Skip to content
DRAFT OPINION (COM(2022)0119 – C90121/2022 – 2022/0084(COD))

On the proposal for a regulation of the European Parliament and of the Council on information security in the institutions, bodies, offices and agencies of the Union

AFCO-PA-730186

Committee on Constitutional Affairs · Rapporteur: Pascal Durand

Official HTML ↗ PDF DOCX
✦ In shortFull text
✦ In short · AI summary of this text, generated 25 Sept 2026

Written by a language model from the full text only; every figure comes from the text. The paragraph links open the paragraph a statement rests on — check the text itself before relying on it.

The Committee on Constitutional Affairs gives its draft opinion on the Commission proposal for a regulation on information security in the Union institutions and bodies. It welcomes the proposal and proposes amendments to strengthen common minimum rules, an interinstitutional approach and protection against foreign interference. The amendments would set common minimum information security rules for all Union institutions and bodies, require an interinstitutional approach to sharing EUCI and sensitive non-classified information, and simplify procedures for sharing with member states. They would require institutions and bodies to safeguard the integrity of EU democratic processes and adopt provisions in tender procedures to curb foreign interference, including vetting of third parties and clearance of staff. They would give the Interinstitutional Coordination Group a role in monitoring compliance through a yearly evaluation report and require Security Authorities to monitor compliance with the regulation and the group's guidance documents.

Committee position. The Committee on Constitutional Affairs calls on the Committee on Civil Liberties, Justice and Home Affairs, as the committee responsible, to take into account its amendments. The amendments strengthen common minimum rules, an interinstitutional approach, monitoring by the Coordination Group and protection against foreign interference.

Key points

  1. The rapporteur welcomes the proposal, part of the EU Security Union Strategy adopted by the Commission on 24 July 2020, to streamline information security rules across Union institutions and bodies.
  2. The amendments would require an interinstitutional approach to sharing EUCI and sensitive non-classified information, with common categories and key handling principles, and simplified procedures for sharing with member states.
  3. They would require effective rules ensuring a common level of information security in all Union institutions and bodies, with equivalence of basic principles and common minimum standards.
  4. They would require the regulation to take account of new working practices, including electronic processing and exchanges of information.
  5. They would require the regulation to contribute to an efficient, independent and resilient administration and not to prevent institutions and bodies from fulfilling their missions or disproportionately limit their institutional autonomy.
  6. They would set up an Interinstitutional Coordination Group, with all Security Authorities represented, to enhance coherence and harmonise information security procedures and tools; the group could set up subgroups with specific tasks.
  7. They would require each institution and body to adopt specific security measures based on an internal risk assessment, while meeting common minimum requirements, and to adapt technical means to their needs and specificities.
  8. They would allow institutions and bodies to maintain their own marking system for internal purposes, and require common provisions for contractors' personnel, including vetting in tender procedures and termination of relationships posing a risk to democratic processes.
  9. They would require security measures for premises to build on an evaluation of security infrastructure and services, taking into account the supply chain and the economic and political environment of suppliers.
  10. They would make it imperative that all institutions and bodies use a single standard of accreditation of communication and information systems handling EUCI, to contribute to a common minimum level of protection.
  11. They would require institutions and bodies to safeguard the integrity of EU democratic processes and adopt provisions in tender procedures to curb foreign interference, covering security infrastructure, vetting of third parties and clearance of staff.
  12. They would require the Coordination Group to monitor compliance through a yearly evaluation report, and Security Authorities to monitor compliance with the regulation and the group's guidance documents; breaches would be notified no later than 1 week after the Security Authority is informed.

Who is affected

  • All Union institutions and bodies, which would have to apply common minimum information security rules and monitor compliance.
  • Contractors and third parties, which would face vetting in tender procedures and possible termination of relationships posing risks.
  • Member states, which would benefit from simplified procedures for sharing EUCI and sensitive non-classified information.
  • Security Authorities of institutions and bodies, which would monitor compliance and report breaches.

Figures and deadlines

  • 24 July 2020: date the Commission adopted the EU Security Union Strategy.
  • 1 week: deadline for informing the originator and notifying competent authorities of a breach after the Security Authority is informed.