### furthermore , in technical specifications and in award criteria , contracting authorities should be allowed to refer to a specific production process , a specific mode of provision of services , or a specific process for any other stage of the life cycle of a product or service , provided that they are linked to the subject - matter of the public contract . in order to better integrate social considerations in public procurement , procurers may also be allowed to include , in the award criterion of the most economically advantageous tender , characteristics related to the working conditions of the persons directly participating in the process of production or provision in question . those characteristics may only concern the protection of health of the staff involved in the production process or the favouring of social integration of disadvantaged persons or members of vulnerable groups amongst the persons assigned to performing the contract , including accessibility for persons with disabilities . any award criteria which include those characteristics should in any event remain limited to characteristics that have immediate consequences on staff members in their working environment . they should be applied in accordance with directive 96 / 71 / ec of the european parliament and of the council of 16 december 1996 concerning the posting of workers in the framework of the provision of services and in a way that does not discriminate directly or indirectly against economic operators from other member states or from third countries parties to the agreement or to free trade agreements to which the union is party . for service contracts and for contracts involving the design of works , contracting authorities should also be allowed to use as an award criterion the organisation , qualification and experience of the staff assigned to performing the contract in question , as this may affect the quality of contract performance and , as a result , the economic value of the tender . ### furthermore , in technical specifications and in award criteria , contracting authorities should be allowed to refer to a specific production process , a specific mode of provision of services , or a specific process for any other stage of the life cycle of a product or service , provided that they are linked to the subject - matter of the public contract . in order to better integrate social considerations in public procurement , procurers may also be allowed to include , in the award criterion of the most economically advantageous tender , characteristics related to the working conditions of the persons directly participating in the process of production or provision in question . those characteristics may concern the working conditions of the staff involved in the production process or the favouring of social integration of disadvantaged persons or members of vulnerable groups amongst the persons assigned to performing the contract , including accessibility for persons with disabilities . any award criteria which include those characteristics should in any event remain limited to characteristics that have immediate consequences on the working conditions of staff members . they should be applied in accordance with directive 96 / 71 / ec of the european parliament and of the council of 16 december 1996 concerning the posting of workers in the framework of the provision of services and in a way that does not discriminate directly or indirectly against economic operators from other member states or from third countries parties to the agreement or to free trade agreements to which the union is party . for service contracts and for contracts involving the design of works , contracting authorities should also be allowed to use as an award criterion the organisation , qualification and experience of the staff assigned to performing the contract in question , as this may affect the quality of contract performance and , as a result , the economic value of the tender .


### without prejudice to national laws , regulations or administrative provisions concerning the remuneration of certain services , the criteria on which contracting authorities shall base the award of public contracts shall be one of the following : ### without prejudice to national laws , regulations or administrative provisions concerning the remuneration of certain services , contracting authorities shall award public contracts to the economically most advantageous tender .


### the most economically advantageous tender referred to in point of paragraph 1 from the point of view of the contracting authority shall be identified on the basis of criteria linked to the subject - matter of the public contract in question . those criteria shall include , in addition to the price or costs referred to in point of paragraph 1 , other criteria linked to the subject - matter of the public contract in question , such as : ### the most economically advantageous tender from the point of view of the contracting authority shall be identified on the basis of criteria linked to the subject - matter of the public contract in question . those criteria shall include price or costs and other qualitative , environmental and social criteria linked to the subject - matter of the public contract in question , such as :


### quality , including technical merit , aesthetic and functional characteristics , accessibility , design for all users , environmental characteristics and innovative character ; ### quality , including technical merit , aesthetic and functional characteristics , accessibility , design for all users , environmental and social characteristics , and innovative character ;


### 1 . with the exception of the transition period between stage iii a and stage iii b , an oem that wishes to make use of the flexibility scheme shall request permission from any approval authority to purchase from his engine suppliers , the quantities of engines described in sections 1 . 1 . 1 . and 1 . 1 . 2 . , that do not comply with the current emission limit values , but are approved to the nearest previous stage of emission limits . ### 1 . without prejudice to 1 . 2 , an oem that wishes to make use of the flexibility scheme , with the exception of engines for propulsion of locomotives , shall request permission from any approval authority for the oem’s engine manufacturers to place on the market engines intended for the oem’s exclusive use . with the exception of stage iiib , the quantities of engines shall not exceed those described in sections 1 . 1 . 1 . and 1 . 1 . 2 .


### the rules applicable to the flexibility scheme should be adapted to extend the application of that scheme to engines for use in propulsion of railcars and locomotives . ### the rules applicable to the flexibility scheme should be adapted to extend its application to engines for use in propulsion of railcars and locomotives .


### 4 as regards engines for use in propulsion of locomotives , during the transition period between stage iii a and stage iii b an oem may seek permission for his engine suppliers to place on the market a maximum of 12 engines for use in propulsion of locomotives under the flexibility scheme . ### 4 as regards engines for use in propulsion of locomotives , during the transition period between stage iii a and stage iii b an oem may seek permission for his engine suppliers to place on the market a maximum of 20 engines for use in propulsion of freight and shunting of locomotives under the flexibility scheme , of which the total number shall be designed to be capable of operating on the uk rail network .


### the transition to stage iii b involves a step change in technology requiring significant implementation costs for redesigning the engines and for developing advanced technical solutions . the transition occurs at the same time when industry faces severe economic difficulties . ### the transition to stage iii b involves a step change in technology requiring significant implementation costs for redesigning the engines and for developing advanced technical solutions . a global financial and economic crisis can not serve as a reason to water down environmental standards . investments in environmentally friendly technologies are important for the promotion of future growth , jobs and health security .


### 1 . 2 . as an optional alternative to section 1 . 1 . 1 and with the exception of engines for use in propulsion of railcars and locomotives , the oem may seek permission for his engine suppliers to place on the market a fixed number of engines under the flexibility scheme . the number of engines in each engine category shall not exceed the following values : ### 1 . 2 . as an optional alternative to section 1 . 1 . 1 . and with the exception of engines for propulsion of railcars , the oem may seek permission for the oem’s engine manufacturers to place on the market a fixed number of engines for the oem’s exclusive use . the number of engines in each engine category shall not exceed the following values :


### the measures provided in this directive reflect a temporary difficulty faced by the manufacturing sector . they should therefore be restricted to the transition from stage iii a to stage iii b and expire by 31 december 2013 at the latest . ### the measures provided in this directive reflect a temporary difficulty faced by the manufacturing sector ; as such , these shall be restricted to stage iii b or to 3 years where no successive stage exists


### member states shall permit the placing on the market of engines , as defined in section 1 of annex i under a , a , a and a , under the flexibility scheme in accordance with the provisions in annex xiii . ### member states shall permit the placing on the market of engines , as defined in section 1 of annex i under a , a , a and a , under the flexibility scheme in accordance with the provisions in annex xiii . spark ignited engines , as defined in section 1 of annex i under a , and engines for propulsion of inland waterways vessels are excluded from this procedure . the flexibility scheme shall start when placing on the market of engines becomes compulsory for any given stage and shall have the duration of any given stage , but not more than three years . the engines shall be type approved according to the stage immediately preceding the one under consideration .


### 2 . during the transition period from stage iii a to stage iii b , with the exception of engines for use in propulsion of railcars and locomotives , an oem that wishes to make use of the flexibility scheme shall request permission from any approval authority to purchase from his engine suppliers , the quantities of engines described in sections 1 . 2 . 1 . and 1 . 2 . 2 . , that do not comply with the current emission limit values , but are approved to the nearest previous stage of emission limits . ### 2 . during stage iii b , with the exception of engines for use in propulsion of railcars and locomotives , an oem that wishes to make use of the flexibility scheme shall request permission from any approval authority for the oem’s engine manufacturers to place on the market engines intended for the oem’s exclusive use . the quantities of engines shall not exceed those described in sections 1 . 2 . 1 . and 1 . 2 . 2 . the engines shall meet the requirements of article 10 .


### 4 as regards engines for use in propulsion of locomotives , during the transition period between stage iii a and stage iii b an oem may seek permission for his engine suppliers to place on the market a maximum of 12 engines for use in propulsion of locomotives under the flexibility scheme . ### 4 as regards engines for propulsion of locomotives , the oem may seek permission for the oem’s engine manufacturers to place on the market a maximum of 12 engines for the oem’s exclusive use .


### 2 during the transition period from stage iii a to stage iii b , with the exception of engines for use in propulsion of railcars and locomotives , an oem that wishes to make use of the flexibility scheme shall request permission from any approval authority to purchase from his engine suppliers , the quantities of engines described in sections 1 . 2 . 1 . and 1 . 2 . 2 . , that do not comply with the current emission limit values , but are approved to the nearest previous stage of emission limits . ### 2 by way of derogation from point 1 . 1 , during stage iii b , but no longer than three years after the beginning of that stage , with the exception of engines for use in propulsion of railcars and locomotives , an oem that wishes to make use of the flexibility scheme shall request permission from any approval authority for the oem’s engine manufacturers to place on the market engines intended for the oem’s exclusive use . the quantities of engines shall not exceed those described in sections 1 . 2 . 1 . and 1 . 2 . 2 .


### 5 . the oem shall include in his application to an approval authority the following information : ### 5 . the oem shall include in the application to an approval authority the following information :


### member states shall permit the placing on the market of engines , as defined in section 1 of annex i under a , a , a and a , under the flexibility scheme in accordance with the provisions in annex xiii . ### member states shall permit the placing on the market of engines , as defined in section 1 of annex i under a , a and a , under the flexibility scheme in accordance with the provisions in annex xiii . engines can be placed on the market under the flexibility scheme from the date when a given stage becomes applicable until the end of that stage , but not longer than three years from the beginning of that stage . the engines shall be type approved according to the stage immediately preceding the applicable one .


### 1 . with the exception of the transition period between stage iii a and stage iii b , an oem that wishes to make use of the flexibility scheme shall request permission from any approval authority to purchase from his engine suppliers , the quantities of engines described in sections 1 . 1 . 1 . and 1 . 1 . 2 . , that do not comply with the current emission limit values , but are approved to the nearest previous stage of emission limits . ### 1 . an oem that wishes to make use of the flexibility scheme , with the exception of engines for propulsion of locomotives , shall request permission from any approval authority for the oem’s engine manufacturers to place on the market engines intended for the oem’s exclusive use . with the exception of stage iiib , the quantities of engines shall not exceed those described in sections 1 . 1 . 1 . and 1 . 1 . 2 .


### 2 during the transition period from stage iii a to stage iii b , with the exception of engines for use in propulsion of railcars and locomotives , an oem that wishes to make use of the flexibility scheme shall request permission from any approval authority to purchase from his engine suppliers , the quantities of engines described in sections 1 . 2 . 1 . and 1 . 2 . 2 . , that do not comply with the current emission limit values , but are approved to the nearest previous stage of emission limits . ### 2 during the transition period from stage iii a to stage iii b , with the exception of engines for use in propulsion of railcars and locomotives , an oem that wishes to make use of the flexibility scheme shall request permission from any approval authority to purchase from his engine suppliers , the quantities of engines described in section 1 . 2 . 2 . , that do not comply with the current emission limit values , but are approved to the nearest previous stage of emission limits .


### compression ignition engines for use other than in propulsion of inland waterway vessels may be placed on the market under a flexibility scheme in accordance with the procedure referred to in annex xiii in addition to paragraphs 1 to 5 . ### compression ignition engines for use other than in propulsion of railcars and inland waterway vessels may be placed on the market under a flexibility scheme in accordance with the procedure referred to in annex xiii in addition to paragraphs 1 to 5 .


### ' 6 . compression ignition engines for use other than in propulsion of inland waterway vessels may be placed on the market under a flexibility scheme in accordance with the procedure referred to in annex xiii in addition to paragraphs 1 to 5 . ' ### ' 6 . compression ignition engines for use other than in propulsion of railcars and inland waterway vessels and in the construction sector may be placed on the market under a flexibility scheme in accordance with the procedure referred to in annex xiii in addition to paragraphs 1 to 5 . '


### engine category ### engine power range


### the measures provided in this directive reflect a temporary difficulty faced by the manufacturing sector . they should therefore be restricted to the transition from stage iii a to stage iii b and expire by 31 december 2013 at the latest . ### the measures provided in this directive reflect a temporary difficulty faced by the manufacturing sector ; as such , these shall be restricted to stage iii b .


### during the transition from stage iii a to stage iii b , the percentage of the number of engines used for application other than propulsion of railcars and locomotives placed on the market under the flexibility scheme , should be increased from 20% to 50% of the equipment manufacturer’s annual sales of equipment with engines in that category . the maximum number of engines that may be placed on the market under the flexibility scheme should be adapted accordingly . ### during the transition from stage iii a to stage iii b , the maximum number of engines that may be placed on the market under the flexibility scheme should not exceed the values contained in the table in annex xiii , point 1 . 2 . 2 . .


### during the transition from stage iii a to stage iii b , the percentage of the number of engines used for application other than propulsion of railcars and locomotives placed on the market under the flexibility scheme , should be increased from 20% to 50% of the equipment manufacturer ' s annual sales of equipment with engines in that category . the maximum number of engines that may be placed on the market under the flexibility scheme should be adapted accordingly . ### during stage iii b , the percentage of the number of engines used for application other than propulsion of railcars and locomotives placed on the market under the flexibility scheme , should be 50% of the equipment manufacturer ' s annual quantity of equipment placed on the market with engines in that category . the optional alternative that a fixed number of engines that may be placed on the market under the flexibility scheme should be adapted accordingly .


### 1 . with the exception of the transition period between stage iii a and stage iii b , an oem that wishes to make use of the flexibility scheme shall request permission from any approval authority to purchase from his engine suppliers , the quantities of engines described in sections 1 . 1 . 1 . and 1 . 1 . 2 . , that do not comply with the current emission limit values , but are approved to the nearest previous stage of emission limits . ### 1 . without prejudice to 1 . 2 , an oem that wishes to make use of the flexibility scheme , with the exception of engines for propulsion of locomotives , shall request permission from any approval authority for the oem’s engine manufacturers to place on the market engines intended for the oem’s exclusive use . with the exception of stage iiib , the quantities of engines shall not exceed those described in sections 1 . 1 . 1 . and 1 . 1 . 2 .


### 1 . 2 . as an optional alternative to section 1 . 1 . 1 and with the exception of engines for use in propulsion of railcars and locomotives , the oem may seek permission for his engine suppliers to place on the market a fixed number of engines under the flexibility scheme . the number of engines in each engine category shall not exceed the following values : ### 1 . 2 . as an optional alternative to section 1 . 1 . 1 . and with the exception of engines for propulsion of railcars , the oem may seek permission for the oem’s engine manufacturers to place on the market a fixed number of engines for the oem’s exclusive use . the number of engines in each engine category shall not exceed the following values :


### during the transition from stage iii a to stage iii b , the percentage of the number of engines used for application other than propulsion of railcars and locomotives placed on the market under the flexibility scheme , should be increased from 20% to 50% of the equipment manufacturer ' s annual sales of equipment with engines in that category . the maximum number of engines that may be placed on the market under the flexibility scheme should be adapted accordingly . ### during the stage iii b , the percentage of the number of engines used for application other than propulsion of railcars , locomotives and inland waterways vessels placed on the market under the flexibility scheme , should be 50% of the equipment manufacturer ' s annual quantity of equipment placed on the market with engines in that category . the optional alternative that a fixed number of engines that may be placed on the market under the flexibility scheme should be adapted accordingly .


### 2 . 2 . as an optional alternative to section 1 . 2 . 1 . , the oem may seek permission for his engine suppliers to place on the market a fixed number of engines under the flexibility scheme . the number of engines in each engine category shall not exceed the following values : ### 2 . 2 . as an optional alternative to section 1 . 2 . 1 . , the oem may seek permission for the oem’s engine manufacturers to place on the market a fixed number of engines for the oem’s exclusive use . the number of engines in each engine category shall not exceed the following values :


### 2 . 1 . the number of engines placed on the market under such flexibility scheme shall , in each engine category , not exceed 50% of the oem ' s annual sales of equipment with engines in that engine category . where an oem has marketed equipment in the eu for a period of less than 5 years the average will be calculated based on the period for which the oem has marketed equipment in the eu . ### 2 . 1 . the number of engines placed on the market under a flexibility scheme shall , in each engine category , not exceed 50 % of the oem ' s annual quantity of equipment placed on the market with engines in that engine category , calculated as the average of the latest five years . in case an oem placed on the market equipment for less than five years , the average shall be calculated based on the period for which the oem has placed equipment on the market .


### the cooperation network shall bring into permanent communication the commission and the competent authorities . when requested , the european network and information security agency shall assist the cooperation network by providing its expertise and advice . ### the cooperation network shall bring into permanent communication the commission and the single points of contact . when requested , the european network and information security agency shall assist the cooperation network by providing its expertise and advice . where appropriate , market operators may also be invited to participate in the activities of the cooperation network referred to in points , , and of paragraph 3 . in order to achieve greater efficiency convergence opportunities with the ciwin network must be evaluated .


### the competent authority may inform the public , or require the public administrations and market operators to do so , where it determines that disclosure of the incident is in the public interest . once a year , the competent authority shall submit a summary report to the cooperation network on the notifications received and the action taken in accordance with this paragraph . ### the competent authority may inform the public , or require the public administrations and market operators to do so , where it determines that disclosure of the incident is in the public interest . every six months , the competent authority shall submit a summary report to the cooperation network on the notifications received and the action taken in accordance with this paragraph .


### the existing capabilities are not sufficient enough to ensure a high level of nis within the union . member states have very different levels of preparedness leading to fragmented approaches across the union . this leads to an unequal level of protection of consumers and businesses , and undermines the overall level of nis within the union . lack of common minimum requirements on public administrations and market operators in turn makes it impossible to set up a global and effective mechanism for cooperation at union level . ### the existing capabilities are not sufficient enough to ensure a high level of nis within the union . member states have very different levels of preparedness leading to fragmented approaches across the union . this leads to an unequal level of protection of consumers and businesses , and undermines the overall level of nis within the union . lack of common minimum requirements on public administrations and market operators in turn makes it impossible to set up a global and effective mechanism for cooperation at union level and undermines the union ' s leading position internationally in safeguarding and promoting a free , efficient and secure internet .


### building upon the significant progress within the european forum of member states in fostering discussions and exchanges on good policy practices including the development of principles for european cyber crisis cooperation , the member states and the commission should form a network to bring them into permanent communication and support their cooperation . this secure and effective cooperation mechanism should enable structured and coordinated information exchange , detection and response at union level . ### building upon the significant progress within the european forum of member states in fostering discussions and exchanges on good policy practices including the development of principles for european cyber crisis cooperation , the member states and the commission should form a network to bring them into permanent communication and support their cooperation . this secure and effective cooperation mechanism , where the participation of market operators is assured , should enable structured and coordinated information exchange , detection and response at union level .


### the competent authorities and the commission shall form a network to cooperate against risks and incidents affecting network and information systems . ### the single points of contact and the commission shall form a network where they shall cooperate against risks and incidents affecting network and information systems .


### those obligations should be extended beyond the electronic communications sector to key providers of information society services , as defined in directive 98 / 34 / ec of the european parliament and of the council of 22 june 1998 laying down a procedure for the provision of information in the field of technical standards and regulations and of rules on information society services27 , which underpin downstream information society services or on - line activities , such as e - commerce platforms , internet payment gateways , social networks , search engines , cloud computing services , application stores . disruption of these enabling information society services prevents the provision of other information society services which rely on them as key inputs . software developers and hardware manufacturers are not providers of information society services and are therefore excluded . those obligations should also be extended to public administrations , and operators of critical infrastructure which rely heavily on information and communications technology and are essential to the maintenance of vital economical or societal functions such as electricity and gas , transport , credit institutions , stock exchange and health . disruption of those network and information systems would affect the internal market . __________________ 27 oj l 204 , 21 . 7 . 1998 , p . 37 . ### those obligations should be extended beyond the electronic communications sector and public administrations to operators of infrastructure which rely heavily on information and communications technology and are essential to the maintenance of vital economical or societal functions such as electricity and gas , transport , credit institutions , financial market infrastructures and health . disruption of those network and information systems would affect the internal market . while the obligations set out in this directive do not extend to key providers of information society services , as defined in directive 98 / 34 / ec of the european parliament and of the council of 22 june 1998 laying down a procedure for the provision of information in the field of technical standards and regulations and of rules on information society services27 , which underpin downstream information society services or on - line activities , such as e - commerce platforms , internet payment gateways , social networks , search engines , cloud computing services , application stores , these may , on a voluntary basis , inform the competent authority or single point of contact of those network security incidents they deem appropriate , and the competent authority or the single point of contact should , if reasonably possible , present the public administrations or the market operators that informed of the incident with strategically analysed information that will help overcome the security threat . __________________ 27 oj l 204 , 21 . 7 . 1998 , p . 37 .


### the competent authorities shall notify incidents of a suspected serious criminal nature to law enforcement authorities . ### the competent authorities and the single point of contact shall inform the concerned market operators about the possibility to bring criminal charges to the law enforcement authorities in case of incidents of a suspected serious criminal nature .


### each member state shall set up a computer emergency response team responsible for handling incidents and risks according to a well - defined process , which shall comply with the requirements set out in point of annex i . a cert may be established within the competent authority . ### each member state shall set up at least one computer emergency response team for each of the sectors established in annex ii , responsible for handling incidents and risks according to a well - defined process , which shall comply with the requirements set out in point of annex i . a cert may be established within the competent authority .


### competent authorities should pay due attention to preserving informal and trusted channels of information - sharing between market operators and between the public and the private sectors . publicity of incidents reported to the competent authorities should duly balance the interest of the public in being informed about threats with possible reputational and commercial damages for the public administrations and market operators reporting incidents . in the implementation of the notification obligations , competent authorities should pay particular attention to the need to maintain information about product vulnerabilities strictly confidential prior to the release of appropriate security fixes . ### competent authorities and single points of contact should pay due attention to preserving informal and trusted channels of information - sharing between market operators and between the public and the private sectors . publicity of incidents reported to the competent authorities and single points of contact should duly balance the interest of the public in being informed about threats with possible reputational and commercial damages for the public administrations and market operators reporting incidents . in order to safeguard trust and efficiency , publicity of incidents shall only take place after consultation with those who reported the incident and only when strictly necessary for achieving the objectives of this directive . in the implementation of the notification obligations , competent authorities and single points of contact should pay particular attention to the need to maintain information about product vulnerabilities strictly confidential prior to the deployment of appropriate security fixes . as a general rule , single points of contact should not disclose personal data of individuals involved in incidents . single points of contact should only disclose personal data where the disclosure of such data is necessary and proportionate in view of the objective pursued .


### undergo a security audit carried out by a qualified independent body or national authority and make the results thereof available to the competent authority . ### provide evidence of effective implementation of security policies , such as results of a security audit carried out by internal auditors , a qualified independent body or national authority , and make the evidence available to the competent authority or to the single point of contact . where necessary , the competent authority or the single point of contact may require additional evidence or exceptionally , and providing due justification , carry out an additional audit . this requirement shall only apply to all market operators laid down in annex ii , where not provided otherwise according to article 15 paragraph 2 point b a .


### criminal activities are in many cases underlying an incident . the criminal nature of incidents can be suspected even if the evidence to support it may not be sufficiently clear from the start . in this context , appropriate co - operation between competent authorities and law enforcement authorities should form part of an effective and comprehensive response to the threat of security incidents . in particular , promoting a safe , secure and more resilient environment requires a systematic reporting of incidents of a suspected serious criminal nature to law enforcement authorities . the serious criminal nature of incidents should be assessed in the light of eu laws on cybercrime . ### criminal activities are in many cases underlying an incident . the criminal nature of incidents can be suspected even if the evidence to support it may not be sufficiently clear from the start . in this context , appropriate co - operation between competent authorities and law enforcement authorities as well as cooperation with the ec3 and enisa should form part of an effective and comprehensive response to the threat of security incidents . in particular , promoting a safe , secure and more resilient environment requires a systematic reporting of incidents of a suspected serious criminal nature to law enforcement authorities . the serious criminal nature of incidents should be assessed in the light of eu laws on cybercrime .


### the cert shall act under the supervision of the competent authority , which shall regularly review the adequacy of its resources , its mandate and the effectiveness of its incident - handling process . ### the certs shall act under the supervision of the competent authority or the single point of contact , which shall regularly review the adequacy of its resources , its mandate and the effectiveness of its incident - handling process .


### as most network and information systems are privately operated , cooperation between the public and private sector is essential . market operators should be encouraged to pursue their own informal cooperation mechanisms to ensure nis . they should also cooperate with the public sector and share information and best practices in exchange of operational support in case of incidents . ### as most network and information systems are privately operated , cooperation between the public and private sector is essential . market operators should be encouraged to pursue their own informal cooperation mechanisms to ensure nis . they should also cooperate with the public sector and mutually share information and best practices in exchange of operational support and strategically analysed information , in case of incidents .


### to ensure transparency and properly inform eu citizens and market operators , the competent authorities should set up a common website to publish non confidential information on the incidents and risks . ### to ensure transparency and properly inform eu citizens and market operators , the single points of contact should set up a common union - wide website to publish non confidential information on the incidents and risks .


### to ensure transparency and properly inform eu citizens and market operators , the competent authorities should set up a common website to publish non confidential information on the incidents and risks . ### to ensure transparency and properly inform eu citizens and market operators , a common website should be setup by enisa and the competent authorities where non confidential information on the incidents and risks is to be published .


### subject to any delegated act adopted under paragraph 5 , the competent authorities may adopt guidelines and , where necessary , issue instructions concerning the circumstances in which public administrations and market operators are required to notify incidents . ### the competent authorities or the single points of contact may adopt guidelines concerning the circumstances in which market operators are required to notify incidents .


### the competent authority may inform the public , or require the public administrations and market operators to do so , where it determines that disclosure of the incident is in the public interest . once a year , the competent authority shall submit a summary report to the cooperation network on the notifications received and the action taken in accordance with this paragraph . ### after consultation with the competent authority and the public administration and market operator concerned , the single point of contact may exceptionally inform the public about individual incidents , where public awareness is necessary to prevent an incident or deal with an ongoing incident , or where the market operator , subject to an incident , has refused to address a serious structural vulnerability related to that incident without undue delay . the single point of contact must properly justify such decision . the competent authority or the single point of contact shall , if reasonably possible , present the public administrations or the market operators that informed of the incident with strategic analysed information that will help overcome the security threat . once a year , the single point of contact shall submit a summary report to the cooperation network on the notifications received and the action taken in accordance with this paragraph . publicity of any individual incidents reported to the competent authorities and single points of contact should duly balance the interest of the public in being informed about threats with possible reputational and commercial damages for the public administrations and market operators that reported them and can only take place after prior consultation .


### upon receipt of an early warning and its assessment , the competent authorities should agree on a coordinated response under the union nis cooperation plan . competent authorities as well as the commission should be informed about the measures adopted at national level as a result of the coordinated response . ### upon receipt of an early warning and its assessment , the single points of contact should agree on a coordinated response under the union nis cooperation plan . the single points of contact as well as the commission should be informed about the measures adopted at national level as a result of the coordinated response .


### to ensure convergent implementation of article 14 , member states shall encourage the use of standards and / or specifications relevant to networks and information security . ### to ensure convergent implementation of article 14 , member states , without prescribing the use of any particular technology , shall encourage the use of interoperable standards and / or specifications relevant to networks and information security .


### the competent authorities shall work in close cooperation with personal data protection authorities when addressing incidents resulting in personal data breaches . ### the competent authorities and the single points of contact shall work in close cooperation with personal data protection authorities when addressing incidents resulting in personal data breaches . the single points of contact and the data protection authorities shall develop , in cooperation with enisa , information exchange mechanisms and a single template to be used both for notifications under article 14 of this directive and regulation 95 / 46 of the european parliament and of the council on the protection of individuals with regard to the processing of personal data and on the free movement of such data .


### they affect or may affect more than one member state . ### the single points of contact or the commission assess that the risk or incident affects more than one member state and they grow rapidly or may grow rapidly in scale .


### a cooperation mechanism should be established at union level to allow for information exchange and coordinated detection and response regarding network and information security . for that mechanism to be effective and inclusive , it is essential that all member states have minimum capabilities and a strategy ensuring a high level of nis in their territory . minimum security requirements should also apply to public administrations and operators of critical information infrastructure to promote a culture of risk management and ensure that the most serious incidents are reported . ### a cooperation mechanism should be established at union level to allow for information exchange and coordinated detection and response regarding network and information security . for that mechanism to be effective and inclusive , it is essential that all member states have minimum capabilities and a strategy ensuring a high level of nis in their territory . minimum security requirements should also apply to public administrations and operators of critical information infrastructure to promote a culture of risk management and ensure that the most serious incidents are reported . the legal framework must be based upon the need to safeguard the privacy and integrity of citizens


### responsibilities in ensuring nis lie to a great extent on public administrations and market operators . a culture of risk management , involving risk assessment and the implementation of security measures appropriate to the risks faced should be promoted and developed through appropriate regulatory requirements and voluntary industry practices . establishing a level playing field is also essential to the effective functioning of the cooperation network to ensure effective cooperation from all member states . ### responsibilities in ensuring nis lie to a great extent on public administrations and market operators . a culture of risk management and trust , involving risk assessment and the implementation of security measures appropriate to the risks faced should be promoted and developed through appropriate regulatory requirements and voluntary industry practices . establishing a trustworthy level playing field is also essential to the effective functioning of the cooperation network to ensure effective cooperation from all member states .


### a secure information - sharing infrastructure should be put in place to allow for the exchange of sensitive and confidential information within the cooperation network . without prejudice to their obligation to notify incidents and risks of union dimension to the cooperation network , access to confidential information from other member states should only be granted to members states upon demonstration that their technical , financial and human resources and processes , as well as their communication infrastructure , guarantee their effective , efficient and secure participation in the network . ### a secure information - sharing infrastructure should be put in place to allow for the exchange of sensitive and confidential information within the cooperation network . without prejudice to their obligation to notify incidents and risks of union dimension to the cooperation network , access to confidential information from other member states should only be granted to members states upon demonstration that their technical , financial and human resources and processes , as well as their communication infrastructure , guarantee their effective , efficient and secure participation in the network . in order for the cooperation network to be able to efficiently fulfil its mission , the commission should establish a budget line for the network .


### to achieve and maintain a common high level of security of network and information systems , each member state should have a national nis strategy defining the strategic objectives and concrete policy actions to be implemented . nis cooperation plans complying with essential requirements need to be developed at national level in order to reach capacity response levels allowing for effective and efficient cooperation at national and union level in case of incidents . ### to achieve and maintain a common high level of security of network and information systems , each member state should have a national nis strategy defining the strategic objectives and concrete policy actions to be implemented . nis cooperation plans complying with essential requirements need to be developed at national level in order to reach capacity response levels allowing for effective and efficient cooperation at national and union level in case of incidents . member states may ask for the assistance of the european network and information security agency in developing their national nis strategies , based on a common minimum nis strategy blueprint .


### the competent authorities shall notify incidents of a suspected serious criminal nature to law enforcement authorities . ### the competent authorities and the single point of contact shall inform the concerned market operators about the possibility to bring criminal charges to the law enforcement authorities in case of incidents of a suspected serious criminal nature .


### the cooperation network shall bring into permanent communication the commission and the competent authorities . when requested , the european network and information security agency shall assist the cooperation network by providing its expertise and advice . ### the cooperation network shall bring into permanent communication the commission and the competent authorities . the european network and information security agency shall assist the cooperation network by providing its expertise and advice .


### the commission shall be empowered to adopt delegated acts in accordance with article 18 , concerning the further specification of the risks and incidents triggering early warning referred to in paragraph 1 . ### the commission shall be empowered to adopt implementing acts in accordance with article 19 , concerning the further specification of the risks and incidents triggering early warning referred to in paragraph 1 , as well as the procedures for sharing sensitive information for market operators , national security or national defense referred to in paragraph 2 .


### information that is considered confidential by a competent authority , in accordance with union and national rules on business confidentiality , should be exchanged with the commission and other competent authorities only where such exchange is strictly necessary for the application of this directive . the information exchanged should be limited to that which is relevant and proportionate to the purpose of such exchange . ### information that is considered confidential by a competent authority or a single point of contact , in accordance with union and national rules on business confidentiality , should be exchanged with the commission and other single points of contact only where such exchange is strictly necessary for the application of this directive . the information exchanged should be limited to that which is relevant , necessary and proportionate to the purpose of such exchange .


### member states shall ensure that competent authorities have the power to issue binding instructions to market operators and public administrations . ### member states shall ensure that the competent authorities and the single points of contact have the power to issue binding instructions to all market operators laid down in annex ii .


### ‘ incident’ means any circumstance or event having an actual adverse effect on security ; ### ‘ incident’ means any reasonably identifiable circumstance or event having an actual adverse effect on security ;


### each member state shall set up a computer emergency response team responsible for handling incidents and risks according to a well - defined process , which shall comply with the requirements set out in point of annex i . a cert may be established within the competent authority . ### each member state shall set up at least one computer emergency response team for each of the sectors established in annex ii , responsible for handling incidents and risks according to a well - defined process , which shall comply with the requirements set out in point of annex i . a cert may be established within the competent authority .


### without prejudice to the possibility for the cooperation network to have informal international cooperation , the union may conclude international agreements with third countries or international organisations allowing and organizing their participation in some activities of the cooperation network . such agreement shall take into account the need to ensure adequate protection of the personal data circulating on the cooperation network . ### without prejudice to the possibility for the cooperation network to have informal international cooperation , the union may conclude international agreements with third countries or international organisations allowing and organizing their participation in some activities of the cooperation network . such agreement shall take into account the need to ensure adequate protection of the personal data circulating on the cooperation network . any transfer of personal data to recipients located in countries outside the union shall be conducted in accordance with articles 25 and 26 of directive 95 / 46 / ec and article 9 of regulation no 45 / 2001 .


### criminal activities are in many cases underlying an incident . the criminal nature of incidents can be suspected even if the evidence to support it may not be sufficiently clear from the start . in this context , appropriate co - operation between competent authorities and law enforcement authorities should form part of an effective and comprehensive response to the threat of security incidents . in particular , promoting a safe , secure and more resilient environment requires a systematic reporting of incidents of a suspected serious criminal nature to law enforcement authorities . the serious criminal nature of incidents should be assessed in the light of eu laws on cybercrime . ### criminal activities are in many cases underlying an incident . the criminal nature of incidents can be suspected even if the evidence to support it may not be sufficiently clear from the start . in this context , appropriate co - operation between competent authorities , single points of contact and law enforcement authorities should form part of an effective and comprehensive response to the threat of security incidents . in particular , promoting a safe , secure and more resilient environment requires a systematic reporting of incidents of a suspected serious criminal nature to law enforcement authorities . the serious criminal nature of incidents should be assessed in the light of eu laws on cybercrime .


### all member states should be adequately equipped , both in terms of technical and organisational capabilities , to prevent , detect , respond to and mitigate network and information systems ' incidents and risks . well - functioning computer emergency response teams complying with essential requirements should therefore be established in all member states to guarantee effective and compatible capabilities to deal with incidents and risks and ensure efficient cooperation at union level . ### all member states and market operators should be adequately equipped both in terms of technical and organisational capabilities , to prevent , detect , respond to and mitigate network and information systems ' incidents and risks . commonly required equipment and capabilities ought to comply with commonly agreed technical standards as well as standards procedures of operation . well - functioning computer emergency response teams complying with essential requirements should therefore be established in all member states to guarantee effective and compatible capabilities to deal with incidents and risks and ensure efficient cooperation at union level . these certs should be enabled to interact on the basis of common technical standards and spo .


### a secure information - sharing infrastructure should be put in place to allow for the exchange of sensitive and confidential information within the cooperation network . without prejudice to their obligation to notify incidents and risks of union dimension to the cooperation network , access to confidential information from other member states should only be granted to members states upon demonstration that their technical , financial and human resources and processes , as well as their communication infrastructure , guarantee their effective , efficient and secure participation in the network . ### a secure information - sharing infrastructure should be put in place , under the supervision of enisa , to allow for the exchange of sensitive and confidential information within the cooperation network . without prejudice to their obligation to notify incidents and risks of union dimension to the cooperation network , access to confidential information from other member states should only be granted to members states upon demonstration that their technical , financial and human resources and processes , as well as their communication infrastructure , guarantee their effective , efficient and secure participation in the network .


### in order to ensure uniform conditions for the implementation of this directive , implementing powers should be conferred on the commission as regards the cooperation between competent authorities and the commission within the cooperation network , the access to the secure information - sharing infrastructure , the union nis cooperation plan , the formats and procedures applicable to informing the public about incidents , and the standards and / or technical specifications relevant to nis . those powers should be exercised in accordance with regulation no 182 / 2011 of the european parliament and of the council of 16 february 2011 laying down the rules and general principles concerning mechanisms for control by member states of the commission ' s exercise of implementing powers30 . __________________ 30 oj l 55 , 28 . 2 . 2011 , p . 13 . ### in order to ensure uniform conditions for the implementation of this directive , implementing powers should be conferred on the commission as regards the cooperation between single points of contact and the commission within the cooperation network , without prejudice to existing cooperation mechanisms at national level , the common set of interconnection and security standards for the secure information - sharing infrastructure , the union nis cooperation plan and the formats and procedures applicable to notifying significant incidents . those powers should be exercised in accordance with regulation no 182 / 2011 of the european parliament and of the council of 16 february 2011 laying down the rules and general principles concerning mechanisms for control by member states of the commission ' s exercise of implementing powers30 . __________________ 30 oj l 55 , 28 . 2 . 2011 , p . 13 .


### competent authorities should pay due attention to preserving informal and trusted channels of information - sharing between market operators and between the public and the private sectors . publicity of incidents reported to the competent authorities should duly balance the interest of the public in being informed about threats with possible reputational and commercial damages for the public administrations and market operators reporting incidents . in the implementation of the notification obligations , competent authorities should pay particular attention to the need to maintain information about product vulnerabilities strictly confidential prior to the release of appropriate security fixes . ### competent authorities and single points of contact should pay due attention to preserving informal and trusted channels of information - sharing between market operators and between the public and the private sectors . publicity of incidents reported to the competent authorities and single points of contact should duly balance the interest of the public in being informed about threats with possible reputational and commercial damages for the public administrations and market operators reporting incidents . in order to safeguard trust and efficiency , publicity of incidents shall only take place after consultation with those who reported the incident and only when strictly necessary for achieving the objectives of this directive . in the implementation of the notification obligations , competent authorities and single points of contact should pay particular attention to the need to maintain information about product vulnerabilities strictly confidential prior to the deployment of appropriate security fixes . as a general rule , single points of contact should not disclose personal data of individuals involved in incidents . single points of contact should only disclose personal data where the disclosure of such data is necessary and proportionate in view of the objective pursued .


### notification of an early warning within the network should be required only where the scale and severity of the incident or risk concerned are or may become so significant that information or coordination of the response at union level is necessary . early warnings should therefore be limited to actual or potential incidents or risks that grow rapidly , exceed national response capacity or affect more than one member state . to allow for a proper evaluation , all information relevant for the assessment of the risk or incident should be communicated to the cooperation network . ### notification of an early warning within the network should be required only where the scale and severity of the incident or risk concerned are or may become so significant that information or coordination of the response at union level is necessary . early warnings should therefore be limited to incidents or risks that grow rapidly , exceed national response capacity or affect more than one member state . to allow for a proper evaluation , all information relevant for the assessment of the risk or incident should be communicated to the cooperation network .


### member states shall ensure that the competent authorities have all the powers necessary to investigate cases of non - compliance of public administrations or market operators with their obligations under article 14 and the effects thereof on the security of networks and information systems . ### member states shall ensure that the competent authorities and the single points of contact have the powers necessary to examine cases of non - compliance of public administrations or market operators with their obligations under article 14 and the effects thereof on the security of networks and information systems .


### the requirements under paragraphs 1 and 2 apply to all market operators providing services within the european union . ### the requirements under paragraphs 1 and 2 apply to all market operators providing services within the european union . public authorities and market operators should provide disclosure tailored to their particular circumstances .


### they affect or may affect more than one member state . ### the single points of contact or the commission assess that the risk or incident affects more than one member state and they grow rapidly or may grow rapidly in scale .


### a cooperation mechanism should be established at union level to allow for information exchange and coordinated detection and response regarding network and information security . for that mechanism to be effective and inclusive , it is essential that all member states have minimum capabilities and a strategy ensuring a high level of nis in their territory . minimum security requirements should also apply to public administrations and operators of critical information infrastructure to promote a culture of risk management and ensure that the most serious incidents are reported . ### a cooperation mechanism should be established at union level to allow for information exchange and coordinated detection and response regarding network and information security . for that mechanism to be effective and inclusive , it is essential that all member states have minimum capabilities and a strategy ensuring a high level of nis in their territory . minimum security requirements should also apply to public administrations , operators of critical information infrastructure and stock listed companies to promote a culture of risk management and ensure that the most serious incidents are reported .


### where the risk or incident subject to an early warning is of a suspected criminal nature , the competent authorities or the commission shall inform the european cybercrime centre within europol . ### where the risk or incident subject to an early warning is of a suspected criminal nature , the single points of contact or the commission shall inform the european cybercrime centre within europol .


### the commission shall establish , by means of implementing acts , the necessary modalities to facilitate the cooperation between competent authorities and the commission referred to in paragraphs 2 and 3 . those implementing acts shall be adopted in accordance with the consultation procedure referred to in article 19 . ### the commission shall establish , by means of implementing acts , the necessary modalities to facilitate the cooperation between single points of contact and the commission referred to in paragraphs 2 and 3 . those implementing acts shall be adopted in accordance with the consultation procedure referred to in article 19 .


### the cooperation network shall bring into permanent communication the commission and the competent authorities . when requested , the european network and information security agency shall assist the cooperation network by providing its expertise and advice . ### the cooperation network shall bring into permanent communication the commission and the single points of contact . when requested , the european network and information security agency shall assist the cooperation network by providing its expertise and advice . where appropriate , market operators may also be invited to participate in the activities of the cooperation network referred to in points , , and of paragraph 3 . in order to achieve greater efficiency convergence opportunities with the ciwin network must be evaluated .


### subject to any delegated act adopted under paragraph 5 , the competent authorities may adopt guidelines and , where necessary , issue instructions concerning the circumstances in which public administrations and market operators are required to notify incidents . ### the competent authorities or the single points of contact may adopt guidelines concerning the circumstances in which market operators are required to notify incidents .


### operator of critical infrastructure that are essential for the maintenance of vital economic and societal activities in the fields of energy , transport , banking , stock exchanges and health , a non exhaustive list of which is set out in annex ii . ### operator of infrastructure that are essential for the maintenance of vital economic and societal activities in the fields of energy , transport , banking , financial market infrastructures and health , and the disruption or destruction of which would have a significant negative impact in a member state as a result of the failure to maintain those functions , a non exhaustive list of which is set out in annex ii .


### the commission shall be empowered to adopt delegated acts in accordance with article 18 , concerning the further specification of the risks and incidents triggering early warning referred to in paragraph 1 . ### the commission shall be empowered to adopt implementing acts in accordance with article 19 , concerning the further specification of the risks and incidents triggering early warning referred to in paragraph 1 , as well as the procedures for sharing sensitive information for market operators , national security or national defense referred to in paragraph 2 .


### member states shall ensure a high level of security of the network and information systems in their territories in accordance with this directive . ### member states shall ensure a sustained continuous high level of security of the network and information systems in their territories in accordance with this directive .


### as most network and information systems are privately operated , cooperation between the public and private sector is essential . market operators should be encouraged to pursue their own informal cooperation mechanisms to ensure nis . they should also cooperate with the public sector and share information and best practices in exchange of operational support in case of incidents . ### as most network and information systems are privately operated , cooperation between the public and private sector is essential . market operators should be encouraged to pursue their own informal cooperation mechanisms to ensure nis . they should also cooperate with the public sector and mutually share information and best practices in exchange of operational support and strategically analysed information , in case of incidents .


### member states shall ensure that public administrations and market operators notify to the competent authority incidents having a significant impact on the security of the core services they provide . ### member states shall ensure that public administrations and market operators notify to the competent authority incidents having a significant impact on the security of the core services they provide completely and without measurable delay .


### member states shall ensure that public administrations and market operators notify to the competent authority incidents having a significant impact on the security of the core services they provide . ### member states shall ensure that public administrations and market operators notify to the competent authority or to the single point of contact incidents having a significant impact on the continuity of the core services they provide , accordingly the commission shall ensure the same obligations vis a vis the european institutions . to determine the significance of the impact of an incident , the following parameters shall inter alia be taken into account :


### technical and organisational measures imposed to public administrations and market operators should not require that a particular commercial information and communications technology product be designed , developed or manufactured in a particular manner . ### technical and organisational measures imposed to public administrations and market operators should not require that a particular commercial information and communications technology product be designed , developed or manufactured in a particular manner . on the other hand , the use of international standards pertaining to cybersecurity should be required .


### criminal activities are in many cases underlying an incident . the criminal nature of incidents can be suspected even if the evidence to support it may not be sufficiently clear from the start . in this context , appropriate co - operation between competent authorities and law enforcement authorities should form part of an effective and comprehensive response to the threat of security incidents . in particular , promoting a safe , secure and more resilient environment requires a systematic reporting of incidents of a suspected serious criminal nature to law enforcement authorities . the serious criminal nature of incidents should be assessed in the light of eu laws on cybercrime . ### criminal or cyberwar activities are in many cases underlying an incident . the criminal nature of incidents can be suspected even if the evidence to support it may not be sufficiently clear from the start . in this context , appropriate co - operation between competent authorities , law enforcement authorities and defence institutions should form part of an effective and comprehensive response to the threat of security incidents . in particular , promoting a safe , secure and more resilient environment requires a systematic reporting of incidents of a suspected serious criminal nature to law enforcement authorities and of possible cyberwar incidents to defence institutions . the serious criminal nature of incidents should be assessed in the light of eu laws on cybercrime .


### a cooperation mechanism should be established at union level to allow for information exchange and coordinated detection and response regarding network and information security . for that mechanism to be effective and inclusive , it is essential that all member states have minimum capabilities and a strategy ensuring a high level of nis in their territory . minimum security requirements should also apply to public administrations and operators of critical information infrastructure to promote a culture of risk management and ensure that the most serious incidents are reported . ### a cooperation mechanism should be established at union level to allow for information exchange and coordinated detection and response regarding network and information security . for that mechanism to be effective and inclusive , it is essential that all member states have minimum capabilities and a strategy ensuring a high level of nis in their territory . minimum security requirements should also apply to public administrations and operators of information infrastructure to promote a culture of risk management and ensure that the most serious incidents are reported .


### this directive should not apply to micro , small and medium - sized enterprises , as defined by commission recommendation 2003 / 361 / ec of 6 may 2003 concerning the definition of micro , small and medium - sized enterprises , even if they are listed companies . ### this directive should not apply to micro , small and medium - sized enterprises , as defined by commission recommendation 2003 / 361 / ec of 6 may 2003 concerning the definition of micro , small and medium - sized enterprises , even if they are listed companies . to take account of the characteristics of the small business sector in some member states , the number of employees in the definition of ‘ sme’ should be raised to 500 ;


### the proportion of women on company boards is progressing very slowly , with an average annual increase of just 0 . 6 percentage points during the past years . the rate of improvement has differed in individual member states and has led to highly divergent results . much more significant progress was noted in the member states where binding measures have been introduced . growing discrepancies between member states are likely to increase given the very different approaches pursued by individual member states to increase the representation of females on boards that are being pursued by individual member states . ### the proportion of women on company boards for example is progressing very slowly . the rate of improvement has differed in individual member states and has led to highly divergent results .


### member states shall take the necessary measures to ensure that the body or bodies designated in accordance with article 20 of directive 2006 / 54 / ec of the european parliament and of the council of 5 july 2006 on the implementation of the principle of equal opportunities and equal treatment of men and women in matters of employment and occupation are also competent for the promotion , analysis , monitoring and support of gender balance on the boards of listed companies . ### member states shall take the necessary measures to ensure that the body or bodies designated in accordance with article 20 of directive 2006 / 54 / ec of the european parliament and of the council of 5 july 2006 on the implementation of the principle of equal opportunities and equal treatment of men and women in matters of employment and occupation are also competent for the promotion , analysis , monitoring and support of gender balance on the boards of listed companies . to that end , member states shall efficiently collaborate with social partners and civil society .


### determining the number of non - executive director positions necessary to meet the objective requires further specification since for most board sizes it is mathematically possible only to go beyond or remain below the exact share of 40 per cent . therefore , the number of board positions necessary to meet the objective should be the number closest to 40 per cent . at the same time , in order to avoid discrimination of the initially over - represented sex , listed companies should not be obliged to appoint members of the under - represented sex to half or more of the non - executive board positions . thus , for example , members of the under - represented sex should hold at least one position on boards with three or four non - executive directors , at least two positions on boards with five or six non - executive directors , and at least three positions on boards with seven or eight non - executive directors . ### where the non - executive board consists of only three members , it is mathematically impossible to go beyond a share of 40 per cent for both genders . therefore , in such cases , members of the underrepresented sex should hold at least one position on boards with three non - executive directors .


### the number of non - executive director positions necessary to meet the objective laid down in paragraph 1 shall be the number closest to the proportion of 40 per cent , but not exceeding 49 per cent . ### the number of non - executive director positions necessary to meet the objective laid down in paragraph 1 shall be at least 40 per cent . if the non - executive board consists of only three board members , the proportion one to two shall suffice .


### existing evidence also shows that labour market equality can improve economic growth substantially . enhancing female presence in the boardrooms of listed companies in the union not only affects the women appointed to boards , but also contributes to attracting female talent to the company and ensuring a greater presence of women at all levels of management and in the workforce . therefore , a higher share of women on company boards has a positive impact on closing both the gender employment gap and the gender pay gap . making full use of the existing female talent pool would constitute a marked improvement in terms of return on education for both individuals and the public sector . female under - representation in the board rooms of publicly listed companies in the eu is a missed opportunity in terms of achieving long - term sustainable growth for member states ' economies at large . ### existing evidence also shows that labour market equality can improve economic growth substantially . enhancing female presence in the boardrooms of listed companies in the union not only affects the women appointed to boards , but also contributes to attracting female talent to the company , ensuring a greater presence of , and recognising the contribution made by , women at all levels of management and in the workforce . therefore , a higher share of women on company boards has a positive impact on closing both the gender employment gap and the gender pay gap . making full use of the existing female talent pool would constitute a marked improvement in terms of return on education for both individuals and the public sector . female under - representation in the boardrooms of publicly listed companies in the eu is a missed opportunity in terms of achieving long - term sustainable growth for member states ' economies at large .


### at company level , it is widely acknowledged that the presence of women on boards improves corporate governance , because team performance and the quality of decision - making are enhanced due to a more diverse and collective mind - set incorporating a wider range of perspectives and therefore reaching more balanced decisions . numerous studies have also shown that there is a positive relationship between gender diversity at top management level and a company ' s financial performance and profitability . enhancing female representation on the boards of publicly listed companies in the union can therefore have a positive impact on the performance of companies concerned . ### at company level , it is widely acknowledged that the presence of women on boards improves corporate governance , because team performance and the quality of decision - making are enhanced due to a more diverse and collective mind - set incorporating a wider range of perspectives as well as a more proactive business model and therefore reaching more balanced decisions , with a view to better reflecting societal and consumers ' realities . numerous studies have also shown that there is a positive relationship between gender diversity at top management level and a company ' s financial performance and profitability . enhancing female representation on the boards of publicly listed companies in the union , given the significant economic and social responsibility of such companies , can therefore have a positive impact on the economic performance of companies concerned . measures to encourage career progression for women at all levels of management should therefore be introduced and reinforced .


### the scattered and divergent regulation or the absence of regulation at national level as regards the gender balance on boards of listed companies does not only lead to discrepancies in the number of women among non - executive directors and different rates of improvement across member states , but also poses barriers to the internal market by imposing divergent corporate governance requirements on european listed companies . those differences in legal and self - regulatory requirements for the composition of corporate boards can lead to practical complications for listed companies operating across borders , notably when establishing subsidiaries or in mergers and acquisitions , as well as for candidates for board positions . ### the scattered and divergent regulation or the absence of regulation at national level as regards the gender balance on boards of listed companies does not only lead to discrepancies in the number of women among non - executive directors and different rates of improvement across member states , but also poses barriers to the internal market by imposing divergent corporate governance requirements on european listed companies . those differences in legal and self - regulatory requirements for the composition of corporate boards can lead to practical complications for listed companies operating across borders , notably when establishing subsidiaries or in mergers and acquisitions , as well as for candidates for board positions . nevertheless , the enforcement of the provisions laid down in the directive should be irrespective of the different ways non - executive directors are selected in european companies ' boards .


### despite the existing union legislation aimed at preventing and combating sex discrimination , the council recommendations aimed specifically at increasing the presence of women in economic decision - making and union - level actions encouraging self - regulation , women continue to be strongly outnumbered by men in the highest decision - making bodies of companies throughout the union . in the private sector and especially in listed companies this gender imbalance is particularly significant and acute . the commission ' s key indicator of gender representation on corporate boards shows that the proportion of women involved in top - level business decision - making remains very low . in january 2012 , women occupied on average just 13 . 7 per cent of board seats in the largest publicly listed companies in member states . among non - executive directors only 15 per cent were women . ### despite the existing union legislation aimed at preventing and combating sex discrimination , the council recommendations aimed at a more balanced participation of women and men in economic decision - making and union - level actions encouraging self - regulation , gender imbalance is still significant in the private sector .


### while this directive does not aim to harmonise national laws on the selection procedures and qualification criteria for board positions in detail , the introduction of certain minimum standards as regards the requirement for listed companies without balanced gender representation to take appointment decisions for non - executive directors on the basis of an objective comparative assessment of the qualifications of candidates in terms of suitability , competence and professional performance is necessary in order to attain gender balance among non - executives directors . only an eu - level measure can effectively help to ensure a competitive level - playing field throughout the union and avoid practical complications in business life . ### while this directive does not aim to harmonise national laws on the selection procedures and qualification criteria for board positions in detail , the introduction of certain minimum standards as regards the requirement for listed companies without balanced gender representation to take appointment decisions for non - executive directors on the basis of an objective comparative assessment of the qualifications of candidates in terms of suitability , competence and professional performance is necessary in order to attain gender balance among non - executive directors . only a binding measure at union level can effectively help to ensure a competitive level - playing field throughout the union , avoid practical complications in business life and allow executives and directors to make full use of the opportunities the internal market has to offer .


### ' listed company ' means a company incorporated in a member state whose securities are admitted to trading on a regulated market within the meaning of article 4 of directive 2004 / 39 / ec , in one or more member states ; ### ' listed company ' means a company which has its seat in a member state and whose shares are admitted to trading on a regulated market within the meaning of article 4 of directive 2004 / 39 / ec , in one or more member states ;


### member states exercise a dominant influence over listed companies which are public undertakings within the meaning of article 2 of commission directive 2006 / 111 / ec of 16 november 2006 on the transparency of financial relations between member states and public undertakings , as well as on financial transparency within certain undertakings . due to that dominant influence , they have the instruments at their disposal to bring about the necessary change more rapidly . therefore , in such companies the objective of least 40 per cent of non - executive directors of the under - represented sex should be set at an earlier date . ### member states exercise a dominant influence over listed companies which are public undertakings within the meaning of article 2 of commission directive 2006 / 111 / ec of 16 november 2006 on the transparency of financial relations between member states and public undertakings , as well as on financial transparency within certain undertakings . due to that dominant influence , they have the instruments at their disposal to bring about the necessary change more rapidly . therefore , in such companies the objective of at least 40 per cent of non - executive directors of the under - represented sex should be set at an earlier date , in conformity with adequate mechanisms set up by member states in line with this directive .


### this directive should not apply to micro , small and medium - sized enterprises , as defined by commission recommendation 2003 / 361 / ec of 6 may 2003 concerning the definition of micro , small and medium - sized enterprises , even if they are listed companies . ### these requirements should not apply to family businesses , micro , small and medium - sized enterprises , as defined by commission recommendation 2003 / 361 / ec of 6 may 2003 concerning the definition of micro , small and medium - sized enterprises .


### the union should therefore aim to increase the presence of women on company boards , in order both to boost economic growth and the competitiveness of european companies and to achieve effective gender equality on the labour market . this aim should be pursued through minimum requirements on positive action in the form of binding measures aiming at attaining a quantitative objective for the gender composition of boards of listed companies , in the view of the fact that member states and other countries which have chosen this or a similar method have achieved the best results in reducing the under - representation of women in economic decision - making positions . ### the union should therefore aim to increase gender balance in companies , in order both to boost economic growth and the competitiveness of european companies . this aim should be pursued through minimum requirements on positive action aiming at promoting gender balance at all levels .


### the efficient use of human capital is the most important determinant of an economy ' s competitiveness and is key to addressing the eu ' s demographic challenges , to competing successfully in a globalised economy and to ensuring a comparative advantage vis - à - vis third countries . the pool of highly trained and qualified women is constantly growing as evidenced by the fact that 60 per cent of university graduates are female . a continued failure to draw on this pool in appointments to economic decision - making positions would amount to a failure to fully exploit skilled human capital . ### the efficient use of human capital is an important determinant to compete successfully in a globalised economy and to ensure a comparative advantage vis - à - vis third countries . the pool of highly trained and qualified women is constantly growing as evidenced by the fact that 60 per cent of current university graduates are female . by drawing on this pool in future appointments to economic decision - making positions at all levels would contribute to better exploitation of capital .


### ' listed company ' means a company incorporated in a member state whose securities are admitted to trading on a regulated market within the meaning of article 4 of directive 2004 / 39 / ec , in one or more member states ; ### ' listed company ' means a company incorporated in a member state whose shares are admitted to trading on a regulated market within the meaning of article 4 of directive 2004 / 39 / ec , in one or more member states ;


### the efficient use of human capital is the most important determinant of an economy ' s competitiveness and is key to addressing the eu ' s demographic challenges , to competing successfully in a globalised economy and to ensuring a comparative advantage vis - à - vis third countries . the pool of highly trained and qualified women is constantly growing as evidenced by the fact that 60 per cent of university graduates are female . a continued failure to draw on this pool in appointments to economic decision - making positions would amount to a failure to fully exploit skilled human capital . ### the efficient use of human capital is the most important determinant of an economy ' s competitiveness , development and growth and is key to addressing the eu ' s demographic challenges , to competing successfully in a globalised economy and to ensuring a comparative advantage vis - à - vis third countries . the pool of highly trained and qualified women is constantly growing as evidenced by the fact that 60 per cent of university graduates are female . a continued failure to draw on this pool in companies ' management positions and decision - making positions would amount to a failure to fully exploit skilled human capital .


### listed companies in the union should be imposed obligations of means providing for appropriate procedures with a view of meeting specific objectives regarding the gender composition of their boards . those listed companies in whose boards members of the under - represented sex hold less than 40 per cent of non - executive director positions should make the appointments to those positions on the basis of a comparative analysis of the qualifications of each candidate , by applying pre - established , clear , neutrally formulated and unambiguous criteria , in order to attain the said percentage at the latest by 1 january 2020 . therefore , the directive establishes the objective of at least 40 per cent of non - executive directors of the under - represented sex by that date . this objective in principle only concerns the overall gender diversity among the non - executive directors and does not interfere with the concrete choice of individual directors from a wide pool of male and female candidates in each individual case . in particular , it does not exclude any particular candidates for director positions , nor does it impose any individual directors on companies or shareholders . the decision on the appropriate board members thus remains with the companies and shareholders . ### listed companies in the union should aim to reach the objective of having at least 40 per cent of non - executive directors of the under - represented sex at the latest by 1 january 2020 . for the purpose of reaching this objective , those listed companies in whose boards members of the under - represented sex hold less than 40 per cent of non - executive director positions should carry out the pre - selection or selection procedure for appointments to those positions on the basis of a comparative analysis of the qualifications of each candidate , by applying pre - established , clear , neutrally formulated and unambiguous criteria .


### in order to attain the objective laid down in paragraph 1 , member states shall ensure that , in the selection of non - executive directors , priority shall be given to the candidate of the under - represented sex if that candidate is equally qualified as a candidate of the other sex in terms of suitability , competence and professional performance , unless an objective assessment taking account of all criteria specific to the individual candidates tilts the balance in favour of the candidate of the other sex . ### in order to attain the objective laid down in paragraph 1 , member states shall ensure that , in the selection of candidates , priority shall be given to the candidate of the under - represented sex if that candidate is equally qualified as a candidate of the other sex in terms of suitability , competence and professional performance , unless an objective assessment taking account of all criteria specific to the individual candidates tilts the balance in favour of the candidate of the other sex .


### this directive lays down measures to ensure a more balanced representation of men and women among the non - executive directors of listed companies by establishing measures aimed at accelerated progress towards gender balance while allowing companies sufficient time to make the necessary arrangements . ### this directive lays down measures to ensure a more balanced representation of men and women among the non - executive directors of listed companies by establishing effective measures aimed at accelerated progress towards equal representation of men and women while allowing companies sufficient time to conclude the necessary agreements .


### determining the number of non - executive director positions necessary to meet the objective requires further specification since for most board sizes it is mathematically possible only to go beyond or remain below the exact share of 40 per cent . therefore , the number of board positions necessary to meet the objective should be the number closest to 40 per cent . at the same time , in order to avoid discrimination of the initially over - represented sex , listed companies should not be obliged to appoint members of the under - represented sex to half or more of the non - executive board positions . thus , for example , members of the under - represented sex should hold at least one position on boards with three or four non - executive directors , at least two positions on boards with five or six non - executive directors , and at least three positions on boards with seven or eight non - executive directors . ### where the non - executive board consists of only three members , it is mathematically impossible to go beyond a share of 40 per cent for both genders . therefore , in such cases , members of the underrepresented sex should hold at least one position on boards with three non - executive directors .


### while some member states have taken regulatory action or encouraged self - regulation with mixed results , the majority of member states have not taken action or indicated their willingness to act in a way that would bring about sufficient improvement . projections based on a comprehensive analysis of all available information on past and current trends as well as intentions show that a balanced gender representation among non - executive board members across the union in line with the objectives set out in this directive will not be achieved by member states acting individually at any point in the foreseeable future . in the light of those circumstances and given the growing discrepancies between member states in terms of the representation of women and men on company boards , the gender balance on corporate boards across the union can only be improved through a common approach , and the potential for gender equality , competitiveness and growth can be better achieved through coordinated action at union level rather than through national initiatives of varying scope , ambition and effectiveness . since the objectives of this directive cannot be sufficiently achieved by the member states and can , therefore , by reason of the scale and effect of action , be better achieved at union level , the union may adopt measures in accordance with the principle of subsidiarity as set out in article 5 of the treaty on european union . ### while some member states have taken regulatory action or encouraged self - regulation with mixed results , the majority of member states have not taken action or indicated their willingness to act in a way that would bring about sufficient improvement in more gender balanced representation within companies at all levels . as these aims will not be achieved by member states acting individually and given the growing discrepancies between member states in terms of the representation of women and men within companies , the gender balance across the union can be more effectively improved through a common approach , and the potential for gender equality , competitiveness and growth can be better achieved through coordinated action at union level rather than through national initiatives of varying scope , ambition and effectiveness . since the objectives of this directive cannot be sufficiently achieved by the member states and can , therefore , by reason of the scale and effect of action , be better achieved at union level , the union may adopt measures in accordance with the principle of subsidiarity as set out in article 5 of the treaty on european union .


### member states shall lay down rules on sanctions applicable to infringements of the national provisions adopted pursuant to this directive and shall take all necessary measures to ensure that they are applied . ### member states shall lay down rules on sanctions applicable to infringements of the requirements for an open and transparent procedure set out in article 4 and shall take all necessary measures to ensure that they are applied .


### where a listed company does not meet the objectives laid down in article 4 or its own individual commitments taken pursuant to paragraph 1 of this article , the information referred to in paragraph 2 of this article shall include the reasons for not reaching the objectives or commitments and a description of the measures which the company has adopted or intends to adopt in order to meet the objectives or commitments . ### where a listed company does not meet the objectives laid down in article 4 or its own individual commitments taken pursuant to paragraph 1 of this article , it shall provide a statement of the reasons for not reaching the objectives or commitments and a description of the measures which the company has adopted or intends to adopt in order to meet the objectives or commitments . that explanation shall form part of the information referred to in paragraph 2 .


### member states should provide for effective , proportionate and dissuasive sanctions for breaches of this directive , which could include , inter alia , administrative fines and nullity or annulment declared by a judicial body of the appointment or of the election of non - executive directors made contrary to the national provisions adopted pursuant to article 4 . ### member states should provide for effective , proportionate and persuasive incentives for these requirements , which could include , inter alia , award schemes for companies with outstanding results .


### the sanctions must be effective , proportionate and dissuasive and may include the following measures : ### the member states shall ensure that there is annual disclosure of the gender balance on the governing bodies of listed undertakings which are not exempted under article 3 .