### the efsi agreement shall provide for the creation of a european investment advisory hub within the eib . the eiah shall have as its objective to build upon existing eib and commission advisory services in order to provide advisory support for investment project identification , preparation and development and act as a single technical advisory hub for project financing within the union . this shall include support on the use of technical assistance for project structuring , use of innovative financial instruments , use of public - private partnerships and advice , as appropriate , on relevant issues of eu legislation . ### the efsi agreement shall provide for the creation of a european investment advisory hub within the eib . the eiah shall provide support taking into account specificities and needs of member states with less advanced financial markets . the eiah shall have as its objective to build upon existing eib and commission advisory services in order to provide advisory support for investment project identification , preparation and development and act as a single technical advisory hub for project financing within the union . this shall include support on the use of technical assistance for project structuring , use of innovative financial instruments , use of public - private partnerships and advice , as appropriate , on relevant issues of eu legislation .


### to meet that objective , the eiah shall use the expertise of the eib , the commission , national promotional banks and the managing authorities of the european structural and investment funds . ### to meet that objective , the eiah shall use the expertise of the eib , the commission , national and regional promotional banks and the managing authorities of the european structural and investment funds .


### development of infrastructure , including in the areas of transport , particularly in industrial centres ; energy , in particular energy interconnections ; and digital infrastructure ; ### development of infrastructure , including in the areas of transport , particularly in industrial centres ; energy , in particular energy interconnections ; and digital infrastructure ; to improve connections between different parts of europe and across borders ;


### infrastructure projects in the environmental , natural resources , urban development and social fields ; ### infrastructure projects in the environmental , natural resources , maritime economy , urban development and social fields ;


### the commission and the eib , with support from the member states , shall promote the creation of a transparent pipeline of current and potential future investment projects in the union . the pipeline is without prejudice to the final projects selected for support according to article 3 . ### the commission and the eib , with support from the member states , shall promote the creation of a transparent pipeline of current and potential future investment projects in the union . the pipeline is without prejudice to the final projects selected for support according to article 3 . the criteria to select investment projects shall take into account the added value in terms of economic and social sustainability .


### the commission and the eib shall develop , update and disseminate , on a regular and structured basis , information on current and future investments which significantly contribute to achieving eu policy objectives . ### the commission and the eib shall develop , update and disseminate , on a regular and structured basis , information on current and future investments which significantly contribute to achieving eu policy objectives . the european parliament may request additional information from the commission and the eib with this regard .


### an assessment of eib financing and investment operations at operation , sector , country and regional levels and their compliance with this regulation , together with an assessment of the allocation of eib financing and investment operations between the objectives in article 5 ; ### an assessment of eib financing and investment operations at operation , sector , country , regional and macroregional levels and their compliance with this regulation , together with an assessment of the allocation of eib financing and investment operations between the objectives in article 5 ;


### a number of barriers hinder the provision of online services which are ancillary to broadcasts and the provision of retransmission services and thereby the free circulation of television and radio programmes within the union . broadcasting organisations transmit daily many hours of news , cultural , political , documentary or entertainment programmes . these programmes incorporate a variety of content such as audiovisual , musical , literary or graphic works , which is protected by copyright and / or related rights under union law . that results in a complex process to clear rights from a multitude of right holders and for different categories of works and other protected subject matter . often the rights need to be cleared in a short time - frame , in particular when preparing programmes such as news or current affairs . in order to make their online services available across borders , broadcasting organisations need to have the required rights to works and other protected subject matter for all the relevant territories which further increases the complexity of the rights’ clearance . ### a number of barriers hinder the provision of online services which are ancillary to broadcasts and the provision of retransmission services and thereby the free circulation of television and radio programmes within the union . broadcasting organisations transmit daily many hours of news and current affairs programmes . these programmes incorporate a variety of content such as audiovisual , musical , literary or graphic works , which is protected by copyright and / or related rights under union law . that results in a complex process to clear rights from a multitude of right holders and for different categories of works and other protected subject matter . often the rights need to be cleared in a short time - frame . in order to make their online services available across borders , broadcasting organisations need to have the required rights to works and other protected subject matter for all the relevant territories which further increases the complexity of the rights’ clearance .


### operators of retransmission services offered on satellite , digital terrestrial , closed circuit ip - based , mobile and similar networks , provide services which are equivalent to those provided by operators of cable retransmission services when they retransmit simultaneously , in an unaltered and unabridged manner , for reception by the public , an initial transmission from another member state of television or radio programmes , where this initial transmission is by wire or over the air , including by satellite but excluding online transmissions , and intended for reception by the public . they should therefore be within the scope of this regulation and benefit from the mechanism introducing mandatory collective management of rights . retransmission services which are offered on the open internet should be excluded from the scope of this regulation as those services have different characteristics . they are not linked to any particular infrastructure and their ability to ensure a controlled environment is limited when compared for example to cable or closed circuit ip - based networks . ### operators of retransmission services offered on satellite , digital terrestrial , closed circuit ip - based , mobile and similar networks , as well as on the open internet , provide services which are equivalent to those provided by operators of cable retransmission services when they retransmit simultaneously , in an unaltered and unabridged manner , for reception by the public , an initial transmission from another member state of television or radio programmes , where this initial transmission is by wire or over the air , including by satellite and intended for reception by the public . they should therefore be within the scope of this regulation and benefit from the mechanism introducing mandatory collective management of rights . retransmission services which are offered on the open internet should only be excluded from the scope of this regulation if their ability to ensure a controlled environment is significantly limited when compared for example to cable or closed circuit ip - based networks . where a retransmission service offered on the open internet is provided to a closed group of subscribers or registered users the service should be regarded as being provided in a controlled environment .


### operators of retransmission services offered on satellite , digital terrestrial , closed circuit ip - based , mobile and similar networks , provide services which are equivalent to those provided by operators of cable retransmission services when they retransmit simultaneously , in an unaltered and unabridged manner , for reception by the public , an initial transmission from another member state of television or radio programmes , where this initial transmission is by wire or over the air , including by satellite but excluding online transmissions , and intended for reception by the public . they should therefore be within the scope of this regulation and benefit from the mechanism introducing mandatory collective management of rights . retransmission services which are offered on the open internet should be excluded from the scope of this regulation as those services have different characteristics . they are not linked to any particular infrastructure and their ability to ensure a controlled environment is limited when compared for example to cable or closed circuit ip - based networks . ### operators of retransmission services offered on satellite , digital terrestrial , closed circuit ip - based , mobile and similar networks and via an internet access service in accordance with regulation no 2015 / 2120 of the european parliament and of the council , provide services which are equivalent to those provided by operators of cable retransmission services when they retransmit simultaneously , in an unaltered and unabridged manner , for reception by the public , an initial transmission from another member state of television or radio programmes , where this initial transmission is by wire or over the air , including by satellite but excluding online transmissions , and intended for reception by the public . they should therefore be within the scope of this regulation and benefit from the mechanism introducing mandatory collective management of rights . retransmission services which are offered on the open internet should only be excluded from the scope of this regulation if they cannot ensure a controlled environment and their services do not have a clearly definable user group when compared for example to cable or closed circuit ip - based networks .


### “retransmission” means any simultaneous , unaltered and unabridged retransmission , other than cable retransmission as defined in directive 93 / 83 / eec and other than retransmission provided over an internet access service as defined in regulation 2015 / 2120 of the european parliament and of the council19 , intended for reception by the public of an initial transmission from another member state , by wire or over the air , including that by satellite but excluding online transmission , of television or radio programmes intended for the reception by the public , provided that such retransmission is made by a party other than the broadcasting organisation which made the initial transmission or under whose control and responsibility such transmission was made . _________________ 19 regulation 2015 / 2120 of the european parliament and of the council of 25 november 2015 laying down measures concerning open internet access and amending directive 2002 / 22 / ec on universal service and users’ rights relating to electronic communications networks and services and regulation no 531 / 2012 on roaming on public mobile communications networks within the union , oj l 310 , 26 . 11 . 2015 , p . 1 . ### “retransmission” means any simultaneous , unaltered and unabridged retransmission in a closed environment , other than cable retransmission as defined in directive 93 / 83 / eec , intended for reception by the public of an initial transmission from another member state , by wire or over the air , including that by satellite , of television or radio programmes intended for the reception by the public , provided that such retransmission is equivalent to retransmissions by operators of cable retransmission services and is made by a party other than the broadcasting organisation which made the initial transmission or under whose control and responsibility such transmission was made .


### “retransmission” means any simultaneous , unaltered and unabridged retransmission , other than cable retransmission as defined in directive 93 / 83 / eec and other than retransmission provided over an internet access service as defined in regulation 2015 / 2120 of the european parliament and of the council19 , intended for reception by the public of an initial transmission from another member state , by wire or over the air , including that by satellite but excluding online transmission , of television or radio programmes intended for the reception by the public , provided that such retransmission is made by a party other than the broadcasting organisation which made the initial transmission or under whose control and responsibility such transmission was made . _________________ 19 regulation 2015 / 2120 of the european parliament and of the council of 25 november 2015 laying down measures concerning open internet access and amending directive 2002 / 22 / ec on universal service and users’ rights relating to electronic communications networks and services and regulation no 531 / 2012 on roaming on public mobile communications networks within the union , oj l 310 , 26 . 11 . 2015 , p . 1 . ### “retransmission” means any simultaneous , unaltered and unabridged retransmission , other than cable retransmission as defined in directive 93 / 83 / eec and other than retransmission provided over an internet access service as defined in regulation 2015 / 2120 of the european parliament and of the council19 , intended for reception by the public of an initial transmission from another member state , by wire or over the air , including that by satellite or by direct injection but excluding online transmission , of television or radio programmes ultimately intended for the reception by the public , provided that such retransmission is made by a party other than the broadcasting organisation which made the initial transmission or under whose control and responsibility such transmission was made . _________________ 19 regulation 2015 / 2120 of the european parliament and of the council of 25 november 2015 laying down measures concerning open internet access and amending directive 2002 / 22 / ec on universal service and users’ rights relating to electronic communications networks and services and regulation no 531 / 2012 on roaming on public mobile communications networks within the union , oj l 310 , 26 . 11 . 2015 , p . 1 .


### ' retransmission ' means any simultaneous , unaltered and unabridged retransmission , other than cable retransmission as defined in directive 93 / 83 / eec and other than retransmission provided over an internet access service as defined in regulation 2015 / 2120 of the european parliament and of the council , intended for reception by the public of an initial transmission from another member state , by wire or over the air , including that by satellite but excluding online transmission , of television or radio programmes intended for the reception by the public , provided that such retransmission is made by a party other than the broadcasting organisation which made the initial transmission or under whose control and responsibility such transmission was made . __________________ 19regulation 2015 / 2120 of the european parliament and of the council of 25 november 2015 laying down measures concerning open internet access and amending directive 2002 / 22 / ec on universal service and users’ rights relating to electronic communications networks and services and regulation no 531 / 2012 on roaming on public mobile communications networks within the union , oj l 310 , 26 . 11 . 2015 , p . 1 . ### ' retransmission ' means any simultaneous , unaltered and unabridged retransmission , other than cable retransmission as defined in directive 93 / 83 / eec , intended for reception by the public of an initial transmission from another member state , in a closed environment , by wire or over the air , including that by satellite but excluding online transmission , of television or radio programmes intended for the reception by the public , provided that such retransmission has the same characteristics as the cable retransmission and is made by a party other than the broadcasting organisation which made the initial transmission or under whose control and responsibility such transmission was made .


### it is appropriate to replace directive 2010 / 30 / eu by a regulation which maintains the same scope , but modifies and enhances some of its provisions in order to clarify and update their content . a regulation is the appropriate legal instrument as it imposes clear and detailed rules which do not give room for divergent transposition by member states and ensures thus a higher degree of harmonisation across the union . a harmonised regulatory framework at union rather than at member state level brings down costs for manufacturers and ensures a level playing field . harmonisation across the union ensures the free movement of goods across the single market . ### it is appropriate to replace directive 2010 / 30 / eu by a regulation which maintains the same scope , but modifies and enhances some of its provisions in order to clarify and update their content . a regulation is the appropriate legal instrument as it imposes clear and detailed rules which do not give room for divergent transposition by member states and ensures thus a higher degree of harmonisation across the union . a harmonised regulatory framework at union rather than at member state level brings down costs for manufacturers and ensures a level playing field . a harmonised regulatory framework can also help build consumer confidence and prevent confusion . harmonisation across the union ensures the free movement of goods across the single market .


### improving the efficiency of energy - related products through informed consumer choice benefits the union economy overall , drives innovation and will contribute to the achievement of the union’s 2020 and 2030 energy efficiency targets . it will also allow consumers to save money . ### improving the efficiency of energy - related products through informed consumer choice benefits the union economy overall , drives innovation and will contribute to the achievement of the union’s 2020 and 2030 energy efficiency targets as well as achievement of the eu’s environmental and climate action targets . it will also allow consumers to save money by reducing household energy bills .


### the provision of accurate , relevant and comparable information on the specific energy consumption of energy - related products facilitates the customer ' s choice in favour of those products which consume less energy and other essential resources during use . a standardised mandatory label is an effective mean to provide potential customers with comparable information on the energy consumption of energy - related products . it should be supplemented with a product information sheet . the label should be easily recognisable , simple and concise . to this end the existing dark green to red colour scale of the label should be retained as the basis to inform customers about the energy efficiency of products . a classification using letters from a to g has shown to be most effective for customers . in situations where because of ecodesign measures under directive 2009 / 125 / ec products can no longer fall into classes ' f ' or ' g ' , those classes should not be shown on the label . for exceptional cases this should also be extended to the ' d ' and ' e ' classes , although this situation is unlikely to occur given that the label would be rescaled once a majority of product models falls into the top two classes . ### the provision of accurate , relevant and comparable information on the specific energy consumption of energy - related products facilitates the customer ' s choice in favour of those products which consume less energy and other essential resources during use . a standardised mandatory label is an effective mean to provide potential customers with comparable and trustworthy information on the energy consumption of energy - related products . it should be supplemented with a product information sheet . the label should be easily recognisable , simple and concise . to this end the existing dark green to red colour scale of the label should be retained as the basis to inform customers about the energy efficiency of products as it is already known to consumers . a classification using letters from a to g has shown to be most effective for customers . in situations where because of ecodesign measures under directive 2009 / 125 / ec products can no longer fall into classes ' f ' or ' g ' , those classes should not be shown on the label . for exceptional cases this should also be extended to the ' d ' and ' e ' classes , although this situation is unlikely to occur given that the label would be rescaled once a majority of product models falls into the top two classes .


### advances in digital technology allow for alternative ways of delivering and displaying labels electronically , such as on the internet , but also on electronic displays in shops . in order to take advantage of such advances , this regulation should allow the use of electronic labels as replacement of or complementary to the physical energy label . in cases where it is not feasible to display the energy label , such as certain forms of distance selling and in advertisements and technical promotional material , potential customers should be provided at least with the energy class of the product . ### advances in digital technology allow for alternative ways of delivering and displaying labels electronically , such as on the internet , but also on electronic displays in shops . in order to take advantage of such advances , this regulation should allow the use of electronic labels as replacement of or complementary to the physical energy label . this provision does not affect the duty of the supplier to accompany each unit of a product with a physical label for the dealer . in cases where it is not feasible to display the energy label , such as certain forms of distance selling and in advertisements and technical promotional material , potential customers should be provided at least with the energy class of the product .


### in order for customers to retain trust in the energy label , other labels that mimic the energy label should not be allowed to be used for energy - related products . additional labels , marks , symbols or inscriptions that are likely to mislead or confuse customers with respect to the consumption of energy should not be allowed either . 20 ### in order for customers to retain trust in the energy label , other labels , even those as part of a national scheme , that mimic the energy label should not be allowed to be used for energy - related products . additional labels , marks , symbols or inscriptions that are likely to mislead or confuse customers with respect to the consumption of energy should not be allowed either .


### in order to ensure legal certainty , it is necessary to clarify that rules on union market surveillance and control of products entering the union market provided for in regulation no 765 / 2008 of the european parliament and of the council21 apply to energy - related products . given the principle of free movement of goods , it is imperative that the market surveillance authorities of the member states cooperate with each other effectively . such cooperation on energy labelling should be reinforced through support by the commission . __________________ 21 oj l 218 , 13 . 8 . 2008 , p . 30 . ### in order to ensure legal certainty , it is necessary to clarify that rules on union market surveillance and control of products entering the union market provided for in regulation no 765 / 2008 of the european parliament and of the council apply to energy - related products . given the principle of free movement of goods , it is imperative that the market surveillance authorities of the member states cooperate with each other effectively . the group of experts on ecodesign and energy labelling administrative co - operation working group has proved to be a suitable framework for the cooperation of market surveillance authorities and should therefore be reinforced by the commission . __________________ 21 oj l 218 , 13 . 8 . 2008 , p . 30 .


### energy consumption and other information concerning the products covered by product - specific requirements under this regulation should be measured by using reliable , accurate and reproducible methods that take into account the generally recognised state - of - the - art measurements and calculation methods . it is in the interests of the functioning of the internal market to have standards which have been harmonised at union level . in the absence of published standards at the time of application of product - specific requirements the commission should publish in the official journal of the european union transitional measurement and calculation methods in relation to those product - specific requirements . once a reference to such a standard has been published in the official journal of the european union compliance with it should provide a presumption of conformity with measurement methods for those product - specific requirements adopted on the basis of this regulation . ### the absolute energy consumption and other environmental and performance information concerning the products covered by product - specific requirements under this regulation should be measured by using reliable , accurate and reproducible methods that take into account the generally recognised state - of - the - art measurements and calculation methods . the measurement and calculation methods and testing environment are to reflect real - life conditions . products shall be tested by applying the operation modes that are applied by the average consumer . simulation of real - life conditions of use , shall be achieved , in particular , by measuring the input power of a product under such conditions , and by taking into account , where relevant , the amount of time required by the product to deliver a certain output of performance or service . test methods of both suppliers and market surveillance authorities should be established and executed in such a way that intentional or unintentional manipulation or amelioration of the test results is detected and eliminated . allowed deviations between tested and declared results shall be limited to the statistical margin of error of the measurement equipment . it is in the interests of the functioning of the internal market to have standards which have been harmonised at union level . in the absence of published standards at the time of application of product - specific requirements the commission should publish in the official journal of the european union transitional measurement and calculation methods in relation to those product - specific requirements . once a reference to such a standard has been published in the official journal of the european union compliance with it should provide a presumption of conformity with measurement methods for those product - specific requirements adopted on the basis of this regulation


### ‘ label’ means a graphic diagram including a classification using letters from a to g in seven different colours from dark green to red in order to show consumption of energy ; ### ‘ label’ means a printed or digital graphic diagram including a classification using letters from a to g , each class corresponding to significant energy savings , in seven different colours from dark green to red in order to show consumption of energy ;


### ' supplementary information ' means information on the functional and environmental performance of an energy - related product , such as its absolute energy consumption or durability , which is based on data that are measurable by market surveillance authorities , is unambiguous and has no significant negative impact on the clear intelligibility and effectiveness of the label as a whole towards customers . ### ' supplementary information ' means information on the functional and environmental performance of an energy - related product , such as its absolute energy consumption or durability , which is based on data that are measurable by market surveillance authorities , is easily understandable and has no significant negative impact on the clear intelligibility and effectiveness of the label as a whole towards customers .


### where the market surveillance authorities of one member state have sufficient reason to believe that an energy - related product covered by a delegated act under this regulation presents a risk to aspects of public interest protection covered by this regulation , they shall carry out an evaluation in relation to the energy - related product concerned covering all the requirements laid down in this regulation and its relevant delegated acts . the supplier shall cooperate as necessary with the market surveillance authorities for that purpose . ### where the market surveillance authorities of one member state have sufficient reason to believe that the information published on the label or the information sheet of an energy - related product does not comply with the requirements set out by a delegated act , and therefore could present a risk to aspects of public interest protection , they shall carry out , in accordance with regulation 765 / 2008 / eu , an evaluation in relation to the energy - related product concerned covering all the requirements laid down in this regulation and its relevant delegated acts . the supplier shall cooperate as necessary with the market surveillance authorities for that purpose .


### where , in the course of that evaluation , the market surveillance authorities find that the energy - related product does not comply with the requirements laid down in this this regulation and its relevant delegated acts , they shall without delay require the supplier to take all appropriate corrective action to bring the energy - related product into compliance with those requirements , to withdraw the energy - related product from the market , or to recall it within a reasonable period , commensurate with the nature of the risk , as they may prescribe . article 21 of regulation no 765 / 2008 shall apply to the measures referred to in this paragraph . ### where , in the course of that evaluation , the market surveillance authorities find that the energy - related product does not comply with the requirements laid down in this this regulation and its relevant delegated acts , they shall without delay require the supplier to take all appropriate corrective action to bring the energy - related product into compliance with those requirements within 4 weeks , to withdraw the energy - related product from the market , or to recall it within a reasonable period , commensurate with the nature of the risk , as they may prescribe . article 21 of regulation no 765 / 2008 shall apply to the measures referred to in this paragraph . market surveillance authorities shall use icsms to inform other market surveillance authorities of the breach of compliance of the energy - related product .


### where the market surveillance authorities consider that non - compliance is not restricted to their national territory , they shall inform the commission and the other member states of the results of the evaluation and of the actions which they have required the supplier to take . ### where the market surveillance authorities consider that there is a possibility that non - compliance is not restricted to their national territory , they shall inform the commission and the other member states of the results of the evaluation and of the actions which they have required the supplier to take . the market surveillance authority in charge shall enter this information into the compliance interface of the product database .


### where the market surveillance authorities consider that non - compliance is not restricted to their national territory , they shall inform the commission and the other member states of the results of the evaluation and of the actions which they have required the supplier to take . ### in the case of non - compliance the market surveillance authorities shall inform the commission , the european parliament and the other member states of the results of the evaluation and of the actions which they have required the supplier to take .


### where the market surveillance authorities consider that non - compliance is not restricted to their national territory , they shall inform the commission and the other member states of the results of the evaluation and of the actions which they have required the supplier to take . ### market surveillance authorities inform the commission and other member states of the results of the evaluation and actions which they have required the supplier to take .


### where the market surveillance authorities consider that non - compliance is not restricted to their national territory , they shall inform the commission and the other member states of the results of the evaluation and of the actions which they have required the supplier to take . ### the market surveillance authorities shall inform the commission and the other member states of the results of the evaluation and of the actions which they have required the supplier to take .


### where the market surveillance authorities consider that non - compliance is not restricted to their national territory , they shall inform the commission and the other member states of the results of the evaluation and of the actions which they have required the supplier to take . ### where the market surveillance authorities consider that there has been non - compliance , they shall inform the commission and the other member states of the results of the evaluation and of the actions which they have required the supplier to take and upload the information in the product database .


### where , within 60 days of receipt of the information referred to in paragraph 5 , no objection has been raised by either a member state or the commission in respect of a provisional measure taken by a member state , that measure shall be deemed justified . ### where , within 30 days of receipt of the information referred to in paragraph 5 , no objection has been raised by either a member state or the commission in respect of a provisional measure taken by a member state , that measure shall be deemed justified .


### in the conduct of its activities under this regulation the commission shall ensure in respect of each delegated act , a balanced participation of member states’ representatives and interested parties concerned with the product group in question , such as industry , including smes and craft industry , trade unions , traders , retailers , importers , environmental protection groups and consumer organisations . for this purpose , the commission shall establish a consultation forum in which these parties shall met . this consultation forum may be combined with the consultation forum referred to in article 18 of directive 2009 / 125 / ec . ### in the conduct of its activities under this regulation the commission shall ensure in respect of each delegated act , a balanced participation of representatives from the european parliament , and the council along with member states’ representatives and interested parties concerned with the product group in question , such as industry , including smes and craft industry , trade unions , traders , retailers , importers , environmental protection groups and consumer organisations . for this purpose , the commission shall establish a consultation forum in which these parties shall met . this consultation forum may be combined with the consultation forum referred to in article 18 of directive 2009 / 125 / ec .


### the commission shall , having consulted the consultation forum referred to in article 10 , establish a working plan which shall be made publicly available . the working plan shall set out an indicative list of product groups which are considered as priorities for the adoption of delegated acts . the working plan shall also set out plans for the revision and rescaling of labels of products or product groups . the working plan may be amended periodically by the commission after consultation with the consultation forum . the working plan may be combined with the working plan required by article 16 of directive 2009 / 125 / ec . ### the commission shall , having consulted the consultation forum referred to in article 10 , establish a long - term working plan which shall be revised on an annual basis after consultation with the consultation forum . the working plan shall set out an indicative list of product groups which are considered as priorities for the adoption of delegated acts . the working plan shall also set out plans for the revision and rescaling of labels of products or product groups . the working plan shall be made publicly available . the working plan may be combined with the working plan required by article 16 of directive 2009 / 125 / ec .


### increased digitisation and connectivity lead to increased cybersecurity risks , thus making society at large more vulnerable to cyber threats and exacerbating dangers faced by individuals , including vulnerable persons such as children . in order to mitigate this risk to society , all necessary actions need to be taken to improve cybersecurity in the eu to better protect network and information systems , telecommunication networks , digital products , services and devices used by citizens , governments and business – from smes to operators of critical infrastructures – from cyber threats . ### increased digitisation and connectivity lead to increased cybersecurity risks , thus making society at large more vulnerable to cyber threats and exacerbating dangers faced by individuals , including vulnerable persons such as children . the transformative power of artificial intelligence and machine learning will be harnessed by society at large , but also by cyber criminals . in order to mitigate these risks to society , all necessary actions need to be taken to improve cybersecurity in the eu to better protect network and information systems , telecommunication networks , digital products , services and devices used by citizens , governments and business – from smes to operators of critical infrastructures – from cyber threats .


### increased digitisation and connectivity lead to increased cybersecurity risks , thus making society at large more vulnerable to cyber threats and exacerbating dangers faced by individuals , including vulnerable persons such as children . in order to mitigate this risk to society , all necessary actions need to be taken to improve cybersecurity in the eu to better protect network and information systems , telecommunication networks , digital products , services and devices used by citizens , governments and business – from smes to operators of critical infrastructures – from cyber threats . ### increased digitisation and connectivity lead to increased cybersecurity risks , thus making society at large more vulnerable to cyber threats and exacerbating dangers faced by individuals , including vulnerable persons such as children . in order to mitigate this risk to society , all necessary actions need to be taken to improve security against cyber - attacks in the eu to better protect network and information systems , telecommunication networks , digital products , services and devices used by citizens , governments and business – from smes to operators of critical infrastructures – from cyber threats .


### cyber - attacks are on the increase and a connected economy and society that is more vulnerable to cyber threats and attacks requires stronger defences . however , while cyber - attacks are often cross - border , policy responses by cybersecurity authorities and law enforcement competences are predominantly national . large - scale cyber incidents could disrupt the provision of essential services across the eu . this requires effective eu level response and crisis management , building upon dedicated policies and wider instruments for european solidarity and mutual assistance . moreover , a regular assessment of the state of cybersecurity and resilience in the union , based on reliable union data , as well as systematic forecast of future developments , challenges and threats , both at union and global level , is therefore important for policy makers , industry and users . ### cyber - attacks are on the increase and a connected economy and society that is more vulnerable to cyber threats and attacks requires stronger and more secure defences . however , while cyber - attacks are often cross - border , policy responses by cybersecurity authorities and law enforcement competences are predominantly national . large - scale cyber incidents could disrupt the provision of essential services across the eu . this requires effective eu level response and crisis management , building upon dedicated policies and wider instruments for european solidarity and mutual assistance . moreover , a regular assessment of the state of cybersecurity and resilience in the union , based on reliable union data , as well as systematic forecast of future developments , challenges and threats , both at union and global level , is therefore important for policy makers , industry and users .


### in light of the increased cybersecurity challenges faced by the union , there is a need for a comprehensive set of measures that would build on previous union action and foster mutually reinforcing objectives . these include the need to further increase capabilities and preparedness of member states and businesses , as well as to improve cooperation and coordination across member states and eu institutions , agencies and bodies . furthermore , given the borderless nature of cyber threats , there is a need to increase capabilities at union level that could complement the action of member states , in particular in the case of large scale cross - border cyber incidents and crises . additional efforts are also needed to increase awareness of citizens and businesses on cybersecurity issues . moreover , the trust in the digital single market should be further improved by offering transparent information on the level of security of ict products and services . this can be facilitated by eu - wide certification providing common cybersecurity requirements and evaluation criteria across national markets and sectors . ### in light of the increased cybersecurity challenges faced by the union , there is a need for a comprehensive set of measures that would build on previous union action and foster mutually reinforcing objectives . these include the need to further increase capabilities and preparedness of member states and businesses , as well as to improve cooperation and coordination across member states and eu institutions , agencies and bodies . furthermore , given the borderless nature of cyber threats , there is a need to increase capabilities at union level that could complement the action of member states , in particular in the case of large scale cross - border cyber incidents and crises . additional efforts are also needed to increase awareness of citizens and businesses on cybersecurity issues . moreover , given that cyber incidents undermine trust in digital service providers and in the digital single market itself , especially among consumers , trust should be further improved by offering transparent information on the level of security of ict products and services . this can be facilitated by eu - wide certification providing common cybersecurity requirements and evaluation criteria across national markets and sectors . alongside union - wide certification , there are a range of voluntary measures that the private sector itself should take to bolster trust in the security of ict products and services , in particular in view of the growing availability of iot devices . for example , more effective use should be made of encryption and other technologies such as blockchain , in order to improve the security of end - users’ data and communications and the overall security of network and information systems in the union .


### the union has already taken important steps to ensure cybersecurity and increase trust in digital technologies . in 2013 , an eu cybersecurity strategy was adopted to guide the union ' s policy response to cybersecurity threats and risks . in its effort to better protect europeans online , in 2016 the union adopted the first legislative act in the area of cybersecurity , the directive 2016 / 1148 concerning measures for a high common level of security of network and information systems across the union . the nis directive put in place requirements concerning national capabilities in the area of cybersecurity , established the first mechanisms to enhance strategic and operational cooperation between member states , and introduced obligations concerning security measures and incident notifications across sectors which are vital for economy and society such as energy , transport , water , banking , financial market infrastructures , healthcare , digital infrastructure as well as key digital service providers . a key role was attributed to enisa in supporting implementation of this directive . in addition , effective fight against cybercrime is an important priority in the european agenda on security , contributing to the overall aim of achieving a high level of cybersecurity . ### the union has already taken important steps to ensure cybersecurity and increase trust in digital technologies . in 2013 , an eu cybersecurity strategy was adopted to guide the union ' s policy response to cybersecurity threats and risks . in its effort to better protect europeans online , in 2016 the union adopted the first legislative act in the area of cybersecurity , the directive 2016 / 1148 concerning measures for a high common level of security of network and information systems across the union . the nis directive , the success of which will depend heavily on effective implementation by member states , put in place requirements concerning national capabilities in the area of cybersecurity , established the first mechanisms to enhance strategic and operational cooperation between member states , and introduced obligations concerning security measures and incident notifications across sectors which are vital for economy and society such as energy , transport , water , banking , financial market infrastructures , healthcare , digital infrastructure as well as key digital service providers . a key role was attributed to enisa in supporting implementation of this directive . in addition , effective fight against cybercrime is an important priority in the european agenda on security , contributing to the overall aim of achieving a high level of cybersecurity .


### the agency should contribute towards raising the awareness of the public about risks related to cybersecurity and provide guidance on good practices for individual users aimed at citizens and organisations . the agency should also contribute to promote best practices and solutions at the level of individuals and organisations by collecting and analysing publicly available information regarding significant incidents , and by compiling reports with a view to providing guidance to businesses and citizens and improving the overall level of preparedness and resilience . the agency should furthermore organise , in cooperation with the member states and the union institutions , bodies , offices and agencies regular outreach and public education campaigns directed to end - users , aiming at promoting safer individual online behaviour and raising awareness of potential threats in cyberspace , including cybercrimes such as phishing attacks , botnets , financial and banking fraud , as well as promoting basic authentication and data protection advice . the agency should play a central role in accelerating end - user awareness on security of devices . ### the agency should contribute towards raising the awareness of the public about risks related to cybersecurity and provide guidance on good practices for individual users aimed at citizens and organisations . the agency should also contribute to promote best practices and solutions at the level of individuals and organisations by collecting and analysing publicly available information regarding significant incidents , and by compiling reports with a view to providing guidance to businesses and citizens and improving the overall level of preparedness and resilience . the agency should furthermore organise , in cooperation with the member states and the union institutions , bodies , offices and agencies regular outreach and public education campaigns directed to end - users , aiming at promoting safer individual online behaviour and raising awareness of potential threats in cyberspace , including cybercrimes such as phishing attacks , botnets , financial and banking fraud , as well as promoting advice on basic authentication , data protection , encryption and other security - and privacy - enhancing technologies and anonymisation tools . the agency should play a central role in accelerating end - user awareness on security of devices .


### the agency should contribute towards raising the awareness of the public about risks related to cybersecurity and provide guidance on good practices for individual users aimed at citizens and organisations . the agency should also contribute to promote best practices and solutions at the level of individuals and organisations by collecting and analysing publicly available information regarding significant incidents , and by compiling reports with a view to providing guidance to businesses and citizens and improving the overall level of preparedness and resilience . the agency should furthermore organise , in cooperation with the member states and the union institutions , bodies , offices and agencies regular outreach and public education campaigns directed to end - users , aiming at promoting safer individual online behaviour and raising awareness of potential threats in cyberspace , including cybercrimes such as phishing attacks , botnets , financial and banking fraud , as well as promoting basic authentication and data protection advice . the agency should play a central role in accelerating end - user awareness on security of devices . ### the agency should contribute towards raising the awareness of the public about risks related to cybersecurity and provide guidance on good practices for individual users aimed at citizens and organisations . the agency should also contribute to promote best practices and solutions at the level of individuals and organisations by collecting and analysing publicly available information regarding significant incidents , and by compiling reports with a view to providing guidance to businesses and citizens and improving the overall level of preparedness and resilience . the agency should furthermore organise , in cooperation with the member states and the union institutions , bodies , offices and agencies regular outreach and public education campaigns directed to end - users , aiming at promoting safer individual online behaviour and raising awareness of potential threats in cyberspace , including cybercrimes such as phishing attacks , ransomware attacks , hijacking , botnets , financial and banking fraud , as well as promoting basic authentication and data protection advice . the agency should play a central role in accelerating end - user awareness on security of devices .


### the agency should encourage member states and service providers to raise their general security standards so that all internet users can take the necessary steps to ensure their own personal cybersecurity . in particular , service providers and product manufacturers should withdraw or recycle products and services that do not meet cybersecurity standards . in cooperation with competent authorities , enisa may disseminate information regarding the level of cybersecurity of the products and services offered in the internal market , and issue warnings targeting providers and manufacturers and requiring them to improve the security , including cybersecurity , of their products and services . ### the agency should encourage member states and service providers to raise their general security standards so that all internet users can take the necessary steps to ensure their own personal cybersecurity . in particular , service providers and product manufacturers should withdraw or recycle products and services that do not meet cybersecurity standards . in cooperation with competent authorities , enisa may disseminate information regarding the level of cybersecurity of the products and services offered in the internal market , and issue warnings targeting providers and manufacturers and requiring them to improve the security , including cybersecurity , of their products and services . any providers or manufacturers receiving a warning regarding the level of cybersecurity of their products should be made public on a dedicated portal .


### conformity assessment is the process demonstrating whether specified requirements relating to a product , process , service , system , person or body have been fulfilled . for the purposes of this regulation , certification should be considered as a type of conformity assessment regarding the cybersecurity features of a product , process , service , system , or a combination of those by an independent third party , other than the product manufacturer or service provider . certification cannot guarantee per se that certified ict products and services are cyber secure . it is rather a procedure and technical methodology to attest that ict products and services have been tested and that they comply with certain cybersecurity requirements laid down elsewhere , for example as specified in technical standards . ### conformity assessment is the process demonstrating whether specified requirements relating to a product , process , service , system , person or body have been fulfilled . for the purposes of this regulation , certification should be considered as a type of conformity assessment regarding the cybersecurity features of a product , process , service , system , or a combination of those by an independent third party , other than the product manufacturer or service provider . certification cannot guarantee per se that certified ict products and services are cyber secure and the end user should be made aware of it . it is rather a procedure and technical methodology to attest that ict products and services have been tested and that they comply with certain cybersecurity requirements laid down elsewhere , for example as specified in technical standards .


### currently , the cybersecurity certification of ict products and services is used only to a limited extent . when it exists , it mostly occurs at member state level or in the framework of industry driven schemes . in this context , a certificate issued by one national cybersecurity authority is not in principle recognised by other member states . companies thus may have to certify their products and services in several member states where they operate , for example with a view to participating in national procurement procedures . moreover , while new schemes are emerging , there seems to be no coherent and holistic approach with regard to horizontal cybersecurity issues , for instance in the field of the internet of things . existing schemes present significant shortcomings and differences in terms of product coverage , levels of assurance , substantive criteria and actual utilisation . ### currently , the cybersecurity certification of ict products and services is used only to a limited extent . when it exists , it mostly occurs at member state level or in the framework of industry driven schemes . in this context , a certificate issued by one national cybersecurity authority is not in principle recognised by other member states . companies thus may have to certify their products and services in several member states where they operate , for example with a view to participating in national procurement procedures , thereby adding to their costs . moreover , while new schemes are emerging , there seems to be no coherent and holistic approach with regard to horizontal cybersecurity issues , for instance in the field of the internet of things . existing schemes present significant shortcomings and differences in terms of product coverage , levels of assurance , substantive criteria and actual utilisation .


### in view of the above , it is necessary to establish a european cybersecurity certification framework laying down the main horizontal requirements for european cybersecurity certification schemes to be developed and allowing certificates for ict products and services to be recognised and used in all member states . the european framework should have a twofold purpose : on the one hand , it should help increase trust in ict products and services that have been certified according to such schemes . on the other hand , it should avoid the multiplication of conflicting or overlapping national cybersecurity certifications and thus reduce costs for undertakings operating in the digital single market . the schemes should be non - discriminatory and based on international and / or union standards , unless those standards are ineffective or inappropriate to fulfil the eu’s legitimate objectives in that regard . ### in view of the above , it is necessary to establish a european cybersecurity certification framework laying down the main horizontal requirements for european cybersecurity certification schemes to be developed and allowing certificates for ict products and services to be recognised and used in all member states . in so doing , it is essential to build on existing national and international schemes , as well as on mutual recognition systems , in particular sog - is , and to make possible a smooth transition from existing schemes under such systems to schemes under the new european framework . the european framework should have a twofold purpose : on the one hand , it should help increase trust in ict products and services that have been certified according to such schemes . on the other hand , it should avoid the multiplication of conflicting or overlapping national cybersecurity certifications and thus reduce costs for undertakings operating in the digital single market . the schemes should be non - discriminatory and based on international and / or union standards , unless those standards are ineffective or inappropriate to fulfil the eu’s legitimate objectives in that regard .


### the commission should be empowered to request enisa to prepare candidate schemes for specific ict products or services . the commission , based on the candidate scheme proposed by enisa , should then be empowered to adopt the european cybersecurity certification scheme by means of implementing acts . taking account of the general purpose and security objectives identified in this regulation , european cybersecurity certification schemes adopted by the commission should specify a minimum set of elements concerning the subject - matter , the scope and functioning of the individual scheme . these should include among others the scope and object of the cybersecurity certification , including the categories of ict products and services covered , the detailed specification of the cybersecurity requirements , for example by reference to standards or technical specifications , the specific evaluation criteria and evaluation methods , as well as the intended level of assurance : basic , substantial and / or high . ### the commission should be empowered to request enisa to prepare candidate schemes for specific ict products or services . the power to adopt acts in accordance with article 290 of the treaty on the functioning of the european union should be delegated to the commission in respect of establishing european cybersecurity certification schemes for ict products and services . it is of particular importance that the commission carry out appropriate consultations during its preparatory work , including at expert level , and that those consultations be conducted in accordance with the principles laid down in the interinstitutional agreement of 13 april 2016 on better law - making . in particular , to ensure equal participation in the preparation of delegated acts , the european parliament and the council receive all documents at the same time as member states’ experts , and their experts systematically have access to meetings of commission expert groups dealing with the preparation of delegated acts . when adopting those delegated acts , the commission should base the cybersecurity certification schemes for ict products and services on any relevant candidate schemes proposed by enisa .


### it is necessary to require all member states to designate one cybersecurity certification supervisory authority to supervise compliance of conformity assessment bodies and of certificates issued by conformity assessment bodies established in their territory with the requirements of this regulation and of the relevant cybersecurity certification schemes . national certification supervisory authorities should handle complaints lodged by natural or legal persons in relation to certificates issued by conformity assessment bodies established in their territories , investigate to the extent appropriate the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable time period . moreover , they should cooperate with other national certification supervisory authorities or other public authority , including by sharing information on possible non - compliance of ict products and services with the requirements of this regulation or specific cybersecurity schemes . ### it is necessary to require all member states to designate one cybersecurity certification supervisory authority to supervise compliance of conformity assessment bodies and of certificates issued by conformity assessment bodies established in their territory with the requirements of this regulation and of the relevant cybersecurity certification schemes . national certification supervisory authorities should handle complaints lodged by natural or legal persons in relation to certificates issued by conformity assessment bodies established in their territories , investigate to the extent appropriate the subject - matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable time period . moreover , they should cooperate with other national certification supervisory authorities or other public authority , including by sharing information on possible non - compliance of ict products and services with the requirements of this regulation or specific cybersecurity schemes . effective cooperation among the national certification supervisory authorities is essential for the proper implementation of european cybersecurity certification schemes and of technical issues concerning the cybersecurity of ict products and services . the commission should facilitate that exchange of information by making available a general electronic information support system , for example the information and communication system on market surveillance and the rapid alert system for dangerous non - food products already used by market surveillance authorities pursuant to regulation no 765 / 2008 .


### the examination procedure should be used for the adoption of implementing acts on european cybersecurity certification schemes for ict products and services ; on modalities of carrying enquiries by the agency ; as well as on the circumstances , formats and procedures of notifications of accredited conformity assessment bodies by the national certification supervisory authorities to the commission . ### the examination procedure should be used for the adoption of implementing acts on european cybersecurity certification schemes for ict products and services ; on modalities of carrying enquiries by the agency ; as well as on the circumstances , formats and procedures of notifications of accredited conformity assessment bodies by the national certification supervisory authorities to the commission , taking into account the proven effectiveness of the electronic notification tool “new approach notified and designated organisations” .


### ‘ ict product and service’ means any element or group of elements of network and information systems ; ### ‘ ict product and service’ means a product , service , process , system , or combination thereof that is an element of network and information systems ;


### the agency shall undertake the tasks assigned to it by this regulation for the purpose of contributing to a high level of cybersecurity within the union . ### the agency shall undertake the tasks assigned to it by this regulation for the purpose of contributing to achieving a high common level of cybersecurity within the union , to reduce fragmentation in the internal market and improve its functioning .


### the agency shall undertake the tasks assigned to it by this regulation for the purpose of contributing to a high level of cybersecurity within the union . ### the agency shall undertake the tasks assigned to it by this regulation for the purpose of contributing to a high level of information security , in order to prevent cyber - attacks within the union .


### the agency shall increase cybersecurity capabilities at union level in order to complement the action of member states in preventing and responding to cyber threats , notably in the event of cross - border incidents . ### the agency shall contribute to increasing cybersecurity capabilities at union level in order to complement and strengthen the action of member states in preventing and responding to cyber threats , notably in the event of cross - border incidents .


### the agency shall promote the use of certification , including by contributing to the establishment and maintenance of a cybersecurity certification framework at union level in accordance with title iii of this regulation , with a view to increasing transparency of cybersecurity assurance of ict products and services and thus strengthen trust in the digital internal market . ### the agency shall promote the use of certification and standardisation while avoiding the fragmentation caused by lack of coordination between existing certification schemes in the union . the agency shall contribute to the establishment and maintenance of a cybersecurity certification framework at union level in accordance with title iii of this regulation , with a view to increasing transparency of cybersecurity assurance of ict products and services and thus strengthen trust in the digital internal market .


### the agency shall promote a high level of awareness of citizens and businesses on issues related to the cybersecurity . ### the agency shall promote a high level of awareness of citizens , authorities and businesses on issues related to the cybersecurity .


### assisting and advising , in particular by providing its independent opinion and supplying preparatory work , on the development and review of union policy and law in the area of cybersecurity , as well as sector - specific policy and law initiatives where matters related to cybersecurity are involved ; ### assisting and advising on the development and review of union policy and law in the area of cybersecurity , as well as sector - specific policy and law initiatives where matters related to cybersecurity are involved ;


### the promotion of an enhanced level of security of electronic communications , including by providing expertise and advice , as well as facilitating the exchange of best practices between competent authorities ; ### the promotion of an enhanced level of security of electronic communications , data storage and data processing , including by providing expertise and advice , as well as facilitating the exchange of best practices between competent authorities ;


### upon a request by two or more member states concerned , and with the sole purpose of providing advice for the prevention of future incidents , the agency shall provide support to or carry out an ex - post technical enquiry following notifications by affected undertakings of incidents having a significant or substantial impact pursuant to directive 2016 / 1148 . the agency shall also carry out such an enquiry upon a duly justified request from the commission in agreement with the concerned member states in case of such incidents affecting more than two member states . ### upon a request by one or more member states concerned , and with the sole purpose of providing advice for the prevention of future incidents , the agency shall provide support to or carry out an ex - post technical enquiry following notifications by affected undertakings of incidents having a significant or substantial impact pursuant to directive 2016 / 1148 . the agency shall also carry out such an enquiry upon a duly justified request from the commission in agreement with the concerned member states in case of such incidents affecting more than two member states .


### aggregating reports from national sources with a view to contribute to establishing common situational awareness ; ### aggregating reports from national and international sources with a view to contribute to establishing common situational awareness ;


### the management board shall be composed of one representative of each member state , and two representatives appointed by the commission . all representatives shall have voting rights . ### the management board shall be composed of one representative of each member state , and two representatives appointed by the commission and the european parliament . all representatives shall have voting rights .


### appoint the executive director and where relevant extend his term of office or remove him from office in accordance with article 33 of this regulation ; ### appoint the executive director through selection based on professional criteria and where relevant extend his term of office or remove him from office in accordance with article 33 of this regulation ;


### the executive director shall report to the european parliament on the performance of his or her duties when invited to do so . the council may invite the executive director to report on the performance of his or her duties . ### the executive director shall report annually to the european parliament on the performance of his or her duties or when invited to do so . the council may invite the executive director to report on the performance of his or her duties .


### the management board , acting on a proposal by the executive director , shall set up a permanent stakeholders ' group composed of recognised experts representing the relevant stakeholders , such as the ict industry , providers of electronic communications networks or services available to the public , consumer groups , academic experts in the cybersecurity , and representatives of competent authorities notified under [ directive establishing the european electronic communications code ] as well as of law enforcement and data protection supervisory authorities . ### the management board , acting on a proposal by the executive director , shall set up a permanent stakeholders ' group composed of recognised experts representing the relevant stakeholders , such as the ict industry , associations of small and medium - sized enterprises , providers of electronic communications networks or services available to the public , consumer groups and associations , academic experts in the field of cybersecurity , the european standardisation organisations , as defined in point of article 2 of regulation no 1025 / 2012 , the relevant sectoral union agencies and bodies , and representatives of competent authorities notified under [ directive establishing the european electronic communications code ] as well as of law enforcement and data protection supervisory authorities .


### the management board , acting on a proposal by the executive director , shall set up a permanent stakeholders ' group composed of recognised experts representing the relevant stakeholders , such as the ict industry , providers of electronic communications networks or services available to the public , consumer groups , academic experts in the cybersecurity , and representatives of competent authorities notified under [ directive establishing the european electronic communications code ] as well as of law enforcement and data protection supervisory authorities . ### the management board , acting on a proposal by the executive director , shall set up a permanent stakeholders ' group composed of recognised experts representing the relevant stakeholders , such as the ict industry , providers of electronic communications networks or services available to the public , consumer groups , academic experts in the cybersecurity , the european forum for accreditation , conformity assessment bodies , and representatives of competent authorities notified under [ directive establishing the european electronic communications code ] as well as of law enforcement and data protection supervisory authorities .


### the term of office of the permanent stakeholders’ group’s members shall be two - and - a - half years . members of the management board may not be members of the permanent stakeholders’ group . experts from the commission and the member states shall be entitled to be present at the meetings of the permanent stakeholders’ group and to participate in its work . representatives of other bodies deemed relevant by the executive director , who are not members of the permanent stakeholders’ group , may be invited to attend the meetings of the permanent stakeholders’ group and to participate in its work . ### the term of office of the permanent stakeholders’ group’s members shall be two - and - a - half years . members of the management board and of the executive board , except the executive director referred to in paragraph 3 , may not be members of the permanent stakeholders’ group . experts from the commission and the member states shall be entitled to be present at the meetings of the permanent stakeholders’ group and to participate in its work . representatives of other bodies deemed relevant by the executive director , who are not members of the permanent stakeholders’ group , may be invited to attend the meetings of the permanent stakeholders’ group and to participate in its work .


### the commission , based on the candidate scheme proposed by enisa , may adopt implementing acts , in accordance with article 55 , providing for european cybersecurity certification schemes for ict products and services meeting the requirements of articles 45 , 46 and 47 of this regulation . ### the commission is empowered to adopt delegated acts , in accordance with article 55a , concerning the establishment of european cybersecurity certification schemes for ict products and services meeting the requirements of articles 45 , 46 and 47 of this regulation . when adopting those delegated acts , the commission shall base the cybersecurity certification schemes for ict products and services on any relevant candidate scheme proposed by enisa .


### a european cybersecurity certification scheme shall be so designed to take into account , as applicable , the following security objectives : ### each european cybersecurity certification scheme shall be so designed to take into account at least the following security objectives :


### by the way of derogation from paragraph 3 , in duly justified cases a particular european cybersecurity scheme may provide that a european cybersecurity certificate resulting from that scheme can only be issued by a public body . such public body shall be one of the following : ### by the way of derogation from paragraph 3 , in duly justified cases , such as for national security reasons , a particular european cybersecurity scheme may provide that a european cybersecurity certificate resulting from that scheme can only be issued by a public body . such public body shall be one of the following :


### each national certification supervisory authority shall , in its organisation , funding decisions , legal structure and decision - making , be independent of the entities they supervise . ### each national certification supervisory authority shall , in its organisation , funding decisions , legal structure and decision - making , be independent of the entities they supervise and shall not be a conformity assessment body or a national accreditation body .


### cooperate with other national certification supervisory authorities or other public authorities , including by sharing information on possible non - compliance of ict products and services with the requirements of this regulation or specific european cybersecurity certification schemes ; ### cooperate with other national certification supervisory authorities , national accreditation bodies or other public authorities , including by sharing information on possible non - compliance of ict products and services with the requirements of this regulation or specific european cybersecurity certification schemes ;


### to withdraw , in accordance with national law , certificates that are not compliant with this regulation or a european cybersecurity certification scheme ; ### withdraw , in accordance with national law , certificates that are not compliant with this regulation or a european cybersecurity certification scheme and inform the national accreditation body accordingly ;


### to examine the relevant developments in the field of cybersecurity certification and exchange good practices on cybersecurity certification schemes ; ### to examine the relevant developments in the field of cybersecurity certification and exchange information and good practices on cybersecurity certification schemes ;


### where the budget is implemented under shared implementation the commission and the member states shall respect the principles of sound financial management , transparency and non - discrimination and shall ensure the visibility of union action . to this end , the commission and the member states shall fulfil their respective control and audit obligations and assume the resulting responsibilities laid down in this regulation . complementary provisions shall be laid down in sector - specific rules . ### where the budget is implemented under shared management , implementation tasks shall be delegated to member states . the commission and the member states shall respect the principles of sound financial management , transparency and non - discrimination and shall ensure the visibility of union action when they manage union funds . to this end , the commission and the member states shall fulfil their respective control and audit obligations and assume the resulting responsibilities laid down in this regulation . complementary provisions shall be laid down in sector - specific rules .


### where financial instruments are implemented under shared implementation with member states , sector specific rules apply , without prejudice to subparagraph 2 of article 208 . ### where esi funds financial instruments are implemented sector specific rules apply .


### where financial instruments are combined within a single agreement with complementary support from the union budget , including grants , this title shall apply to the whole measure . the reporting shall be carried out in accordance with article 242 . ### where financial instruments are combined within a single agreement with complementary support from the union budget , this title shall apply to the whole measure . the reporting shall be carried out in accordance with article 242 .


### upon the adoption by the european parliament and the council of the decision to mobilise the fund , the commission shall adopt a decision , by means of an implementing act , awarding the financial contribution from the fund and shall pay that financial contribution immediately and in a single instalment to the beneficiary state . if an advance has been paid pursuant to article 4a only the balance shall be paid . ### at the same time as it adopts a proposal for a decision to mobilise the fund , the commission shall adopt a decision , by means of an implementing act , awarding the financial contribution from the fund , which shall enter into force on the date at which the european parliament and the council adopt the decision to mobilise the fund . the commission shall pay that financial contribution immediately and in a single instalment to the beneficiary state . if an advance has been paid pursuant to article 4a only the balance shall be paid .


### “an estimate of additional public and private resources to be potentially raised by the financial instrument down to the level of the final recipient , including as appropriate an assessment of the need for , and level of , differentiated treatment to attract counterpart resources from private investors and / or a description of the mechanisms which will be used to establish the need for , and extent of , such differentiated treatment , such as a competitive or appropriately independent assessment process ; ” ### “an estimate of additional public and private resources to be potentially raised by the financial instrument down to the level of the final recipient , including as appropriate an assessment of the need for , and extent of , differentiated treatment to attract counterpart resources from private investors and / or a description of the mechanisms which will be used to establish the need for , and extent of , such differentiated treatment , such as a competitive or appropriately independent assessment process ; ”


### a publicly - owned bank or financial institution , established as a legal entity carrying out financial activities on a professional basis , which fulfils all the following conditions : ### a publicly - owned bank or institution , established as a legal entity carrying out financial activities on a professional basis , which fulfils all the following conditions :


### –operates under a public policy mandate given by the relevant authority of a member state at national or regional level , to carry out economic development activities contributing to the objectives of the esi funds ; ### –operates under a public policy mandate given by the relevant authority of a member state at national or regional level , which should include carrying out economic development activities contributing to the objectives of the esi funds ;


### –carries out its development activities in regions , policy areas and sectors for which access to funding from market sources is not generally available or sufficient ; ### –carries out its activities including development in regions , policy areas or sectors for which access to funding from market sources is not generally available or sufficient ;


### –is subject to the supervision of an independent authority in accordance with national law . ### –is subject to the supervision of an independent authority in accordance with applicable law .


### “when implementing the financial instrument , the bodies referred to in points to of the first subparagraph shall ensure compliance with applicable law , including rules covering the esi funds , state aid , public procurement and relevant standards and applicable legislation on the prevention of money laundering , the fight against terrorism , tax fraud and tax evasion . those bodies shall not make use of or engage in tax avoidance structures , in particular aggressive tax planning schemes or practices not complying with tax good governance criteria , as set out in eu legislation including commission recommendations and communications or or any formal notice by the latter . they shall not be established and , in relation to the implementation of the financial operations shall not maintain business relations with entities incorporated in jurisdictions that do not co - operate with the union in relation to the application of the internationally agreed tax standards on transparency and exchange of information . those bodies may , under their responsibility , conclude agreements with financial intermediaries for the implementation of financial operations . they shall transpose requirements referred to in this paragraph in their contracts with the financial intermediaries selected to participate in the execution of financial operations under such agreements . ” ### “when implementing the financial instrument , the bodies referred to in points to of the first subparagraph shall comply with applicable law , including rules covering the esi funds , state aid , public procurement and relevant standards and applicable legislation on the prevention of money laundering , the fight against terrorism , tax fraud and tax evasion . those bodies shall not make use of or engage in practices not complying with eu tax good governance principles , as set out in the union legislation . in this context , the bodies implementing financial instruments shall take the utmost account of the policies of the union . they shall not be established and , in relation to the implementation of the financial instruments shall not maintain business relations with entities incorporated in jurisdictions that do not co - operate with the union in relation to the application of the internationally agreed tax standards on transparency and exchange of information . those bodies may , under their responsibility , conclude agreements with financial intermediaries for the implementation of financial instruments . they shall transpose requirements referred to in this paragraph in their contracts with the financial intermediaries selected to participate in the execution of financial instruments under such agreements . ”


### when implementing financial instruments under point of article 38 , the bodies referred to in paragraph 2 of this article shall ensure compliance with applicable law , including rules covering the esi funds , state aid , public procurement and relevant standards and applicable legislation on the prevention of money laundering , the fight against terrorism , tax fraud and tax evasion . those bodies shall not make use of or engage in tax avoidance structures , in particular aggressive tax planning schemes or practices not complying with tax good governance criteria as set out in eu legislation including commission recommendations and communications or any formal notice by the latter . they shall not be established and , in relation to the implementation of the financial operations shall not maintain business relations with entities incorporated in jurisdictions that do not co - operate with the union in relation to the application of the internationally agreed tax standards on transparency and exchange of information . those bodies may , under their responsibility , conclude agreements with financial intermediaries for the implementation of financial operations . they shall transpose requirements referred to in this paragraph in their contracts with the financial intermediaries selected to participate in the execution of financial operations under such agreements . ### when implementing financial instruments under point of article 38 , the bodies referred to in paragraph 5 of this article shall comply with applicable law , including rules covering the esi funds , state aid , public procurement and relevant standards and applicable legislation on the prevention of money laundering , the fight against terrorism , tax fraud and tax evasion . those bodies shall not make use of or engage in practices not complying with eu tax good governance principles , as set out in the union legislation . in this context , the bodies implementing financial instruments shall take the utmost account of the policies of the union . they shall not be established and , in relation to the implementation of the financial instruments shall not maintain business relations with entities incorporated in jurisdictions that do not co - operate with the union in relation to the application of the internationally agreed tax standards on transparency and exchange of information . those bodies may , under their responsibility , conclude agreements with financial intermediaries for the implementation of financial instruments . they shall transpose requirements referred to in this paragraph in their contracts with the financial intermediaries selected to participate in the execution of financial instruments under such agreements .


### reporting by managing authorities under article 46 on operations comprising financial instruments under this article shall be based on the information kept by the eib for the purposes of its reporting pursuant to article 16 and of the efsi regulation , supplemented by the additional information required under article 46 . ### reporting by managing authorities under article 46 on operations comprising financial instruments under this article shall be based on the information kept by the eib for the purposes of its reporting pursuant to article 16 and of the efsi regulation , supplemented by the additional information required under article 46 . requirements under this paragraph shall allow for uniform reporting conditions in accordance with article 46 of this regulation .


### entrust implementation tasks to a financial institution , which shall either open a fiduciary account in its name and on behalf of the managing authority or set up a separate block of finance within the financial institution for programme contribution . in the case of a separate block of finance , an accounting distinction shall be made between programme resources invested in the financial instrument and the other resources available in the financial institution . the assets held on fiduciary accounts and such separate blocks of finance shall be managed in accordance with the principle of sound financial management following appropriate prudential rules and shall have appropriate liquidity . ### entrust implementation tasks to a body , which shall either open a fiduciary account in its name and on behalf of the managing authority or set up a separate block of finance within the financial institution for programme contribution . in the case of a separate block of finance , an accounting distinction shall be made between programme resources invested in the financial instrument and the other resources available in the financial institution . the assets held on fiduciary accounts and such separate blocks of finance shall be managed in accordance with the principle of sound financial management following appropriate prudential rules and shall have appropriate liquidity .


### where managing authorities contribute esi funds programme resources to an existing instrument under point of article 38 , the fund manager of which has already been selected by the eib , international financial institutions in which a member state is a shareholder , or a publicly - owned bank or financial institution , established as a legal entity carrying out financial activities on a professional basis and fulfilling the conditions set out under article 38 , they shall entrust implementation tasks to this fund manager through the award of a direct contract . ### where , for the purpose of implementing financial instruments referred to under point of article 38 , managing authorities contribute esi funds programme resources to an existing instrument , the fund manager of which has already been selected by the eib , international financial institutions in which a member state is a shareholder , or a publicly - owned bank or financial institution , established as a legal entity carrying out financial activities on a professional basis and fulfilling the conditions set out under article 38 , they shall entrust implementation tasks to this fund manager through the award of a direct contract .


### the eib or other international financial institutions in which a member state is a shareholder shall provide to the designated authorities control reports with each application for payment . they shall also provide to the commission and to the designated authorities an annual audit report drawn up by the external auditors of these bodies . ### the eib or other international financial institutions in which a member state is a shareholder by 30 april shall provide to the designated authorities control and performance reports with each application for payment and level of reimbursement to final recipients in the previous year . they shall also provide to the commission and to the designated authorities an annual audit report drawn up by the external auditors of these bodies .


### the commission shall be empowered to adopt an implementing act concerning the models for the control reports and the annual audit reports of the first sub - paragraph of this paragraph . ### the commission shall be empowered to adopt an implementing act concerning the models for the control reports and the annual audit reports of the third sub - paragraph of this paragraph .


### financing which is not linked to costs of the relevant operations but is based on the fulfilment of conditions related to the realisation of progress in implementation or the achievement of objectives of programmes . the detailed modalities concerning the financing conditions and their application shall be set out in delegated acts adopted in accordance with the empowerment provided for in paragraph 5 . ### financing which is not linked to costs of the relevant operations but is based on the fulfilment of conditions related to the realisation of progress in implementation or the achievement of objectives of programmes . the detailed modalities concerning the financing conditions and their application shall be set out in delegated acts adopted in accordance with the empowerment provided for in paragraph 5 . the form of standard scales of unit costs , lump sums or flat rates ,  is applicable also operations receiving state aid , and in particular to state aid exempted from notification under regulation no 651 / 2014 and following amendments .


### innovation of new technologies helps to lower vehicle emissions , supporting the decarbonisation of the transport sector . an increased uptake of low - and zero - emission road vehicles is likely to reduce emissions of co2 and certain pollutant emissions and to promote competitiveness and growth of the european industry in the increasing global markets for low - and zero - emission vehicles . ### innovation of new technologies helps to lower vehicle emissions , supporting the decarbonisation of the transport sector . an increased uptake of low - and zero - emission road vehicles is likely to reduce emissions of co2 and certain pollutant emissions and thereby improve the air quality in cities and other polluted areas , while contributing to competitiveness and growth of the european industry in the increasing global markets for low - and zero - emission vehicles .


### innovation of new technologies helps to lower vehicle emissions , supporting the decarbonisation of the transport sector . an increased uptake of low - and zero - emission road vehicles is likely to reduce emissions of co2 and certain pollutant emissions and to promote competitiveness and growth of the european industry in the increasing global markets for low - and zero - emission vehicles . ### innovation of new technologies helps to lower vehicle emissions , supporting the decarbonisation of the transport sector . an increased uptake of low - and zero - emission road vehicles will reduce emissions of co2 and certain pollutant emissions and promote competitiveness and growth of the european industry in the increasing global markets for low - and zero - emission vehicles .