EU introduces strict new security rules for VPNs with the help of industry giants

The European Telecommunications Standards Institute (ETSI) has released security requirements for VPNs under the Cyber Resilience Act

NordVPN and Surfshark are among the industry players collaborating to help shape these security baselines

The new rules ensure that all VPNs sold in Europe adhere to auditable standards for encryption, authentication, and vulnerability management

The European Union is fundamentally changing how privacy tools are regulated, introducing an official security standard for VPN services on the market. Crafted under the sweeping Cyber Resilience Act (CRA), the new framework sets strict, auditable cybersecurity requirements for any virtual private network sold in Europe.

Until now, users looking to protect their digital footprint have largely had to rely on a provider's own marketing claims or third-party audits to verify encryption strength or no-logs VPN policies . Now, the European Telecommunications Standards Institute (ETSI) has stepped in to establish a unified legal baseline known as EN 304 620 .

This comprehensive standard was not drafted in a vacuum. Major industry players, like Palo Alto Networks, Cisco, Airbus, and Google, alongside industry heavyweights NordVPN and Surfshark , have actively contributed to shaping these security parameters to ensure they are both operationally feasible and technically robust.

For everyday users, this legislation is a massive win. It ensures that any VPN software you download complies with mandatory European benchmarks for data confidentiality, authentication, and secure key management.

Miguel Fornes compares this shift to the arrival of seat belts and airbags in cars. "Before crash tests and seatbelt laws, drivers simply had to hope their car was safe. Once official safety standards existed, every car had to meet them. Surfshark is helping do the same thing for VPNs."

NordVPN – the best VPN overall NordVPN came out on top in our 2026 round of VPN tests. We think it's the best VPN for most people. It’s easy to use, very secure, fast enough for gaming, and offers flawless streaming service unblocking. Subscriptions start at the equivalent of $3.49 per month. View Deal

Surfshark – the best cheap VPN Surfshark is a fast, easy-to-use VPN that seriously beats the competition when it comes to subscription pricing. Its two-year Starter plan is the cheapest, but we think Surfshark One is the best value plan, starting at the equivalent of just $2.79 a month. View Deal

Setting a new benchmark for VPN security

Draft standard EN 304 620 specifically targets VPN clients, servers, and gateways. It dictates exactly how these products must encapsulate and encrypt your traffic to protect data integrity as it travels across untrusted networks.

Whether a provider uses industry-standard AES-256 encryption, cutting-edge WireGuard protocols, or RAM-only VPN servers , they will need to demonstrate deterministic and testable security controls.

The standard is a vital pillar of the broader Cyber Resilience Act, which by the end of 2027, will fully require manufacturers of digital products to meet essential cybersecurity requirements.

New rules also mandate rapid incident reporting for actively exploited vulnerabilities, keeping providers strictly accountable if their infrastructure is ever compromised.

For anyone wondering, " Are VPNs safe? " this EU-wide standardization effectively guarantees a much higher baseline of protection, forcing potentially shady free VPN apps to either step up their security engineering or face removal from the European market entirely.

Not just VPNs: A wider net for software security

VPNs aren't the only software getting a major regulatory upgrade. Alongside the VPN guidelines, ETSI recently launched the approval process for 17 European standards supporting the CRA.

The expanded list covers everyday digital essentials, including password managers , antivirus software, smart home assistants, connected toys, and wearables.

As these proposals move through public enquiry and final approvals, the end result is clear: European consumers are about to benefit from a much safer, more resilient digital ecosystem by default.

Indexed and credited by AIPROPX. Originating outlet: TechRadar. Open at source →