31 August 2026
After three years of collaboration, the Horizon Europe project CERTIFAI has successfully concluded. From September 2023 to August 2026, 11 organisations from seven European countries worked together to develop innovative methods and tools supporting cybersecurity certification and conformity assessment of ICT products and services.
CERTIFAI – Agile Conformance Assessment for Cybersecurity Certification Enhanced by Artificial Intelligence – explored how artificial intelligence and automation can support the increasingly complex processes associated with cybersecurity certification. The project focused particularly on improving evidence management, traceability, risk assessment, assurance case development and preparation for conformity assessment.
Addressing the Challenges of Cybersecurity Certification
Modern ICT products and services are continuously evolving through software updates, new functionalities and changing cybersecurity threats. At the same time, manufacturers and service providers must comply with a growing number of regulatory requirements, standards and certification schemes.
Traditional certification processes can require significant amounts of documentation, manual evaluation and coordination between manufacturers, assessors and certification bodies. Maintaining evidence and demonstrating continued compliance throughout the lifecycle of a product or service therefore represents a considerable challenge.
CERTIFAI addressed these issues by developing a structured approach that combines cybersecurity expertise, certification methodologies and AI-assisted tools. The objective was not to replace existing certification schemes, assessors or professional judgement, but to provide practical support for organisations preparing for cybersecurity assessment and certification.
From Research to Practical Solutions
One of the main results of the project is the CERTIFAI Integrated Framework, which brings together the methodologies, workflows and technical tools developed by the consortium.
The framework supports the collection, organisation and evaluation of cybersecurity-related information and evidence. It is designed to improve traceability between cybersecurity risks, applicable requirements, implemented security measures and the evidence used during conformity assessment.
The project developed and integrated several supporting tools, including:
- ThreatSpider, supporting threat and risk analysis;
- SAC Composer, supporting the preparation and management of security assurance cases;
- Copilot for Evaluation and Analysis of Security Assurance Cases, providing AI-assisted support for the review and analysis of assurance information;
- SimVul, supporting vulnerability-related analysis and simulation activities;
- LOGA, supporting the processing and analysis of relevant technical information.
Together, these tools demonstrate how AI-supported technologies can assist manufacturers, assessors and other stakeholders during different stages of cybersecurity certification and conformity assessment.
Validation Across Four Industrial Use Cases
The CERTIFAI approach was validated through four industrial use cases covering different technologies, regulatory environments and cybersecurity challenges.
The use cases represented the following domains:
- railway systems;
- industrial automation;
- maritime technologies;
- IoT-based fire detection solutions.
The validation activities allowed the consortium to test the developed methodologies and tools in realistic environments and to collect feedback from industrial organisations, technology developers and conformity assessment experts.
The use cases demonstrated the potential of the CERTIFAI approach to support evidence management, improve links between requirements and technical documentation, facilitate risk analysis and assist organisations in preparing for cybersecurity assessments.
They also highlighted the importance of adapting certification support tools to the characteristics of individual products, sectors and applicable certification frameworks.
Supporting the Evolving European Regulatory Landscape
The CERTIFAI project was carried out during a period of significant development in European cybersecurity legislation.
New requirements introduced through initiatives such as the Cyber Resilience Act are increasing the responsibility of manufacturers to ensure cybersecurity throughout the lifecycle of products with digital elements. Organisations must be able to identify and manage cybersecurity risks, maintain technical documentation, address vulnerabilities and demonstrate compliance with applicable requirements.
CERTIFAI contributes to this evolving environment by providing methods and tools that can help organisations organise certification-related information and prepare evidence in a more structured and traceable way.
The project results may also support future conformity assessment activities by facilitating cooperation and information exchange between manufacturers, technology providers, assessors and certification bodies.
Artificial Intelligence as a Supporting Technology
An important conclusion of the project is that artificial intelligence has considerable potential to support cybersecurity certification and conformity assessment.
AI-assisted tools can help process large amounts of technical information, identify connections between requirements and evidence, support the preparation of assurance cases and improve the consistency of selected assessment activities.
However, the project also confirmed that AI cannot replace cybersecurity expertise, professional judgement or human oversight. Certification decisions must remain the responsibility of qualified and independent experts.
The most effective approach is therefore to use artificial intelligence as a supporting technology that complements the work of manufacturers, assessors and certification bodies while maintaining transparency, accountability and appropriate human control.
Scientific Dissemination and Stakeholder Engagement
Throughout its implementation, CERTIFAI actively shared its results with researchers, industrial organisations, certification experts, standardisation stakeholders and public authorities.
The consortium presented its work through scientific publications, conferences, workshops, project events, stakeholder consultations and online communication activities. Project partners also contributed to discussions related to cybersecurity certification, artificial intelligence, conformity assessment and standardisation.
A major dissemination milestone was the CERTIFAI Final Conference, held on 11 June 2026 in Prague, Czech Republic. The hybrid event brought together 51 participants, including representatives from industry, research organisations, certification and assessment bodies, public authorities, standardisation communities and the CERTIFAI Advisory Board.
During the conference, the consortium presented the CERTIFAI Framework, demonstrated the developed tools, shared experiences from the four use cases and discussed the practical application and future exploitation of the project results.
The conference presentations and recording are available on the CERTIFAI website.
A Collaborative European Effort
CERTIFAI brought together organisations with complementary expertise in cybersecurity, artificial intelligence, research, software development, industrial technologies, conformity assessment and certification.
This multidisciplinary cooperation was essential for connecting technical research with practical certification requirements and industrial needs.
The consortium consisted of:
- TECNALIA Research & Innovation;
- DNV;
- Norwegian University of Science and Technology;
- UBITECH;
- Simula Research Laboratory;
- TTTECH;
- Mindchip;
- Hitachi Rail GTS Austria GmbH;
- Schneider Electric;
- Catalink;
- Elektrotechnický zkušební ústav (EZÚ).
The collaboration between research institutions, technology providers, industrial organisations and a certification body enabled the project to examine cybersecurity certification from multiple perspectives.
Looking Beyond the Project
Although the funded implementation of CERTIFAI ends in August 2026, the knowledge, methodologies and technical results developed during the project will continue to be used and further explored by the consortium partners.
Several partners intend to continue scientific dissemination, further develop selected tools, explore their integration into existing services and platforms, and pursue new research and innovation opportunities.
The project results, publications, public deliverables and other materials will remain available through the CERTIFAI website.
By bringing together artificial intelligence, cybersecurity expertise and conformity assessment practices, CERTIFAI has contributed to the ongoing discussion about how certification processes can become more efficient, traceable and responsive to the continuous evolution of digital products and services.
About CERTIFAI
CERTIFAI – Agile Conformance Assessment for Cybersecurity Certification Enhanced by Artificial Intelligence – was a Horizon Europe research and innovation project implemented from September 2023 to August 2026.
The project investigated how artificial intelligence, automation and structured evidence management can support cybersecurity certification and conformity assessment throughout the lifecycle of ICT products and services.
Grant Agreement No.: 101120606
Project duration: September 2023 – August 2026
Project website: https://certifai.info/
Funded by the European Union. Views and opinions expressed are, however, those of the authors only and do not necessarily reflect those of the European Union or the European Commission. Neither the European Union nor the granting authority can be held responsible for them.
