Skip to content
DRAFT REPORT (COM(2022)0119 – C90121/2022 – 2022/0084(COD))

On the proposal for a regulation of the European Parliament and of the Council on information security in the institutions, bodies, offices and agencies of the Union

LIBE-PR-751547

Committee on Civil Liberties, Justice and Home Affairs · Rapporteur: Vladimír Bilčík

Official HTML ↗ PDF DOCX
✦ In shortFull text
✦ In short · AI summary of this text, generated 25 Sept 2026

Written by a language model from the full text only; every figure comes from the text. The paragraph links open the paragraph a statement rests on — check the text itself before relying on it.

This is the rapporteur's draft report on the Commission proposal for a regulation on information security in the Union's institutions, bodies, offices and agencies. It adopts Parliament's first-reading position and proposes 33 amendments to the Commission proposal. The amendments add common minimum rules, principles of minimisation and time-limiting of classification, protection for whistle-blowers, and safeguards for the integrity of democratic processes. They also set deadlines for breach notification, require training within six months of entry into force, and change the Coordination Group's voting rule to a two-thirds majority.

Committee position. The rapporteur proposes that Parliament adopt its first-reading position with 33 amendments to the Commission proposal, adding common minimum rules, classification minimisation, whistle-blower protection, democratic integrity safeguards, breach-notification deadlines and a two-thirds voting rule for the Coordination Group.

Key points

  1. Parliament adopts its position at first reading and calls on the Commission to refer the matter to Parliament again if it replaces or substantially amends its proposal.
  2. The regulation would lay down common minimum information security rules for all Union institutions and bodies.
  3. Classification of EU classified information should follow the principles of minimisation and limiting its duration in time.
  4. Institutions should enhance transparency, minimise confidential documents, protect whistle-blowers and avoid classification that prevents Union entities from fulfilling their mission.
  5. Institutions should increase organisational interoperability and protect networks, information systems, data and equipment used to capture, store, process and transmit information.
  6. When developing their document security framework, institutions shall safeguard the integrity of the Union's democratic processes and adopt provisions in tender procedures to curb the risk of foreign interference.
  7. Institutions handling EUCI shall organise mandatory training at least once every 5 years, and design and implement training courses not later than six months after entry into force.
  8. The Coordination Group would act by a majority of at least two thirds of its members and monitor compliance through a yearly evaluation report.
  9. A sub-group on administrative arrangements with third countries and international organisations would be set up, and the sub-group on EUCI sharing would include the European Parliament.
  10. Institutions would have to inform the originator and notify competent authorities of a breach without undue delay and not later than one week after the Security Authority is informed.
  11. The originator may consult intended recipients on classification level to prevent over-classification, and shall take into account recipients' rights and obligations under the Treaties.
  12. End-to-end encryption would be required in particular when exchanging sensitive non-classified information, and a process for identifying and reporting vulnerabilities would be set up.

Who is affected

  • All Union institutions and bodies, which would have to apply common minimum information security rules.
  • Staff authorised to access EUCI, who would receive mandatory training at least once every 5 years.
  • The Coordination Group, which would act by a two-thirds majority and monitor compliance.
  • Third countries and international organisations, whose security clearances may be accepted if the Union has a security of information agreement.

Figures and deadlines

  • Mandatory training at least once every 5 years for individuals authorised to access EUCI.
  • Training courses to be designed and implemented not later than six months after entry into force.
  • Breach notification not later than one week after the Security Authority is informed.
  • Coordination Group decisions by a majority of at least two thirds of its members.

Legal basis: Article 294(2) and Article 298 of the Treaty on the Functioning of the European Union, and Article 106a of the Treaty establishing the European Atomic Energy Community.