> For the complete documentation index, see [llms.txt](https://www.mica.wtf/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.mica.wtf/nis2/chapter-iv-cybersecurity-risk-management-measures-and-reporting-obligations-art.-20-25/24.md). # Art. 24 — Use of European cybersecurity certification schemes NIS2 Article 24 — Use of European cybersecurity certification schemes. Directive (EU) 2022/2555, Chapter IV — Cybersecurity risk-management measures and reporting obligations. 1. In order to demonstrate compliance with particular requirements of [Article 21](/nis2/chapter-iv-cybersecurity-risk-management-measures-and-reporting-obligations-art.-20-25/21.md), Member States may require essential and important entities to use particular ICT products, ICT services and ICT processes, developed by the essential or important [entity](https://headlesslaw.com/definitions/nis2/entity/) or procured from third parties, that are certified under European [cybersecurity](https://headlesslaw.com/definitions/nis2/cybersecurity/) certification schemes adopted pursuant to Article 49 of Regulation (EU) 2019/881. Furthermore, Member States shall encourage essential and important entities to use qualified trust services. 2. The Commission is empowered to adopt delegated acts, in accordance with [Article 38](/nis2/chapter-viii-delegated-and-implementing-acts-art.-38-39/38.md), to supplement this Directive by specifying which categories of essential and important entities are to be required to use certain certified ICT products, ICT services and ICT processes or obtain a certificate under a European cybersecurity certification scheme adopted pursuant to Article 49 of Regulation (EU) 2019/881. Those delegated acts shall be adopted where insufficient levels of cybersecurity have been identified and shall include an implementation period. Before adopting such delegated acts, the Commission shall carry out an impact assessment and shall carry out consultations in accordance with Article 56 of Regulation (EU) 2019/881. 3. Where no appropriate European cybersecurity certification scheme for the purposes of paragraph 2 of this Article is available, the Commission may, after consulting the Cooperation Group and the European Cybersecurity Certification Group, request ENISA to prepare a candidate scheme pursuant to Article 48(2) of Regulation (EU) 2019/881. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://www.mica.wtf/nis2/chapter-iv-cybersecurity-risk-management-measures-and-reporting-obligations-art.-20-25/24.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.