### the types of financing and the methods of implementation under this regulation should be chosen on the basis of their ability to achieve the specific objectives of the actions and to deliver results , taking into account , in particular , the costs of controls , the administrative burden , and the expected risk of non - compliance . this should include consideration of the use of lump sums , flat rates and unit costs , as well as financing not linked to costs as referred to in article 125 of the financial regulation . in accordance with the financial regulation , regulation no 883 / 2013 of the european parliament and of the council20 council regulation no 2988 / 9521 council regulation no 2185 / 9622 and council regulation 2017 / 193923 the financial interests of the union are to be protected through proportionate measures , including the prevention , detection , correction and investigation of irregularities and fraud , the recovery of funds lost , wrongly paid or incorrectly used and , where appropriate , the imposition of administrative sanctions . in particular , in accordance with regulation no 883 / 2013 and regulation no 2185 / 96 the european anti - fraud office may carry out administrative investigations , including on - the - spot checks and inspections , with a view to establishing whether there has been fraud , corruption or any other illegal activity affecting the financial interests of the union . in accordance with regulation 2017 / 1939 , the european public prosecutor’s office may investigate and prosecute fraud and other criminal offences affecting the financial interests of the union as provided for in directive 2017 / 1371 of the european parliament and of the council24 . in accordance with the financial regulation , any person or entity receiving union funds is to fully cooperate in the protection of the union’s financial interests , to grant the necessary rights and access to the commission , olaf , the eppo and the european court of auditors and to ensure that any third parties involved in the implementation of union funds grant equivalent rights . __________________ 20 regulation no 883 / 2013 of the european parliament and of the council of 11 september 2013 concerning investigations conducted by the european anti - fraud office and repealing regulation no 1073 / 1999 of the european parliament and of the council and council regulation no 1074 / 1999 , no 2988 / 95 of 18 december 1995 on the protection of the european communities financial interests . 22 council regulation no 2185 / 96 of 11 november 1996 concerning on - the - spot checks and inspections carried out by the commission in order to protect the european communities’ financial interests against fraud and other irregularities . 23 council regulation 2017 / 1939 of 12 october 2017 implementing enhanced cooperation on the establishment of the european public prosecutor’s office . 24 directive 2017 / 1371 of the european parliament and of the council of 5 july 2017 on the fight against fraud to the union’s financial interests by means of criminal law . ### the types of financing and the methods of implementation under this regulation should be chosen on the basis of their ability to achieve the specific objectives of the actions and to deliver results , taking into account , in particular , the costs of controls , the administrative burden , the size and capacity of relevant stakeholders and targeted beneficiaries , and the expected risk of non - compliance . this should include consideration of the use of lump sums , flat rates , unit costs and cascading grants , as well as co - funding criteria which take into account volunteer work and financing not linked to costs as referred to in article 125 of the financial regulation . co - funding requirements should be accepted in kind and may be waived in cases of limited complementary funding . in accordance with the financial regulation , regulation no 883 / 2013 of the european parliament and of the council20 council regulation no 2988 / 9521 council regulation no 2185 / 9622 and council regulation 2017 / 193923 the financial interests of the union are to be protected through proportionate measures , including the prevention , detection , correction and investigation of irregularities and fraud , the recovery of funds lost , wrongly paid or incorrectly used and , where appropriate , the imposition of administrative sanctions . in particular , in accordance with regulation no 883 / 2013 and regulation no 2185 / 96 the european anti - fraud office may carry out administrative investigations , including on - the - spot checks and inspections , with a view to establishing whether there has been fraud , corruption or any other illegal activity affecting the financial interests of the union . in accordance with regulation 2017 / 1939 , the european public prosecutor’s office may investigate and prosecute fraud and other criminal offences affecting the financial interests of the union as provided for in directive 2017 / 1371 of the european parliament and of the council24 . in accordance with the financial regulation , any person or entity receiving union funds is to fully cooperate in the protection of the union’s financial interests , to grant the necessary rights and access to the commission , olaf , the eppo and the european court of auditors and to ensure that any third parties involved in the implementation of union funds grant equivalent rights . __________________ 20 regulation no 883 / 2013 of the european parliament and of the council of 11 september 2013 concerning investigations conducted by the european anti - fraud office and repealing regulation no 1073 / 1999 of the european parliament and of the council and council regulation no 1074 / 1999 , no 2988 / 95 of 18 december 1995 on the protection of the european communities financial interests . 22 council regulation no 2185 / 96 of 11 november 1996 concerning on - the - spot checks and inspections carried out by the commission in order to protect the european communities’ financial interests against fraud and other irregularities . 23 council regulation 2017 / 1939 of 12 october 2017 implementing enhanced cooperation on the establishment of the european public prosecutor’s office . 24 directive 2017 / 1371 of the european parliament and of the council of 5 july 2017 on the fight against fraud to the union’s financial interests by means of criminal law .


### the general objective of the programme is to protect and promote rights and values as enshrined in the eu treaties , including by supporting civil society organisations , in order to sustain open , democratic and inclusive societies . ### the general objective of the programme is to protect and promote rights and values as enshrined in the treaties , including democracy , the rule of law and fundamental rights as enshrined in article 2 teu , in particular by supporting and building the capacity of civil society organisations at local , regional , national and transnational level , in order to sustain open , rights - based , democratic , equal and inclusive societies .


### within the specific objective set out in point of article 2 , the programme shall focus on : ### within the general objective set out in article 2 and within the specific objective set out in point of article 2 , the programme shall focus on :


### preventing and combating inequalities and discrimination on grounds of sex , racial or ethnic origin , religion or belief , disability , age or sexual orientation , and supporting comprehensive policies to promote gender equality and anti - discrimination and their mainstreaming as well policies to combat racism and all forms of intolerance ; ### preventing and combating inequalities and discrimination on grounds of sex , gender , racial , social , cultural or ethnic origin , religion or belief , disability , age or sexual orientation , and supporting comprehensive policies to promote gender equality and anti - discrimination and their mainstreaming as well policies to combat racism , xenophobia , homophobia and all other forms of intolerance ;


### eur [ 408 . 705 . 000 ] for the specific objectives referred to in article 2 and 2 ; ### eur [ 474 . 457 . 000 ] for the specific objectives referred to in points and of article 2 ;


### eur [ 233 . 000 . 000 ] for the specific objective referred to in article 2 ; ### eur [ 500 . 000 . 000 ] for the specific objective referred to in point of article 2 ;


### resources allocated to member states under shared management may , at their request , be transferred to the programme . the commission shall implement those resources directly in accordance with article 62 of the financial regulation or indirectly in accordance with article 62 . where possible those resources shall be used for the benefit of the member state concerned . ### resources allocated to member states under shared management may , at their request , or at the commission ' s request , be transferred to the programme . the commission shall implement those resources directly in accordance with article 62 of the financial regulation . where possible , those resources shall be used for the benefit of the member state concerned .


### the programme shall be implemented in direct management in accordance with the financial regulation or in indirect management with bodies referred to in article 61 of the financial regulation . ### the programme shall be implemented in direct management in accordance with the financial regulation or in indirect management with bodies referred to in point of article 62 of the financial regulation .


### actions contributing to the achievement of a specific objective specified in article 2 may receive funding under this regulation . in particular , activities listed in annex i shall be eligible for funding . ### actions contributing to the achievement of a specific objective specified in article 2 may receive funding under this regulation . in particular the following activities shall be eligible for funding : awareness raising , creative actions , educational activities and dissemination of information to improve the use and knowledge of the policies and rights in the areas covered by the programme ; mutual learning through exchange of good practices among stakeholders to improve civic and democratic engagement based on knowledge and mutual understanding ; and advocacy , creative , analytical and monitoring activities1a to improve the understanding of the situation in the member states and at union level in the areas covered by the programme as well as to improve the implementation of union law and policies ; training relevant stakeholders to improve their awareness , ability to use and knowledge of the policies and rights in the fields covered ; information and communication technology tools development and maintenance accessible for all ; strengthening citizen ' s awareness of european culture , values , history and remembrance as well as their sense of solidarity belonging to the union ; bringing together europeans of different nationalities and cultures by giving them the opportunity to participate in twinning activities , including town - twinning activities ; encouraging and facilitating active inclusive participation and public mobilization in the construction of a more democratic union as well as use of and awareness of rights and values through support to civil society organisations ; financing the technical and organisational support to implement regulation no 211 / 2011 , thereby underpinning the exercise by citizens of the right to launch and support european citizens ' initiatives ; developing the capacity of european networks to promote , apply and further develop union law , policy goals and strategies as well as supporting civil society organisations of all sizes active in the areas covered by the programme ; enhancing knowledge of the programme and dissemination and transferability of its results and fostering citizen outreach , including by setting up and supporting programme desks / national contact networks . ______________________ 1athese activities include for instance the collection of data and statistics ; the development of common methodologies and , where appropriate , indicators or benchmarks ; studies , researches , analyses and surveys ; evaluations ; impact assessment ; the elaboration and publication of guides , reports and educational material .


### actions contributing to the achievement of a specific objective specified in article 2 may receive funding under this regulation . in particular , activities listed in annex i shall be eligible for funding . ### actions contributing to the achievement of a general or specific objective specified in article 2 may receive funding under this regulation . in particular , activities listed in article 9 a ( shall be eligible for funding .


### grants under the programme shall be awarded and managed in accordance with title viii of the financial regulation . ### grants under the programme shall be awarded and managed in accordance with title viii of the financial regulation and shall include action grants , multiannual operating grants and cascading grants .


### —a third country associated to the programme ; ### —for the specific objectives referred to in points and of article 2 , a third country associated to the programme ;


### indicators to report on progress of the programme towards the achievement of the specific objectives set out in article 2 are set out in annex ii . ### indicators to report on progress of the programme towards the achievement of the specific objectives set out in article 2 shall , where applicable , be collected disaggregated by gender . the list of indicators are set out in annex ii .


### the performance reporting system shall ensure that data for monitoring programme implementation and results are collected efficiently , effectively , and in a timely manner . to that end , proportionate reporting requirements shall be imposed on recipients of union funds and member states . ### the performance reporting system shall ensure that data for monitoring programme implementation and results , are conceived and collected efficiently , effectively , and in a timely manner , that the allocation of funds for specific projects is reflected accurately and that the synergies created between funding programmes are properly evidenced . participation of the entities involved in the programme shall be ensured to that end . proportionate reporting and least burdensome requirements shall be imposed on recipients of union funds and member states .


### the performance reporting system shall ensure that data for monitoring programme implementation and results are collected efficiently , effectively , and in a timely manner . to that end , proportionate reporting requirements shall be imposed on recipients of union funds and member states . ### the performance reporting system shall ensure that data for monitoring programme implementation and results are collected efficiently , effectively , and in a timely manner . to that end , proportionate and least burdensome reporting requirements shall be imposed on recipients of union funds and member states . in order to facilitate reporting requirements being met , the commission shall make available user - friendly formats and provide orientation and support programmes particularly targeted to civil society organisations , who may not always have the know - how and adequate resources and staff to meet reporting requirements .


### evaluations shall be carried out in a timely manner to feed into the decision - making process . ### evaluations shall be gender mainstreamed , include a specific chapter for each strand and be carried out in a timely manner to feed into the decision - making process .


### the interim evaluation of the programme shall be performed once there is sufficient information available about the implementation of the programme , but no later than four years after the start of the programme implementation . the mid - term evaluation shall take into account the results of the evaluations of the long - term impact of the predecessor programmes . ### the interim evaluation of the programme shall be performed once there is sufficient information available about the implementation of the programme , but no later than four years after the start of the programme implementation . the interim evaluation shall take into account the results of the evaluations of the long - term impact of the predecessor programmes .


### the commission shall communicate the conclusions of the evaluations accompanied by its observations , to the european parliament , the council , the european economic and social committee and the committee of the regions . ### the commission shall communicate the conclusions of the evaluations accompanied by its observations , to the european parliament , the council , the european economic and social committee and the committee of the regions . the commission shall make the evaluation public by publishing it on its website .


### before adopting a delegated act , the commission shall consult experts designated by each member state in accordance with the principles laid down in the interinstitutional agreement on better law - making of 13 april 2016 . ### before adopting a delegated act , the commission shall consult experts designated by each member state in accordance with the principles laid down in the interinstitutional agreement of 13 april 2016 on better law - making . the composition of the group of experts consulted shall ensure gender balance . when preparing and drawing up delegated acts , the commission shall ensure a timely and simultaneous transmission of all documents , including the draft acts , to the european parliament and the council at the same time as to member states ' experts . where they consider this necessary , the european parliament and the council may each send experts to meetings of the commission expert groups dealing with the preparation of delegated acts to which member states ' experts are invited . to that end , the european parliament and the council shall receive the planning for the following months and invitations for all experts meetings .


### as soon as it adopts a delegated act , the commission shall notify it simultaneously to the european parliament and to the council . ### as soon as it adopts a delegated act , the commission shall notify it simultaneously to the european parliament and to the council . based on the interinstitutional agreement of 13 april 2016 on better law - making , citizens and other stakeholders may express their opinion on the draft text of a delegated act during a four - week period . the european economic and social committee and the committee of regions shall be consulted on the draft text , based on the experience of ngos and local and regional authorities with respect to the implementation of the programme .


### bringing together europeans of different nationalities and cultures by giving them the opportunity to participate in town - twinning activities ; ### bringing together citizens of different nationalities and cultures by giving them the opportunity to participate in meetings , town - twinning activities , small scale and civil society projects , thus creating the conditions for a stronger bottom - up approach , aimed at shaping the union’s political agenda ;


### encouraging and facilitating active participation in the construction of a more democratic union as well as awareness of rights and values through support to civil society organisations ### encouraging and facilitating active and inclusive participation , with particular attention to marginalised groups of society , in the construction of a more democratic union , by promoting , inter alia , the use of e - democracy tools and the european citizens ' initiative ; raising awareness of promoting and defending rights and values through support to civil society organisations ;


### the programme will be monitored on the basis of a set of indicators intended to measure the extent to which the general and specific objectives of the programme have been achieved and with a view to minimising administrative burdens and costs . to that end , data will be collected as regards the following set of key indicators : ### the programme will be monitored on the basis of a set of result indicators intended to measure the extent to which the general and specific objectives of the programme have been achieved and with a view to minimising administrative burdens and costs . to that end , data will be collected as regards the following set of key indicators :


### the right to respect for his or her private and family life , home and communications is a fundamental right enshrined in article 7 of the charter of fundamental rights . the protection of personal data is a fundamental right enshrined in article 8 of the charter of fundamental rights and article 16 of the treaty on the functioning of the european union . compliance with the rules for the protection of personal data is subject to the control by independent supervisory authorities . the unions’ legal framework , in particular regulation 2016 / 679 of the european parliament and of the council12 and directive 2016 / 680 of the european parliament and of the council13 lay down provisions to ensure that the right to protection of personal data is effectively protected . these legal instruments entrust the national data protection supervisory authorities with the task of promoting public awareness and understanding of the risks , rules , safeguards and rights in relation to the processing of personal data . the union should be able to conduct awareness - raising activities , carry out studies and other relevant activities given the importance of the right to the protection of personal data in times of rapid technological developments . _________________ 12 oj l 119 , 4 . 5 . 2016 , p . 1 - 88 . 13 oj l 119 , 4 . 5 . 2016 , p . 89 - 131 . ### the right to respect for his or her private and family life , home and communications is a fundamental right enshrined in article 7 of the charter of fundamental rights . the protection of personal data is a fundamental right enshrined in article 8 of the charter of fundamental rights and article 16 of the treaty on the functioning of the european union . compliance with the rules for the protection of personal data is subject to the control by independent supervisory authorities . the unions’ legal framework , in particular regulation 2016 / 679 of the european parliament and of the council12 and directive 2016 / 680 of the european parliament and of the council13 lay down provisions to ensure that the right to protection of personal data is effectively protected . these legal instruments entrust the national data protection supervisory authorities with the task of promoting public awareness and understanding of the risks , rules , safeguards and rights in relation to the processing of personal data . the union should be able to conduct awareness - raising activities , support civil society organisations in advocating for data protection in line with union standards , carry out studies and other relevant activities given the importance of the right to the protection of personal data in times of rapid technological developments . _________________ 12 oj l 119 , 4 . 5 . 2016 , p . 1 - 88 . 13 oj l 119 , 4 . 5 . 2016 , p . 89 - 131 .


### the general objective of the programme is to protect and promote rights and values as enshrined in the eu treaties , including by supporting civil society organisations , in order to sustain open , democratic and inclusive societies . ### the general&#160 ; objective of the programme is to protect and promote rights and values as&#160 ; enshrined in the treaties , including democracy , the rule of law and fundamental&#160 ; rights as enshrined in article 2 teu , in particular by supporting and&#160 ; building the capacity of civil society organisations at&#160 ; local , regional , national and transnational level , in order to&#160 ; sustain open , rights - based , democratic , equal and inclusive societies .


### preventing and combating inequalities and discrimination on grounds of sex , racial or ethnic origin , religion or belief , disability , age or sexual orientation , and supporting comprehensive policies to promote gender equality and anti - discrimination and their mainstreaming as well policies to combat racism and all forms of intolerance ; ### preventing&#160 ; and combating inequalities and discrimination on grounds of sex , racial , &#160 ; social or ethnic origin , religion or belief , disability , age , &#160 ; language or sexual orientation , and supporting comprehensive policies&#160 ; to promote gender equality and anti - discrimination and their mainstreaming as&#160 ; well policies to combat racism and all forms of intolerance ;


### within the specific objective set out in point of article 2 , the programme shall focus on : ### within the general objective set out in article 2 and within the specific objective set out in point of article 2 , the programme shall focus on :


### actions contributing to the achievement of a specific objective specified in article 2 may receive funding under this regulation . in particular , activities listed in annex i shall be eligible for funding . ### actions contributing to the achievement of a general or specific objective specified in article 2 may receive funding under this regulation . in particular , activities listed in article 9 a ( shall be eligible for funding .


### the evaluation committee may be composed of external experts . ### the evaluation committee may be composed of external experts . the composition of the evaluation committee shall ensure gender balance .


### indicators to report on progress of the programme towards the achievement of the specific objectives set out in article 2 are set out in annex ii . ### indicators&#160 ; to report on progress of the programme towards the achievement of the&#160 ; specific objectives set out in article 2 shall , where applicable , be collected&#160 ; disaggregated by gender , age , educational background , occupation and other relevant factors . the list of indicators are set out in annex&#160 ; ii .


### the structural reform support programme was established with the objective of strengthening the capacity of member states to prepare and implement growth - sustaining administrative and structural reforms , including through assistance for the efficient and effective use of the union funds . support under the programme is provided by the commission , upon request by a member state , and can cover a wide range of policy areas . developing resilient economies built on strong economic and social structures , which allow member states to efficiently absorb shocks and swiftly recover from them , contributes to economic and social cohesion . the implementation of institutional , administrative and growth - sustaining structural reforms is an appropriate tool for achieving such a development . ### the structural reform support programme was established with the objective of strengthening the capacity of member states to prepare and implement growth - sustaining administrative and inclusive structural reforms , including through assistance for the efficient and effective use of the union funds and to develop comprehensive and sustainable inclusion policies . support under the programme is provided by the commission , upon request by a member state , and can cover a wide range of policy areas . developing resilient economies built on strong economic and social structures , which allow member states to efficiently absorb shocks and swiftly recover from them , contributes to economic and social cohesion . the implementation of institutional , administrative and sustainable structural reforms is an appropriate tool for achieving such a development . it is important that structural reforms are backed by democratic support , making the involvement of partners from local and regional authorities , economic and social partners and representatives of civil society unavoidable .


### strengthening economic and social cohesion by reinforcing structural reforms is crucial for successful participation in the economic and monetary union . that is particularly important for member states whose currency is not the euro , in their preparation to join the euro area . ### strengthening economic and social cohesion is crucial for successful participation in the economic and monetary union , including for member states wishing to join the euro area .


### it is thus appropriate to stress in the general objective of the programme – within its contribution towards responding to economic and social challenges – that enhancing cohesion , competitiveness , productivity , sustainable growth , and job creation should also contribute to the preparations for future participation in the euro area by those member states whose currency is not the euro . ### it is thus appropriate to stress in the general objective of the programme – within its contribution towards responding to economic and social challenges – that enhancing cohesion , competitiveness , productivity , sustainable and inclusive growth , and job creation should also contribute to convergence in and outside the euro area .


### the general objective of the programme shall be to contribute to institutional , administrative and growth - sustaining structural reforms in the member states by providing support to national authorities for measures aimed at reforming and strengthening institutions , governance , public administration , and economic and social sectors in response to economic and social challenges , with a view to enhancing cohesion , competitiveness , productivity , sustainable growth , job creation , and investment , which will also prepare for participation in the euro area , in particular in the context of economic governance processes , including through assistance for the efficient , effective and transparent use of the union funds . ; ### the general objective of the programme shall be to contribute to institutional , administrative and growth - sustaining and inclusive structural reforms in the member states by providing support to national authorities for measures aimed at reforming and strengthening institutions , governance , public administration , and economic and social sectors in response to economic and social challenges , with a view to enhancing cohesion , competitiveness , productivity , sustainable and inclusive growth , job creation , investment , and convergence in and outside the euro area , in particular in the context of economic governance processes , including through assistance for the efficient , effective and transparent use of the union funds . ;


### the use of pesticides , should be significantly restricted . preference should be given to the application of measures that prevent any damage by pests and weeds through techniques which do not involve the use of plant protection products such as crop rotation . presence of pests and weeds should be monitored to decide whether any intervention is economically and ecologically justified . the use of certain plant protection products should be allowed if such techniques do not provide adequate protection and only if those plant protection products have been authorised in accordance with regulation no 1107 / 2009 of the european parliament and of the council28 , after having been assessed to be compatible with objectives and principles of organic production , including with restrictive conditions of use , and consequently authorised in accordance with this regulation . __________________ 28 regulation no 1107 / 2009 of the european parliament and of the council of 21 october 2009 concerning the placing of plant protection products on the market and repealing council directives 79 / 117 / eec and 91 / 414 / eec . ### the use of pesticides , should be prohibited for the purposes of organic production . preference should be given to the application of measures that prevent any damage by pests and weeds through techniques which do not involve the use of plant protection products such as crop rotation . presence of pests and weeds should be monitored to decide whether any intervention is economically and ecologically justified . the use of certain plant protection products should be allowed if such techniques do not provide adequate protection and only if those plant protection products have been authorised in accordance with regulation no 1107 / 2009 of the european parliament and of the council28 , after having been assessed to be compatible with objectives and principles of organic production , including with restrictive conditions of use , and consequently authorised in accordance with this regulation . __________________ 28 regulation no 1107 / 2009 of the european parliament and of the council of 21 october 2009 concerning the placing of plant protection products on the market and repealing council directives 79 / 117 / eec and 91 / 414 / eec .


### organic production is based on the general principle of restriction of the use of external inputs . farmers are required to take measures to prevent the risk of contamination by non - authorised products or substances . despite such measures , there may be instances where farmers are prevented from marketing their agricultural products as organic due to the unintentional presence of non - authorised products or substances . it is therefore appropriate to provide for the possibility whereby member states may , in accordance with article 42 of the treaty , be authorised by the commission to grant national payments to compensate for the losses incurred in such instances . member states may also use the instruments of the common agricultural policy to cover totally or partially such losses . ### member states should ensure that losses organic farmers incur due to unintended contaminations are adequately covered . where the origin of contamination can be traced , member states are to apply the polluter - pays principle .


### this regulation establishes the principles of organic production and lays down the rules concerning organic production and the use of indications referring thereto in labelling and advertising . ### this regulation establishes the principles of organic production and its control and certification and lays down the rules concerning organic production and its control and the use of indications referring thereto in labelling and advertising . it provides the basis for sustainable and dynamic development of organic production and its positive effects on the environment and public health , while ensuring the effective functioning of the internal market , and ensuring consumer confidence .


### mass catering operations carried out by a mass caterer as defined in point of article 2 of regulation no 1169 / 2011 of the european parliament and of the council35 shall not be subject to this regulation . __________________ 35 regulation no 1169 / 2011 of the european parliament and of the council of 25 october 2011 on the provision of food information to consumers , amending regulations no 1924 / 2006 and no 1925 / 2006 of the european parliament and of the council , and repealing commission directive 87 / 250 / eec , council directive 90 / 496 / eec , commission directive 1999 / 10 / ec , directive 2000 / 13 / ec of the european parliament and of the council , commission directives 2002 / 67 / ec and 2008 / 5 / ec and commission regulation no 608 / 2004 . ### mass catering operations for the provision of organic food products and preparations carried out by a mass caterer as defined in point of article 2 of regulation no 1169 / 2011 of the european parliament and of the council35 shall not be subject to this regulation __________________ 35 regulation no 1169 / 2011 of the european parliament and of the council of 25 october 2011 on the provision of food information to consumers , amending regulations no 1924 / 2006 and no 1925 / 2006 of the european parliament and of the council , and repealing commission directive 87 / 250 / eec , council directive 90 / 496 / eec , commission directive 1999 / 10 / ec , directive 2000 / 13 / ec of the european parliament and of the council , commission directives 2002 / 67 / ec and 2008 / 5 / ec and commission regulation no 608 / 2004 .


### ‘ agricultural raw material’ means an agricultural product that has not been subjected to any operation of preservation or processing ; ### ‘ agricultural raw material’ means an agricultural product that has not been subjected to any operation of processing , preparation or preservation ;


### ‘ preventive measures’ means measures to be taken in order to ensure soil quality as well as prevention and control of pests and weeds , and to prevent contamination with products or substances that are not authorised under this regulation ; ### ‘ preventive measures’ means measures to be taken in order to ensure soil quality and fertility , preservation of biodiversity as well as prevention and control of pests , diseases and weeds , and to prevent contamination with products or substances that are not authorised under this regulation at all stages of production , preparation and distribution ;


### ‘ conversion’ means the transition from non - organic to organic production within a given period of time ; ### ‘ conversion’ means the transition from non - organic to organic farming within a given period of time , during which the provisions concerning the organic production are applied ;


### ‘ ionising radiation’ means ionising radiation as defined in article 1 of council directive 96 / 29 / euratom47 . __________________ 47 council directive 96 / 29 / euratom of 13 may 1996 laying down basic safety standards for the protection of the health of workers and the general public against the dangers arising from ionizing radiation . ### ‘ ionising radiation’ means ionising radiation as defined in article 1 of council directive 96 / 29 / euratom47 and as regulated by directive 1999 / 2 / ec47a ; __________________ 47 council directive 96 / 29 / euratom of 13 may 1996 laying down basic safety standards for the protection of the health of workers and the general public against the dangers arising from ionizing radiation . 47a directive 1999 / 2 / ec of the european parliament and of the council of 22 february 1999 on the approximation of the laws of the member states concerning foods and food ingredients treated with ionising radiation


### principles of organic production ### objectives and principles of organic production


### organic production is a sustainable management system for agriculture that is based on the following general principles : ### organic production is a sustainable management system that is based on the following general principles :


### practice land - related crop cultivation and livestock production or practice aquaculture which complies with the principle of sustainable exploitation of fisheries ; ### practice soil bound crop cultivation and / or land related livestock production within the farm ecosystem which complies with preventive measures such as : - soil protection and cover against wind and water erosion , - crop rotation , - use of seeds and animals with a high degree of resistance against diseases , or practice sustainable aquaculture ;


### exclusion of genetic engineering , animal cloning , artificially induced polyploidy and ionising radiation from the whole organic food chain ; ### exclusion of genetic engineering , animal cloning , artificially induced polyploidy and ionising radiation and the use of antibiotics from the whole organic food chain ;


### the authorisation of the use of chemically synthesised products or substances shall be strictly limited to cases where the use of external inputs referred to in article 4 would contribute to unacceptable environmental impacts . ### the authorisation of products and substances from other categories as mentioned under article 4 for application as mentioned in paragraph 1 of this article shall be strictly limited to cases where the use of external inputs referred to in article 4 would contribute to unacceptable impacts to the environment , animal or human health or product quality .


### the commission shall adopt implementing acts authorising or withdrawing the authorisation of products and substances that may be used in organic production in general and products and substances that may be used in the production of processed organic food in particular , and establishing the procedures to be followed for the authorisation and the lists of those products and substances and , where appropriate , their description , compositional requirements and conditions for use . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 37 . ### the commission shall be empowered to adopt delegated acts in accordance with article 36 authorising or withdrawing the authorisation of products and substances that may be used in organic production in general and products and substances that may be used in the production of processed organic food in particular , and establishing the procedures to be followed for the authorisation and the lists of those products and substances and , where appropriate , their description , compositional requirements and conditions for use .


### equine animals shall have access to pasturage for grazing whenever conditions allow ; ### equine animals shall have access to pasturage for grazing whenever conditions allow . at all other times , horses should have access to roughage ;


### rearing systems for equine animals shall be based on maximum use of grazing pasturage according to the availability of pastures in the different periods of the year . at least 60 % of the dry matter in daily rations of equine animals shall consist of roughage , fresh or dried fodder , or silage ; ### rearing systems for equine animals shall be based on maximum use of grazing pasturage according to the availability of pastures in the different periods of the year . where higher percentages of roughage are not possible , the following minimum rules shall apply whilst respecting the nutrition , health and welfare requirements of the breeds : at least 60 % of the dry matter in daily rations of equine animals shall consist of roughage , fresh or dried fodder , or silage ;


### housing of equine animals shall have smooth , but not slippery floors . at least half of the indoor surface area as specified in the table on minimum surface areas for equine animals set out in point 2 . 2 . 4 . , shall be solid , that is , not of slatted or of grid construction ; ### housing of equine animals shall have smooth , but not slippery floors . the entire indoor surface area as specified in the table on minimum surface areas for equine animals set out in point 2 . 2 . 4 . , shall be solid , that is , not of slatted or of grid construction ;


### housing of porcine animals shall have smooth , but not slippery floors . at least half of the indoor surface area as specified in the table on minimum surface areas for porcine animals set out in point 2 . 3 . 4 . , shall be solid , that is , not of slatted or of grid construction ; ### housing of porcine animals shall have smooth , but not slippery floors . the entire indoor surface / floor area as specified in the table on minimum surface areas for porcine animals set out in point 2 . 3 . 4 . , shall be solid , that is , not of slatted or of grid construction ;


### where poultry are kept indoors due to restrictions or obligations imposed on the basis of union legislation , they shall permanently have access to sufficient quantities of roughage and suitable material in order to meet their ethological needs . ### where poultry are kept indoors , including due to restrictions imposed due to bad weather conditions or obligations imposed on the basis of union legislation , they shall have access to a veranda as well as permanently have access to sufficient quantities of roughage and suitable material in order to meet their ethological needs .


### the use of network and information systems by citizens , businesses and governments across the union is now pervasive . digitisation and connectivity are becoming core features in an ever growing number of products and services and with the advent of the internet of things millions , if not billions , of connected digital devices are expected to be deployed across the eu during the next decade . while an increasing number of devices are connected to the internet , security and resilience are not sufficiently built in by design , leading to insufficient cybersecurity . in this context , the limited use of certification leads to insufficient information for organisational and individual users about the cybersecurity features of ict products and services , undermining trust in digital solutions . ### the use of network and information systems by citizens , businesses and governments across the union is now pervasive . digitisation and connectivity are becoming core features in an ever growing number of products and services and with the advent of the internet of things millions , if not billions , of connected digital devices are expected to be deployed across the eu during the next decade . while an increasing number of devices are connected to the internet , security and resilience are not sufficiently built in by design , leading to insufficient it security . in this context , the limited and fragmented use of certification leads to insufficient information for organisations and individual users about the it security features of ict products and services , undermining trust in digital solutions . ict networks provide the backbone for digital products and services which have the potential to support all aspects of citizens’ lives and drive europe’s economic growth . to ensure that the objectives of the digital single market are fully achieved , the essential technological building blocks on which important areas such as e - health , iot , artificial intelligence , quantum technology as well as intelligent transport systems and advanced manufacturing rely , must be in place .


### cyber - attacks are on the increase and a connected economy and society that is more vulnerable to cyber threats and attacks requires stronger defences . however , while cyber - attacks are often cross - border , policy responses by cybersecurity authorities and law enforcement competences are predominantly national . large - scale cyber incidents could disrupt the provision of essential services across the eu . this requires effective eu level response and crisis management , building upon dedicated policies and wider instruments for european solidarity and mutual assistance . moreover , a regular assessment of the state of cybersecurity and resilience in the union , based on reliable union data , as well as systematic forecast of future developments , challenges and threats , both at union and global level , is therefore important for policy makers , industry and users ### cyber - attacks are on the increase and a connected economy and society that is more vulnerable to cyber threats and attacks requires stronger and more secure defences . however , while cyber - attacks are often cross - border , policy responses by it security authorities and law enforcement competences are predominantly national . large - scale cyber incidents could disrupt the provision of essential services across the eu . this requires effective eu level response and crisis management , building upon dedicated policies and wider instruments for european solidarity and mutual assistance . moreover , a regular assessment of the state of it security and resilience in the union , based on reliable union data , as well as systematic forecast of future developments , challenges and threats , both at union and global level , is therefore important for policy makers , industry and users .


### in light of the increased cybersecurity challenges faced by the union , there is a need for a comprehensive set of measures that would build on previous union action and foster mutually reinforcing objectives . these include the need to further increase capabilities and preparedness of member states and businesses , as well as to improve cooperation and coordination across member states and eu institutions , agencies and bodies . furthermore , given the borderless nature of cyber threats , there is a need to increase capabilities at union level that could complement the action of member states , in particular in the case of large scale cross - border cyber incidents and crises . additional efforts are also needed to increase awareness of citizens and businesses on cybersecurity issues . moreover , the trust in the digital single market should be further improved by offering transparent information on the level of security of ict products and services . this can be facilitated by eu - wide certification providing common cybersecurity requirements and evaluation criteria across national markets and sectors . ### in light of the increased it security challenges faced by the union , there is a need for a comprehensive set of measures that would build on previous union action and foster mutually reinforcing objectives . these include the need to further increase capabilities and preparedness of member states and businesses , as well as to improve cooperation and coordination across member states and eu institutions , agencies and bodies . furthermore , given the borderless nature of cyber threats , there is a need to increase capabilities at union level that could complement the action of member states , in particular in the case of large scale cross - border cyber incidents and crises . additional efforts are also needed to deliver a coordinated eu response and increase awareness of citizens and businesses on it security issues . moreover , the trust in the digital single market should be further improved by offering transparent information on the level of security of ict products and services . this can be facilitated by eu - wide certification providing common it security requirements and evaluation criteria across national markets and sectors . alongside union - wide certification , there is a range of voluntary measures widely accepted in the market place , depending on the product , service , use or standard . these measures as well as the industry bottom up approach , including the use of security - by - design , leveraging and contributing to international standards , should be encouraged .


### the union has already taken important steps to ensure cybersecurity and increase trust in digital technologies . in 2013 , an eu cybersecurity strategy was adopted to guide the union ' s policy response to cybersecurity threats and risks . in its effort to better protect europeans online , in 2016 the union adopted the first legislative act in the area of cybersecurity , the directive 2016 / 1148 concerning measures for a high common level of security of network and information systems across the union . the nis directive put in place requirements concerning national capabilities in the area of cybersecurity , established the first mechanisms to enhance strategic and operational cooperation between member states , and introduced obligations concerning security measures and incident notifications across sectors which are vital for economy and society such as energy , transport , water , banking , financial market infrastructures , healthcare , digital infrastructure as well as key digital service providers . a key role was attributed to enisa in supporting implementation of this directive . in addition , effective fight against cybercrime is an important priority in the european agenda on security , contributing to the overall aim of achieving a high level of cybersecurity . ### the union has already taken important steps to ensure it security and increase trust in digital technologies . in 2013 , an eu cybersecurity strategy was adopted to guide the union ' s policy response to it security threats and risks . in its effort to better protect europeans online , in 2016 the union adopted the first legislative act in the area of it security , the directive 2016 / 1148 concerning measures for a high common level of security of network and information systems across the union . the nis directive fulfils the digital single market strategy and together with other instruments , such as directive . . . / . . . [ establishing the european electronic communications code ] , regulation 2016 / 679 of the european parliament and of the council1a and directive 2002 / 58 / ec of the european parliament and of the council1b , puts in place requirements concerning national capabilities in the area of it security , established the first mechanisms to enhance strategic and operational cooperation between member states , and introduced obligations concerning security measures and incident notifications across sectors which are vital for economy and society such as energy , transport , water , banking , financial market infrastructures , healthcare , digital infrastructure as well as key digital service providers . a key role was attributed to enisa in supporting implementation of this directive . in addition , effective fight against cybercrime is an important priority in the european agenda on security , contributing to the overall aim of achieving a high level of it security . _______________ 1a regulation 2016 / 679 of the european parliament and of the council of 27 april 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data , and repealing directive 95 / 46 / ec 1b directive 2002 / 58 / ec of the european parliament and of the council of 12 july 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector .


### it is recognised that , since the adoption of the 2013 eu cybersecurity strategy and the last revision of the agency ' s mandate , the overall policy context has changed significantly , also in relation to a more uncertain and less secure global environment . in this context and within the framework of the new union cybersecurity policy , it is necessary to review the mandate of enisa to define its role in the changed cybersecurity ecosystem and ensure it contributes effectively to the union ' s response to cybersecurity challenges emanating from this radically transformed threat landscape , for which , as recognised by the evaluation of the agency , the current mandate is not sufficient . ### it is recognised that , since the adoption of the 2013 eu cybersecurity strategy and the last revision of the agency ' s mandate , the overall policy context has changed significantly , also in relation to a more uncertain and less secure global environment . in this context and within the framework of the new union it security policy , it is necessary to review the mandate of enisa to define its role in the changed it security ecosystem and ensure it undertakes a leading role which will effectively improve the union ' s response to it security challenges emanating from this radically transformed threat landscape , for which , as recognised by the evaluation of the agency , the current mandate is not sufficient .


### given the increasing cybersecurity challenges the union is facing , the financial and human resources allocated to the agency should be increased to reflect its enhanced role and tasks , and its critical position in the ecosystem of organisations defending the european digital ecosystem . ### given the increasing it security challenges the union is facing , the financial and human resources allocated to the agency should be increased to reflect its enhanced role and tasks , and its critical position in the ecosystem of organisations defending the european digital ecosystem . due regard should be given to further enhancement of capacity of the agency .


### the agency should develop and maintain a high level of expertise and operate as a point of reference establishing trust and confidence in the single market by virtue of its independence , the quality of the advice it delivers and the information it disseminates , the transparency of its procedures and methods of operation , and its diligence in carrying out its tasks . the agency should proactively contribute to national and union efforts while carrying out its tasks in full cooperation with the union institutions , bodies , offices and agencies and the member states . in addition , the agency should build on input from and cooperation with the private sector as well as other relevant stakeholders . a set of tasks should establish how the agency is to accomplish its objectives while allowing flexibility in its operations . ### the agency should develop and maintain a high level of expertise and operate as a point of reference establishing trust and confidence in the single market by virtue of its independence , the quality of the advice it delivers and the information it disseminates , the transparency of its procedures and methods of operation , and its diligence in carrying out its tasks . the agency should proactively contribute to national and union efforts while carrying out its tasks in full cooperation with the union institutions , bodies , offices and agencies and the member states . in addition , the agency should build on input from and cooperation with the private sector as well as other relevant stakeholders . a clear agenda and a set of tasks and objectives which the agency is to accomplish should be clearly defined while giving due consideration to the necessary flexibility of its operations . where possible , the highest degree of transparency and dissemination of information should be maintained .


### the underlying task of the agency is to promote the consistent implementation of the relevant legal framework , in particular the effective implementation of the nis directive , which is essential in order to increase cyber resilience . in view of the fast evolving cybersecurity threat landscape , it is clear that member states must be supported by more comprehensive , cross - policy approach to building cyber resilience . ### the underlying task of the agency is to promote the consistent implementation of the relevant legal framework , in particular the effective implementation of the nis directive , directive . . . / . . . [ establishing the european electronic communications code ] , regulation 2016 / 679 and directive 2002 / 58 / ec , which is essential in order to increase cyber resilience . in view of the fast evolving it security threat landscape , it is clear that member states must be supported by more comprehensive , cross - policy approach to building cyber resilience .


### to understand better the challenges in the field of cybersecurity , and with a view to providing strategic long term advice to member states and union institutions , the agency needs to analyse current and emerging risks . for that purpose , the agency should , in cooperation with member states and , as appropriate , with statistical bodies and others , collect relevant information and perform analyses of emerging technologies and provide topic - specific assessments on expected societal , legal , economic and regulatory impacts of technological innovations on network and information security , in particular cybersecurity . the agency should furthermore support member states and union institutions , agencies and bodies in identifying emerging trends and preventing problems related to cybersecurity , by performing analyses of threats and incidents . ### to understand better the challenges in the field of it security , and with a view to providing strategic long term advice to member states and union institutions , the agency needs to analyse current and emerging risks , incidents and vulnerabilities . for that purpose , the agency should , in cooperation with member states and , as appropriate , with statistical bodies and others , collect relevant information and perform analyses of emerging technologies and provide topic - specific assessments on expected societal , legal , economic and regulatory impacts of technological innovations on network and information security , in particular it security . the agency should furthermore support member states and union institutions , agencies and bodies in identifying emerging trends and preventing problems related to it security , by performing analyses of threats , incidents and vulnerabilities .


### the agency should contribute towards raising the awareness of the public about risks related to cybersecurity and provide guidance on good practices for individual users aimed at citizens and organisations . the agency should also contribute to promote best practices and solutions at the level of individuals and organisations by collecting and analysing publicly available information regarding significant incidents , and by compiling reports with a view to providing guidance to businesses and citizens and improving the overall level of preparedness and resilience . the agency should furthermore organise , in cooperation with the member states and the union institutions , bodies , offices and agencies regular outreach and public education campaigns directed to end - users , aiming at promoting safer individual online behaviour and raising awareness of potential threats in cyberspace , including cybercrimes such as phishing attacks , botnets , financial and banking fraud , as well as promoting basic authentication and data protection advice . the agency should play a central role in accelerating end - user awareness on security of devices . ### the agency should contribute towards raising the awareness of the public about risks related to it security and provide guidance on good practices for individual users aimed at citizens and organisations . the agency should also contribute to promote best practices and solutions at the level of individuals and organisations by collecting and analysing publicly available information regarding significant incidents , and by compiling and publishing reports and guides with a view to providing guidance to businesses and citizens and improving the overall level of preparedness and resilience . the agency should furthermore organise , in cooperation with the member states and the union institutions , bodies , offices and agencies regular outreach and public education campaigns directed to end - users , aiming at promoting safer individual online behaviour and raising awareness of potential threats in cyberspace , including cybercrimes such as phishing attacks , botnets , financial and banking fraud , as well as promoting authentication , encryption , anonymisation and data protection advice . the agency should play a central role in accelerating end - user awareness on security of devices and secure use of services , popularising security by design at union level , privacy by design and the incidents and their solutions . in achieving this objective the agency should make the best use of available best practices and experience , especially from academic institutions and it security researchers .


### the agency should contribute towards raising the awareness of the public about risks related to cybersecurity and provide guidance on good practices for individual users aimed at citizens and organisations . the agency should also contribute to promote best practices and solutions at the level of individuals and organisations by collecting and analysing publicly available information regarding significant incidents , and by compiling reports with a view to providing guidance to businesses and citizens and improving the overall level of preparedness and resilience . the agency should furthermore organise , in cooperation with the member states and the union institutions , bodies , offices and agencies regular outreach and public education campaigns directed to end - users , aiming at promoting safer individual online behaviour and raising awareness of potential threats in cyberspace , including cybercrimes such as phishing attacks , botnets , financial and banking fraud , as well as promoting basic authentication and data protection advice . the agency should play a central role in accelerating end - user awareness on security of devices . ### the agency should contribute towards raising the awareness of the public about risks related to it security and provide guidance on good practices for individual users aimed at citizens and organisations . to improve the overall level of preparedness and resilience , the agency should also contribute to promote best practices and solutions at the level of individuals and organisations by collecting and analysing available information regarding significant incidents and by compiling reports with a view to providing guidance to businesses , citizens and relevant authorities at union and national level . the agency should furthermore organise , in cooperation with the member states and the union institutions , bodies , offices and agencies regular outreach and public education campaigns directed to end - users . these campaigns should promote it security education and safer individual online behaviour and raise awareness of potential threats in cyberspace , including cybercrimes such as phishing attacks , botnets , financial and banking fraud , forgery and illegal content , as well as advocating data protection and basic authentication to prevent data and identity theft . the agency should play a central role in accelerating end - user awareness on security of devices .


### to ensure that it fully achieves its objectives , the agency should liaise with relevant institutions , agencies and bodies , including cert - eu , european cybercrime centre at europol , european defence agency , european agency for the operational management of large - scale it systems , european aviation safety agency and any other eu agency that is involved in cybersecurity . it should also liaise with authorities dealing with data protection in order to exchange know - how and best practices and provide advice on cybersecurity aspects that might have an impact on their work . representatives of national and union law enforcement and data protection authorities should be eligible to be represented in the agency’s permanent stakeholders group . in liaising with law enforcement bodies regarding network and information security aspects that might have an impact on their work , the agency should respect existing channels of information and established networks . ### to ensure that it fully achieves its objectives , the agency should liaise with relevant institutions , agencies and bodies , including cert - eu , european cybercrime centre at europol , european defence agency , european agency for the operational management of large - scale it systems , european aviation safety agency and any other eu agency that is involved in it security . it should also liaise with authorities dealing with data protection in order to exchange know - how and best practices and provide advice on it security aspects that might have an impact on their work . representatives of national and union law enforcement and data protection authorities should be eligible to be represented in the agency’s permanent stakeholders group . in liaising with law enforcement bodies regarding network and information security aspects that might have an impact on their work , the agency should respect existing channels of information and established networks . partnerships should be established with academic institutions that have research initiatives in the relevant areas , while the input from consumer organisations and other organisations should have appropriate channels and should always be analysed .


### to ensure that it fully achieves its objectives , the agency should liaise with relevant institutions , agencies and bodies , including cert - eu , european cybercrime centre at europol , european defence agency , european agency for the operational management of large - scale it systems , european aviation safety agency and any other eu agency that is involved in cybersecurity . it should also liaise with authorities dealing with data protection in order to exchange know - how and best practices and provide advice on cybersecurity aspects that might have an impact on their work . representatives of national and union law enforcement and data protection authorities should be eligible to be represented in the agency’s permanent stakeholders group . in liaising with law enforcement bodies regarding network and information security aspects that might have an impact on their work , the agency should respect existing channels of information and established networks . ### to ensure that it fully achieves its objectives , the agency should liaise with relevant institutions , agencies and bodies , including cert - eu , european cybercrime centre at europol , european defence agency , european agency for the operational management of large - scale it systems , european aviation safety agency , european global navigation satellite systems agency and any other eu agency that is involved in it security . it should also liaise with union and national authorities dealing with data protection in order to exchange know - how and best practices and provide advice on it security aspects that might have an impact on their work . representatives of national and union law enforcement and data protection authorities should be eligible to be represented in the agency’s permanent stakeholders group . in liaising with law enforcement bodies regarding network and information security aspects that might have an impact on their work , the agency should respect existing channels of information and established networks .


### in order for the agency to function properly and effectively , the commission and the member states should ensure that persons to be appointed to the management board have appropriate professional expertise and experience in functional areas . the commission and the member states should also make efforts to limit the turnover of their respective representatives on the management board in order to ensure continuity in its work . ### in order for the agency to function properly and effectively , the commission and the member states should ensure that persons to be appointed to the management board have appropriate professional expertise and experience in functional areas . the commission and the member states should also make efforts to limit the turnover of their respective representatives on the management board in order to ensure continuity in its work . due to the high market value of the skills required in the agency ' s work , it is necessary to ensure that the salaries and the social conditions offered to all agency staff are competitive and ensure that the best professionals can choose to work there .


### the smooth functioning of the agency requires that its executive director be appointed on grounds of merit and documented administrative and managerial skills , as well as competence and experience relevant for cybersecurity , and that the duties of the executive director be carried out with complete independence . the executive director should prepare a proposal for the agency’s work programme , after prior consultation with the commission , and take all necessary steps to ensure the proper execution of the work programme of the agency . the executive director should prepare an annual report to be submitted to the management board , draw up a draft statement of estimates of revenue and expenditure for the agency , and implement the budget . furthermore , the executive director should have the option of setting up ad hoc working groups to address specific matters , in particular of a scientific , technical , legal or socioeconomic nature . the executive director should ensure that the ad hoc working groups’ members are selected according to the highest standards of expertise , taking due account of a representative balance , as appropriate according to the specific issues in question , between the public administrations of the member states , the union institutions and the private sector , including industry , users , and academic experts in network and information security . ### the smooth functioning of the agency requires that its executive director be appointed on grounds of merit and documented administrative and managerial skills , as well as competence and experience relevant for it security , and that the duties of the executive director be carried out with complete independence . the executive director should prepare a proposal for the agency’s work programme , after prior consultation with the commission , and take all necessary steps to ensure the proper execution of the work programme of the agency . the executive director should prepare an annual report to be submitted to the management board , draw up a draft statement of estimates of revenue and expenditure for the agency , and implement the budget . furthermore , the executive director should have the option of setting up ad hoc working groups to address specific matters , in particular of a scientific , technical , legal or socioeconomic nature . the executive director should ensure that the ad hoc working groups’ members are selected according to the highest standards of expertise , taking due account of a representative and gender balance , as appropriate according to the specific issues in question , between the public administrations of the member states , the union institutions and the private sector , including industry , users , and academic experts in network and information security .


### the agency should have a permanent stakeholders’ group as an advisory body , to ensure regular dialogue with the private sector , consumers’ organisations and other relevant stakeholders . the permanent stakeholders’ group , set up by the management board on a proposal by the executive director , should focus on issues relevant to stakeholders and bring them to the attention of the agency . the composition of the permanent stakeholders group and the tasks assigned to this group , to be consulted in particular regarding the draft work programme , should ensure sufficient representation of stakeholders in the work of the agency . ### the agency should have a permanent stakeholders’ group as an advisory body , to ensure regular dialogue with the private sector , consumers’ organisations , academia and other relevant stakeholders . the permanent stakeholders’ group , set up by the management board on a proposal by the executive director , should focus on issues relevant to stakeholders and bring them to the attention of the agency , providing input on which ict products and services to cover in future european it security certification schemes . the composition of the permanent stakeholders group and the tasks assigned to this group , to be consulted in particular regarding the draft work programme , should ensure efficient and equitable representation of stakeholders in the work of the agency .


### currently , the cybersecurity certification of ict products and services is used only to a limited extent . when it exists , it mostly occurs at member state level or in the framework of industry driven schemes . in this context , a certificate issued by one national it security authority is not in principle recognised by other member states . companies thus may have to certify their products and services in several member states where they operate , for example with a view to participating in national procurement procedures . moreover , while new schemes are emerging , there seems to be no coherent and holistic approach with regard to horizontal cybersecurity issues , for instance in the field of the internet of things . existing schemes present significant shortcomings and differences in terms of product coverage , levels of assurance , substantive criteria and actual utilisation . ### currently , the it security certification of ict products and services is used only to a limited extent . when it exists , it mostly occurs at member state level or in the framework of industry driven schemes . in this context , a certificate issued by one national it security authority is not in principle recognised by other member states . companies thus may have to certify their products and services in several member states where they operate , for example with a view to participating in national procurement procedures , and these procedures may entail additional costs for companies . moreover , while new schemes are emerging , there seems to be no coherent and holistic approach with regard to horizontal it security issues , for instance in the field of the internet of things . existing schemes present significant shortcomings and differences in terms of product coverage , levels of assurance , substantive criteria and actual utilisation . a case - by - case approach should ensure that services and products are subject to appropriate certification schemes . additionally , a risk - based approach is needed for effective identification and mitigation of risks and to avoid increased costs for manufacturers .


### in view of the above , it is necessary to establish a european cybersecurity certification framework laying down the main horizontal requirements for european cybersecurity certification schemes to be developed and allowing certificates for ict products and services to be recognised and used in all member states . the european framework should have a twofold purpose : on the one hand , it should help increase trust in ict products and services that have been certified according to such schemes . on the other hand , it should avoid the multiplication of conflicting or overlapping national cybersecurity certifications and thus reduce costs for undertakings operating in the digital single market . the schemes should be non - discriminatory and based on international and / or union standards , unless those standards are ineffective or inappropriate to fulfil the eu’s legitimate objectives in that regard . ### in view of the above , it is necessary to establish a european it security certification framework laying down the main horizontal requirements for european it security certification schemes to be developed and allowing certificates for ict products and services to be recognised and used in all member states . the european framework should have a twofold purpose : on the one hand , it should help increase trust in ict products and services that have been certified according to such schemes . on the other hand , it should avoid the multiplication of conflicting or overlapping national it security certifications and thus reduce costs for undertakings operating in the digital single market . the schemes should be guided by security - by - design and the principles referred in regulation 2016 / 679 , be non - discriminatory and based on selected iso / iec and / or union standards , unless those standards are ineffective or inappropriate to fulfil the eu’s legitimate objectives in that regard .


### the purpose of european cybersecurity certification schemes should be to ensure that ict products and services certified under such a scheme comply with specified requirements . such requirements concern the ability to resist , at a given level of assurance , actions that aim to compromise the availability , authenticity , integrity and confidentiality of stored or transmitted or processed data or the related functions of or services offered by , or accessible via those products , processes , services and systems within the meaning of this regulation . it is not possible to set out in detail in this regulation the cybersecurity requirements relating to all ict products and services . ict products and services and related cybersecurity needs are so diverse that it is very difficult to come up with general cybersecurity requirements valid across the board . it is , therefore necessary to adopt a broad and general notion of cybersecurity for the purpose of certification , complemented by a set of specific cybersecurity objectives that need to be taken into account when designing european cybersecurity certification schemes . the modalities with which such objectives will be achieved in specific ict products and services should then be further specified in detail at the level of the individual certification scheme adopted by the commission , for example by reference to standards or technical specifications . ### the purpose of european it security certification schemes should be to ensure that ict products and services certified under such a scheme comply with specified requirements . such requirements concern the ability to resist , at a given level of assurance , actions that aim to compromise the availability , authenticity , integrity and confidentiality of stored or transmitted or processed data or the related functions of or services offered by , or accessible via those products , processes , services and systems within the meaning of this regulation . it is not possible to set out in detail in this regulation the it security requirements relating to all ict products and services . ict products and services and related it security needs are so diverse , as is their lifecycle , that it is very difficult to come up with general it security requirements valid across the board . it is , therefore necessary to adopt a broad and general notion of it security for the purpose of certification , complemented by a set of specific it security objectives that need to be taken into account when designing european it security certification schemes . the modalities with which such objectives will be achieved in specific ict products and services should then be further specified in detail at the level of the individual certification scheme adopted by the commission in close consultation with the member states and industrial stakeholders , for example by reference to standards or technical specifications . the individual certification schemes should be designed in such a way that all actors involved in the development of relevant it products and services are encouraged to develop and adopt standards , norms and principles which ensure the highest possible level of security throughout the lifecycle .


### the commission should be empowered to request enisa to prepare candidate schemes for specific ict products or services . the commission , based on the candidate scheme proposed by enisa , should then be empowered to adopt the european cybersecurity certification scheme by means of implementing acts . taking account of the general purpose and security objectives identified in this regulation , european cybersecurity certification schemes adopted by the commission should specify a minimum set of elements concerning the subject - matter , the scope and functioning of the individual scheme . these should include among others the scope and object of the cybersecurity certification , including the categories of ict products and services covered , the detailed specification of the cybersecurity requirements , for example by reference to standards or technical specifications , the specific evaluation criteria and evaluation methods , as well as the intended level of assurance : basic , substantial and / or high . ### the commission should be empowered to request enisa to prepare candidate schemes for specific ict products or services . the commission , based on the candidate scheme proposed by enisa , should then be empowered to adopt the european it security certification scheme by means of implementing acts . taking account of the general purpose and security objectives identified in this regulation , european it security certification schemes adopted by the commission should specify a minimum set of elements concerning the subject - matter , the scope and functioning of the individual scheme . these should include among others the scope and object of the it security certification , including the categories of ict products and services covered , the detailed specification of the it security requirements , for example by reference to standards or technical specifications , the specific evaluation criteria and evaluation methods , as well as the intended level of assurance : basic , substantial and / or high . the assurance levels should be defined on a case - by - case basis to ensure that ict services and products are subject to appropriate certification schemes , and should take into account the different individual use cases as well as the own responsibility and education of users .


### recourse to european cybersecurity certification should remain voluntary , unless otherwise provided in union or national legislation . however , with a view to achieving the objectives of this regulation and avoiding the fragmentation of the internal market , national cybersecurity certification schemes or procedures for the ict products and services covered by a european cybersecurity certification scheme should cease to produce effects from the date established by the commission by means of the implementing act . moreover , member states should not introduce new national certification schemes providing cybersecurity certification schemes for ict products and services already covered by an existing european cybersecurity certification scheme . ### recourse to european it security certification should remain voluntary , unless otherwise provided in union or national legislation . after this initial stage , and depending on the maturity of implementation in the member states and the criticality of a product or service , potentially mandatory certification schemes for certain ict products and services may be introduced in a phased approach for future generations of technology and in response to the policy objectives of tomorrow . however , with a view to achieving the objectives of this regulation and avoiding the fragmentation of the internal market , national it security certification schemes or procedures for the ict products and services covered by a european it security certification scheme should cease to produce effects from the date established by the commission by means of the implementing act . moreover , member states should not introduce new national certification schemes providing it security certification schemes for ict products and services already covered by an existing european it security certification scheme .


### lays down a framework for the establishment of european cybersecurity certification schemes for the purpose of ensuring an adequate level of cybersecurity of ict products and services in the union . such framework shall apply without prejudice to specific provisions regarding voluntary or mandatory certification in other union acts . ### lays down a framework for the establishment of european it security certification schemes for the purpose of ensuring an adequate level of it security of ict products and services in the union . such framework shall apply without prejudice to specific provisions regarding voluntary or mandatory certification in other union acts .


### the agency shall promote the use of certification , including by contributing to the establishment and maintenance of a cybersecurity certification framework at union level in accordance with title iii of this regulation , with a view to increasing transparency of cybersecurity assurance of ict products and services and thus strengthen trust in the digital internal market . ### the agency shall promote the use of certification , including by contributing to the development of union and international standards on it security , the establishment and maintenance of a it security certification framework at union level in accordance with title iii of this regulation , with a view to increasing transparency of it security assurance of ict products and services and thus strengthen trust in the digital internal market .


### assisting member states to implement consistently the union policy and law regarding cybersecurity notably in relation to directive 2016 / 1148 , including by means of opinions , guidelines , advice and best practices on topics such as risk management , incident reporting and information sharing , as well as facilitating the exchange of best practices between competent authorities in this regard ; ### assisting member states to implement consistently the union policy and law regarding cybersecurity notably in relation to directive 2016 / 1148 , including by means of opinions , guidelines , advice and best practices on topics such as secure software and systems development , risk management , incident reporting and information sharing , technical and organisational measures , in particular the establishment of coordinated vulnerability disclosure programmes , as well as facilitating the exchange of best practices between competent authorities in this regard ;


### assisting member states to implement consistently the union policy and law regarding cybersecurity notably in relation to directive 2016 / 1148 , including by means of opinions , guidelines , advice and best practices on topics such as risk management , incident reporting and information sharing , as well as facilitating the exchange of best practices between competent authorities in this regard ; ### assisting member states to implement consistently the union policy and law regarding it security notably in relation to directive 2016 / 1148 , directive . . . / . . . [ establishing the european electronic communications code ] , regulation 2016 / 679 and directive 2002 / 58 / ec , including by means of opinions , guidelines , advice and best practices on topics such as risk management , incident reporting and information sharing , as well as facilitating the exchange of best practices between competent authorities in this regard ;


### facilitate the establishment and take - up of european and international standards for risk management and for the security of ict products and services , as well as draw up , in collaboration with member states , advice and guidelines regarding the technical areas related to the security requirements for operators of essential services and digital service providers , as well as regarding already existing standards , including member states ' national standards , pursuant to article 19 of directive 2016 / 1148 ; ### consult the iso / iec international standardisation bodies and european standardisation organisations on the development of standards , to ensure the appropriateness of standards used in european cybersecurity certification schemes and facilitate the establishment and take - up of european and iso / iec standards for risk management and for the security of ict products and services , as well as draw up , in collaboration with member states , advice and guidelines regarding the technical areas related to the security requirements for operators of essential services and digital service providers , as well as regarding already existing standards , including member states ' national standards , pursuant to article 19 of directive 2016 / 1148 ;


### organise , in cooperation with the member states and union institutions , bodies , offices and agencies regular outreach campaigns to increase cybersecurity and its visibility in the union . ### organise , in cooperation with the member states and union institutions , bodies , offices , agencies and other relevant stakeholders , regular outreach campaigns to increase it security and its visibility in the union ;


### appoint the executive director and where relevant extend his term of office or remove him from office in accordance with article 33 of this regulation ; ### appoint the executive director through selection procedure based on professional criteria and where relevant extend his term of office or remove him from office in accordance with article 33 of this regulation ;


### the agency’s host member state shall provide the best possible conditions to ensure the proper functioning of the agency , including the accessibility of the location , the existence of adequate education facilities for the children of staff members , appropriate access to the labour market , social security and medical care for both children and spouses . ### the agency’s host member state shall provide the best possible conditions to ensure the proper functioning of the agency , including the accessibility of the headquarters and other offices location by international airport , the existence of adequate education facilities for the children of staff members , appropriate access to the labour market , social security and medical care for both children and spouses .


### following a request from the commission , enisa shall prepare a candidate european cybersecurity certification scheme which meets the requirements set out in articles 45 , 46 and 47 of this regulation . member states or the european cybersecurity certification group established under article 53 may propose the preparation of a candidate european cybersecurity certification scheme to the commission . ### following a request from the commission , enisa shall prepare a candidate european it security certification scheme which meets the requirements set out in articles 45 , 46 and 47 of this regulation . member states , the european cybersecurity certification group established under article 53 or the permanent stakeholders group established under article 20 , may propose the preparation of a candidate european it security certification scheme to the commission .


### the commission , based on the candidate scheme proposed by enisa , may adopt implementing acts , in accordance with article 55 , providing for european cybersecurity certification schemes for ict products and services meeting the requirements of articles 45 , 46 and 47 of this regulation . ### the commission , based on the candidate scheme proposed by enisa , may adopt implementing acts , in accordance with article 55 , providing for european it security certification schemes for ict products and services meeting the requirements of articles 45 , 46 and 47 of this regulation . the commission may consult the european data protection board and take account of its view before adopting such implementing acts .


### rules concerning how previously undetected cybersecurity vulnerabilities in ict products and services are to be reported and dealt with ; ### rules requiring vulnerabilities in ict products and services that are not publicly known to be reported expeditiously by the appropriate authorities to relevant vendors and manufacturers using a coordinated vulnerability disclosure process .


### cooperate with other national certification supervisory authorities or other public authorities , including by sharing information on possible non - compliance of ict products and services with the requirements of this regulation or specific european cybersecurity certification schemes ; ### cooperate with other national certification supervisory authorities or other public authorities , such as national data protection supervisory authorities , including by sharing information on possible non - compliance of ict products and services with the requirements of this regulation or specific european it security certification schemes ;


### this directive shall not prevent member states from adopting or maintaining in force provisions designed to grant qualified entities or any other persons concerned other procedural means to bring actions aimed at the protection of the collective interests of consumers at national level . ### this directive shall not prevent member states from adopting or maintaining in force provisions designed to ensure a higher level of protection of any affected citizen or to grant qualified entities or any other persons concerned more favourable procedural means to bring actions aimed at the protection of the collective interests of consumers at national level .


### this directive shall apply to representative actions brought against infringements by traders of provisions of the union law listed in annex i that harm or may harm the collective interests of consumers . it shall apply to domestic and cross - border infringements , including where those infringements have ceased before the representative action has started or before the representative action has been concluded . ### this directive shall apply to representative actions brought against infringements by manufacturers and / or suppliers of goods and services as well as traders of provisions of the union law listed in annex i that harm or may harm any public interest , including , but not limited to , the collective interests listed in annex 1 . it shall apply to domestic and cross - border infringements , including where those infringements have ceased before the representative action has started or before the representative action has been concluded .


### member states shall ensure that in particular consumer organisations and independent public bodies are eligible for the status of qualified entity . member states may designate as qualified entities consumer organisations that represent members from more than one member state . ### member states shall ensure that established or ad - hoc organisations defending a public interest , in particular consumer organisations and independent public bodies are eligible for the status of qualified entity . member states may designate as qualified entities organisations that represent members from more than one member state .


### for the purposes of article 5 , member states shall ensure that qualified entities are entitled to bring representative actions seeking a redress order , which obligates the trader to provide for , inter alia , compensation , repair , replacement , price reduction , contract termination or reimbursement of the price paid , as appropriate . a member state may require the mandate of the individual consumers concerned before a declaratory decision is made or a redress order is issued . ### for the purposes of article 5 , member states shall ensure that qualified entities are entitled to bring representative actions seeking a redress order for material or consequential damage , which obligates the manufacturers , suppliers of goods and services or trader to provide for , inter alia , compensation , repair , replacement , price reduction , contract termination or reimbursement of the price paid , as appropriate . a member state may require the mandate of the individual consumers concerned before a declaratory decision is made or a redress order is issued .