Europeanisation on demand: the EU cybersecurity certification regime between market integration and core state powers (1997–2019)

Abstract

Despite promises by European Union (EU) policymakers to “fundamentally change” cybersecurity certification, they have recently created a regime that is strikingly similar to already existing certification arrangements. How can we explain this puzzle? Through a process-tracing analysis based on 41 documents and 18 interviews, this article traces the development of the EU cybersecurity certification regime over the past two decades. It deconstructs certification into standardisation, accreditation, certification, and evaluation; analyses how each regime component changed over time; and discusses to what extent causal mechanisms that are derived from classic theories of EU integration explain the limited nature of policy change. The observed dynamics uncover a “Europeanization on Demand” model that allows national authorities to completely control the extent of integration. This study challenges the dichotomous understanding portrayed by EU integration literature, of mutually exclusive dynamics of market or core state powers integration, highlighting intriguing political dynamics in EU cybersecurity policymaking.

Supranational Security States for National Security Problems: Governing by Rules and Capacities in Technology-Driven European Security Spaces

“…The nature of transboundary and technology-driven security issues confronting the EU is changing in origin, trajectory, and effect (Eriksson & Rhinard, 2009;Shepherd, 2021), leading to surprising and often unexplored deployments of supranational policy instruments in areas that fall within core national security interests (Genschel & Jachtenfuchs, 2016Sivan-Sevilla, 2021;Hoeffler, 2023;Schilde, 2023). The collective involvement and recognized competence of EU-level institutions in managing the allocation of security values in Europe, often in conjunction with national-level authorities, is defined here as a 'supranational security state.'…”