### [name of the european political party or european political foundation] and its members having their seat inside the european union are committed to comply with the conditions for registration laid down in article 3(1) , points (d) and (e) , or article 3(2) , points (c) and (d) , of [this regulation] , i.e. to observe , in particular in its programme and in its activities , the values on which the union is founded , as expressed in article 2 of the treaty on european union , namely respect for human dignity , freedom , democracy , equality , the rule of law and respect for human rights , including the rights of persons belonging to minorities. ### [name of the european political party or european political foundation] is committed to comply with the conditions for registration laid down in article 3(1) , point (d) , or article 3(2) , point (c) , of [this regulation] , i.e. to observe , in particular in its programme and in its activities , the values on which the union is founded , as expressed in article 2 of the treaty on european union , namely respect for human dignity , freedom , democracy , equality , the rule of law and respect for human rights , including the rights of persons belonging to minorities.


### [name of the european political party or european political foundation] is also committed to ensure that the same applies to its member parties or member organisations having their seat in the union and that its member parties or member organisations having their seat outside the union observe equivalent values. ### deleted


### (15) in order to protect the financial interests of the union , and to align this regulation with article 297 tfeu , the decisions to de-register should take effect upon notification. ### deleted


### (46) political advertising plays an important role for political parties to communicate to citizens and interact with them on political issues. it can take many forms and be disseminated through many media , from television and radio , to print and online social media. it is an important part of the electoral process and represents an important part of the amounts spent by political parties and candidates. while it brings important benefits , it also entails potential risks to electoral processes and democracy. those risks can arise from opaque practices and the use of political advertising as a vector for disinformation including when the advertising does not disclose its political nature , and where it is funded and targeted covertly. ### deleted


### (47) a high level of transparency should therefore be provided by european political parties in their political advertising to support a fair political debate and free and elections including to combat disinformation. it should support citizens’ understanding of the nature , source and context of political advertising , including its funding and the amounts spent , and regarding whether and how it was targeted to them. it should also promote accountability and contribute to reducing the incidence of the misuse of political advertising , including connected to disinformation and other types of interference in the democratic debate. the transparency requirements should support the european dimension of elections to the european parliament including the cross border dimension. ### deleted


### (48) member states should ensure adequate enforcement of the transparency obligations applicable to political advertising laid down in this regulation. member states should entrust competent authorities with the necessary powers to supervise compliance with those transparency obligations. in order to avoid undue interferences , such national regulatory authorities or bodies should exercise their powers impartially and transparently and be legally distinct from the government and functionally independent of their respective governments and of any other public or private body. citizens and other interested parties should be able to know which regulatory authorities are competent in each member state , which should be achieved by providing an obligation for the authority to publish on its website and keep updated a list of member states’ national regulatory authorities. decisions of national regulatory authorities should be subject to effective legal remedies , in full compliance with article 47 of the charter. this should include ensuring that appropriate redress can be sought and obtained in due time , upon request of any interested party , requiring the european political party to put an end to any violation of the transparency requirements laid down in this regulation. ### deleted


### (51) european political parties should implement and regularly update their policy on their use of political advertising. this policy and an annual report on its implementation should be available on the european political party’s website. ### deleted


### (52) regulation (eu) 2022/xx [on the transparency and targeting of political advertising] establishes obligations for data controllers using targeting or amplification techniques in the context of political advertising. when using targeting or amplification techniques for political advertising , european political parties should ensure compliance with article 12 of that regulation. supervisory authorities within the meaning of article 4 , point (21) of regulation (eu) 2016/679 of the european parliament and of the council29 should be competent to monitor compliance with this regulation. ### deleted


### (53) information concerning compliance by european political parties with the transparency requirements established in this regulation should be available at union level. in order to facilitate this , the authority should prepare and publish a factual and descriptive report on any decisions of national regulatory authorities or supervisory authorities pursuant to this regulation. ### deleted


### (54) in view of the need to protect the integrity of the european democratic process , european political parties should prove compliance with transparency rules applicable to political advertising in order to be eligible for funds coming from the budget of the european union. ### deleted


### (66) to further align the evaluation of this regulation with the elections to the european parliament cycle , the dates of the proposed comprehensive review should be adapted. moreover , to avoid duplication , the provisions on transparency and targeting of political advertising should be evaluated as part of the commission’s report following the elections to the european parliament. ### deleted


### 16. ‘political advertising’ means advertising within the meaning of article 2 , point (2) , of regulation 2022/xx [on the transparency and targeting of political advertising]; ### deleted


### 17. ‘political advertisement’ means advertisement within the meaning of article 2 , point (3) of regulation 2022/xx [on the transparency and targeting of political advertising]; ### deleted


### 18. ‘political advertising services’ means services within the meaning of article 2 , point (5) of regulation (eu) 2022/xx [on the transparency and targeting of political advertising]. ### deleted


### its internal rules governing the use of political advertising; ### deleted


### [...] ### deleted


### (5) a decision of the authority to de-register a european political party or a european political foundation , to which no objections have been raised under the procedure laid down in paragraph 4 , together with the detailed grounds for de-registration , shall be notified to the european political party or foundation concerned and published in the official journal of the european union. the decision shall take effect upon notification in accordance with article 297 tfeu. ### (5) a decision of the authority to de-register a european political party or a european political foundation , to which no objections have been raised under the procedure laid down in paragraph 4 , together with the detailed grounds for de-registration , shall be notified to the european political party or foundation concerned and published in the official journal of the european union , and the decision shall take effect three months after the date of its publication.


### (1) a european political party or a european political foundation shall lose its european legal personality upon the notification of a decision pursuant to article 11(5). ### (1) a european political party or a european political foundation shall lose its european legal personality upon the entry into force of a decision of the authority to remove it from the register as published in the official journal of the european union. the decision shall enter into force three months after such publication unless the european political party or the european political foundation concerned requests a shorter period.


### (4) financial contributions or grants from the general budget of the european union shall not exceed 95 % of the annual reimbursable expenditure indicated in the budget of a european political party and 95 % of the eligible costs incurred by a european political foundation. european political parties may use any unused part of the union contribution awarded to cover reimbursable expenditure within the financial year following its award. amounts unused after that financial year shall be recovered in accordance with regulation (eu , euratom) 2018/1046 . financial contributions in the year of elections to the european parliament may cover 100% of the reimbursable expenditure incurred by a european political party. ### (4) financial contributions or grants from the general budget of the european union shall not exceed 95 % of the annual reimbursable expenditure indicated in the budget of a european political party and 95 % of the eligible costs incurred by a european political foundation. european political parties may use any unused part of the union contribution awarded to cover reimbursable expenditure within the financial year following its award. amounts unused after that financial year shall be recovered in accordance with regulation (eu , euratom) 2018/1046 .


### (5) a european political party shall include in its application evidence demonstrating its compliance with article 5 , that it maintains an up to date policy for the use of political advertising and that it has implemented it throughout the 12 months preceding the final date for submission of applications. ### deleted


### no more than one year after the publication of the report by the european parliament , the commission shall present a report on the application of this regulation accompanied , if appropriate , by a proposal to amend this regulation. the commission’s report shall pay particular attention to the implications of this regulation for the position of small european political parties and european political foundations. however , the commission’s report shall not cover the evaluation of the requirements for political advertising set out in this regulation , which shall be part of the report referred to in article 19 of regulation 2022/xx [on the transparency and targeting of political advertising]. ### no more than one year after the publication of the report by the european parliament , the commission shall present a report on the application of this regulation. the commission’s report shall pay particular attention to the implications of this regulation for the position of small european political parties and european political foundations.


### (1) by way of derogation from article 5(4) , until [five years after the entry into force of this regulation] , the report on the implementation of the policy for the use of political advertising shall cover the political advertisements published by the european political party from [the date of entry into force of this regulation]. the first report shall be prepared by [one year after the entry into force of this regulation]. ### deleted


### (1) ### deleted


### (1) – links to the advertisement as published or where necessary , examples of other audio or visual advertising campaign materials; ### deleted


### – links to the advertisement as published or where necessary , examples of other audio or visual advertising campaign materials; ### deleted


### – provisional statement of the amounts spent or allocated by the european political party for the preparation , placement , publication and dissemination of the political advertisement as well as the actual amounts once known; ### deleted


### – the source of the funds being used for the specific advertisement campaign including for the preparation , placement , publication and dissemination of a political advertisement. ### deleted


### – in case targeting techniques are used , meaningful information on the techniques used , including the points provided under annex ii to regulation 2022/xx [on the transparency and targeting of political advertising]. ### deleted


### (2) – annually aggregated information on its use of targeted political advertising; ### deleted


### – annually aggregated information on its use of targeted political advertising; ### deleted


### – a list of the specific campaigns with which political advertising was used; ### deleted


### – the amounts yearly spent on political advertising during the last 5 years; ### deleted


### – the distribution channels used; ### deleted


### – a link to the information made available in the repository for disclosure by european political parties.] ### deleted


### 9. believes that in contrast to the negative image associated with initiatives taken during the euro crisis of the early 2010s , the response to ngeu shows the merits of a more ambitious , collective and democratic crisis response at eu level; calls on all eu institutions , therefore , to ensure that the political signal given by ngeu lives on , by demonstrating that the eu delivers on its promises and by offering a longer-term political vision; ### 9. believes that in contrast to the negative image associated with initiatives taken during the euro crisis of the early 2010s , the response to ngeu shows the merits of a more ambitious , collective and democratic crisis response at eu level;


### 10. underlines that further investments in eu policies will be necessary to strengthen eu competitiveness and strategic autonomy , in particular regarding industry and climate action; considers , in this regard , that ngeu is a good example of a viable architecture for funding above the mff ceilings; ### 10. underlines that further investments in eu policies will be necessary to strengthen eu competitiveness and strategic autonomy , in particular regarding industry and climate action;


### 12. insists on the need to involve the budgetary authority at all stages of this process; recalls that under the own resources decision , the commission is required to publish a regularly updated plan of expected principal and interest payments , to be discussed with parliament and council in the regular interinstitutional meetings on the topic of ngeu; ### 12. recalls that under the own resources decision , the commission is required to publish a regularly updated plan of expected principal and interest payments , to be discussed with parliament and council in the regular interinstitutional meetings on the topic of ngeu;


### 13. firmly believes that the success of ngeu , and in particular the credibility and sustainability of its financing , will also be assessed against the union’s ability to repay the common debt with new own resources in the environmental and corporate sector , rather than with increased gross national income-based contributions from the member states; ### 13. firmly believes that the success of ngeu , and in particular the credibility and sustainability of its financing , will also be assessed against the union’s ability to maintain the financing of its traditional policies , namely the common agricultural policy and the cohesion policy;


### 14. stresses that the introduction of such new own resources would avoid cuts to union programmes in the future , which would undermine the very purpose and long-term benefits of the recovery plan; believes that introducing new own resources would achieve lasting benefits , not only in the delivery of union policies , but also in ensuring the union’s standing as a credible and smart debt issuer; calls , therefore , on the member states to move as swiftly as possible in the current negotiations to establish own resources based on the eu emissions trading system , the carbon border adjustment mechanism and pillar i of the oecd; ### deleted


### 1. notes that the european economy is recovering faster than expected from the devastating impact of the global pandemic; underlines the crucial importance that timely policy interventions have played and will continue to play in mitigating the impact of the pandemic on the european economy; ### 1. notes that the european economy is recovering from the devastating impact of the global pandemic , although uncertainties remain; underlines the crucial importance that timely policy interventions have played and will continue to play in mitigating the impact of the pandemic on the european economy;


### 2. is concerned about emerging new variants , localised pandemic lockdowns , increased energy prices , inflationary pressure , supply-side disruptions and emerging labour shortages; notes that these risks could hamper economic growth prospects in the coming months and delay the transition to a more sustainable and future-proof economy; ### 2. is concerned about emerging new variants , the impact on prices of the european commission’s green deal , localised pandemic lockdowns , increased energy prices , inflationary pressure , supply-side disruptions and emerging labour shortages; notes that these risks could hamper economic growth prospects in the coming months;


### 8. is convinced that the coordination of national fiscal policies remains crucial in underpinning the recovery; notes that the overall fiscal stance , taking into account national budgets and the rrf , is projected to remain supportive in 2022 to sustain the recovery; agrees with the commission that member states with low or medium levels of debt should pursue or maintain a supportive fiscal stance , and that member states with high levels of debt should use the rrf to finance additional investment to support the recovery , while pursuing a prudent fiscal policy; agrees with the commission that all member states should preserve or broadly preserve their national financed investment; ### 8. is convinced that the coordination of national fiscal policies remains crucial in underpinning the recovery; notes that the overall fiscal stance , taking into account national budgets and the rrf , is projected to remain supportive in 2022 to sustain the recovery; agrees with the commission that all member states should preserve or broadly preserve their national financed investment;


### 10. highlights that the rrf presents an unprecedented and unique opportunity for all member states to address key structural challenges and investment needs and insists that all recovery and resilience plans address all requirements of the rrf regulation , in particular the six pillars; highlights the interplay between the european semester and the rrf; calls on the member states to make the most of this opportunity and to use it to transform their economies and make them sustainable , more competitive and more resilient to future shocks; highlights the role of the european parliament in the implementation of the rrf , as enshrined in the rrf regulation; ### 10. highlights that the impact of the rrf on investment will be marginal compared to the contribution of national expenditure , although it presents an opportunity for all member states to address part of the key structural challenges and investment needs and insists that all recovery and resilience plans address all requirements of the rrf regulation , in particular the six pillars; highlights the interplay between the european semester and the rrf; calls on the member states to make the most of this opportunity and to use it to transform their economies and make them sustainable , more competitive and more resilient to future shocks; highlights the role of the european parliament in the implementation of the rrf , as enshrined in the rrf regulation;


### 12. notes that many member states are having to contend with old and new structural challenges that are hindering their growth potential; highlights , therefore , that tackling structural challenges is crucial for a sustainable recovery and continued growth; takes the view that implementing reforms to address old and new structural vulnerabilities is key not only to improving the ability to withstand and cope with existing challenges , but also to accomplishing the twin transitions in a sustainable , fair and inclusive manner and to reducing social inequalities; points to the lack of national ownership as one of the main weaknesses in enacting reforms aimed at addressing structural deficiencies; ### 12. notes that many member states are having to contend with old and new structural challenges that are hindering their growth potential; highlights , therefore , that tackling structural challenges is crucial for a sustainable recovery and continued growth; takes the view that implementing reforms economically and socially sustainable to address old and new structural vulnerabilities is key not only to improving the ability to withstand and cope with existing challenges , but also to accomplishing the twin transitions in a sustainable , fair and inclusive manner and to reducing social inequalities; points to the lack of national ownership as one of the main weaknesses in enacting reforms aimed at addressing structural deficiencies;


### 13. is concerned that the commission identified macroeconomic vulnerabilities related to imbalances and excessive imbalances in 12 member states; is worried that the nature and source of member states’ imbalances remain largely the same as before the pandemic and that the pandemic could also be exacerbating imbalances and economic divergences; calls on the member states to take advantage of the unprecedented opportunity provided by the rrf to significantly reduce existing macroeconomic imbalances , in particular by including ambitious reform measures in the national plans of all member states; stresses that sound execution is essential to make full use of this opportunity; ### 13. is concerned that the commission identified macroeconomic vulnerabilities related to imbalances and excessive imbalances in 12 member states; is worried that the nature and source of member states’ imbalances remain largely the same as before the pandemic , as many mistakes were made in the management of the severe financial crisis , and that the pandemic could also be exacerbating imbalances and economic divergences; calls on the member states to preserve national investments , which has been and will be the main tools for recovery , and to take advantage of the opportunity provided by the rrf to significantly reduce existing macroeconomic imbalances , in particular by including ambitious reform measures economically and socially sustainable in the national plans of all member states; stresses that sound execution is essential to make full use of this opportunity;


### (1) the transition to a low-carbon , more sustainable , resource-efficient , circular and fair economy is key to ensuring the long-term competitiveness of the economy of the union and the well-being of its peoples. in 2016 , the union concluded the paris agreement31 . article 2(1) , point (c) , of the paris agreement sets out the objective of strengthening the response to climate change by , among other means , making finance flows consistent with a pathway towards low greenhouse gas emissions and climate-resilient development. ### (1) the transition to a low-carbon , more sustainable , resource-efficient , innovation-driven , circular and fair economy , with the objective of achieving carbon neutrality by 2050 , is key to ensuring the long-term competitiveness of the economy of the union and the well-being of its peoples. in 2016 , the union concluded the paris agreement31. article 2(1) , point (c) , of the paris agreement sets out the objective of strengthening the response to climate change by , among other means , making finance flows consistent with a pathway towards low greenhouse gas emissions and climate-resilient development.


### (3) environmentally sustainable bonds are one of the main instruments for financing investments related to low-carbon technologies , energy and resource efficiency as well as sustainable transport infrastructure and research infrastructure. financial or non-financial undertakings or sovereigns can issue such bonds. various existing initiatives for environmentally sustainable bonds do not ensure common definitions of environmentally sustainable economic activities. this prevents investors from easily identifying bonds the proceeds of which are aligned with , or are contributing to environmental objectives as laid down in the paris agreement. ### (3) environmentally sustainable bonds are one of the main instruments for financing investments related to low-carbon technologies , energy and resource efficiency as well as sustainable transport infrastructure and research infrastructure. financial or non-financial undertakings or sovereigns can issue such bonds. various existing initiatives for environmentally and socially sustainable bonds do not ensure common definitions of environmentally sustainable economic activities. this prevents investors from easily identifying bonds the proceeds of which are aligned with , or are contributing to environmental objectives as laid down in the paris agreement.


### (5) in ensuring alignment with the objectives of the paris agreement , and given the existing divergences and absence of common rules , it is likely that member states will adopt diverging measures and approaches , which will have a direct negative impact on , and create obstacles to , the proper functioning of the internal market , and be detrimental to issuers of environmentally sustainable bonds. the parallel development of market practices based on commercially driven priorities that produce divergent results causes market fragmentation and risks further exacerbating inefficiencies in the functioning of the internal market. divergent standards and market practices make it difficult to compare different bonds , create uneven market conditions for issuers , cause additional barriers within the internal market , and risk distorting investment decisions. ### (5) in ensuring alignment with the objectives of the paris agreement and of the sustainable development goals , and given the existing divergences and absence of common rules , it is likely that member states will adopt diverging measures and approaches , which will have a direct negative impact on , and create obstacles to , the proper functioning of the internal market , and be detrimental to issuers of environmentally sustainable bonds. the parallel development of market practices based on commercially driven priorities that produce divergent results causes market fragmentation and risks further exacerbating inefficiencies in the functioning of the internal market. divergent standards and market practices make it difficult to compare different bonds , create uneven market conditions for issuers , cause additional barriers within the internal market , and risk greenwashing and distorting investment decisions.


### (7) a uniform set of specific requirements should therefore be laid down for bonds issued by financial or non-financial undertakings or sovereigns that voluntarily wish to use the designation ‘european green bond’ or ‘eugb’ for such bonds. specifying quality requirements for european green bonds in the form of a regulation should ensure that there are uniform conditions for the issuance of such bonds by preventing diverging national requirements that could result from a transposition of a directive , and should also ensure that those conditions are directly applicable to issuers of such bonds. issuers that voluntarily use the designation ‘european green bond’ or ‘eugb’ should follow the same rules across the union , to increase market efficiency by reducing discrepancies and thereby also reducing the costs of assessing those bonds for investors. ### (7) a uniform and harmonised set of specific requirements should therefore be laid down for bonds issued by financial or non-financial undertakings or sovereigns that voluntarily wish to use the designation ‘european green bond’ or ‘eugb’ for such bonds. specifying quality requirements for european green bonds in the form of a regulation should ensure that there are uniform conditions for the issuance of such bonds by preventing diverging national requirements that could result from a transposition of a directive , and should also ensure that those conditions are directly applicable to issuers of such bonds. issuers that voluntarily use the designation ‘european green bond’ or ‘eugb’ should follow the same rules across the union , to increase market efficiency by reducing discrepancies and thereby also reducing the costs of assessing those bonds for investors , who should over time come to regard sustainable finance as mainstream.


### (10) sovereigns are frequent issuers of environmentally sustainable bonds and should therefore also be allowed to issue ‘european green bonds’ , provided that the proceeds of such bonds are used to finance either assets or expenditure that meet the taxonomy , or assets or expenditure that will meet those requirements within a reasonably short period from the issuance of the bond concerned , which can be extended however where duly justified by the specific features of the economic activities and investments concerned. ### (10) sovereigns are frequent issuers of environmentally sustainable bonds and should therefore also be allowed to issue ‘european green bonds’ , provided that the proceeds of such bonds are used to finance either assets or expenditure that meet the taxonomy , or assets or expenditure that will meet those requirements within a reasonably short period from the issuance of the bond concerned , which can be extended however where duly justified by the specific features of the economic activities and investments concerned. european green bonds issued by the union could propel green public investment , with the aim of invigorating the economy of the union , levelling the playing field of its regions , and ensuring the union’s open strategic autonomy.


### (15) issuers of european green bonds should abide by their commitments to investors and allocate the proceeds of their bonds within a reasonably short time after issuance. at the same time , issuers should not be penalised for allocating bond proceeds to economic activities that do not yet meet the taxonomy requirements , but will do so within the five year period (or extended ten year period). issuers should in any case allocate all proceeds of their european green bonds before the maturity of each bond. ### (15) issuers of european green bonds should abide by their commitments to investors and allocate the proceeds of their bonds within a reasonably short time after issuance. at the same time , issuers should not be penalised for allocating bond proceeds to economic activities that do not yet meet the taxonomy requirements , but will do so within the five year period (or extended ten year period). issuers should in any case allocate all proceeds of their european green bonds before the maturity of each bond. once this regulation enters into force , the european securities and markets authority (esma) should develop draft regulatory technical standards to specify how taxonomy-alignment plans will be prepared. the commission should eventually adopt those regulatory technical standards as a delegated act.


### (9) the proceeds of european green bonds should be used to finance economic activities that have a lasting positive impact on the environment. such lasting positive impact can be attained in several ways. since fixed assets are long-term assets , a first way is to use the proceeds of such european green bonds to finance fixed tangible or fixed intangible assets that are not financial assets , provided that those fixed assets relate to economic activities that meet the requirements for environmentally sustainable economic activities set out in article 3 of regulation (eu) 2020/852 (‘taxonomy requirements’). since financial assets can be used to finance economic activities with a lasting positive impact on the environment , a second way is to use those proceeds to finance financial assets , provided that the proceeds from those financial assets are allocated to economic activities that meet the taxonomy requirements. since the assets of households can also have a long-term positive impact on the environment , those financial assets should also include the assets of households. since capital expenditure and selected operating expenditure can be used to acquire , upgrade , or maintain fixed assets , a third way is to use the proceeds of such bonds to finance capital and operating expenditures that relate to economic activities that meet the taxonomy requirements or that will meet those requirements within a reasonably short period from the issuance of the bond concerned , which can be extended however where duly justified by the specific features of the economic activities and investments concerned. for the reasons outlined above , the capital and operating expenditures should also include the expenditures of households. ### (9) notwithstanding the green bond markets already functioning prior to the entry into force of this regulation , for which best practices should be kept , fostered , and eventually standardised within the ‘eugb’ standard provided for in this regulation , the proceeds of european green bonds should be used to finance economic activities that have a lasting positive impact on the environment. such lasting positive impact can be attained in several ways. since fixed assets are long-term assets , a first way is to use the proceeds of such european green bonds to finance fixed tangible or fixed intangible assets that are not financial assets , provided that those fixed assets relate to economic activities that meet the requirements for environmentally sustainable economic activities set out in article 3 of regulation (eu) 2020/852 (‘taxonomy requirements’). since financial assets can be used to finance economic activities with a lasting positive impact on the environment , a second way is to use those proceeds to finance financial assets , provided that the proceeds from those financial assets are allocated to economic activities that meet the taxonomy requirements. since the assets of households can also have a long-term positive impact on the environment , those financial assets should also include the assets of households. since capital expenditure and selected operating expenditure can be used to acquire , upgrade , or maintain fixed assets , a third way is to use the proceeds of such bonds to finance capital and operating expenditures that relate to economic activities that meet the taxonomy requirements or that will meet those requirements within a reasonably short period from the issuance of the bond concerned , which can be extended however where duly justified by the specific features of the economic activities and investments concerned. for the reasons outlined above , the capital and operating expenditures should also include the expenditures of households.


### (27) to enable esma to perform its supervisory tasks , and in particular to compel external reviewers to put an end to an infringement , to supply complete and correct information or to comply with an investigation or an on-site inspection , esma should be able to impose penalties or periodic penalty payments. ### (27) to enable esma to perform its supervisory tasks , and in particular to compel external reviewers to put an end to an infringement , to supply complete and correct information or to comply with an investigation or an on-site inspection , esma should be able to impose penalties or periodic penalty payments. six months after the entry into force of this regulation , and after gaining a first understanding of the eugb standard market , esma should develop draft regulatory technical standards to counter possible conflicts of interest that might have occurred during those six months. the commission should eventually adopt those regulatory technical standards as a delegated act.


### (36) in order to encourage external reviewers to provide their services to the issuers of european green bonds as of the entry into application of this regulation , this regulation sets out a transitional regime for the first 30 months following the entry into force of this regulation. ### (36) in order to encourage external reviewers to provide their services to the issuers of european green bonds as of the entry into application of this regulation , this regulation sets out a transitional regime for the first 30 months following the entry into force of this regulation. sustainable bonds already issued before the entry into force of this regulation should be invited by esma to comply with this regulation as regards disclosure requirements and the use of external reviewers.


### (14) the efficient usage of data leads to better monitoring and compliance of firms. therefore , both direct and indirect supervision by the authority and supervisory authorities of all obliged entities across the system should rely on expedient access to relevant data and information about the obliged entities themselves and the supervisory actions and measures taken towards them. to that end , the authority should establish a central aml/cft database with information collected from all supervisory authorities , and should make such information selectively available to any supervisory authority within the system. this data should also cover withdrawal of authorisation procedures , fit and proper assessments of shareholders and members of individual obliged entities as this will enable relevant authorities to duly consider possible shortcomings of specific entities and individuals that might have materialised in other member states. the database should also include statistical information about supervisory and other public authorities involved in aml/cft supervision. such information would enable effective oversight by the authority of the proper functioning and effectiveness of the aml/cft supervisory system. the information from the database would enable the authority to react in a timely manner to potential weaknesses and cases of non-compliance by non-selected obliged entities. pursuant to article 24 of council regulation (eu) 2017/193934 , the authority will without undue delay report to the eppo any criminal conduct in respect of which it could exercise its competence in accordance with article 22 and article 25(2) and (3) of that regulation. pursuant to article 8 of regulation 883/201335 , the authority will transmit to olaf without delay any information relating to possible cases of fraud , corruption or any other illegal activity affecting the financial interests of the union. ### (14) the efficient usage of data leads to better monitoring and compliance of firms. therefore , both direct and indirect supervision by the authority and supervisory authorities of all obliged entities across the system should rely on expedient access to relevant data and information about the obliged entities themselves and the supervisory actions and measures taken towards them. to that end , the authority should establish a central aml/cft database with information collected from all supervisory authorities , and should make such information selectively available to any supervisory authority within the system and also to aml compliance entities. this data should also cover withdrawal of authorisation procedures , fit and proper assessments of shareholders and members of individual obliged entities as this will enable relevant authorities to duly consider possible shortcomings of specific entities and individuals that might have materialised in other member states. the database should also include statistical information about supervisory and other public authorities involved in aml/cft supervision. such information would enable effective oversight by the authority of the proper functioning and effectiveness of the aml/cft supervisory system. the information from the database would enable the authority to react in a timely manner to potential weaknesses and cases of non-compliance by non-selected obliged entities. pursuant to article 24 of council regulation (eu) 2017/193934 , the authority will without undue delay report to the eppo any criminal conduct in respect of which it could exercise its competence in accordance with article 22 and article 25(2) and (3) of that regulation. pursuant to article 8 of regulation 883/201335 , the authority will transmit to olaf without delay any information relating to possible cases of fraud , corruption or any other illegal activity affecting the financial interests of the union.


### (17) in order to ensure that only the riskiest obliged entities among those with significant cross-border operations are supervised directly at the level of the union , the assessment of their inherent risk should be harmonised. currently , there are various national approaches and supervisory authorities use distinct benchmarks for assessment and classification of inherent ml/tf risk of obliged entities. using these national methodologies for selection of entities for direct supervision at union level could lead to a different playing field among them. therefore , the authority should be empowered to develop regulatory technical standards laying out a harmonised methodology and benchmarks for categorising the inherent ml/tf risk as low , medium , substantial , or high. the methodology should be tailored to particular types of risks and therefore should follow different categories of obliged entities which are financial institutions in accordance with the regulation of the european parliament and of the council on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing [op please insert the next number for com(2021)420]. that methodology should be sufficiently detailed and should establish specific quantitative and qualitative benchmarks considering at least the risk factors related to types of customers served , products and services offered , and geographical areas , including third country jurisdictions that obliged entities operate in or are related to. specifically , each assessed obliged entity would have its inherent risk profile classified in each member state where it operates in a manner consistent with the classification of any other obliged entity in the union. the quantitative and qualitative benchmarks would allow such classification to be objective and not dependent on the discretion of a given supervisory authority in a member state , or the discretion of the authority. ### (17) in order to ensure that only the riskiest obliged entities among those with significant cross-border operations are supervised directly at the level of the union , the assessment of their inherent risk should be harmonised. currently , there are various national approaches and supervisory authorities use distinct benchmarks for assessment and classification of inherent ml/tf risk of obliged entities. using these national methodologies for selection of entities for direct supervision at union level could lead to a different playing field among them. therefore , the authority should be empowered to develop regulatory technical standards laying out a harmonised methodology and benchmarks for categorising the inherent ml/tf risk as low , medium , substantial , or high. the methodology should be tailored to particular types of risks and therefore should follow different categories of obliged entities which are financial institutions in accordance with the regulation of the european parliament and of the council on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing [op please insert the next number for com(2021)420]. that methodology should be sufficiently detailed and should establish specific quantitative and qualitative benchmarks considering at least the risk factors related to types of customers served , products and services offered , period of activity and geographical areas , including third country jurisdictions that obliged entities operate in or are related to. specifically , each assessed obliged entity would have its inherent risk profile classified in each member state where it operates in a manner consistent with the classification of any other obliged entity in the union. the quantitative and qualitative benchmarks would allow such classification to be objective and not dependent on the discretion of a given supervisory authority in a member state , or the discretion of the authority.


### (60) public-private partnerships (‘ppps’) have become increasingly important cooperation and information exchange fora between fius , various national supervisory and law enforcement authorities and obliged entities in some member states. where the authority would act as direct supervisor of selected obliged entities which are part of a ppp in any member state , it could be beneficial for the authority to also participate therein , on conditions determined by the relevant national public authority or authorities that set up such ppp , and with their explicit agreement. ### (60) public-private partnerships (‘ppps’) have become increasingly important cooperation and information exchange fora between fius , various national supervisory and law enforcement authorities and obliged entities in some member states. where the authority would act as direct supervisor of selected obliged entities which are part of a ppp in any member state , it could be beneficial for the authority to also participate therein , on conditions determined by the relevant national public authority or authorities that set up such ppp , and with their explicit agreement. the authority may , by its initiative , create ppps in cases where it considers they would be valuable for the achievement of the objectives set out in the regulation. in such ppps , the authority shall invite the entities it considers appropriate. the authority may also invite aml compliance entities.


### 4. any supervisory authority or any non-aml authority may address to the authority a reasoned request for information collected pursuant to paragraph 2 that is relevant for its supervisory activities. the authority shall assess those requests and provide the information requested by the supervisory authorities or non-aml authorities on a need-to-know basis and confidential basis and in a timely manner. the authority shall inform the authority that has initially provided the requested information , of the identity of the requesting supervisory or other authority , the identity of an obliged entity concerned , the reason for the information request as well as whether the information has been provided to the requesting authority. ### 4. any supervisory authority , any non-aml authority and aml compliance entity may address to the authority a reasoned request for information collected pursuant to paragraph 2 and paragraph 3 that is relevant for its supervisory activities. the authority shall assess those requests and provide the information requested by the supervisory authorities or non-aml authorities or aml compliance entity on a need-to-know basis and confidential basis and in a timely manner. when the request is made by an authority , the authority shall inform the authority that has initially provided the requested information , of the identity of the requesting supervisory or other authority , the identity of an obliged entity concerned , the reason for the information request as well as whether the information has been provided to the requesting authority.


### (2) an executive board , which shall exercise the tasks set out in article 53: ### deleted


### [...] ### deleted


### 2. the persons referred to in paragraph 1 or their representatives and , in the case of legal persons or associations having no legal personality , the persons authorised to represent them by law or by their constitution , shall supply the information requested. lawyers duly authorised to act may supply the information on behalf of their clients. the latter shall remain fully responsible if the information supplied is incomplete , incorrect or misleading. ### 2. the persons referred to in paragraph 1 or their representatives and , in the case of legal persons or associations having no legal personality , the persons authorised to represent them by law or by their constitution , shall supply the information requested in a timely manner. lawyers duly authorised to act may supply the information on behalf of their clients. the latter shall remain fully responsible if the information supplied is incomplete , incorrect or misleading.


### 1. in order to carry out the tasks conferred on it by this regulation , the authority may , subject to prior notification to the financial supervisor concerned , conduct all necessary on-site inspections at the business premises of the legal persons referred to in article 16. where the proper conduct and efficiency of the inspection so require , the authority may carry out the on-site inspection without prior announcement to those legal persons. ### 1. in order to carry out the tasks conferred on it by this regulation , the authority may , subject to prior notification to the financial supervisor concerned , conduct all necessary on-site inspections at the business premises of the legal persons referred to in article 16. where the proper conduct and efficiency of the inspection so require , including where the inspection is related to an ongoing investigation carried out under article 17 , the authority may carry out the on-site inspection without prior announcement to those legal persons.


### (11) in may 2011 , the secretaries-general of the union institutions and bodies decided to establish a pre-configuration team for a computer emergency response team for the union’s institutions , bodies and agencies (cert-eu) supervised by an inter-institutional steering board. in july 2012 , the secretaries-general confirmed the practical arrangements and agreed to maintain cert-eu as a permanent entity to continue to help improve the overall level of information technology security of the union’s institutions , bodies and agencies as an example of visible inter-institutional cooperation in cybersecurity. in september 2012 , cert-eu was established as a taskforce of the european commission with an interinstitutional mandate. in december 2017 , the union institutions and bodies concluded an interinstitutional arrangement on the organisation and operation of cert-eu3 . this arrangement should continue to evolve to support the implementation of this regulation. ### (11) in may 2011 , the secretaries-general of the union institutions and bodies decided to establish a pre-configuration team for a computer emergency response team for the union’s institutions , bodies and agencies (cert-eu) supervised by an inter-institutional steering board. in july 2012 , the secretaries-general confirmed the practical arrangements and agreed to maintain cert-eu as a permanent entity to continue to help improve the overall level of information technology security of the union’s institutions , bodies and agencies as an example of visible inter-institutional cooperation in cybersecurity. in september 2012 , cert-eu was established as a taskforce of the european commission with an interinstitutional mandate. in december 2017 , the union institutions and bodies concluded an interinstitutional arrangement on the organisation and operation of cert-eu3 . this arrangement should continue to evolve to support the implementation of this regulation and be evaluated on a regular basis in light of future negotiations of long-term budget frameworks allowing for further decisions to be made with respect to the functioning and institutional role of cert-eu , including the possible establishment of cert-eu as a union office.


### 4. each union institution , body and agency shall have effective mechanisms in place to ensure that an adequate percentage of the it budget is spent on cybersecurity. ### 4. each union institution , body and agency shall have effective mechanisms in place to ensure that an adequate percentage of the ict budget is spent on cybersecurity.


### 2. for the application of administrative and financial procedures , the head of cert-eu shall act under the authority of the commission. ### 2. for the application of administrative and financial procedures , the head of cert-eu shall act under the authority of the commission under the supervision of the iicb.


### (4) the union institutions , bodies and agencies are attractive targets who face highly skilled and well-resourced threat actors as well as other threats. at the same time , the level and maturity of cyber resilience and the ability to detect and respond to malicious cyber activities varies significantly across those entities. it is thus necessary for the functioning of the european administration that the institutions , bodies and agencies of the union achieve a high common level of cybersecurity through a cybersecurity baseline (a set of minimum cybersecurity rules with which network and information systems and their operators and users have to be compliant to minimise cybersecurity risks) , information exchange and collaboration. ### (4) the union institutions , bodies and agencies are attractive targets who face highly skilled and well-resourced threat actors as well as other threats. at the same time , the level and maturity of cyber resilience and the ability to detect and respond to malicious cyber activities varies significantly across those entities. it is thus necessary for the functioning of the european administration that the institutions , bodies and agencies of the union achieve a high common level of cybersecurity through the implementation of cybersecurity risk management measures commensurate to the respective risks posed , information exchange and collaboration.


### this regulation applies to the management , governance and control of cybersecurity risks by all union institutions , bodies and agencies and to the organisation and operation of cert-eu and the interinstitutional cybersecurity board. ### this regulation applies to all union institutions , bodies , offices and agencies and to the functioning , organisation and operation of cert-eu and the iicb.


### 3. the processing of personal data carried out under this regulation shall be subject to regulation (eu) 2018/1725 of the european parliament and of the council. ### deleted


### 1. to enable cert-eu to coordinate vulnerability management and incident response , it may request union institutions , bodies and agencies to provide it with information from their respective it system inventories that is relevant for the cert-eu support. the requested institution , body or agency shall transmit the requested information , and any subsequent updates thereto , without undue delay. ### 1. to enable cert-eu effectively perform its mission tasks in accordance with article 12 of this regulation , it may request union institutions , bodies and agencies to provide it with information from their respective ict system inventories that is relevant for the cert-eu support. the requested institution , body or agency shall transmit the requested information , and any subsequent updates thereto , without undue delay.


### 4. the sharing obligations shall not extend to eu classified information (euci) and to information that a union institution , body or agency has received from a member state security or intelligence service or law enforcement agency under the explicit condition that it will not be shared with cert-eu. ### 4. the cybersecurity information sharing arrangements and obligations obligations shall not extend to eu classified information (euci) and to information that a union institution , body or agency has received from a member state security or intelligence service or law enforcement agency under the explicit condition that it will not be shared with cert-eu.


### 5. the notification obligations shall not extend to euci and to information that a union institution , body or agency has received from a member state security or intelligence service or law enforcement agency under the explicit condition that it will not be shared with cert-eu. ### 5. the reporting obligations shall not extend to euci and to information that a union institution , body or agency has received from a member state security or intelligence service or law enforcement agency under the explicit condition that it will not be shared with cert-eu.


### (6) to reach a high common level of cybersecurity , it is necessary that each union institution , body and agency establishes an internal cybersecurity risk management , governance and control framework that ensures an effective and prudent management of all cybersecurity risks , and takes account of business continuity and crisis management. ### (6) to reach a high common level of cybersecurity , it is necessary that each union institution , body and agency establishes an internal cybersecurity risk management , governance and control framework that ensures an effective and prudent management of all cybersecurity risks , and takes account of business continuity and crisis management. the framework should lay down cybersecurity policies and priorities for the security of network and information systems encompassing the entirety of the ict environment. the framework should be reviewed on a regular basis and at least every three years on the basis of key performance indicators to ensure that strategic objectives are met.


### (7) the differences between union institutions , bodies and agencies require flexibility in the implementation since one size will not fit all. the measures for a high common level of cybersecurity should not include any obligations directly interfering with the exercise of the missions of union institutions , bodies and agencies or encroaching on their institutional autonomy. thus , those institutions , bodies and agencies should establish their own frameworks for cybersecurity risk management , governance and control , and adopt their own baselines and cybersecurity plans. ### (7) the differences between union institutions , bodies and agencies require flexibility in the implementation since one size will not fit all. the measures for a high common level of cybersecurity should not include any obligations directly interfering with the exercise of the missions of union institutions , bodies and agencies or encroaching on their institutional autonomy. thus , those institutions , bodies and agencies should establish their own frameworks for cybersecurity risk management , governance and control , and adopt their own cybersecurity risk management measures and cybersecurity plans. union institutions , bodies , offices and agencies should continuously evaluate the effectiveness of the adopted risk management measures and their proportionality relative to the identified risks , and where necessary , adjust and revise accordingly their frameworks and plans on the basis of the results of the cybersecurity maturity assessments.


### (9) a high common level of cybersecurity requires cybersecurity to come under the oversight of the highest level of management of each union institution , body and agency , who should approve a cybersecurity baseline that should address the risks identified under the framework to be established by each institution , body and agency. addressing the cybersecurity culture , i.e. the daily practice of cybersecurity , is an integral part of a cybersecurity baseline in all union institutions , bodies and agencies. ### (9) a high common level of cybersecurity requires cybersecurity to come under the oversight of the highest level of management of each union institution , body and agency , who should oversee the implementation of the provisions of this regulation and approve the establishment , and any subsequent revisions thereof , of the risk management and control framework , the corresponding cybersecurity risk management measures addressing the risks identified in the framework and the cybersecurity plans of each union institution , body , office and agency. addressing the cybersecurity culture , i.e. the daily practice of cybersecurity , is an integral part of a cybersecurity risk management , governance and control framework and the corresponding cybersecurity risk management measures in all union institutions , bodies , offices and agencies.


### (13) many cyberattacks are part of wider campaigns that target groups of union institutions , bodies and agencies or communities of interest that include union institutions , bodies and agencies. to enable proactive detection , incident response or mitigating measures , union institutions , bodies and agencies should notify cert-eu of significant cyber threats , significant vulnerabilities and significant incidents and share appropriate technical details that enable detection or mitigation of , as well as response to , similar cyber threats , vulnerabilities and incidents in other union institutions , bodies and agencies. following the same approach as the one envisaged in directive [proposal nis 2] , where entities become aware of a significant incident they should be required to submit an initial notification to cert-eu within 24 hours. such information exchange should enable cert-eu to disseminate the information to other union institutions , bodies and agencies , as well as to appropriate counterparts , to help protect the union it environments and the union’s counterparts’ it environments against similar incidents , threats and vulnerabilities. ### (13) many cyberattacks are part of wider campaigns that target groups of union institutions , bodies and agencies or communities of interest that include union institutions , bodies and agencies. to enable proactive detection , incident response or mitigating measures , and recovery from significant incidents , union institutions , bodies and agencies should notify cert-eu of significant incidents and share appropriate technical details that enable detection or mitigation of , as well as response to and recovery from similar incidents in other union institutions , bodies and agencies. following the same approach as the one envisaged in directive [proposal nis 2] , where union institutions , bodies , offices and agencies become aware of a significant incident they should be required to submit an early warning to cert-eu within 24 hours. such information exchange should enable cert-eu to disseminate the information to other union institutions , bodies and agencies , as well as to appropriate counterparts , to help protect the union it environments and the union’s counterparts’ it environments against similar incidents , threats and vulnerabilities.


### (17) cert-eu should have the mission to contribute to the security of the it environment of all union institutions , bodies and agencies. cert-eu should act as the equivalent of the designated coordinator for the union institutions , bodies and agencies , for the purpose of coordinated vulnerability disclosure to the european vulnerability registry as referred to in article 6 of directive [proposal nis 2]. ### (17) cert-eu should have the mission to contribute to the security of the ict environment of all union institutions , bodies , offices and agencies. where appropriate , and in coordination with the union institutions , bodies , offices and agencies , cert-eu may propose to the iicb for its approval , a proposal for a coordinated cyber insurance policy covering union institutions , bodies , offices and agencies , in order to establish first and third-party coverage to address the potential impact of incidents. cert-eu should act as the equivalent of the designated coordinator for the union institutions , bodies and agencies , for the purpose of coordinated vulnerability disclosure to the european vulnerability registry as referred to in article 6 of directive [proposal nis 2].


### (20) in supporting operational cybersecurity , cert-eu should make use of the available expertise of the european union agency for cybersecurity through structured cooperation as provided for in regulation (eu) 2019/881 of the european parliament and of the council5 . where appropriate , dedicated arrangements between the two entities should be established to define the practical implementation of such cooperation and to avoid the duplication of activities. cert-eu should cooperate with the european union agency for cybersecurity on threat analysis and share its threat landscape report with the agency on a regular basis. ### (20) in supporting operational cybersecurity , cert-eu should make use of the available expertise of the european union agency for cybersecurity (enisa) through structured cooperation as provided for in regulation (eu) 2019/881 of the european parliament and of the council5 . where appropriate , dedicated arrangements between the two entities should be established to define the practical implementation of such cooperation and to avoid the duplication of activities. cert-eu should cooperate with enisa on threat analysis and share its threat landscape report with the agency on a regular basis.


### this regulation lays down: ### 2. to that end , this regulation lays down:


### obligations on union institutions , bodies and agencies to establish an internal cybersecurity risk management , governance and control framework; ### obligations on union institutions , bodies , offices and agencies to establish a cybersecurity risk management , governance and control framework;


### rules on the organisation and operation of the cybersecurity centre for the union institutions , bodies and agencies (cert-eu) and on the organisation and operation of the interinstitutional cybersecurity board. ### rules on the organisation , tasks and operation of the cybersecurity centre for the union institutions , bodies , offices and agencies (cert-eu) and on the functioning , organisation and operation of the interinstitutional cybersecurity board (iicb).


### (2) ‘network and information system’ means network and information system within the meaning of article 4(1) of directive [proposal nis 2]; ### (2) ‘network and information system’ means network and information system as defined in article 4(1) of directive [proposal nis 2];


### (4) ‘cybersecurity’ means cybersecurity within the meaning of article 4(3) of directive [proposal nis 2]; ### (4) ‘cybersecurity’ means cybersecurity as defined in article 2(1) of regulation (eu) 2019/881 of the european parliament and of the council7a;


### (5) ‘highest level of management’ means a manager , management or coordination and oversight body at the most senior administrative level , taking account of the high-level governance arrangements in each union institution , body or agency; ### (5) ‘highest level of management’ means a manager , management or coordination and oversight body at the most senior administrative level with a mandate to make or authorise decisions , taking account of the high-level governance arrangements in each union institution , body or agency;


### (7) ‘significant incident’ means any incident unless it has limited impact and is likely to be already well understood in terms of method or technology; ### deleted


### (8) ‘major attack’ means any incident requiring more resources than are available at the affected union institution , body or agency and at cert-eu; ### (8) ‘major incident' means any incident whose disruption exceeds cert-eu’s or any individual union institution , body ,office or agency’s capacity to respond to it or with a significant impact on at least two union institutions , bodies , offices and agencies;


### (11) ‘significant cyber threat’ means a cyber threat with the intention , opportunity and capability to cause a significant incident; ### (11) ‘significant cyber threat’ means a cyber threat as defined in article 4(7a) of directive [proposal nis 2];


### (14) ‘cybersecurity risk’ means any reasonably identifiable circumstance or event having a potential adverse effect on the security of network and information systems; ### (14) ‘risk’ means any risk as defined in article 4(7b) of directive [proposal nis 2];


### (16) ‘cybersecurity baseline’ means a set of minimum cybersecurity rules with which network and information systems and their operators and users must be compliant , to minimise cybersecurity risks. ### deleted


### risk management , governance and control ### risk management , governance and control framework


### 1. each union institution , body and agency shall establish its own internal cybersecurity risk management , governance and control framework (‘the framework’) in support of the entity’s mission and exercising its institutional autonomy. this work shall be overseen by the entity’s highest level of management to ensure an effective and prudent management of all cybersecurity risks. the framework shall be in place by …. at the latest [15 months after the entry into force of this regulation]. ### 1. each union institution , body and agency shall establish its own cybersecurity risk management , governance and control framework (‘the framework’) in support of the entity’s mission and exercising its institutional autonomy. this work shall be overseen by the entity’s highest level of management to ensure an effective and prudent management of all cybersecurity risks. the framework shall be in place by …. at the latest [15 months after the entry into force of this regulation].


### 2. the framework shall cover the entirety of the it environment of the concerned institution , body or agency , including any on-premise it environment , outsourced assets and services in cloud computing environments or hosted by third parties , mobile devices , corporate networks , business networks not connected to the internet and any devices connected to the it environment. the framework shall take account of business continuity and crisis management and it shall consider supply chain security as well as the management of human risks that could impact the cybersecurity of the concerned union institution , body or agency. ### 2. the framework shall cover the entirety of the ict environment of the concerned union institution , body , office or agency. the framework shall take account of business continuity and crisis management and it shall consider supply chain security as well as the management of human risks and all other relevant technical , operational and organisational risks that could impact the cybersecurity of the concerned union institution , body or agency.


### 3. the highest level of management of each union institution , body and agency shall provide oversight over the compliance of their organisation with the obligations related to cybersecurity risk management , governance , and control , without prejudice to the formal responsibilities of other levels of management for compliance and risk management in their respective areas of responsibility. ### 3. the highest level of management of each union institution , body , office and agency shall oversee the compliance of its organisation with the obligations related to cybersecurity risk management , governance , and control , without prejudice to the formal responsibilities of other levels of management for compliance and risk management in their respective areas of responsibility.


### cybersecurity baseline ### cybersecurity risk management measures


### 1. the highest level of management of each union institution , body and agency shall approve the entity’s own cybersecurity baseline to address the risks identified under the framework referred to in article 4(1). it shall do so in support of its mission and exercising its institutional autonomy. the cybersecurity baseline shall be in place by …. at the latest [18 months after the entry into force of this regulation] and shall address the domains listed in annex i and the measures listed in annex ii. ### 1. the highest level of management of each union institution , body and agency shall approve the entity’s own cybersecurity risk management measures to address the risks identified under the framework referred to in article 4(1). having regard to the state of the art and , where applicable , relevant european and international standards , or available european cybersecurity certificates as defined in article 2 of regulation (eu) 2019/881 , those risk management measures shall ensure a level of security of network and information systems across the entirety of the ict environment commensurate to the risks identified under the framework referred to in article 4(1). when assessing the proportionality of those measures , due account shall be taken of the degree of the union institution , body , office or agency’s exposure to risks , its size , the likelihood of occurrence of incidents and their severity , including their societal , economic and interinstitutional impact.


### 2. the senior management of each union institution , body and agency shall follow specific trainings on a regular basis to gain sufficient knowledge and skills in order to apprehend and assess cybersecurity risk and management practices and their impact on the operations of the organisation. ### 2. the senior management of each union institution , body , office and agency as well as all relevant staff tasked with implementing the cybersecurity risks management measures and obligations of this regulation shall follow specific trainings on a regular basis to gain sufficient knowledge and skills in order to apprehend and assess cybersecurity risk and management practices and their impact on the operations of the organisation.


### 6 maturity assessments ### 6 cybersecurity maturity assessments


### 1. following the conclusions derived from the maturity assessment and considering the assets and risks identified pursuant to article 4 , the highest level of management of each union institution , body and agency shall approve a cybersecurity plan without undue delay after the establishment of the risk management , governance and control framework and the cybersecurity baseline. the plan shall aim at increasing the overall cybersecurity of the concerned entity and shall thereby contribute to the achievement or enhancement of a high common level of cybersecurity among all union institutions , bodies and agencies. to support the entity’s mission on the basis of its institutional autonomy , the plan shall at least include the domains listed in annex i , the measures listed in annex ii , as well as measures related to incident preparedness , response and recovery , such as security monitoring and logging. the plan shall be revised at least every three years , following the maturity assessments carried out pursuant to article 6. ### 1. following the conclusions derived from the maturity cybersecurity assessment and considering risks identified pursuant to article 4 , the highest level of management of each union institution , body , office and agency shall approve a cybersecurity plan without undue delay after the establishment of the risk management , governance and control framework , and the cybersecurity risk management measures. the cybersecurity plan shall aim at increasing the overall cybersecurity of the concerned entity union institution , body , office or agency and shall thereby contribute to the achievement or enhancement of a high common level of cybersecurity among all union institutions , bodies , offices and agencies. to support the union institution , body , office or agency's mission on the basis of its institutional autonomy , the plan shall at least include the cybersecurity risk management measures referred to in article 5 (1a) and 5(2a). the cybersecurity plan shall be revised at least every three years , or where necessary , with any substantial revision of the framework referred to in article 4 , following the cybersecurity maturity assessments carried out pursuant to article 6.


### 2. the cybersecurity plan shall include staff members’ roles and responsibilities for its implementation. ### 2. the cybersecurity plan shall include relevant staff members’ roles and responsibilities for its implementation , including detailed job descriptions for technical and operational staff as well as all relevant processes underpinning performance evaluation.


### 3. the cybersecurity plan shall consider any applicable guidance documents and recommendations issued by cert-eu. ### 3. the cybersecurity plan shall consider any applicable guidance documents and recommendations issued by cert-eu in accordance with article 13 and another applicable or targeted recommendations issued by the iicb and cert-eu.


### 1. upon completion of maturity assessments , the union institutions , bodies and agencies shall submit these to the interinstitutional cybersecurity board. upon completion of security plans , the union institutions , bodies and agencies shall notify the interinstitutional cybersecurity board of the completion. upon request of the board , they shall report on specific aspects of this chapter. ### 1. upon completion of their respective cybersecurity maturity assessments referred to in article 6 and cybersecurity plans referred to in article 7 , the union institutions , bodies , offices and agencies shall submit these to the iicb.


### the european union agency for cybersecurity. ### the european union agency for cybersecurity (enisa).


### 6. the iicb shall meet at the initiative of its chair , at the request of cert-eu or at the request of any of its members. ### 6. the iicb shall meet at the initiative of its chair , and at least two times a year , at the request of cert-eu or at the request of any of its members.


### review any reports requested from cert-eu on the state of implementation of this regulation by the union institutions , bodies and agencies; ### request reports from cert-eu on the state of implementation of this regulation by the union institutions , bodies and agencies;


### the iicb shall monitor the implementation of this regulation and of adopted guidance documents , recommendations and calls for action by the union institutions , bodies and agencies. where the iicb finds that union institutions , bodies or agencies have not effectively applied or implemented this regulation or guidance documents , recommendations and calls for action issued under this regulation , it may , without prejudice to the internal procedures of the relevant union institution , body or agency: ### where the iicb finds that union institutions , bodies or agencies have not effectively applied or implemented this regulation or guidance documents , recommendations and calls for action issued under this regulation , it may , without prejudice to the internal procedures of the relevant union institution , body or agency:


### 1. the mission of cert-eu , the autonomous interinstitutional cybersecurity centre for all union institutions , bodies and agencies , shall be to contribute to the security of the unclassified it environment of all union institutions , bodies and agencies by advising them on cybersecurity , by helping them to prevent , detect , mitigate and respond to incidents and by acting as their cybersecurity information exchange and incident response coordination hub. ### 1. the mission of cert-eu , the autonomous interinstitutional cybersecurity centre for all union institutions , bodies and agencies , shall be to contribute to the security of the unclassified ict environment of all union institutions , bodies and agencies by advising them on cybersecurity , by helping them to prevent , detect , mitigate and respond to and recover from incidents and by acting as their cybersecurity information exchange and incident response coordination hub.


### 6. cert-eu may organise cybersecurity exercises or recommend participation in existing exercises , in close cooperation with the european union agency for cybersecurity whenever applicable , to test the level of cybersecurity of the union institutions , bodies and agencies. ### 6. cert-eu may organise cybersecurity exercises or recommend participation in existing exercises , in close cooperation with enisa whenever applicable , to test the level of cybersecurity of the union institutions , bodies and agencies.


### 7. cert-eu may provide assistance to union institutions , bodies and agencies regarding incidents in classified it environments if it is explicitly requested to do so by the constituent concerned. ### 7. cert-eu may provide assistance to union institutions , bodies and agencies regarding incidents in classified ict environments if it is explicitly requested to do so by the constituent concerned. the provisions and obligations on all union institutions , bodies , offices and agencies set out in chapter v of this regulation shall not apply to incidents in classified ict environments unless an individual union institution , body office or agency explicitly and voluntarily apply them in order to seek actionable assistance from cert-eu or otherwise contribute to situational awareness at the union level.


### modalities for or improvements to cybersecurity risk management and the cybersecurity baseline; ### modalities for or improvements to cybersecurity risk management and cybersecurity risk management measures;


### modalities for maturity assessments and cybersecurity plans; and ### modalities for cybersecurity maturity assessments and cybersecurity plans; and


### the head of cert-eu shall regularly submit reports to the iicb and the iicb chair on the performance of cert-eu , financial planning , revenue , implementation of the budget , service level agreements and written agreements entered into , cooperation with counterparts and partners , and missions undertaken by staff , including the reports referred to in article 10(1). ### the head of cert-eu shall regularly submit reports to the iicb and the iicb chair , and submit ad-hoc reports to the iicb upon its request , on the performance of cert-eu , financial planning , revenue , implementation of the budget , service level agreements and written agreements entered into , cooperation with counterparts and partners , and missions undertaken by staff , including the reports referred to in article 10.


### 1. the commission , after having obtained the unanimous approval of the iicb , shall appoint the head of cert-eu. the iicb shall be consulted at all stages of the procedure prior to the appointment of the head of cert-eu , in particular in drafting vacancy notices , examining applications and appointing selection boards in relation to this post. ### deleted


### 19 sharing obligations ### 19 cybersecurity information sharing arrangements and obligations


### 20 notification obligations ### 20 reporting obligations


### all union institutions , bodies and agencies shall make an initial notification to cert-eu of significant cyber threats , significant vulnerabilities and significant incidents without undue delay and in any event no later than 24 hours after becoming aware of them. ### deleted


### all union institutions , bodies and agencies shall make an initial notification to cert-eu of significant cyber threats , significant vulnerabilities and significant incidents without undue delay and in any event no later than 24 hours after becoming aware of them. ### all union institutions , bodies , offices and agencies shall report , without undue delay to cert-eu in accordance with paragraph 2(b) of any incident having a significant impact.


### in duly justified cases and in agreement with cert-eu , the union institution , body or agency concerned can deviate from the deadline laid down in the previous paragraph. ### deleted


### 2. the union institutions , bodies and agencies shall further notify to cert-eu without undue delay appropriate technical details of cyber threats , vulnerabilities and incidents that enable detection , incident response or mitigating measures. the notification shall include if available: ### deleted


### 3. cert-eu shall submit to enisa on a monthly basis a summary report including anonymised and aggregated data on significant cyber threats , significant vulnerabilities and significant incidents notified in accordance with paragraph 1. ### 3. cert-eu shall submit to enisa on a monthly basis a summary report including anonymised and aggregated data on significant incidents notified in accordance with paragraph 2(b) and cyber threats , incidents , near misses and vulnerabilities notified in accordance with article 19(1).


### 4. the iicb may issue guidance documents or recommendations concerning the modalities and content of the notification. cert-eu shall disseminate the appropriate technical details to enable proactive detection , incident response or mitigating measures by union institutions , bodies and agencies. ### 4. the iicb may issue guidance documents or recommendations concerning the modalities and content of the notification. when preparing such guidance documents or recommendations , the iicb shall take into account the specifications made by any implementing acts adopted by the commission specifying the type of information , the format and the procedure of a notification submitted pursuant to article 20 (11) of directive [proposal nis2]. cert-eu shall disseminate the appropriate technical details to enable proactive detection , incident response or mitigating measures by union institutions , bodies , offices and agencies.


### 3. cert-eu shall support union institutions , bodies and agencies regarding situational awareness of cyber threats , vulnerabilities and incidents. ### 3. cert-eu , in cooperation with enisa , shall support union institutions , bodies and agencies regarding situational awareness of cyber threats , vulnerabilities and incidents.


### major attacks ### major incidents


### 1. cert-eu shall coordinate among union institutions , bodies and agencies responses to major attacks. it shall maintain an inventory of technical expertise that would be needed for incident response in the event of such attacks. ### 1. cert-eu shall coordinate among union institutions , bodies and agencies responses to major incidents. it shall maintain an inventory of technical expertise that would be needed for incident response in the event of such major incidents and assist the iicb in coordinating union institutions , bodies , offices and agencies’ cyber crisis management plans for major incidents referred to in article 10(if).


### 3. with the approval of the concerned union institutions , bodies and agencies , cert-eu may also call on experts from the list referred to in paragraph 2 for contributing to the response to a major attack in a member state , in line with the joint cyber unit’s operating procedures. ### 3. with the approval of the concerned union institutions , bodies and agencies , cert-eu may also call on experts from the list referred to in paragraph 2 for contributing to the response to a major incident in a member state , in line with the joint cyber unit’s operating procedures.


### 3. the commission shall evaluate the functioning of this regulation and report to the european parliament , the council , the european economic and social committee and the committee of the regions no sooner than five years after the date of entry into force. ### 3. the commission shall evaluate the functioning of this regulation and report to the european parliament , the council , the european economic and social committee and the committee of the regions no later than five years after the date of entry into force.


### the following domains shall be addressed in the cybersecurity baseline: ### deleted


### union institutions , bodies and agencies shall address at least the following specific cybersecurity measures in the implementation of the cybersecurity baseline and in their cybersecurity plans , in line with the guidance documents and recommendations from the iicb: ### deleted


### 1. stresses that the policy-first-driven european financial architecture for development (efad) should be guided by the principles and objectives set out in the un 2030 agenda for sustainable development , the paris agreement and the addis ababa action agenda; ### 1. stresses that the policy-first-driven european financial architecture for development (efad) should be guided by the principles and objectives set out in the un 2030 agenda for sustainable development , the paris agreement and the addis ababa action agenda , as well as environmental , social , human rights and rule of law standards;


### 2. strongly insists that efad must strengthen the strategic partnerships between the european union and its global development partners; reiterates that such partnerships should always be based on mutual respect and dignity , shared interests and values; ### 2. strongly insists that efad must strengthen the strategic partnerships between the european union and its global development partners; reiterates that such partnerships should always be based on mutual respect and dignity , shared interests and values and the recognition of country ownership regarding the implementation of developmental strategies


### 3. underlines the interconnection between development and security; highlights the role that development plays in preventing conflicts , ensuring durable exits from conflicts and bolstering crisis management; insists on the importance of further developing a well-tailored development-security nexus; ### 3. underlines the interconnection between development and security; highlights the role that development plays in preventing conflicts , ensuring durable exits from conflicts and bolstering crisis management; insists on the importance of further developing a well-tailored development-security nexus; recalls , however , that official development assistance should not be conditional upon the cooperation of partner countries in controlling migratory flows;


### 4. emphasises the role of a collective , coherent eu approach , which could be effective in helping to foster the expansion of social protection systems in developing countries; ### 4. emphasises the role of a collective , coherent eu approach , which could be effective in helping to foster the expansion of social protection systems in developing countries that are in line with all the relevant ilo instruments on social security;


### 5. underlines that consistency across all eu financing instruments , initiatives and strategies is crucial in order to maximise the eu’s global response to sustainable growth , development and peace; ### 5. underlines that consistency across all eu financing instruments , initiatives , strategies and policies is crucial in order to maximise the eu’s global response to sustainable growth , development and peace;


### 6. is alarmed at how the covid-19 pandemic has exposed the long-standing structural drivers of health inequalities; ### 6. is alarmed at how the covid-19 pandemic has exposed the long-standing structural drivers of health inequalities; insists on the need to invest heavily in the development of resilient public health systems in partner countries and to carry out research to develop vaccines and treatments against diseases that are recurrent in developing countries;


### 8. recognises the need to enhance and improve the institutional set-up , reduce heavy bureaucratic coordination and strengthen institutional flexibility; ### 8. recognises the need to enhance and improve the institutional set-up , address the ‘development effectiveness deficit’ in the current set-up , reduce heavy bureaucratic coordination and strengthen institutional flexibility;


### b. whereas achieving the sdgs and the goals of the paris agreement and addressing other acute global challenges requires joint engagement at international level; ### b. whereas achieving the sdgs and the goals of the paris agreement and addressing the various impacts from the continuing pandemic , the war in ukraine , worsening climate change and other acute global challenges requires joint engagement at international level; whereas the debt burden of partner countries has dramatically increased because of these impacts;


### 9. insists that mechanisms for ensuring policy coherence for sustainable development must be enshrined in efad and used more systematically and efficiently by all relevant eu institutions and all member states , including at the highest political level; ### 9. insists that mechanisms for ensuring policy coherence for sustainable development must be enshrined in efad and used more systematically and efficiently by all relevant eu institutions and all member states , including at the highest political level; insists that policy coherence for sustainable development should be mainstreamed in the design and implementation of all kinds of eu policies in order to ensure that they do not negatively affect the attainment of the sdgs;


### 11. believes that the team europe approach should play a key role in further improving strategic cooperation and global coordination and the coherence and effectiveness of development efforts , especially at partner-country level , and believes that it has the potential to further identify key issues that need to be solved; ### 11. believes that the team europe approach should play a key role in further improving strategic cooperation and global coordination and the coherence and effectiveness of development efforts , especially at partner-country level , and believes that it has the potential to further identify key issues that need to be solved; stresses that the team europe approach must ensure effective coordination of the development policies of the eu and the member states , including those of regional governments holding powers in development cooperation;


### 12. calls on the commission to put forward a powerful eu policy direction and to further align the eu development financial institutions’ activities within the new open architecture; is of the opinion that the programming process must fully cover the use of eu budgetary guarantees; ### 12. calls on the commission to put forward a powerful eu policy direction and to further align the eu development financial institutions’ activities within the new open , collaborative , transparent and inclusive architecture; is of the opinion that the programming process must fully cover the use of eu budgetary guarantees;


### 14. considers eu taxonomy to be an important tool for achieving the sdgs and the objectives of the paris agreement; ### 14. considers eu taxonomy should be an important tool for achieving the sdgs and the objectives of the paris agreement; regrets , in this regard , that the inclusion of gas and nuclear power in the eu taxonomy complementary climate delegated act does not prevent greenwashing and misleads investors in identifying economic activities that are in line with the eu environmental and climate objectives;


### 17. welcomes the setting-up of eib global , a dedicated development branch within the eib group , which has been operational since 1 january 2022; ### 17. welcomes the setting-up of eib global , a dedicated development branch within the eib group , which has been operational since 1 january 2022; points out that the governance structure of the new branch needs to be fully transparent and designed to enable meaningful representation from recipient countries and to facilitate an extensive dialogue with civil society organisations;


### 20. encourages the eib , the european bank for reconstruction and development and the european development banks and financial institutions to strengthen their cooperation; ### 20. encourages the eib , the european bank for reconstruction and development and the european development banks and financial institutions to strengthen their cooperation , both at strategic and technical level;


### 24. recognises the importance and potential of member state development banks within the efad structure; stresses the pressing need to boost private sector development in sub-saharan africa; ### 24. recognises the importance and potential of member state development banks within the efad structure; stresses the pressing need to boost private sector development in sub-saharan africa , with special regard for building industrial capacity in green energy industries , boosting the manufacturing capacity of medical equipment and enabling the development of regional supply chains;


### 27. insists that the member states honour their commitment to spend 0.7 % of their gross national income on oda; underlines the important role of oda as a catalyst for change and a lever for the mobilisation of other resources; stresses the importance of the eu’s commitment to mobilise resources for climate action and the eib’s role in making progress in this area; ### 27. strongly regrets that only four member states attain at least 0.7% of their oda/gni ratio; insists that all the member states honour their commitment to spend 0.7 % of their gross national income on oda; underlines the important role of oda as a catalyst for change and a lever for the mobilisation of other resources; stresses the importance of the eu’s commitment to mobilise resources for climate action and the eib’s role in making progress in this area;


### (3) on 11 march 2020 , the world health organization (who) declared the novel coronavirus covid-19 outbreak a global pandemic. from the challenges experienced in responding to the pandemic it became clear that the centre’s role in the union’s framework for health crisis preparedness and response should be strengthened. ### (3) on 11 march 2020 , the world health organization (who) declared the novel coronavirus covid-19 outbreak a global pandemic. from the challenges experienced in responding to the pandemic it became clear that the centre’s role in the union’s framework for health crisis preparedness and response should be strengthened and improved taking into account the lessons learned during the pandemic in order to better use the centre’s potential to face future outbreaks.