, and IoT eUICC demand shows no sign of cooling
• The EUCC line resuming issuance after a zero month, with year-to-date already an order of magnitude ahead of history
• High-assurance work: EAL6+ and EAL7 combined sit at 13 issuances across all of 2026 so far, still a thin slice of the total

How NenkinTracker helps you see this

A monthly recap is a snapshot; the value is in watching it move. NenkinTracker tracks Common Criteria and adjacent-scheme certifications as they are issued, across CCRA, EUCC, ESA, PSA, SESIP, and MIFARE, with change detection on the underlying documents so you see new issuances and post-issuance updates as they happen. You can start tracking for free and follow the schemes, vendors, and products that matter to you.