### a european cybersecurity certification scheme shall attest that the ict products and services that have been certified in accordance with such scheme comply with specified requirements as regards their ability to resist at a given level of assurance , actions that aim to compromise the availability , authenticity , integrity or confidentiality of stored or transmitted or processed data or the functions or services offered by , or accessible via , those products , processes , services and systems . ### a european cybersecurity certification scheme shall attest that the ict products and services that have been certified in accordance with such scheme comply with specified requirements set out by european or international standards as regards their ability to resist at a given level of assurance , actions that aim to compromise the availability , authenticity , integrity or confidentiality of stored or transmitted or processed data or the functions or services offered by , or accessible via , those products , processes , services and systems .


### the agency shall promote a high level of awareness of citizens and businesses on issues related to the cybersecurity . ### the agency shall promote and support projects contributing to a high level of awareness and cyber literacy among citizens and businesses on issues related to the cybersecurity .


### upon a request by two or more member states concerned , and with the sole purpose of providing advice for the prevention of future incidents , the agency shall provide support to or carry out an ex - post technical enquiry following notifications by affected undertakings of incidents having a significant or substantial impact pursuant to directive 2016 / 1148 . the agency shall also carry out such an enquiry upon a duly justified request from the commission in agreement with the concerned member states in case of such incidents affecting more than two member states . ### upon a request by one or more member states concerned , and with the sole purpose of providing assistance either in the form of advice for the prevention of future incidents , or in the form of assisting in the response to a current large scale incidents , the agency shall provide support to or carry out an ex - post technical enquiry following notifications by affected undertakings of incidentshaving a significant or substantial impact pursuant to directive 2016 / 1148 . the agency shall perform the above activities by receiving relevant information from the affected member states and by utilising its own resources on threat analysis as well as resources on incident response made available from cert eu for that purpose . the agency shall also carry out such an enquiry upon a duly justified request from the commission in agreement with the concerned member states in case of such incidents affecting more than one member state .


### lays down a framework for the establishment of european cybersecurity certification schemes for the purpose of ensuring an adequate level of cybersecurity of ict products and services in the union . such framework shall apply without prejudice to specific provisions regarding voluntary or mandatory certification in other union acts . ### lays down a framework for the establishment of european cybersecurity certification schemes for the purpose of ensuring an adequate level of cybersecurity of ict products , processes and services in the union . such framework shall apply without prejudice to specific provisions regarding voluntary or mandatory certification in other union acts .


### the agency shall facilitate the establishment of and continuously support sectoral information sharing and analysis centres , in particular in the sectors listed in annex ii of directive 2016 / 1148 , by providing best practices and guidance on available tools , procedure , as well as on how to address regulatory issues related to information sharing . ### the agency shall facilitate the establishment of and continuously support sectoral information sharing and analysis centres , in particular in the sectors listed in annex ii of directive 2016 / 1148 , by providing best practices and guidance on available tools , procedure , cyber hygiene principles , as well as on how to address regulatory issues related to information sharing .


### the evaluation shall also assess the impact , effectiveness and efficiency of the provisions of title iii with regard to the objectives of ensuring an adequate level of cybersecurity of ict products and services in the union and improving the functioning of the internal market . ### the evaluation shall also assess the impact , effectiveness and efficiency of the provisions of title iii with regard to the objectives of ensuring an adequate level of cybersecurity of ict products , services and processes in the union and improving the functioning of the internal market . the commission shall assess , five years after the adoption of the regulation , a potential extension of the scope of title iii .


### to ensure that it fully achieves its objectives , the agency should liaise with relevant institutions , agencies and bodies , including cert - eu , european cybercrime centre at europol , european defence agency , european agency for the operational management of large - scale it systems , european aviation safety agency and any other eu agency that is involved in cybersecurity . it should also liaise with authorities dealing with data protection in order to exchange know - how and best practices and provide advice on cybersecurity aspects that might have an impact on their work . representatives of national and union law enforcement and data protection authorities should be eligible to be represented in the agency’s permanent stakeholders group . in liaising with law enforcement bodies regarding network and information security aspects that might have an impact on their work , the agency should respect existing channels of information and established networks . ### to ensure that it fully achieves its objectives , the agency should liaise with relevant institutions , eu supervisory and other competent authorities , agencies and bodies , including cert - eu , european cybercrime centre at europol , european defence agency , european agency for the operational management of large - scale it systems , european central bank , european banking authority , european data protection board , european aviation safety agency and any other eu agency that is involved in cybersecurity . it should also liaise with authorities dealing with data protection in order to exchange know - how and best practices and provide advice on cybersecurity aspects that might have an impact on their work . representatives of national and union law enforcement and data protection authorities should be eligible to be represented in the agency’s permanent stakeholders group . in liaising with law enforcement bodies regarding network and information security aspects that might have an impact on their work , the agency should respect existing channels of information and established networks .


### advise the union and the member states on research needs and priorities in the area of cybersecurity , with a view to enabling effective responses to current and emerging risks and threats , including with respect to new and emerging information and communications technologies , and to using risk - prevention technologies effectively ; ### advise the union and the member states on research needs and priorities in the areas of cybersecurity , data protection and privacy , with a view to enabling effective responses to current and emerging risks and threats , including with respect to new and emerging information and communications technologies , and to using risk - prevention technologies effectively ;


### conformity assessment is the process demonstrating whether specified requirements relating to a product , process , service , system , person or body have been fulfilled . for the purposes of this regulation , certification should be considered as a type of conformity assessment regarding the cybersecurity features of a product , process , service , system , or a combination of those by an independent third party , other than the product manufacturer or service provider . certification cannot guarantee per se that certified ict products and services are cyber secure . it is rather a procedure and technical methodology to attest that ict products and services have been tested and that they comply with certain cybersecurity requirements laid down elsewhere , for example as specified in technical standards . ### conformity assessment is the process demonstrating whether specified requirements relating to a product , process , service , system , person or body have been fulfilled . for the purposes of this regulation , certification and self assessment should be considered as a type of conformity assessment regarding the cybersecurity features of a product , process , service , system , or a combination of those by an independent third party , other than the product manufacturer or service provider . self - assessment may be undertaken by smes for conformity with the lowest assurance level . certification cannot guarantee per se that certified ict products and services are cyber secure and this must be duly communicated to consumers and businesses . it is rather a procedure and technical methodology to attest that ict products and services have been tested and that they comply with certain cybersecurity requirements laid down elsewhere , for example as specified in technical standards .


### when preparing candidate schemes referred to in paragraph 1 of this article , enisa shall consult all relevant stakeholders and closely cooperate with the group . the group shall provide enisa with the assistance and expert advice required by enisa in relation to the preparation of the candidate scheme , including by providing opinions where necessary . ### before preparing candidate schemes referred to in paragraph 1 of this article , the commission shall conduct an open public consultation for all relevant stakeholders . in preparing the consultation the commission shall closely cooperate with the european cybersecurity certification group , enisa and the stakeholder certification group .


### a european cybersecurity certification scheme shall attest that the ict products and services that have been certified in accordance with such scheme comply with specified requirements as regards their ability to resist at a given level of assurance , actions that aim to compromise the availability , authenticity , integrity or confidentiality of stored or transmitted or processed data or the functions or services offered by , or accessible via , those products , processes , services and systems . ### with a view to ensuring the proper functioning of the internal market while aiming at a high level of cybersecurity , cyber resilience and trust within the union , a voluntary european cybersecurity certification framework shall be introduced . the framework shall provide fair and equal opportunities for all companies in europe . a european cybersecurity certificate shall attest that the ict development procedures , products and / or services has been evaluated , using a standardised methodology for conformity assessment , against specified security standards laid down in a european cybersecurity certification scheme , that have been defined with the aim to protect the availability , integrity or confidentiality of stored or transmitted or processed data or the functions or services offered by , or accessible via , those products , processes , services and systems .


### preparing candidate european cybersecurity certification schemes for ict products and services in accordance with article 44 of this regulation ; ### preparing candidate european cybersecurity certification schemes for ict products , services and processes in accordance with article 44 of this regulation ;


### the agency should contribute towards raising the awareness of the public about risks related to cybersecurity and provide guidance on good practices for individual users aimed at citizens and organisations . the agency should also contribute to promote best practices and solutions at the level of individuals and organisations by collecting and analysing publicly available information regarding significant incidents , and by compiling reports with a view to providing guidance to businesses and citizens and improving the overall level of preparedness and resilience . the agency should furthermore organise , in cooperation with the member states and the union institutions , bodies , offices and agencies regular outreach and public education campaigns directed to end - users , aiming at promoting safer individual online behaviour and raising awareness of potential threats in cyberspace , including cybercrimes such as phishing attacks , botnets , financial and banking fraud , as well as promoting basic authentication and data protection advice . the agency should play a central role in accelerating end - user awareness on security of devices . ### the agency should contribute towards raising the awareness of the public about risks related to cybersecurity and provide guidance on good practices for individual users aimed at citizens , organisations and businesses . the agency should also contribute to promote best practices and solutions at the level of individuals , organisations and businesses by collecting and analysing publicly available information regarding significant incidents , and by compiling reports with a view to providing guidance to businesses and citizens and improving the overall level of preparedness and resilience . the agency should furthermore organise , in cooperation with the member states and the union institutions , bodies , offices and agencies regular outreach and public education campaigns directed to end - users , aiming at promoting safer individual online behaviour , digital literacy and raising awareness of potential threats in cyberspace , including cybercrimes such as phishing attacks , botnets , financial and banking fraud , as well as promoting basic authentication and data protection advice . the agency should play a central role in accelerating end - user awareness on security of devices . given that individual mistakes and unawareness of cyber risks constitutes a main factor of uncertainty in cyber security , the agency should be provided with adequate resources for exercising this function to the maximum degree possible .


### by the way of derogation from paragraph 3 , in duly justified cases a particular european cybersecurity scheme may provide that a european cybersecurity certificate resulting from that scheme can only be issued by a public body . such public body shall be one of the following : ### by the way of derogation from paragraph 3 , and only in duly justified cases , a particular european cybersecurity scheme may provide that a european cybersecurity certificate resulting from that scheme can only be issued by a public body . such public body shall be a body that is accredited as conformity assessment body pursuant to article 51 .


### detailed specification of the cybersecurity requirements against which the specific ict products and services are evaluated , for example by reference to union or international standards or technical specifications ; ### detailed specification of the cybersecurity requirements against which the specific ict products and services are evaluated by reference to standards or technical specifications in accordance with point of article 2 of regulation no 1025 / 2012 ;


### the agency shall increase cybersecurity capabilities at union level in order to complement the action of member states in preventing and responding to cyber threats , notably in the event of cross - border incidents . ### the agency shall contribute to increasing cybersecurity capabilities at union level in order to complement the action of developing member states skills in preventing and responding to cyber threats .


### in light of the increased cybersecurity challenges faced by the union , there is a need for a comprehensive set of measures that would build on previous union action and foster mutually reinforcing objectives . these include the need to further increase capabilities and preparedness of member states and businesses , as well as to improve cooperation and coordination across member states and eu institutions , agencies and bodies . furthermore , given the borderless nature of cyber threats , there is a need to increase capabilities at union level that could complement the action of member states , in particular in the case of large scale cross - border cyber incidents and crises . additional efforts are also needed to increase awareness of citizens and businesses on cybersecurity issues . moreover , the trust in the digital single market should be further improved by offering transparent information on the level of security of ict products and services . this can be facilitated by eu - wide certification providing common cybersecurity requirements and evaluation criteria across national markets and sectors . ### in light of the increased cybersecurity challenges faced by the union , there is a need for a comprehensive set of measures that would build on previous union action and foster mutually reinforcing objectives . these include the need to further increase capabilities and preparedness of member states and businesses , as well as to improve cooperation and coordination across member states and eu institutions , agencies and bodies . furthermore , given the borderless nature of cyber threats , there is a need to increase capabilities at union level that could complement the action of member states , in particular in the case of large scale cross - border cyber incidents and crises . additional efforts are also needed to increase awareness of citizens and businesses on cybersecurity issues . moreover , the trust in the digital single market should be further improved by offering transparent information on the level of security of ict products and services . this can be facilitated by eu - wide certification providing common cybersecurity requirements and evaluation criteria across national markets and sectors . the challenges faced should be proportianally reflected on the budget allocated to the agency , so as to ensure the optimal functionality under the current circumstances .


### ‘ european cybersecurity certification scheme’ means the comprehensive set of rules , technical requirements , standards and procedures defined at union level applying to the certification of information and communication technology products and services falling under the scope of that specific scheme ; ### ‘ european cybersecurity certification scheme’ means the comprehensive set of rules , technical requirements , standards and procedures defined at union level applying to the certification of information and communication technology products , services and processes falling under the scope of that specific scheme ;


### the agency shall promote a high level of awareness of citizens and businesses on issues related to the cybersecurity . ### the agency shall promote a high level of cyber hygiene and awareness of citizens and businesses on issues related to the cybersecurity .


### in order to specify further the criteria for the accreditation of conformity assessment bodies , the power to adopt acts in accordance with article 290 of the treaty on the functioning of the european union should be delegated to the commission . the commission should carry out appropriate consultations during its preparatory work , including at expert level . those consultations should be conducted in accordance with the principles laid down in the interinstitutional agreement on better law - making of 13 april 2016 . in particular , to ensure equal participation in the preparation of delegated acts , the european parliament and the council should receive all documents at the same time as member states ' experts , and their experts systematically have access to meetings of commission expert groups dealing with the preparation of delegated acts . ### in order to specify further the criteria for the accreditation of conformity assessment bodies , the power to adopt acts in accordance with article 290 of the treaty on the functioning of the european union should be delegated to the commission . the commission should carry out appropriate consultations during its preparatory work , including at expert level and with relevant stakeholders , as appropriate . those consultations should be conducted in accordance with the principles laid down in the interinstitutional agreement on better law - making of 13 april 2016 . in particular , to ensure equal participation in the preparation of delegated acts , the european parliament and the council should receive all documents at the same time as member states ' experts , and their experts systematically have access to meetings of commission expert groups dealing with the preparation of delegated acts .


### ‘ european cybersecurity certificate’ means a document issued by a conformity assessment body attesting that a given ict product or service fulfils the specific requirements laid down in a european cybersecurity certification scheme ; ### ‘ european cybersecurity certificate’ means a document issued either by a conformity assessment body or by self - assessment , where permitted , attesting that a given ict product , process or service fulfils the specific requirements laid down in a european cybersecurity certification scheme ;


### conformity assessment is the process demonstrating whether specified requirements relating to a product , process , service , system , person or body have been fulfilled . for the purposes of this regulation , certification should be considered as a type of conformity assessment regarding the cybersecurity features of a product , process , service , system , or a combination of those by an independent third party , other than the product manufacturer or service provider . certification cannot guarantee per se that certified ict products and services are cyber secure . it is rather a procedure and technical methodology to attest that ict products and services have been tested and that they comply with certain cybersecurity requirements laid down elsewhere , for example as specified in technical standards . ### conformity assessment is the process demonstrating whether specified requirements relating to a product , process , service , system , person or body have been fulfilled . for the purposes of this regulation , certification and self - assessment should be considered as a type of conformity assessment regarding the cybersecurity features of a product , process , service , system , or a combination of those . certification is undertaken by an independent third party , other than the product manufacturer or service provider . self - assessment may be undertaken by the product manufacturer or operator where the likelihood of a cybersecurity incident occurring , and / or the likelihood of such incident causing substantial harm to society or a large section thereof , is not expected to be high , taking into account the manufacturer or service provider’s intended use of the product or service in question . conformity assessment cannot guarantee per se that certified ict products and services are cyber secure . it is rather a procedure and technical methodology to attest that ict products and services have been tested and that they comply with certain cybersecurity requirements laid down elsewhere , for example as specified in technical standards .


### the agency shall promote the use of certification , including by contributing to the establishment and maintenance of a cybersecurity certification framework at union level in accordance with title iii of this regulation , with a view to increasing transparency of cybersecurity assurance of ict products and services and thus strengthen trust in the digital internal market . ### the agency shall promote the use of certification , including by contributing to the establishment and maintenance of a cybersecurity certification framework at union level in accordance with title iii of this regulation , with a view to increasing transparency of cybersecurity assurance of ict products , services and processes and thus strengthen trust in the digital internal market .


### ensure that authorised persons , programmes or machines can access exclusively the data , services or functions to which their access rights refer ; ### for products corresponding to level of certification high , ict products , services and processes used by public administration of a member state . the european cybersecurity certification schemes for this category shall be based on international standards , existing national or multilateral standards in use by member states .


### the agency shall be a centre of expertise on cybersecurity by virtue of its independence , the scientific and technical quality of the advice and assistance it delivers and the information it provides , the transparency of its operating procedures and methods of operation , and its diligence in carrying out its tasks . ### the agency shall be a centre of expertise on theoretical and practical cybersecurity by virtue of its independence , the scientific and technical quality of the advice and assistance it delivers and the information it provides , the transparency of its operating procedures and methods of operation , and its diligence in carrying out its tasks .


### to ensure that it fully achieves its objectives , the agency should liaise with relevant institutions , agencies and bodies , including cert - eu , european cybercrime centre at europol , european defence agency , european agency for the operational management of large - scale it systems , european aviation safety agency and any other eu agency that is involved in cybersecurity . it should also liaise with authorities dealing with data protection in order to exchange know - how and best practices and provide advice on cybersecurity aspects that might have an impact on their work . representatives of national and union law enforcement and data protection authorities should be eligible to be represented in the agency’s permanent stakeholders group . in liaising with law enforcement bodies regarding network and information security aspects that might have an impact on their work , the agency should respect existing channels of information and established networks . ### to ensure that it fully achieves its objectives , the agency should liaise with relevant institutions , agencies and bodies , including cert - eu , european cybercrime centre at europol , european defence agency , european agency for the operational management of large - scale it systems , european aviation safety agency , european central bank , european banking authority , the single resolution board , european securities and markets authority , other european and national supervisory authorities as appropriate , the european standards organisations , relevant stakeholders as appropriate , and any other eu agency that is involved in cybersecurity . it should also liaise with authorities dealing with data protection in order to exchange know - how and best practices and provide advice on cybersecurity aspects that might have an impact on their work . representatives of national and union law enforcement and data protection authorities should be eligible to be represented in the agency’s permanent stakeholders group . in liaising with law enforcement bodies regarding network and information security aspects that might have an impact on their work , the agency should respect existing channels of information and established networks .


### ‘ cyber threat’ means any potential circumstance or event that may adversely impact network and information systems , their users and affected persons . ### ‘ cyber threat’ means any intentional action , including an automated command , that may adversely impact network and information systems , their users and affected persons ;


### the group shall be composed of national certification supervisory authorities . the authorities shall be represented by the heads or by other high level representatives of national certification supervisory authorities . ### the group shall be composed of national certification supervisory authorities . the authorities shall be represented by the heads or by other high level representatives of national certification supervisory authorities . upon invitation , members of the stakeholder certification group shall be entitled to be present at the meetings of the european cybersecurity certification group and to participate in its work .


### following a request from the commission , enisa shall prepare a candidate european cybersecurity certification scheme which meets the requirements set out in articles 45 , 46 and 47 of this regulation . member states or the european cybersecurity certification group established under article 53 may propose the preparation of a candidate european cybersecurity certification scheme to the commission . ### enisa shall prepare a candidate european cybersecurity certification scheme which meets the requirements set out in articles 45 , 46 and 47 of this regulation . member states or the european cybersecurity certification group established under article 53 , shall propose the preparation of a candidate scheme that falls under the scope of article 45 , while the stakeholder certification group , established under article [ 20b ] , shall propose the preparation of a candidate european cybersecurity certification scheme that falls under the scope of article 45 or , to enisa and the commission .


### ‘ cyber threat’ means any potential circumstance or event that may adversely impact network and information systems , their users and affected persons . ### ‘ cyber threat’ means any action including an automated command , potential circumstance or event , that may adversely impact network and information systems , their users and affected persons ;


### upon a request by two or more member states concerned , and with the sole purpose of providing advice for the prevention of future incidents , the agency shall provide support to or carry out an ex - post technical enquiry following notifications by affected undertakings of incidents having a significant or substantial impact pursuant to directive 2016 / 1148 . the agency shall also carry out such an enquiry upon a duly justified request from the commission in agreement with the concerned member states in case of such incidents affecting more than two member states . ### upon a request by a member state concerned , and with the sole purpose of providing assistance either in the form of advice for the prevention of future incidents , or in the form of assisting in the response to a current large scale incident , the agency shall provide support to or carry out an ex - post technical enquiry following notifications by affected undertakings of incidents having a significant or substantial impact pursuant to directive 2016 / 1148 . the agency shall also carry out such an enquiry upon a duly justified request from the commission in agreement with the concerned member states in case of such incidents affecting more than one member state .


### upon a request by two or more member states concerned , and with the sole purpose of providing advice for the prevention of future incidents , the agency shall provide support to or carry out an ex - post technical enquiry following notifications by affected undertakings of incidents having a significant or substantial impact pursuant to directive 2016 / 1148 . the agency shall also carry out such an enquiry upon a duly justified request from the commission in agreement with the concerned member states in case of such incidents affecting more than two member states . ### upon a request by one or more member states concerned , and with the sole purpose of providing assistance either in the form of advice for the prevention of future incidents , or in the form of assisting in the response to a current large scale incidents , the agency shall provide support to or carry out an ex - post technical enquiry following notifications by affected undertakings of incidentshaving a significant or substantial impact pursuant to directive 2016 / 1148 . the agency shall perform the above activities by receiving relevant information from the affected member states and by utilising its own resources on threat analysis as well as resources on incident response made available from cert eu for that purpose . the agency shall also carry out such an enquiry upon a duly justified request from the commission in agreement with the concerned member states in case of such incidents affecting more than one member state .


### the agency should assist the member states and union institutions , bodies , offices and agencies in their efforts to build and enhance capabilities and preparedness to prevent , detect and respond to cybersecurity problems and incidents and in relation to the security of network and information systems . in particular , the agency should support the development and enhancement of national csirts , with a view of achieving a high common level of their maturity in the union . the agency should also assist with the development and update of union and member states strategies on the security of network and information systems , in particular on cybersecurity , promote their dissemination and track progress of their implementation . the agency should also offer trainings and training material to public bodies , and where appropriate ' train the trainers ' with a view to assisting member states in developing their own training capabilities . ### the agency should assist the member states and union institutions , bodies , offices and agencies in their efforts to build and enhance capabilities and preparedness to prevent , detect and respond to cybersecurity problems and incidents and in relation to the security of network and information systems . in particular , the agency should support the development and enhancement of national csirts , with a view of achieving a high common level of their maturity in the union . the agency should also assist with the development and update of union and member states strategies on the security of network and information systems , in particular on cybersecurity , promote their dissemination and track progress of their implementation . considering that human mistakes are one of the most pertinent risks to cyber security , the agency should also offer trainings and training material to public bodies , and to the maximum extent possible ' train the trainers ' with a view to assisting member states and union institutions and agencies in developing their own training capabilities .


### conformity assessment is the process demonstrating whether specified requirements relating to a product , process , service , system , person or body have been fulfilled . for the purposes of this regulation , certification should be considered as a type of conformity assessment regarding the cybersecurity features of a product , process , service , system , or a combination of those by an independent third party , other than the product manufacturer or service provider . certification cannot guarantee per se that certified ict products and services are cyber secure . it is rather a procedure and technical methodology to attest that ict products and services have been tested and that they comply with certain cybersecurity requirements laid down elsewhere , for example as specified in technical standards . ### conformity assessment is the process demonstrating whether specified requirements relating to a product , process , service , system , person or body have been fulfilled . for the purposes of this regulation , certification and self - assessment should be considered as a type of conformity assessment regarding the cybersecurity features of a product , process , service , system , or a combination of those . certification is undertaken by an independent third party , other than the product manufacturer or service provider . self - assessment may be undertaken by the product manufacturer or operator where the likelihood of a cybersecurity incident occurring , and / or the likelihood of such incident causing substantial harm to society or a large section thereof , is not expected to be high or substantial , taking into account the manufacturer or service provider’s intended use of the product or service in question . conformity assessment cannot guarantee per se that certified ict products and services are cyber secure . it is rather a procedure and technical methodology to attest that ict products and services have been tested and that they comply with certain cybersecurity requirements laid down elsewhere , for example as specified in technical standards .


### by the way of derogation from paragraph 3 , in duly justified cases a particular european cybersecurity scheme may provide that a european cybersecurity certificate resulting from that scheme can only be issued by a public body . such public body shall be one of the following : ### by the way of derogation from paragraph 3 , and only in duly justified cases , a particular european cybersecurity scheme may provide that a european cybersecurity certificate resulting from that scheme can only be issued by a public body . such public body shall be a body that is accredited as conformity assessment body pursuant to article 51 . the natural or legal person which submits its ict products or services to the certification mechanism shall make available to the conformity assessment body referred to in article 51 with all information necessary to conduct the certification procedure .


### when preparing candidate schemes referred to in paragraph 1 of this article , enisa shall consult all relevant stakeholders and closely cooperate with the group . the group shall provide enisa with the assistance and expert advice required by enisa in relation to the preparation of the candidate scheme , including by providing opinions where necessary . ### before preparing candidate schemes referred to in paragraph 1 of this article , the commission shall conduct an open public consultation for all relevant stakeholders . in preparing the consultation the commission shall closely cooperate with the european cybersecurity certification group , enisa and the stakeholder certification group .


### it is properly constituted according to the law of a member state ; ### it is properly constituted according to the law of a member state and is registered on a list at the competent ministry of the company ' s member state ;


### qualified entities should be fully transparent about the source of funding of their activity in general and regarding the funds supporting a specific representative action for redress in order to enable courts or administrative authorities to assess whether there may be a conflict of interest between the third party funder and the qualified entity and to avoid risks of abusive litigation as well as to assess whether the funding third party has sufficient resources in order to meet its financial commitments to the qualified entity . the information provided by the qualified entity to the court or administrative authority overseeing the representative action should enable it to assess whether the third party may influence procedural decisions of the qualified entity in the context of the representative action , including on settlements and whether it provides financing for a representative action for redress against a defendant who is a competitor of the fund provider or against a defendant on whom the fund provider is dependant . if any of these circumstances is confirmed , the court or administrative authority should be empowered to require the qualified entity to refuse the relevant funding and , if necessary , reject standing of the qualified entity in a specific case . ### qualified entities should , throughout each phase of the process , be fully transparent about the source of funding of their activity in general and regarding the funds supporting a specific representative action for redress in order to enable courts or administrative authorities to assess whether there may be a conflict of interest between the third party funder and the qualified entity and to avoid risks of abusive litigation as well as to assess whether the funding third party has sufficient resources in order to meet its financial commitments to the qualified entity . the information provided by the qualified entity to the court or administrative authority overseeing the representative action should enable it to assess whether the third party may influence procedural decisions of the qualified entity in the context of the representative action , including on settlements and whether it provides financing for a representative action for redress against a defendant who is a competitor of the fund provider or against a defendant on whom the fund provider is dependant . if any of these circumstances is confirmed , the court or administrative authority should be empowered to require the qualified entity to refuse the relevant funding and , if necessary , reject standing of the qualified entity in a specific case .


### the qualified entity seeking a redress order as referred in article 6 shall declare at an early stage of the action the source of the funds used for its activity in general and the funds that it uses to support the action . it shall demonstrate that it has sufficient financial resources to represent the best interests of the consumers concerned and to meet any adverse costs should the action fail . ### the qualified entity seeking a redress order as referred in article 6 shall declare at an early stage of the action the source of the funds used for its activity in general and the funds that it uses to support the action throughout the whole procedure . it shall demonstrate in a transparent way that it has sufficient financial resources to represent the best interests of the consumers concerned and to meet any adverse costs should the action fail .


### the translation services required for the functioning of the agency shall be provided by the translation centre of the bodies of the european union . ### the translation services required for the functioning of the agency might be provided by the translation centre of the bodies of the european union or other translation services , that respect union’s environmental , labour and social criteria .


### in carrying out its tasks , the agency shall maintain a close dialogue particularly with specialised bodies , whether public or private , public authorities and workers’ and employers’ organisations . the agency , without prejudice to its own aims , shall ensure cooperation with other european union agencies aimed at avoiding overlaps and promoting synergy and complementarity in their activities , in particular with the european agency for safety and health at work , the european centre for the development of vocational training and , where relevant , with other eu agencies . ### in carrying out its tasks , the agency shall maintain a close dialogue particularly with specialised bodies at national level but also in the international sphere , e . g . the international labor organization or the organisation for economic co - operation and development , whether public or private , public authorities and workers’ and employers’ organisations . the agency , without prejudice to its own aims , shall ensure cooperation with other european union agencies aimed at avoiding overlaps and promoting synergy and complementarity in their activities , including the possibility of working jointly , in particular with the european agency for safety and health at work , the european centre for the development of vocational training and , where relevant , with other eu agencies .


### preparing the agency’s draft statement of estimates of revenue and expenditure and implementing its budget . ### preparing the agency’s draft statement of estimates of revenue and expenditure and implementing its budget , as part of the agency’s programming document .


### the executive director shall be appointed by the management board , from a list of candidates proposed by the commission , following an open and transparent selection procedure . ### the executive director shall be appointed by the management board , from a list of candidates proposed by the commission after obtaining the consent of the management board which must be involved in the process of short - listing the candidates and can act by written procedure if necessary , and following an open and transparent selection procedure . once appointed the new executive director must attend a hearing in the competent european parliament committee .


### the executive board shall be composed of the chairperson of the management board , the three deputy chairpersons , the coordinators of the three groups as referred to in article 4 and one representative of the commission . each group referred to in article 4 may designate up to two alternates to attend the meetings of the executive board , in the absence of the full members . the chairperson of the management board shall also be the chairperson of the executive board . the executive director shall take part in the meetings of the executive board , but shall not have the right to vote . ### the executive board shall be composed of the chairperson of the management board , the three deputy chairpersons , the coordinators of the three groups as referred to in article 4 , one more representative of each group and one representative from each european union institution , the parliament and the commission . each group referred to in article 4 may designate up to two alternates to attend the meetings of the executive board , aiming to achieve a balanced representation between men and women when designate alternates . the chairperson of the management board shall also be the chairperson of the executive board . the executive director shall take part in the meetings of the executive board , but shall not have the right to vote .


### the management board shall elect a chairperson and three deputy chairpersons as follows &#8211 ; one from amongst the members representing member states , one from amongst the members representing employers ' organisations , one from amongst the members representing employees ' organisations and one from amongst the members representing the commission . the chairperson and the deputy chairpersons shall be elected by a majority of two - thirds of members of the management board with voting rights . ### the management board shall elect a chairperson and three deputy chairpersons as follows &#8211 ; one from amongst the members representing member states , one from amongst the members representing employers ' organisations , one from amongst the members representing employees ' organisations and one from amongst the members representing the european union ' s institutions - the commission and the parliament . the chairperson and the deputy chairpersons shall be elected by a majority of two - thirds of members of the management board with voting rights .


### as the three so - called tripartite agencies , the european foundation for the improvement of living and working conditions , the european agency for safety and health at work and the european centre for the development of vocational training address issues related to the labour market and working environment and vocational education and training and skills , close coordination among the three agencies is required and ways to enhance efficiency and synergies should be exploited . in addition , where relevant , the agency should seek to engage in efficient cooperation with the european commission ' s in - house research capacities . ### as the three tripartite agencies , the european foundation for the improvement of living and working conditions , the european agency for safety and health at work and the european centre for the development of vocational training address issues related to the labour market and working environment and vocational education and training and skills , close coordination among the three agencies is required so that the work of the agencies does not overlap where they have similar fields of interest , while ways to enhance efficiency and synergies should be exploited and any duplication among agencies , as well as between them and the commission , concerning their mandates , objectives and activities should be avoided . in addition , where relevant , the agency should seek to engage in efficient cooperation with the commission ' s and the european parliament ' s in - house research capacities . the added value of eurofound is its unique pan - european comparable data on an extremely rich and a wide range of living and working conditions provided not only to union institutions , member states , and the social partners but also to the general public .


### no later than 5 years after the date referred to in article 37 , and every 5 years thereafter , the commission shall perform an evaluation in compliance with the commission guidelines to assess the agency ' s performance in relation to its objectives , mandate and tasks . the evaluation shall , in particular , address the possible need to modify the mandate of the agency , and the financial implications of any such modification . ### no later than 5 years after the date referred to in article 37 , and every 5 years thereafter , the commission shall perform an evaluation in compliance with the commission guidelines to assess the agency ' s performance in relation to its objectives , mandate and tasks . the management board shall be consulted in the evaluation . the evaluation shall , in particular , address the possible need to modify the mandate of the agency , and the related additional financial , budgetary and human resources if new tasks are allocated to the agency or if the workload linked to existing task increases .


### the commission shall send draft estimates to the budgetary authority together with the draft general budget of the union . ### the commission shall send draft estimates to the budgetary authority together with the draft general budget of the union . the commission shall send these draft estimates simultaneously to the agency .


### in order to allow the elm to respond to potential upcoming challenges and union priorities , as well as to provide a strategic response addressing root causes of migration , the maximum ceiling for the eib financing operations under the eu guarantee should be increased to eur 32 300 000 000 by releasing the optional additional amount of eur 3 000 000 000 . under the general mandate , the amount of eur 1 400 000 000 should be earmarked for projects in the public sector directed to refugees and host communities in crisis affected areas . ### in order to allow the elm to respond to potential upcoming challenges and union priorities , as well as to provide a strategic response addressing root causes of migratory pressures stemming from poverty , underdevelopment , inequality , demographic growth , lack of employment and economic opportunities as well as from climate change , the maximum ceiling for the eib financing operations under the eu guarantee should be increased to eur 38 470 000 000 . under the general mandate , the amount of eur 1 400 000 000 should be earmarked for projects in the public sector directed to refugees and host communities in crisis affected areas .


### a maximum amount of eur 30 000 000 000 under a general mandate , of which an amount of up to eur 1 400 000 000 is earmarked for projects in the public sector directed to refugees and host communities ; ### a maximum amount of eur 36 170 000 000 under a general mandate , of which an amount of up to eur 1 400 000 000 is earmarked for projects in the public sector directed to address the root causes of migratory pressures stemming from poverty , underdevelopment , inequality , demographic growth , lack of employment and economic opportunities as well as from climate change ;


### eib financing operations supporting the general objectives set out in point of paragraph 1 shall back investment projects that address root causes of the migration and contribute to long - term economic resilience and safeguard sustainable development in beneficiary countries . eib financing operations shall , in particular , address increased needs for infrastructure and related services to cater for the migrants influx , and boost employment opportunities for host and refugee communities to foster economic integration and enable refugees to become self - reliant . ### eib financing operations supporting the general objectives set out in point of paragraph 1 shall back investment projects that address root causes of migratory pressures stemming from poverty , underdevelopment , inequality , demographic growth , lack of employment and economic opportunities as well as from climate change and contribute to long - term economic resilience and safeguard sustainable development in beneficiary countries while ensuring compliance with the sdgs . eib financing operations shall , in particular , strengthen humanitarian action and support for decent job creation , while ensuring the full respect of human , labour and social rights , fundamental freedoms and gender mainstreaming by implementing a rights - based approach encompassing all human and social rights in line with transparency , participation , non - discrimination and accountability . eib financing operations shall recognise that gender equality is a cross cutting issue to achieving sustainable development . a gender perspective shall be applied to all financing operations . the eib shall ensure that it develops a gender action plan by 31 december 2017 and that all eib operations under this mandate comply with the principles of its gender strategy approved in december 2016


### the maximum ceiling of the eib financing operations under eu guarantee throughout the period 2014 - 20 shall not exceed eur 32 300 000 000 . amounts initially earmarked for financing operations but subsequently cancelled shall not count against the ceiling . ### the maximum ceiling of the eib financing operations under eu guarantee throughout the period 2014 - 20 shall not exceed eur 38 470 000 000 . amounts initially earmarked for financing operations but subsequently cancelled shall not count against the ceiling .


### indicators for projects providing strategic response addressing root causes of migration shall be developed by the eib ; ; ### indicators for projects providing strategic response addressing root causes of migration shall be developed by the eib in consultation and in cooperation with stakeholders and the civil society ;


### addressing root causes of migration should be added as a new objective of the mandate . ### addressing root causes of migratory pressures stemming from poverty , underdevelopment , inequality , demographic growth , lack of employment and economic opportunities as well as from climate change should be added as a new objective of the mandate ; every project financed under the new objective should fulfil the criteria for official development assistance established by the development assistance committee of the oecd and be in compliance with article 208 of the treaty on the functioning of the european union and un´s guiding principles on business and human rights .


### a pre - condition for granting the union’s macro - financial assistance should be that georgia respects effective democratic mechanisms – including a multi - party parliamentary system – and the rule of law , and guarantees respect for human rights . in addition , the specific objectives of the union’s macro - financial assistance should strengthen the efficiency , transparency and accountability of the public finance management systems in georgia , and promote structural reforms aimed at supporting sustainable and inclusive growth , employment creation and fiscal consolidation . both the fulfilment of the preconditions and the achievement of those objectives should be regularly monitored by the commission and the european external action service . ### a pre - condition for granting the union’s macro - financial assistance should be that georgia respects effective democratic mechanisms – including a multi - party parliamentary system – and the rule of law , and guarantees respect for human rights . in addition , the specific objectives of the union’s macro - financial assistance should strengthen the efficiency , transparency and accountability of the public finance management systems in georgia , and promote structural reforms aimed at supporting sustainable and inclusive growth , employment creation and fiscal consolidation . the union’s macro - financial assistance to georgia should also include measures to support the implementation of the association agreement , including the dcfta . to ensure that specific objectives can be properly assessed , they need to be set out in a verifiable and measurable manner . both the fulfilment of the preconditions and the achievement of those objectives should be regularly monitored by the commission and the european external action service . if the precondition and the objectives are not met or if the aims and principles of the association agreement are generally disregarded , the commission should temporarily suspend or cancel the disbursement of the union’s macro - financial assistance .


### the programme should promote and integrate cooperation with third countries and international organisations and initiatives based on common interest , mutual benefit and global commitments to implement the un sdgs . international cooperation should aim to strengthen the union ' s research and innovation excellence , attractiveness and economic and industrial competitiveness , to tackle global challenges , as embodied in the un sdgs , and to support the union ' s external policies . an approach of general opening for international participation and targeted international cooperation actions should be followed , including through appropriate eligibility for funding of entities established in low to middle income countries . at the same time , association of third countries to the programme should be promoted . ### the programme should promote and integrate cooperation with third countries and international organisations and initiatives based on common interest , mutual benefit and global commitments to implement the un sdgs . international cooperation should aim to strengthen the union ' s research and innovation excellence , attractiveness and economic and industrial competitiveness , to tackle global challenges , as embodied in the un sdgs , and to support the union ' s external policies , notably the reduction and long - term eradication of poverty . an approach of general opening for international participation and targeted international cooperation actions should be followed , including through appropriate eligibility for funding of entities established in low to middle income countries . at the same time , association of third countries to the programme should be promoted .


### activities supported under the programme should contribute towards the achievement of the union ' s objectives and priorities , the monitoring and assessment of progress against those objectives and priorities and for the development of revised or new priorities . ### activities supported under the programme should contribute towards the achievement of the union ' s objectives and priorities , the monitoring and assessment of progress against those objectives and priorities and for the development of revised or new priorities . european research priorities should therefore be aligned with the sustainable development goals in terms of establishing targets and measuring the impact of the programme .


### the programme ' s general objective is to deliver scientific , economic and societal impact from the union ' s investments in research and innovation so as to strengthen the scientific and technological bases of the union and foster its competitiveness , including in its industry , deliver on the union strategic priorities , and contribute to tackling global challenges , including the sustainable development goals . ### the programme ' s general objective is to deliver scientific , economic and societal impact from the union ' s investments in research and innovation so as to strengthen the scientific and technological bases of the union and foster its competitiveness , including in its industry , deliver on the union strategic priorities , and contribute to tackling global challenges , including measures to help achieve the sustainable development goals inside and outside the union .


### synergies with the neighbourhood , development and international cooperation instrument will ensure that the programme ' s research and innovation activities with the participation of third countries and targeted international cooperation actions seek alignment and coherence with parallel market uptake and capacity - building actions strands under the external instrument , based on joint definition of needs and areas of intervention commonly defined during the programme ' s strategic research and innovation planning process . ### synergies with the neighbourhood , development and international cooperation instrument will ensure that the programme ' s research and innovation activities with the participation of third countries and targeted international cooperation actions seek alignment and coherence with parallel market uptake and capacity - building actions strands under the external instrument , based on joint definition of needs and areas of intervention commonly defined during the programme ' s strategic research and innovation planning process and are fully aligned with the global goals of the 2030 agenda on sustainable development . such synergies will facilitate fulfilment of article 66 . 2 of the wto trips1a agreement , which notes the commitment by developed countries to provide incentives to their enterprises or institutions for the purpose of promoting and encouraging technology transfer to least - developed country members . _________________ 1a trips agreement : the agreement on trade - related aspects of intellectual property rights article 66 . 2 article 66 . 2 of the trips agreement requires developed - country members to provide incentives to enterprises and institutions in their territories for the purpose of promoting and encouraging technology transfer to least - developed country members in order to enable them to create a sound and viable technological base .


### the programme should support research and innovation in an integrated manner , respecting all relevant provisions of the world trade organisation . the concept of research , including experimental development should be used in accordance with the frascati manual developed by the oecd , whereas the concept of innovation should be used in accordance with the oslo manual developed by the oecd and eurostat , following a broad approach that covers social innovation . the oecd definitions regarding technological readiness level should continue , as in the previous framework programme horizon 2020 , to be taken into account in the classification of technological research , product development and demonstration activities , and the definition of types of action available in calls for proposals . in principle grants should not be awarded for actions where activities go above trl 8 . the work programme for a given call under the pillar ' global challenges and industrial competitiveness ' could allow grants for large - scale product validation and market replication . ### the programme should support research and innovation in an integrated manner , respecting all relevant provisions of the world trade organisation . the concept of research , including experimental development should be used in accordance with the frascati manual developed by the oecd , whereas the concept of innovation should be used in accordance with the oslo manual developed by the oecd and eurostat , following a broad approach that covers social innovation . the oecd definitions regarding technological readiness level should continue , as in the previous framework programme horizon 2020 , to be taken into account in the classification of technological research , product development and demonstration activities , and the definition of types of action available in calls for proposals . in principle grants should not be awarded for actions where activities go above trl 8 . the work programme for a given call under the pillar ' global challenges and industrial competitiveness ' could allow grants for large - scale product validation and market replication , recognizing this is of specific importance in areas with market failure , for instance antimicrobial resistance and tb .


### the conception and design of the programme should respond to the need for establishing a critical mass of supported activities , throughout the eu union and through international cooperation , in line with the un sustainable development goals . programme implementation should reinforce the pursuit of this aim . ### the conception and design of the programme should respond to the need for establishing a critical mass of supported activities , throughout the eu union and through international cooperation , in line with the un sustainable development goals . horizon europe should support and leverage national strategies for the fulfilment of the un sdgs through common infrastructures and shared approaches . programme implementation should reinforce the pursuit of this aim signalling the eu’s commitment to providing leadership in addressing global challenges of and to sharing its knowledge with the wider world


### the pillar ' global challenges and industrial competitiveness ' should be established through clusters of research and innovation activities , in order to maximise integration across the respective work areas while securing high and sustainable levels of impact in relation to the resources that are expended . it will encourage cross - disciplinary , cross - sectoral , cross - policy and cross - border collaboration in pursuit of the un sdgs and the competitiveness of the union ' s industries therein . ### european research priorities extend beyond scientific ambitions . they include support for human well - being , environmental stability and economic sustainability . the pillar ' global challenges and industrial competitiveness ' should be established through clusters of research and innovation activities , in order to maximise integration across the respective work areas while securing high and sustainable levels of impact in relation to the resources that are expended . it will encourage cross - disciplinary , cross - sectoral , cross - policy and cross - border collaboration in pursuit of the un sdgs and the competitiveness of the union ' s industries therein . it will also facilitate the development of appropriate metrics and evaluation criteria methodologies to measure policy and programme impact on all dimensions of sustainable development , including human development .


### the activities developed under the programme should aim at eliminating gender inequalities and promoting equality between women and men in research and innovation , in compliance with articles 2 and 3 of the treaty on european union and article 8 of the tfeu . the gender dimension should be adequately integrated in research and innovation content and followed through at all stages of the research cycle . ### the activities developed under the programme should aim at eliminating gender inequalities and promoting equality between women and men in research and innovation , in compliance with articles 2 and 3 of the treaty on european union and article 8 of the tfeu . the gender dimension should be adequately integrated in research and innovation content and followed through at all stages of the research cycle . the programme should include concrete measures to counteract unconscious gender bias .


### in order to effectively protect business users where needed , this regulation should apply where the terms and conditions of a contractual relationship , regardless of their name or form , are not individually negotiated by the parties to them . whether or not terms and conditions were individually negotiated should be determined on the basis of an overall assessment , whereby the fact that certain provisions thereof may have been individually negotiated is , in itself , not decisive . ### in order to effectively protect business users where needed , this regulation should apply to the terms and conditions of a contractual relationship , or provisions thereof , regardless of their name or form , that have not been individually negotiated by the parties .


### that information shall include the total number of complaints lodged , the subject - matter of the complaints , the time period needed to process the complaints and the decision taken on the complaints . ### that information shall include the total number of complaints lodged , the main types of complaints , the nature of problems raised by business users and the average time period needed to process the complaints and the decision taken on the complaints .


### it shall apply from [ date : six months following the day of its publication ] . ### it shall apply from [ date : twelve months following the day of its publication ] .


### this regulation shall apply to online intermediation services and online search engines provided , or offered to be provided , to business users and corporate website users , respectively , that have their place of establishment or residence in the union and that , through online intermediation services or online search engines , offer goods or services to consumers located in the union , irrespective of the place of establishment or residence of the providers of those services . ### this regulation shall apply to online search engines and online intermediation services provided , or offered to be provided , to business users and corporate website users , respectively , that have their place of establishment or are actively operating in the union , that target consumers located in the union and that , through online intermediation services or online search engines , offer goods or services to consumers located in the union , irrespective of the place of establishment or residence of the providers of those services .


### the statement of reasons referred to in paragraph 1 shall contain a reference to the specific facts or circumstances that led to the decision of the provider of online intermediation services , as well as a reference to the applicable objective ground or grounds for that decision referred to in article 3 . ### the statement of reasons referred to in paragraph 1 or 1a shall contain a reference to the specific facts or circumstances that led to the decision of the provider of online intermediation services , as well as a reference to the applicable objective ground or grounds for that decision referred to in article 3 .


### ‘ online search engine’ means a digital service that allows users to perform searches of , in principle , all websites or websites in a particular language on the basis of a query on any subject in the form of a keyword , phrase or other input , and returns links in which information related to the requested content can be found ; ### ‘ online search engine’ means a digital service that allows users to perform searches of , in principle , all websites or websites in a particular language on the basis of a query on any subject in the form of a keyword , phrase or other input , such as a voice command , and returns links in which information related to the requested content can be found ;


### as the objective of this regulation , namely to ensure a fair , predictable , sustainable and trusted online business environment within the internal market , cannot be sufficiently achieved by the member states , but can rather , by reason of its scale and effects , be better achieved at union level , the union may adopt measures , in accordance with the principle of subsidiarity as set out in article 5 of the treaty on european union . in accordance with the principle of proportionality , as set out in that article , this regulation does not go beyond what is necessary in order to achieve that objective . ### as the objective of this regulation , namely to ensure a clear , fair , predictable , sustainable and trusted online business environment within the internal market , cannot be sufficiently achieved by the member states , but can rather , by reason of its scale and effects , be better achieved at union level , the union may adopt measures , in accordance with the principle of subsidiarity as set out in article 5 of the treaty on european union . in accordance with the principle of proportionality , as set out in that article , this regulation does not go beyond what is necessary to achieve that objective .


### online intermediation services and online search engines , as well as the commercial transactions facilitated by those services , have an intrinsic cross - border potential and are of particular importance for the proper functioning of the union’s internal market in today’s economy . the potentially unfair and harmful trading practices of certain providers of those services in respect of business users and corporate website users hamper the full realisation of that potential and negatively affect the proper functioning of the internal market . in addition , the full realisation of that potential is hampered , and the proper functioning of the internal market is negatively affected , by diverging laws of certain member states which , with a varying degree of effectiveness , regulate those services , while other member states are considering adopting such laws . ### online intermediation services , operating systems and online search engines , as well as the commercial transactions facilitated by those services , have an intrinsic cross - border potential and are of particular importance for the proper functioning of the union’s internal market in today’s economy . the potentially unfair and harmful trading practices of certain providers of those services in respect of business users and corporate website users hamper the full realisation of that potential and negatively affect the proper functioning of the internal market . in addition , the full realisation of that potential is hampered , and the proper functioning of the internal market is negatively affected , by diverging laws of certain member states which , with a varying degree of effectiveness , regulate those services , while other member states are considering adopting such laws .


### providers of online search engines shall set out for corporate website users the main parameters determining ranking , by providing an easily and publicly available description , drafted in clear and unambiguous language on the online search engines of those providers . they shall keep that description up to date . ### providers of online search engines shall set out for corporate website users the main parameters determining ranking in the general search results pages , by providing an easily and publicly available description , drafted in clear , plain and intelligible language on the online search engines of those providers . they shall keep that description up to date with regard to material changes that can reasonably be expected to affect corporate website users in substantive manner and having a negative result . where a provider of an online search engine has altered the ranking order or delisted a particular website following a third party notification , the provider shall offer the business user the possibility to inspect the content of the notice .


### for reasons of consistency , the definition of online search engine used in this regulation should be aligned with the definition used in directive 2016 / 1148 of the european parliament and of the council21 . _________________ 21 directive 2016 / 1148 of the european parliament and of the council concerning measures for a high common level of security of network and information systems across the union . ### the definition of online search engine used in this regulation should be broader than the definition used in directive 2016 / 1148 of the european parliament and of the council21 in order to ensure technology - neutrality and recognise the variety of search services . _________________ 21 directive 2016 / 1148 of the european parliament and of the council concerning measures for a high common level of security of network and information systems across the union .


### a provider of online intermediation services can have legitimate reasons to decide to suspend or terminate the provision of its services , in whole or in part , to a given business user , including by delisting individual goods or services of a given business user or effectively removing search results . however , given that such decisions can significantly affect the interests of the business user concerned , they should be properly informed of the reasons thereof . the statement of reasons should allow business users to ascertain whether there is scope to challenge the decision , thereby improving the possibilities for business users to seek effective redress where necessary . in addition , requiring a statement of reasons should help to prevent or remedy any unintended removal of online content provided by business users which the provider incorrectly considers to be illegal content , in line with commission recommendation no 2018 / 33422 . the statement of reasons should identify the objective ground or grounds for the decision , based on the grounds that the provider had set out in advance in its terms and conditions , and refer in a proportionate manner to the relevant specific circumstances that led to that decision . _________________ 22 commission recommendation no 2018 / 334 of 1 march 2018 on measures to effectively tackle illegal content online . ### a provider of online intermediation services can have legitimate reasons to decide to suspend , delist or terminate the provision of its services , in whole or in part , to a given business user , including by delisting individual goods or services of a given business user or effectively removing search results . it can also be under a legal obligation to remove certain content , or to suspend or terminate the provision of its services in whole or in part . however , given that such decisions can significantly affect the interests of the business user concerned , they should be properly informed in advance of the termination or suspension , except for in cases where a provider of online intermediation services is under a legal obligation to terminate its services immediately . there could also be cases in which the provider of the online intermediation service is not under a legal obligation to terminate its services , for example due to illegal or unsafe products or services being marketed , but where the provider has reasonable doubts regarding the safety of a product or service , counterfeiting , fraud , or suitability of the product or service to minors . in such cases , it should be possible for the provider of the online intermediation service to act immediately to protect consumers . however , in these exceptional cases where services could be terminated immediately , the business user should in any case be provided with a statement of reasons for the termination of the service . the statement of reasons should allow business users to ascertain whether there is scope to challenge the decision , thereby improving the possibilities for business users to seek effective redress where necessary . in addition , requiring a statement of reasons should help to prevent or remedy any unintended removal of online content provided by business users which the provider incorrectly considers to be illegal content , in line with commission recommendation no 2018 / 33422 . the statement of reasons should identify the objective ground or grounds for the decision , based on the grounds that the provider had set out in advance in its terms and conditions , and refer in a proportionate manner to the relevant specific circumstances that led to that decision , except in cases where a provider of online intermediation services is under a legal obligation not to disclose them . _________________ 22 commission recommendation no 2018 / 334 of 1 march 2018 on measures to effectively tackle illegal content online .


### through the description referred to in paragraph 1 , providers of online intermediation services shall adequately inform business users at least of the following : ### through the description referred to in paragraph 1 , providers of online intermediation services or search engines shall adequately inform business users at least of the following :


### the requirements of this regulation regarding the internal complaint - handling systems aim at allowing providers of online intermediation services a reasonable degree of flexibility when operating those systems and addressing individual complaints , so as to minimise any administrative burden . in addition , the internal complaint - handling systems should allow providers of online intermediation services to address , where necessary , in a proportionate manner any use in bad faith which certain business users might seek to make of those systems . in cases other than any alleged non - compliance with the legal obligations of this regulation , the internal complaint - handling systems should moreover not be open to complaints involving only negligible negative effects on the business user concerned . in light of the costs of setting up and operating such systems , it is appropriate to exempt from those obligations any providers of online intermediation services which constitute small enterprises , in line with the relevant provisions of commission recommendation 2003 / 361 / ec25 . __________________ 25 commission recommendation 2003 / 361 / ec of 6 may 2003 concerning the definition of micro , small and medium - sized enterprises . ### the requirements of this regulation regarding the internal complaint - handling systems aim at allowing providers of online intermediation services a reasonable degree of flexibility when operating those systems and addressing individual complaints , so as to minimise any administrative burden . in addition , the internal complaint - handling systems should allow providers of online intermediation services to address , where necessary , in a proportionate manner any use in bad faith which certain business users might seek to make of those systems . in light of the costs of setting up and operating such systems , it is appropriate to exempt from those obligations any providers of online intermediation services which constitute small enterprises , in line with the relevant provisions of commission recommendation 2003 / 361 / ec25 . __________________ 25 commission recommendation 2003 / 361 / ec of 6 may 2003 concerning the definition of micro , small and medium - sized enterprises .


### ranking ; ### ranking and default settings ;


### providers of online intermediation services shall engage in good faith in any attempt to reach an agreement through the mediation of any of the mediators which they identified in accordance with paragraph 1 , with a view to reaching an agreement on the settlement of the dispute . ### providers of online intermediation services and business users shall engage in good faith in any attempt to reach an agreement through the mediation of any of the mediators which have been identified in accordance with paragraph 1 , with a view to reaching an agreement on the settlement of the dispute .


### since online intermediation services and online search engines typically have a global dimension , this regulation should apply to providers of those services regardless of whether they are established in a member state or outside the union , provided that two cumulative conditions are met . firstly , the business users or corporate website users should be established in the union . secondly , the business users or corporate website users should , through the provision of those services , offer their goods or services to consumers located in the union at least for part of the transaction . such consumers should be located in the union , but do not need to have their place of residence in the union nor have the nationality of any member state . accordingly , this regulation should not apply where the business users or corporate websites users are not established in the union or where they are established in the union but where they use online intermediation services or online search engines to offer goods or services exclusively to consumers located outside the union or to persons who are not consumers . ### since online intermediation services , operating systems and online search engines typically have a global dimension , this regulation should apply to providers of those services regardless of whether they are established in a member state or outside the union , provided that two cumulative conditions are met . firstly , the business users or corporate website users should be established in the union . secondly , the business users or corporate website users should , through the provision of those services , offer their goods or services to consumers located in the union at least for part of the transaction . such consumers should be located in the union , but do not need to have their place of residence in the union nor have the nationality of any member state . accordingly , this regulation should not apply where the business users or corporate websites users are not established in the union or where they are established in the union but where they use online intermediation services or online search engines to offer goods or services exclusively to consumers located outside the union or to persons who are not consumers .


### ' business user ' means any natural or legal person which through online intermediation services offers goods or services to consumers for purposes relating to its trade , business , craft or profession ; ### ' business user ' means any natural or legal person which through online intermediation services offers or seeks to offer goods or services to consumers for purposes relating to its trade , business , craft or profession ;


### ' online search engine ' means a digital service that allows users to perform searches of , in principle , all websites or websites in a particular language on the basis of a query on any subject in the form of a keyword , phrase or other input , and returns links in which information related to the requested content can be found ; ### ' online search engine ' means a digital service or interface or mobile applications that allows users to perform searches of web content , in a particular language on the basis of a query in the form of a keyword , phrase or other input in many options , and returns result in which information related to the query can be found ;


### are drafted in clear and unambiguous language ; ### are drafted in clear language ;


### providers of online intermediation services might in certain cases restrict in the terms and conditions the ability of business users to offer goods or services to consumers under more favourable conditions through other means than through those online intermediation services . in those cases , the providers concerned should set out the grounds for doing so , in particular with reference to the main economic , commercial or legal considerations for the restrictions . this transparency obligation should however not be understood as affecting the assessment of the legality of such restrictions under other acts of union law or the law of member states in accordance with union law , including in the areas of competition and unfair commercial practices , and the application of such laws . ### providers of online intermediation services often restrict in the terms and conditions the ability of business users to offer goods or services to consumers under more favourable conditions through other means than through those online intermediation services . certain member states already prohibit such practices , as they unfairly limit the freedom of business users to set the conditions of sale of their own products and services , and may also harm consumers by restricting their choice . thus , this regulation should prohibit such clauses in the european union , and hence harmonise the legal framework of member states .


### online intermediation services and online search engines , as well as the commercial transactions facilitated by those services , have an intrinsic cross - border potential and are of particular importance for the proper functioning of the union’s internal market in today’s economy . the potentially unfair and harmful trading practices of certain providers of those services in respect of business users and corporate website users hamper the full realisation of that potential and negatively affect the proper functioning of the internal market . in addition , the full realisation of that potential is hampered , and the proper functioning of the internal market is negatively affected , by diverging laws of certain member states which , with a varying degree of effectiveness , regulate those services , while other member states are considering adopting such laws . ### online intermediation services and online search engines , as well as the transactions facilitated by those services , have an intrinsic cross - border potential and are of particular importance for the proper functioning of the union’s internal market in today’s economy . the potentially unfair and harmful trading practices of certain providers of those services in respect of business users and corporate website users hamper the full realisation of that potential and negatively affect the proper functioning of the internal market . in addition , the full realisation of that potential is hampered , and the proper functioning of the internal market is negatively affected , by diverging laws of certain member states which , with a varying degree of effectiveness , regulate those services , while other member states are considering adopting such laws .


### where a provider of online intermediation services itself offers certain goods or services to consumers through its own online intermediation services , or does so through a business user which it controls , that provider may compete directly with other business users of its online intermediation services which are not controlled by the provider . in such situations , in particular , it is important that the provider of online intermediation services acts in a transparent manner and provides a description of any differentiated treatment , whether through legal , commercial or technical means , that it might give in respect of goods or services it offers itself compared to those offered by business users . to ensure proportionality , this obligation should apply at the level of the overall online intermediation services , rather than at the level of individual goods or services offered through those services . ### where a provider of online intermediation services itself offers certain goods or services to consumers through its own online intermediation services , or does so through a business user which it controls , that provider may compete directly with other business users of its online intermediation services which are not controlled by the provider . in such situations , in particular , it is important that the provider of online intermediation services acts in a transparent manner and provides a description of any differentiated treatment , whether through legal , commercial or technical means , such as default settings , that it might give in respect of goods or services it offers itself compared to those offered by business users . providers of online intermediation services should therefore not be allowed to provide any good or service under their direct or indirect control as a default option without first giving consumers the possibility to select among different competing options available when using the online intermediation service for the first time . differentiated treatment should only be allowed to the extent that competition law is fully complied with . to ensure proportionality , this obligation should apply at the level of the overall online intermediation services , rather than at the level of individual goods or services offered through those services . moreover , as online intermediaries often own more than one platform or website , they should inform business users that sign a contract for listing with them , of which platforms or websites the listing is displayed on .


### providers of online intermediation services and providers of online search engines shall , when complying with the requirements of this article , not be required to disclose any trade secrets as defined in article 2 of directive 2016 / 943 . ### providers of online intermediation services and providers of online search engines shall , when complying with the requirements of this article , not be required to disclose any trade secrets as defined in article 2 of directive 2016 / 943 . with the objective of preventing the disclosure of relevant information to the company´s competition .


### examples of online intermediation services covered by this regulation should consequently include online e - commerce market places , including collaborative ones on which business users are active , online software applications services and online social media services . however , this regulation should not apply to online advertising serving tools or online advertising exchanges which are not provided with the aim of facilitating the initiation of direct transactions and which do not involve a contractual relationship with consumers . this regulation should also not apply to online payment services , since they do not themselves meet the applicable requirements but are rather inherently auxiliary to the transaction for the supply of goods and services to the consumers concerned . ### examples of online intermediation services covered by this regulation should consequently include online e - commerce market places , including collaborative ones on which business users are active , online software applications services and online social media services . however , this regulation should not apply to online payment services , since they do not themselves meet the applicable requirements but are rather inherently auxiliary to the transaction for the supply of goods and services to the consumers concerned .


### providers of online intermediation services shall set out in their terms and conditions the main parameters determining ranking and the reasons for the relative importance of those main parameters as opposed to other parameters . ### providers of online intermediation services shall set out in their terms and conditions the main parameters determining ranking and the reasons for the relative importance of those main parameters as opposed to other parameters . however , it will avoid favouring the platforms own products over those of third parties .


### providers of online intermediation services might in certain cases restrict in the terms and conditions the ability of business users to offer goods or services to consumers under more favourable conditions through other means than through those online intermediation services . in those cases , the providers concerned should set out the grounds for doing so , in particular with reference to the main economic , commercial or legal considerations for the restrictions . this transparency obligation should however not be understood as affecting the assessment of the legality of such restrictions under other acts of union law or the law of member states in accordance with union law , including in the areas of competition and unfair commercial practices , and the application of such laws . ### providers of online intermediation services sometimes restrict in the terms and conditions the ability of business users to offer goods or services to consumers under more favourable conditions through other means than through those online intermediation services . such restrictions should not be admissible , as they deprive business users in a disproportionate manner from exercising their entrepreneurial freedom to set the conditions of sale of their own products and services , and may also harm consumers by preventing them access to a wider choice .


### where those main parameters include the possibility to influence ranking against any direct or indirect remuneration paid by business users to the provider of online intermediation services concerned , that provider of online intermediation services shall also include in its terms and conditions a description of those possibilities and of the effects of such remuneration on ranking . ### the possibility to influence ranking against any direct or indirect remuneration paid by business users to the provider of online intermediation services concerned shall be prohibited . ranking should be established solely according to objective criteria regarding the quality of the good or service offered .


### set out the objective grounds for decisions to suspend or terminate , in whole or in part , the provision of their online intermediation services to business users . ### set out the objective , non - discriminatory , fair and reasonable grounds , consistent with those terms and conditions , for decisions to impose sanctions such as restrict , suspend or terminate , in whole or in part , the provision of their online intermediation services to business users .