- The European Telecommunications Standards Institute (ETSI) has released security requirements for VPNs under the Cyber Resilience Act
- NordVPN and Surfshark are among the industry players collaborating to help shape these security baselines
- The new rules ensure that all VPNs sold in Europe adhere to auditable standards for encryption, authentication, and vulnerability management
The European Union is fundamentally changing how privacy tools are regulated, introducing an official security standard for VPN services on the market. Crafted under the sweeping Cyber Resilience Act (CRA), the new framework sets strict, auditable cybersecurity requirements for any virtual private network sold in Europe.
Until now, users looking to protect their digital footprint have largely had to rely on a provider’s own marketing claims or third-party audits to verify encryption strength or no-logs VPN policies. Now, the European Telecommunications Standards Institute (ETSI) has stepped in to establish a unified legal baseline known as EN 304 620.
This comprehensive standard was not drafted in a vacuum. Major industry players, like Palo Alto Networks, Cisco, Airbus, and Google, alongside industry heavyweights NordVPN and Surfshark, have actively contributed to shaping these security parameters to ensure they are both operationally feasible and technically robust.
For everyday users, this legislation is a massive win. It ensures that any VPN software you download complies with mandatory European benchmarks for data confidentiality, authentication, and secure key management.
Miguel Fornes compares this shift to the arrival of seat belts and airbags in cars. “Before crash tests and seatbelt laws, drivers simply had to hope their car was safe. Once official safety standards existed, every car had to meet them. Surfshark is helping do the same thing for VPNs.”
Setting a new benchmark for VPN security
Draft standard EN 304 620 specifically targets VPN clients, servers, and gateways. It dictates exactly how these products must encapsulate and encrypt your traffic to protect data integrity as it travels across untrusted networks.
Whether a provider uses industry-standard AES-256 encryption, cutting-edge WireGuard protocols, or RAM-only VPN servers, they will need to demonstrate deterministic and testable security controls.
The standard is a vital pillar of the broader Cyber Resilience Act, which by the end of 2027, will fully require manufacturers of digital products to meet essential cybersecurity requirements.
New rules also mandate rapid incident reporting for actively exploited vulnerabilities, keeping providers strictly accountable if their infrastructure is ever compromised.
For anyone wondering, “Are VPNs safe?” this EU-wide standardization effectively guarantees a much higher baseline of protection, forcing potentially shady free VPN apps to either step up their security engineering or face removal from the European market entirely.
Not just VPNs: A wider net for software security
VPNs aren’t the only software getting a major regulatory upgrade. Alongside the VPN guidelines, ETSI recently launched the approval process for 17 European standards supporting the CRA.
The expanded list covers everyday digital essentials, including password managers, antivirus software, smart home assistants, connected toys, and wearables.
As these proposals move through public enquiry and final approvals, the end result is clear: European consumers are about to benefit from a much safer, more resilient digital ecosystem by default.
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!
https://cdn.mos.cms.futurecdn.net/72vjQXmi4arSDj4JeoWXse-2121-80.jpg
Source link
