Phio TX Earns EUCC Certification at EAL2

European security leaders buy on proof, not promises. When a cybersecurity product claims to protect data, a CISO under NIS2 or DORA needs an independent body to confirm it, not a vendor’s word in a datasheet. For quantum-safe security, that proof now exists.

Phio TX® version 4.5.6, the cryptographic management platform from Quantum XChange, is the first post-quantum cryptographic management platform awarded EUCC certification at assurance level EAL2. DEKRA Testing and Certification evaluated and certified the product under Common Criteria (CC:2022), with Spain’s national certification authority, Centro Criptológico Nacional, as the responsible body. The certificate, EUCC-3095-2026-000003-I-00, issued on 10 November 2026, is listed in the EU’s official certificate registry and runs for 5 years. It covers PhioTX-V 4.5.6, the software Key Management Entity that generates and delivers post-quantum keys as a virtual appliance. Cybersecurity information, security advisories, and vulnerability reporting for the certified product are published at quantumxc.com/cybersecurity-information.

For regulated European buyers, this changes vendor selection. Phio TX no longer asks the EU market to trust a quantum-safe claim. A rigorous independent European evaluation backs it.

The significance of the certification is both important and practical. The EUCC certificate is recognized across all 27 EU member states, so a single evaluation clears the security reviews, procurement checks, and vendor-risk screening that used to run country by country. For a platform protecting data-in-motion, EU market access stops being an open question and becomes a settled one. Phio TX is the first post-quantum cryptographic management platform to reach that position, and it got there before any other PQC software solutions provider.

What EUCC at EAL2 Confirms

EUCC is the first cybersecurity certification scheme adopted under the EU Cybersecurity Act. It builds on Common Criteria (ISO/IEC 15408), the international standard for evaluating the security properties of IT products, and ENISA, the EU Agency for Cybersecurity, maintains it. A product certified once carries weight across all member states, which replaces the old country-by-country patchwork with one EU-wide mark.

EAL2 sits on the Common Criteria assurance scale. It requires structured developer testing, design documentation, and independent vulnerability analysis by the evaluating lab, a recognized bar for commercial security products. Under EUCC, EAL2 maps to the “substantial” assurance tier.

Why This Matters to an EU CISO

For European security teams, independent certification is moving from a tiebreaker to a gate. Three forces drive that position.

• Regulation – NIS2, DORA, and eIDAS 2.0 raise the bar for demonstrable security, and NIS2’s Commission Implementing Regulation (EU) 2024/2690 writes crypto-agility, the ability to update cryptographic algorithms and policies without disrupting operations, into the requirements. FINMA’s July 2026 quantum guidance points EU and Swiss financial institutions the same way. EUCC gives auditors a recognized artifact in place of vendor assurances.
• Procurement – EU public-sector and critical-infrastructure tenders increasingly reference EUCC or Common Criteria. No certificate, no shortlist.
• Sovereignty – European organizations want security evaluated against European standards by European labs. France’s ANSSI will stop certifying security products without quantum-resistant encryption from 2027, which turns certification into a procurement gate for French government and critical-infrastructure buyers.

EUCC certification answers all three with one credential. It tells an auditor, a procurement officer, and a national authority the same thing: an accredited lab evaluated this product and a recognized body issued proof.

For a vendor without it, the opposite holds. Every EU deal reopens the same question, every security review starts from zero, and in markets like France the answer will soon be no. A certified platform settles the question before the first meeting. Phio TX settles it today.

FIPS and EUCC, One Platform

Here is where the industry earns its skepticism. Plenty of vendors slide an “in process” certification into a datasheet and hope procurement skips the footnote. Quantum XChange withheld the EUCC claim until the certificate was in hand. That day has arrived.

With EUCC certified, Phio TX holds independent validation on both sides of the Atlantic. In the US, it carries the industry’s first FIPS 140-3 + FIPS 203 + Entropy validated stack:

• FIPS 140-3 NIST CMVP Certificate #4850 (module validation)
• FIPS 203 NIST CAVP Certificate #6060 (ML-KEM algorithm validation)
• NIST Entropy Source Certificate #E79 (source validation)

Paired with EUCC at EAL2, Phio TX is the first post-quantum cryptography (PQC) management platform to hold both FIPS validation and EUCC certification, and Quantum XChange is the only vendor to offer both for a PQC solution. For multinational organizations, that reduces compliance complexity: one platform meets both European and US security assurance expectations, so security reviews, procurement, and vendor-risk programs reference a single cryptographic management platform.

“Operating in highly regulated markets across Europe means we need security solutions that are not only technically advanced, but also independently validated against recognized standards. Quantum XChange’s EUCC validation gives us greater confidence in Phio TX as we advance our quantum-safe strategy, support compliance obligations across EU jurisdictions, and protect the sovereignty of sensitive data across a highly distributed environment,” said Jacinto Cavestany, CEO at Evolutio.

The credential matters because the threat is present-tense. Adversaries already practice Harvest Now, Decrypt Later (HNDL), collecting encrypted data today to decrypt once a capable quantum computer exists. Long-shelf-life data, financial records, health data, and state secrets, is exposed the moment it crosses the wire. PQC standards like FIPS 203 ML-KEM address the math. Certification proves the implementation holds.

Certification That Survives the Next Algorithm

A certificate is a point in time. Algorithms and standards shift, and a platform that needs a full recertification scramble every time the set changes leaves buyers exposed between cycles. Phio TX is an architecture that adapts to change instead of one you rebuild.

Phio TX runs a crypto-agility control plane. Key delivery stays out-of-band, the platform is algorithm- and source-agnostic, algorithm swaps happen live, and the whole platform deploys as an overlay on the infrastructure you already run. When NIST or an EU body updates the algorithm set, Phio TX changes the algorithm in place, executable in minutes, with no downtime and no maintenance window. Crypto-agility is part of the architecture, not a roadmap promise.

“EUCC certification is an important milestone for Quantum XChange and for customers that require trusted, independently evaluated cybersecurity solutions,” said Eddy Zervigon, CEO of Quantum XChange. “Customers need technologies that meet today’s compliance requirements while supporting long-term cryptographic resilience. Phio TX delivers that assurance and provides a practical path to modernize key management without costly upgrades every time an algorithm breaks or a standard evolves.”

Frequently Asked Questions

Is Phio TX EUCC certified?

Yes. PhioTX-V 4.5.6 holds EUCC certification at EAL2 under Common Criteria (CC:2022), certificate EUCC-3095-2026-000003-I-00. DEKRA issued it on 10 November 2026 under Spain’s Centro Criptológico Nacional, valid for 5 years. It is listed in the EU’s official certificate registry, giving EU buyers independent proof.

What does EAL2 mean for buyers?

EAL2 is a Common Criteria assurance level requiring structured developer testing, design documentation, and independent vulnerability analysis by the evaluating lab. It is a recognized bar for commercial security products, and it tells procurement and audit teams an accredited lab examined the product, not the vendor.

How does EUCC compare to FIPS validation?

FIPS validation is the US standard, issued by NIST. EUCC is the EU equivalent, based on Common Criteria and overseen by ENISA. Both give independent, government-recognized evidence of security. Phio TX is the first PQC platform to hold both, and Quantum XChange is the only vendor to offer both for a PQC solution.

Why does EUCC certification matter for post-quantum cryptography?

Standardized PQC algorithms like ML-KEM address the math, but buyers still need proof the implementation is sound. EUCC and FIPS provide that independent evidence. For regulated European enterprises under NIS2, DORA, and eIDAS 2.0, certification turns a quantum-safe claim into an auditable fact.

Does EUCC certification lock Phio TX to one algorithm?

No. Phio TX hot-swaps PQC algorithms with no downtime and no maintenance window. When NIST or an EU body updates the algorithm set, the platform adapts in place. Crypto-agility is built into the architecture, so the certified platform absorbs algorithm changes without a recertification scramble.

Ready to Secure Your Network?

EUCC at EAL2 and a full FIPS stack give you independent proof on both sides of the Atlantic. See what that means for your quantum-safe migration.

Read the full announcement: https://quantumxc.com/press-releases/eucc-certification-phio-tx-first-post-quantum-platform/

Talk to an Expert