Skip to content
OPINION (COM(2022)0119 – C90121/2022 – 2022/0084(COD))

On the proposal for a regulation of the European Parliament and of the Council Proposal for a regulation of the European Parliament and of the Council on information security in the institutions, bodies, offices and agencies of the Union

ITRE-AD-738558

Committee on Industry, Research and Energy · Rapporteur: Henna Virkkunen

Official HTML ↗ PDF DOCX
✦ In shortFull textProcedure & committee votes
✦ In short · AI summary of this text, generated 17 Oct 2026

Written by a language model from the full text only; every figure comes from the text. The paragraph links open the paragraph a statement rests on — check the text itself before relying on it.

The Committee on Industry, Research and Energy gives its opinion on the proposed regulation on information security in the Union's institutions, bodies, offices and agencies. It proposes amendments to streamline rules across Union entities, strengthen access to information for Members, and add data protection and transparency safeguards.

Committee position. The committee welcomes the proposal and proposes amendments to streamline rules across Union entities, strengthen Members' access to information, add data protection and transparency safeguards, and adjust provisions on training, encryption, incident notification and cryptographic products.

Key points

  1. Replaces 'institutions and bodies' with 'Union entities' throughout, covering institutions, bodies, offices and agencies set up by the Treaties or a legislative act.
  2. Adds that Members of Union institutions should have access to all necessary information on the need-to-know principle to exercise their mandate.
  3. Requires that any limitation of the right to personal data protection and privacy be necessary and proportionate under Article 52(1) of the Charter, and that information security measures comply with Union data protection law.
  4. Calls for transparency, minimisation and time-limiting of classified documents, safeguards against misuse of classification, and adequate protection of whistle-blowers.
  5. Adds that contractor personnel should undergo a vetting procedure as part of the tender procedure, taking into account the full supply chain and operational environment.
  6. Requires Union entities to adopt a personal data breach handling procedure under Regulation (EU) 2018/1725.
  7. Requires mandatory training at least once every 5 years for all individuals authorised to access EUCI, plus specific training for information security functions, and new training within six months of entry into force.
  8. Adds end-to-end encryption, in particular when exchanging sensitive non-classified information, and requires incidents to be handled under the cybersecurity regulation.
  9. Requires notification of the originator and competent authorities without undue delay and no later than one week after the Security Authority is informed of a breach.
  10. Requires a process for identifying and reporting vulnerabilities, including internal and external rewards, complemented by audits and penetration tests.
  11. Keeps the Council's list of approved cryptographic products for EUCI, and tasks ENISA with establishing a yearly updated list of additional approved products for RESTREINT UE/EU RESTRICTED information within 18 months of entry into force.
  12. Adds the European Parliament to the sub-group on EUCI sharing, which should ensure synergy with Regulation (EC) No 1049/2001 and that classification does not in itself prevent disclosure.

Who is affected

  • Union institutions, bodies, offices and agencies: would apply common information security rules and choose specific measures based on risk assessments.
  • Members of Union institutions, including the European Parliament: would have access to necessary information under the need-to-know principle.
  • Contractors and outsourcing providers: their personnel would undergo vetting as part of tender procedures.
  • ENISA: would establish and yearly update a list of additional approved cryptographic products for RESTREINT UE/EU RESTRICTED information.
  • The Council: would maintain the list of approved cryptographic products for EUCI based on input from National Security Authorities.

Figures and deadlines

  • at least once every 5 years: mandatory training for all individuals authorised to access EUCI
  • six months after the date of entry into force of this Regulation: deadline for designing and implementing effective trainings
  • not later than one week after the Security Authority has been informed of the breach: deadline to inform the originator
  • not later than one week after the Security Authority has been informed of the breach: deadline to notify competent authorities
  • 18 months after the date of entry into force of this Regulation: deadline for ENISA to establish the list of additional approved cryptographic products
  • yearly basis: frequency for ENISA to update the list of additional approved cryptographic products
  • yearly basis: frequency for the Coordination Group to inform the Council of recommended cryptographic products