Skip to content
DRAFT REPORT (COM(2022)0119 – C90121/2022 – 2022/0084(COD))

On the proposal for a regulation of the European Parliament and of the Council on information security in the institutions, bodies, offices and agencies of the Union

LIBE-PR-776837

Committee on Civil Liberties, Justice and Home Affairs · Rapporteur: Lena Düpont

Official HTML ↗ PDF DOCX
✦ In shortFull text
✦ In short · AI summary of this text, generated 25 Sept 2026

Written by a language model from the full text only; every figure comes from the text. The paragraph links open the paragraph a statement rests on — check the text itself before relying on it.

This is the rapporteur's draft report on the Commission proposal for a regulation on information security in the EU institutions, bodies, offices and agencies. It adopts Parliament's position at first reading and tables amendments to the proposal. The amendments add common minimum rules, require institutions to safeguard the integrity of democratic processes and curb foreign interference in tender procedures, and set training duties. They require the Coordination Group to adopt guidance on EUCI creation and classification that minimises classification and avoids overclassification, and to monitor compliance through a yearly evaluation report. They set deadlines for informing the originator and notifying competent authorities of breaches, and add end-to-end encryption and vulnerability reporting.

Committee position. The rapporteur proposes that Parliament adopt its position at first reading with amendments to the Commission proposal, adding common minimum rules, transparency and minimisation safeguards for classification, breach notification deadlines, and training and monitoring duties.

Key points

  1. Parliament adopts its position at first reading on the proposed regulation on information security in the Union's institutions, bodies, offices and agencies.
  2. The regulation would lay down common minimum information security rules for all Union institutions and bodies.
  3. Institutions and bodies must safeguard the integrity of the Union's democratic processes and adopt specific provisions in tender procedures to curb the risk of foreign interference, covering security infrastructure, vetting of third-party organisations and security clearance of staff.
  4. Institutions and bodies handling and storing EUCI must organise mandatory training at least once every 5 years, and design and implement training courses not later than six months after entry into force.
  5. Risk management must cover the integrity, availability and resilience of processing systems and services, the risks for the rights and freedoms of natural persons, and business continuity, disaster recovery and crisis management.
  6. The Coordination Group acts by a majority of at least two thirds of its members and must monitor compliance by institutions and bodies through a yearly evaluation report.
  7. A sub-group on administrative arrangements with third countries and international organisations is added, and cooperation and coordination with CERT-EU is strengthened.
  8. End-to-end encryption must be used, in particular when exchanging sensitive non-classified information.
  9. Guidance documents on EUCI creation and classification must take account of minimisation of classification and the risk of overclassification, and include rules on assessing and justifying classification to increase transparency and avoid unjustified lock-in effects.
  10. The originator must be informed, and competent authorities notified, of a breach without undue delay and not later than one week after the Security Authority has been informed.
  11. Institutions and bodies may accept security clearances from third countries and international organisations with which the Union has a security of information agreement, while ensuring the principles on clearances are observed.
  12. The originator may consult intended recipients on the classification level to prevent overclassification, and must take into account recipients' rights and obligations under the Treaties for initial dissemination.

Who is affected

  • All Union institutions and bodies, which must apply common minimum information security rules and safeguard democratic processes.
  • Staff authorised to access EUCI, who must undergo mandatory training at least once every 5 years.
  • The Coordination Group, which acts by a two-thirds majority and monitors compliance through a yearly evaluation report.
  • Third countries and international organisations with a security of information agreement with the Union, whose security clearances may be accepted.

Figures and deadlines

  • at least once every 5 years — mandatory training for individuals authorised to access EUCI
  • not later than ... [six months after the date of entry into force of this Regulation] — deadline to design and implement training courses
  • a majority of at least two thirds of its members — voting rule for the Coordination Group
  • not later than one week after the Security Authority has been informed of the breach — deadline to inform the originator
  • not later than one week after the Security Authority has been informed of the breach — deadline to notify competent authorities

Legal basis: Article 294(2) and Article 298 of the Treaty on the Functioning of the European Union, and Article 106a of the Treaty establishing the European Atomic Energy Community