In implementing article 19, the CIP Department shall without imposing or discriminating in favour of the use of any particular type of technology, encourage the use of ICT products, ICT services and ICT processes, developed by the essential or important entity or procured from third parties, that are certified under European cybersecurity certification schemes adopted pursuant to Article 49 of Regulation (EU) 2019/881 of the European Parliament and of the Council of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification and repealing Regulation (EU) No 526/2013 (the Cybersecurity Act):

Provided that the CIP Department, or where appointed the competent authority, shall require, where applicable, that essential and important entities use such ICT products, ICT services and ICT processes:

Provided also that specific categories of essential and important entities listed in the Commission's delegated acts, shall use certain certified ICT products, ICT services and ICT processes or obtain a certificate under a European cybersecurity certification scheme adopted pursuant to Article 49 of Regulation (EU) 2019/881.