III. SECURITY OF INFORMATION AGREEMENTS

Security of information agreements shall establish the basic principles and minimum standards governing the exchange of classified information between the Union and a third State or international organisation. Security of information agreements shall provide for technical implementing arrangements to be agreed between the competent security authorities of the relevant Union institutions and bodies and the competent security authority of the third State or international organisation in question. Such arrangements shall take account of the level of protection provided by the security regulations, structures and procedures in place in the third State or international organisation concerned. They shall be approved by the Security Committee. No EUCI shall be exchanged under a security of information agreement by electronic means unless explicitly provided for in the agreement or in corresponding technical implementing arrangements. When the Council concludes a security of information agreement, a registry shall be designated in each party as the main point of entry and exit for classified information exchanges. In order to assess the effectiveness of the security regulations, structures and procedures in the third State or international organisation concerned, assessment visits shall be conducted in mutual agreement with the third State or international organisation concerned. Such assessment visits shall be conducted in accordance with the relevant provisions of Annex III and shall evaluate: the regulatory framework applicable for protecting classified information; any specific features of the security policy and the way in which security is organised in the third State or international organisation which may have an impact on the level of classified information that may be exchanged; the security measures and procedures actually in place; and security clearance procedures for the level of EUCI to be released. The team conducting an assessment visit on behalf of the Union shall assess whether the security regulations and procedures in the third State or international organisation in question are adequate for the protection of EUCI at a given level. The findings of such visits shall be set out in a report on the basis of which the Security Committee shall determine the maximum level of EUCI which may be exchanged in hard copy, and where appropriate electronically, with the third party concerned as well as any specific conditions governing exchange with that party. Every endeavour shall be made to conduct a full security assessment visit to the third State or international organisation in question before the Security Committee approves the implementing arrangements in order to establish the nature and the effectiveness of the security system in place. However, where this is not possible the Security Committee shall receive as full a report as possible from the GSC Security Office, based on the information available to it, informing the Security Committee about the security regulations applicable and the way in which security is organised in the third State or international organisation concerned. The report on the assessment visit, or in the absence of such a report the report referred to in paragraph 12, shall be forwarded to, and deemed satisfactory by, the Security Committee before EUCI is actually released to the third State or international organisation in question. The competent security authorities of the Union institutions and bodies shall communicate to the third State or international organisation the date as from when the Union is in a position to release EUCI under the agreement, as well as the maximum level of EUCI which may be exchanged in paper form or by electronic means. Follow-up assessment visits shall be conducted as necessary, in particular if: there is a need for the releasable level of EUCI to be raised; the Union has been notified of fundamental changes in the third State or international organisation’s security arrangements that might have an impact on how it protects EUCI; or there has been a serious incident involving unauthorised disclosure of EUCI. Once the security of information agreement is in force and classified information is exchanged with the third State or international organisation concerned, the Security Committee may decide to modify the maximum level of EUCI which may be exchanged in paper form or by electronic means, in particular in the light of any follow-up assessment visit.

← anx_VI__cpt_1__cpt_2__point_4__text_1 · All articles · 5. →

Source: EUR-Lex (Cellar) · retrieved 2026-11-01 · Text as adopted (Official Journal); later amendments are not incorporated in this text.