EUROPEAN COMMISSION Brussels, 2.12.2020 COM(2020) 712 final 2020/0345(COD) Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on a computerised system for communication in cross-border civil and criminal proceedings (e-CODEX system), and amending Regulation (EU) 2018/1726



(Text with EEA relevance) {SEC(2020) 408 final} - {SWD(2020) 541 final} - {SWD(2020) 542 final}



EXPLANATORY MEMORANDUM 1.CONTEXT OF THE PROPOSAL •Reasons for and objectives of the proposal Ensuring effective access to justice for citizens and businesses and facilitating judicial cooperation between the Member States are among the main objectives of the EU’s Area of Freedom, Security and Justice enshrined in the Treaty on the Functioning of the European Union. Over the last decade, the Union has made considerable efforts to coordinate and harmonise cross-border judicial proceedings with a view to closer judicial cooperation in civil and criminal matters. A large number of Union acts have been adopted to facilitate the coordination between national rules on (i) international jurisdiction, (ii) the recognition and enforcement of judicial acts and orders, (iii) the cross-border service of judicial documents and (iv) taking of evidence. A large number of Union acts have also been adopted to establish Union-level judicial procedures, such as the European order for payment, the European small claims procedure, the European account preservation order, etc. The effective implementation of these measures is a Union priority. In this context, developments in e-Justice are instrumental for the success of cross-border judicial proceedings, whose aim is to improve the functioning of Member States’ judicial systems and help to streamline procedures, reduce costs and increase accessibility. To ensure effective means of communication between parties and courts, as well as between authorities in different Member States, information technology tools are key. The Commission has therefore made constant efforts to improve online access to procedural information and has promoted the use of dynamic forms provided through the European e-Justice portal. e-CODEX (e-Justice Communication via On-line Data Exchange) was launched under the multiannual e-Justice action plan 2009-2013, mainly to promote the digitalisation of cross-border judicial proceedings and to facilitate the communication between Member States’ judicial authorities. e-CODEX facilitates secure communication in civil and criminal proceedings via a tailor-made solution for the cross-border exchange of electronic messages in the area of judicial cooperation. The e-CODEX system consists of a package of software products which can be used to set up an access point for secure communication. Access points using e-CODEX can communicate with other access points over the internet via a set of common protocols, with no central system involved. Each access point can be linked, for instance, to a national case management system in order to allow it to exchange documents securely with other similar systems. Regarding the exchange of documents in specific procedures, the e-CODEX system makes available standardised digital forms (they are not linked to the content to be transmitted but just make possible the communication) that allow information to be exchanged between national systems. e-CODEX was developed by 21 Member States with the participation of other third countries/territories and organisations between 2010 and 2016. The total cost of developing the system was about EUR 24 million, of which 50% were funded by the EU in the form of grants and 50% by the participating Member States. Currently the e-CODEX system is managed by a consortium of Member States and other organisations, financed by an EU grant. Between the end of the current consortium and the takeover of the system by an EU agency another entity will have to guarantee the sustainability of the system. e-CODEX currently facilitates electronic communication between citizens and courts, and between Member State administrations in some cross-border civil and criminal proceedings. So far, 10 Member States have participated in pilots for the use of e-CODEX in different legal procedures. The European e-Justice portal will use e-CODEX to enable citizens to electronically sign and send applications for European payment orders and small claims to competent courts in the Member States. In addition, in 2018 the Commission proposed legislation to provide for a mandatory digital channel that could be used to serve documents and to take evidence, by means of a decentralised IT system which could be based on an interoperable solution, such as e-CODEX, as the means of digital transmission. These two Regulations were adopted on 25 November 2020. Building on Member States’ support and their experience in using the system in different civil and criminal proceedings, e-CODEX has the potential to become the main digital solution for a secure transmission of electronic data in cross-border civil and criminal proceedings in the Union. In its evaluation of the project grant for e-CODEX, the Commission concluded that the e-Justice pilot project has provided the key building blocks to achieve secure and reliable exchanges in judicial cooperation. Furthermore, in its Communication “Digitalisation of justice in the European Union – A toolbox of opportunities”, adopted together with this proposal, the Commission considers e-CODEX as the main tool and the gold standard for establishing an interoperable, secure and decentralised communication network between national IT systems in cross-border civil and criminalproceedings. The long-term sustainability, increased use and operational management of e-CODEX are a priority for the Union. e-CODEX could be used to enable more efficient judicial cooperation between judicial authorities in criminal matters, thus stepping up the fight against cross-border crime, terrorism and cybercrime. This covers mutual recognition procedures under various instruments and other judicial cooperation procedures such as those under the Convention on Mutual Assistance in Criminal Matters between the Member States of the European Union, the corresponding provisions of which were replaced by the European investigation order. Temporary funding for running the e-CODEX system could be found from the Connecting Europe Facility (CEF), the Justice programme or their successors under the next multiannual financial framework. However, the consortium of Member States and other organisations which presently ensures the IT development and maintenance of the e-CODEX software will not provide for the system’s long-term operational management. Using temporary action grants to manage the system is not a sustainable solution, nor a solution that could allow e-CODEX to become the default system for cross-border civil and criminal proceedings in the future. Most recently on 13 October 2020, the Council has invited the Commission to present a legislative proposal ensuring the sustainability of e-CODEX with an adequate governance and management structure compatible with eu-LISA that respects the independence of the judiciary and the constitutional requirements of the Member States while ensuring adequate representation of the EU and Member States’ judicial authorities, as well as of the key stakeholders. To provide for the sustainable, long-term operational management of the e-CODEX system, this proposal aims to establish a stable governance solution for the system, with a transparent decision-making process ensuring the involvement of Member States and other relevant stakeholders. Furthermore, the e-CODEX system needs to be managed in a way that does not call into question the independence of the national judiciaries. This can be achieved by providing a governance model which ensures that Member States’ judiciaries are adequately represented and that a separate budget is allocated to the entity managing the system. The impact assessment has showed that the best solution to ensure a stable future for e-CODEX is to transfer it to the European Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice, referred to as eu-LISA, and mandating the Agency to provide for the system’s operational management. Stable governance for the e-CODEX system will make it possible to establish it as the default system for exchanging electronic messages for judicial cooperation at EU level. eu-LISA would not take over the e-CODEX system before July 2023. The handover cannot take place earlier due to the existing significant tasks entrusted to eu-LISA, namely with the development and future management of a number of large-scale centralised EU information systems for security, border and migration management, i.e. the Entry/Exit system (EES), the European Travel Information and Authorisation System (ETIAS) and the European Criminal Records Information System for Third-Country Nationals (ECRIS-TCN). In addition, the Agency is also in charge of modernising the Schengen Information System (SIS) and the Visa Information System (VIS). Moreover, in accordance with Regulations (EU) 2019/817 and (EU) 2019/818 on establishing a framework for interoperability between EU information systems, eu-LISA was given the task of ensuring technical interoperability between those systems. The timing for taking over the e-CODEX system by eu-LISA is a central element of this proposal to guarantee that e-CODEX’s permanent management can be effectively ensured. It would not be feasible to take over the system earlier than in July 2023.

As the agency responsible for the e-CODEX system’s operational management, eu-LISA would have to provide for the personnel and technical environment necessary for those tasks. By 31 December 2022, the entity managing the system would need to submit a handover document to eu-LISA specifying the arrangements for the e-CODEX system’s transfer (including the criteria for a successful handover process and completion, as agreed by the Commission). It will also need to submit related documentation, including provisions on intellectual property rights and on the software products to be handed over. During the six-month transitional period before the e-CODEX system is transferred to eu-LISA, a handover process would take place between the entity managing the system – a consortium of Member States and legal professionals organisations with EU funding – and eu-LISA. This will involve transferring a stable version of the e-CODEX system, including relevant know-how, software and related documentation and digital templates. The software to be transferred includes the DOMIBUS Connector and supporting software, while the DOMIBUS Gateway software, which is also a part of e-CODEX, will continue to be managed by the Commission. The entity managing the system will remain responsible for the e-CODEX system’s management, performing only corrective maintenance work. However, it should also support eu-LISA in setting up the necessary technical environment to ensure proper management of the e-CODEX system. The Commission will monitor the handover/takeover process to ensure that the entity managing the system follows the procedures correctly, based on the criteria specified in the handover document submitted by the entity. eu-LISA will only take over responsibility for the e-CODEX system on the condition that the Commission has declared the handover/takeover process as successfully completed. Once eu-LISA takes over responsibility for the system, at the earliest on 1 July 2023, it will have to ensure, on the basis of technical and service-level requirements set out in implementing acts, that the existing software remains functional in a changing technical environment and is adapted to evolving user needs. Moreover, eu-LISA will have to maintain or update the digital templates for the different procedures where e-CODEX will be used to respond to legal or organisational changes and create new ones for those instruments within the scope of the regulation in which e-CODEX is introduced. The Commission will then ensure that these templates are laid down in an implementing act establishing detailed specifications on the use of e-CODEX for such procedures. •Consistency with existing policy provisions in the policy area There is a clear need to do more at both the European and national level to ensure that justice systems take full advantage of digital technologies for the communication between authorities and with citizens and business. Significant work is still needed in a number of areas, such as: the development of secure electronic transmission channels within and between judicial and other competent authorities, legal practitioners and the relevant EU agencies and bodies; the further digitalisation and interconnection of national databases and registers; the digitalisation of judicial services provided to the public; the digitalisation of judicial cooperation and the use of secure and high-quality distance communication technology. One important strand of e-Justice policy initiatives involves establishing interoperable tools for communication between the IT systems of the judicial authorities in the Member States. e-CODEX is the main tool addressing this need which has been developed to date. With the development of an IT platform for judicial cooperation in criminal matters (the e-Evidence digital exchange system), which uses e-CODEX as its communication infrastructure, and the recent conclusion of negotiations on the Regulations on Service of Documents and Taking of Evidence, there is an increasing need to ensure the e-CODEX system’s sustainable management. This proposal follows the request made by the Council, in its June 2016 conclusions on improving criminal justice in cyberspace, where it asked the Commission to develop a platform with a secure communication channel for the digital exchange of requests for electronic evidence and replies between competent authorities. After considering different options, Member State experts participating in the development of the platform reached the conclusion that e-CODEX would be the most suitable system for this kind of exchange of electronic evidence. This proposal would provide a long-term solution for the operational management of e-CODEX and would thus ensure that the solution chosen for the exchange platform is maintained. The proposal extends the mandate of eu-LISA to include e-CODEX among its competencies. In order for eu-LISA to manage e-CODEX within that mandate, this proposal also includes amendments to the eu-LISA establishing Regulation. •Consistency with other Union policies The e-CODEX system is one of the key components of the Commission’s e-Justice policy to improve access to and the efficiency of justice in the Member States and is included in the European e‑Justice action plan for 2019-2023. It is also confirmed as the main tool for secure digital communication in cross-border judicial proceedings in the Commission’s Communication “Digitalisation of justice in the European Union – A toolbox of opportunities”. In the context of a digital single market that aims to provide high-speed, secure and trustworthy infrastructures and services, solutions for promoting e-Justice were part of the 2016 eGovernment action plan. The e-Justice portal is a one-stop shop for judicial information in the EU and offers citizens the possibility of submitting small claims and applications for European payment orders electronically, using e-CODEX, in Member States where electronic transmission is allowed. The e-CODEX system forms part of the e-Justice digital service infrastructure within the Connecting Europe Facility (CEF). Moreover, one of the components of e-CODEX has been taken up and maintained by the Commission as part of the eDelivery building block within CEF, which demonstrates it as a useful system not only for justice, but also in other areas. 2.LEGAL BASIS, SUBSIDIARITY AND PROPORTIONALITY •Legal basis Since the e-CODEX system would facilitate judicial cooperation both in civil and criminal matters, the legal basis for the system is a combination of Articles 81 and 82 of the Treaty on the Functioning of the European Union. More specifically, the e-CODEX system facilitates access to justice in civil matters in line with Article 81(2). In criminal matters, Article 82(1) is the legal basis for the EU’s right to act in the field of judicial cooperation to facilitate cooperation between judicial or equivalent authorities of the Member States in relation to proceedings in criminal matters and the enforcement of decisions. •Subsidiarity Creating a mechanism for the secure exchange of information in cross-border judicial proceedings is best achieved at EU level. In the absence of EU action, there is a high probability that Member States may develop national systems without taking into account whether interoperability can be ensured among them. While operational management at EU level entails costs, it is the best way to achieve an interoperable system for cross-border communication between competent authorities and therefore the best way to achieve the general objective: a common area of security and justice that works even more efficiently. Establishing a common system for digital cross-border exchange at EU level will provide an off-the-shelf solution that can be used for different legal procedures while ensuring interoperability between national systems. Such a system is more effective than having diverging systems at national level, which would not necessarily ensure that cross-border communication between Member States is possible. Moreover, having a common system at EU level will generate economies of scale, as the EU will have to manage only one IT solution for secure cross-border communication in the justice area. It will also provide added value for Member States, as the costs of digitalising their cross-border procedures are expected to decrease and become less of a barrier for cooperation.

•Proportionality Ensuring permanent operational management of the e-CODEX system at EU level is a proportionate way of promoting cross-border communication in the justice area. By entrusting eu-LISA with the system’s operational management, an adequate return can be obtained on the EUR 24 million invested in developing the system. Maintaining this system is a less costly and less complex solution compared to developing a new system or using other systems which are not tailor-made for the justice area. There are several reasons why transferring the e-CODEX-related tasks specifically to eu-LISA is the most suitable option. An agency specialised in managing IT systems would possess the know-how needed to operate e-CODEX. Since Member States are represented on the management board of agencies, their interests, as well as the interests of national judiciaries, can be taken into account. Moreover, in view of the Member States’ strong support for the eu-LISA solution, it is more likely that the system will be taken up by them if the operational management by eu-LISA is chosen as a solution. An EU decentralised agency would also be able to react to the evolving technical needs emerging from the Member States that use e-CODEX. Such an agency would therefore provide a flexible solution and would be able to make the necessary technical changes to the e-CODEX system. In view of the important new tasks that have recently been allocated to eu-LISA relating to the EES, ETIAS and ECRIS-TCN systems, as well as the recent proposals on interoperability between EU information systems, the e-CODEX system should not be transferred to eu-LISA before July 2023. •Choice of the instrument The Commission is putting forward a proposal for a Regulation as the proposed legal instrument to establish the e-CODEX system at EU level, and is entrusting the eu-LISA Agency with the system’s operational management. To this effect, the proposal amends Regulation (EU) 2018/1726 establishing eu-LISA. This Regulation is directly applicable in all Member States and binding in its entirety. It therefore guarantees a uniform application of the rules across the EU and their entry into force at the same time. It offers legal certainty by avoiding divergent interpretations in the Member States, thus preventing legal fragmentation. By establishing the e-CODEX system, the Regulation’s adoption will contribute to the uptake of e-CODEX by more Member States for procedures in which the system is already used as well as for future ones. 3.RESULTS OF EX POST EVALUATIONS, STAKEHOLDER CONSULTATIONS AND IMPACT ASSESSMENTS •Ex post evaluations/fitness checks of existing legislation The Report on the application of Regulation (EC) 1896/2006 of the European Parliament and of the Council creating a European order for payment procedure includes data on the number of payment orders in the EU and the length of proceedings. This data was used in the impact assessment to estimate potential savings as a result of using the e-CODEX system to submit European payment orders. •Stakeholder consultations All major legal professions were consulted by the e-CODEX consortium on the possibility of handing over the operational management of e-CODEX to a permanent entity. As part of the preparatory discussion in the Council since 2014, specific feedback has been collected from the Council of Bars and Law Societies of Europe (CCBE), the Notaries of Europe (CNUE), the European Chamber of Judicial Officers (CEHJ) and the European Law Institute (ELI). Moreover, the e-CODEX consortium evaluated the use of e-CODEX in different pilot procedures by sending out questionnaires to stakeholders, including courts, consumer organisations and legal professionals. The results of this evaluation were generally positive. The consortium managing the e-CODEX system maintained a regular dialogue with all important stakeholders and all Member States via the Expert Group on e-CODEX-related issues, which is part of the Council Working Party on e-Justice and meets four to six times per year. Moreover, the Council Working Party on e-Justice held meetings under its cooperation mechanism in 2016 and 2017, where stakeholders were invited to discuss topics related to e-Justice. e-CODEX was on the agenda of these two meetings. The Council Working Party held further discussions relating to e-CODEX in 2018 and 2019. Further consultation was carried out through the publication of the inception impact assessment on 17 July 2017. Respondents submitted comments in support of maintaining e-CODEX and favoured giving the responsibility for its management to an EU agency. The respondents included legal practitioners, Member State authorities and an international organisation (the Hague Conference on Private International Law). •Collection and use of expertise Studies carried out by the current e-CODEX consortium — in particular on the experience gained from using e-CODEX in pilots for legal procedures such as the European small claims procedure or the European payment order procedure — were used during the impact assessment for this legislative proposal. In addition, the Commission commissioned a study on the long-term sustainability of digital service infrastructures (DSIs), which was carried out in 2016-2017. This study covered the e-Justice DSI, including e‑CODEX, and recommended a handover to an EU regulatory agency as the best option for ensuring the sustainability of DSIs. Furthermore, a recent study commissioned by the Estonian government and carried out by PricewaterhouseCoopers also confirmed that the most realistic scenario in the short-to-medium term would be to manage e-CODEX within eu-LISA’s current management structure.

•Impact assessment This proposal is supported by the impact assessment presented in the accompanying staff working document SWD(2020) 541. The Regulatory Scrutiny Board reviewed the draft impact assessment at its meeting of 13 December 2017 and delivered its opinion (positive with reservations) on 15 December 2017, indicating that the impact assessment report should be adjusted to incorporate the Board’s recommendations on specific aspects. These related firstly to the future of the e-CODEX system; the Board considered that it was not sufficiently clear whether the choice of the hosting agency had already been agreed between the Council and the Commission. Secondly, the Board felt that the report should better explain why the uptake of e-CODEX is low and how the proposed regulation would overcome the existing bottlenecks. Thirdly, the Board considered that the comparison between the two options for hosting e-CODEX should be more balanced and less partial. The Commission updated its impact assessment to respond to these main considerations and to address a number of other comments made by the Board. The impact assessment evaluated several legislative and non-legislative options. Some options were discarded at an early stage. The possibility of creating a separate legal entity, for example, was discarded on the basis that such a measure would be disproportionate in relation to the limited tasks that would be given to the entity. The option of using or developing an alternative system was also discarded, mainly because the current e-CODEX solution has proved to be very effective and efficient in the procedures for which it is already being used, and it is reasonable to expect a return on the EUR 24 million invested in creating it. Furthermore, a commercial solution would raise issues regarding long-term sustainability and data integrity, as the owner of the alternative system could in theory have access to the data transferred using that system. Handing over e-CODEX to a Member State or a consortium of Member States could not be considered either, as Member States have clearly rejected this possibility. Their preference, as expressed in Council conclusions, is to hand over responsibility for the operational management of e-CODEX to eu-LISA. Under these conditions, two options were assessed against the baseline scenario (under which no permanent operational management would be provided, leading to the expiry of e-CODEX). Of these two, the option of handing over e-CODEX to an agency was considered the most appropriate. The alternative option — to have the Commission ensure the operational management of e-CODEX — was deemed less appropriate, since it would be more difficult to ensure Member States’ involvement in the system’s governance. The Member States consider it important for the system’s management to fully respect the independence of the national judiciaries. An agency could also be a more flexible solution, allowing input from stakeholders to be better taken into account. Of the existing agencies, only eu-LISA has the relevant experience in managing IT systems in the area of justice and home affairs and should therefore be given the task of managing e-CODEX. The impact assessment concluded that benefits would arise from using e-CODEX for the digitalisation of justice, as it would facilitate and speed up cross-border civil and criminal proceedings and judicial cooperation. It would help to improve the functioning of the digital single market by increasing the efficiency of cross-border proceedings, and it would have a positive impact on the fight against cross-border crime by facilitating cooperation between the competent authorities. Using the e-CODEX system in cross-border civil and criminal proceedings could also make national courts more efficient. As regards the options for ensuring the e-CODEX system’s operational management, the impact assessment considered that an EU regulatory agency like eu-LISA would have the appropriate capacity for this purpose. The Agency will be able to adapt the e-CODEX system to the technical needs emerging from the Member States that use e-CODEX. This would allow to avoid any asymmetric developments at national level that could potentially impinge on the interoperability between Member States’ national systems. SMEs and micro-enterprises would benefit from the digitalisation of cross-border civil and criminal proceedings facilitated by e-CODEX. The possibility of submitting claims to courts on-line — for instance, applications for European payment orders or claims under the European small claims procedure (if allowed under national law) — would lead to savings resulting from reduced postage costs and more efficient and shorter procedures. There would be no additional costs for SMEs (or other operators) for using e-CODEX in a specific legal procedure. •Fundamental rights The e-CODEX system would make it easier for people to exercise their right to an effective judicial remedy, in line with Article 47 of the Charter of Fundamental Rights, ‘Right to an effective remedy and to a fair trial’, since electronic communication and document transmission facilitates and speeds up the court proceedings. Stakeholders have pointed out that Article 47 also guarantees the right to an impartial and independent tribunal, and that in order to be in conformity with that Article, future governance and coordination of e-CODEX and e-CODEX-related activities need to respect that right. Since the e-CODEX system is a decentralised system, there will be no data storage or data processing by the entity entrusted with the operational management of the system components beyond what is necessary to maintain contacts with the entities operating e-CODEX access points. These entities have the responsibility for setting up and operating the different e-CODEX networks, and thus they will be the only ones responsible for the personal data transmitted via the respective access points. Depending on whether an access point is operated by an EU institution, body or agency or at national level, and depending on which national authorities are processing personal data and for what purposes, either Regulation (EU) 2018/1725 or the General Data Protection Regulation or Directive (EU) 2016/680 will apply. eu-LISA, as is already the case, has to comply with Regulation (EU) 2018/1725 when processing personal data. As regards, in particular, the task of making further technical developments to the system, this includes ensuring that any improvements or new versions of the software components entrusted to eu-LISA respect security and data protection requirements by design and by default. Article 10 of this proposal makes eu-LISA responsible for carrying out this task, and for data security overall. 4.BUDGETARY IMPLICATIONS The total costs for 2022-2027 amount to EUR 9.667 million (average cost per year of EUR 1.611 million). Of this amount, the eu-LISA funding for the same period is EUR 8.723 million. The costs include the additional human resources required for the activities to be carried out by eu-LISA and by the Commission. At eu-LISA, the recruitment of internal resources will start as of 1 September 2022 with two CA posts to cater a the smooth handover. As from 1 January 2023, eu-LISA should have a total of 2 Temporary Agents and 3 Contract Agents, which will ensure core functions with regard to e-CODEX. Additionally, the Commission (Directorate-General for Justice and Consumers) will have to be involved in providing policy governance of eu-LISA’s work, in monitoring the Agency, and in preparing the necessary implementing acts mandated by the Regulation. One additional statutory post has been budgeted for this from 2022. The legislative financial statement accompanying this proposal contains detailed explanations of the costs. 5.OTHER ELEMENTS •Implementation plans and monitoring, evaluation and reporting arrangements The entity managing the e-CODEX system will continue to be responsible for it until the successful finalisation of the handover/takeover process. The process of handing over the system to eu-LISA is scheduled to take no more than 6 months starting on 1 January 2023. During this period, the entity managing the e-CODEX system will retain full responsibility for the e-CODEX system. This period will allow eu-LISA to make the necessary preparations for the takeover of the system. The Agency should recruit the necessary staff and plan for procurement activities accordingly. Two years after eu-LISA takes over responsibility for the e-CODEX system and every 2 years after that, eu-LISA must provide the Commission with a comprehensive activities report on the technical evolution and functioning of the e-CODEX system during the reporting period, including its security. These reports will be based on the information provided annually by the Member States and the Commission. They will contain the list of authorised e-CODEX access points; an inventory of the cross-border civil and criminal procedures using the e-CODEX system; the degree of digitalisation of each cross-border civil or criminal procedure; the number of business messages sent to and received from each of the other Member States involved in each cross-border civil and criminal procedure; and the number and type of incidents impacting the security of the e-CODEX system.

Three years after eu-LISA takes over responsibility for the e-CODEX system and every 4 years after that, the Commission has to produce an overall evaluation of the e-CODEX system, including an assessment of the Regulation’s application, an examination of results achieved against objectives. The first evaluation should include also an assessment of the functioning of the Programme Management Board, and whether it should be maintained. Taking into account the outcome of that evaluation, the Commission may make any necessary future actions. •Detailed explanation of the specific provisions of the proposal Article 1 sets out the subject matter of the Regulation. The Regulation establishes the e-CODEX system and entrusts its operational management to eu-LISA. Furthermore, the Regulation sets out the responsibilities of the Commission, of the Member States and of the entities operating authorised e-CODEX access points. Article 2 defines the scope of the Regulation. The Regulation applies to the electronic transmission of information in cross-border civil and criminal proceedings through the e-CODEX system, in accordance with legal instruments adopted in civil and criminal cooperation. Annex I provides a list of these instruments. Article 3 contains the definitions of terms used in the Regulation. Article 4 defines the e-CODEX system and lays down its composition, consisting of an access point software (including a gateway and a connector). In addition, the e-CODEX system is composed of digital procedural standards that make the interconnection between the access points possible. Article 5 mandates the Commission to adopt, by 31 December 2022, implementing acts defining the service-level requirements for the activities carried out by eu-LISA. It further mandates the Commission to define by means of implementing acts the minimum technical specifications and standards, including on security, underpinning the software products included in the e-CODEX system; the service-level requirements and other necessary technical specifications for the activities to be carried out by eu-LISA in accordance with Article 6; as well as the terms of the handover/takeover process. In addition, the Commission may also adopt implementing acts on the technical arrangements for using the e-CODEX system in the different cross-border civil and criminal procedures listed in the Annex I. The Commission is also given the responsibility of maintaining a list of authorised e-CODEX access points operated by EU institutions, bodies or agencies, of notifying eu-LISA of any changes to this list, and of nominating correspondents who are entitled to receive support on how to use the e-CODEX system. Article 6 sets out eu-LISA’s responsibilities for the e-CODEX system’s operational management. It also charges eu-LISA with certain additional tasks with regard to the e‑CODEX system and the corresponding technical work in relation to the components mentioned in Article 4 for which eu-LISA is responsible. Article 7 gives Member States the responsibility to maintain a list of authorised e-CODEX access points, which are operated within their territory; to inform eu-LISA of any changes to that list, and to nominate correspondents who are entitled to receive support on how to use the e-CODEX system. Article 8 defines the responsibilities of entities operating authorised e-CODEX access points. These include responsibility for securely setting up and operating the access point, as well as for any damages to it and for the security of the data transmitted through it. They will also be responsible for collecting statistical information concerning their operation. Article 9 specifies the procedure for the handover of the e-CODEX system from the entity managing the e-CODEX system to eu-LISA, including a monitoring role for the Commission. The earliest proposed date for the takeover is 1 July 2023, so that eu-LISA has time to carry out the tasks already entrusted to it for the EES, ETIAS and ECRIS-TCN systems, for the modernisation of SIS and VIS and for ensuring interoperability between EU information systems. The takeover will only take place when the Commission declares that the handover/takeover process has been completed successfully. By 31 December 2022, the entity managing the e-CODEX system should submit a handover document specifying the arrangements for the transfer of the e-CODEX system to eu-LISA. During the handover period, the entity managing the e-CODEX system will retain full responsibility for the e-CODEX system and ensure that only corrective maintenance activities are performed in the system. The handover covers the components of the e-CODEX system defined in Article 4, i.e. the connector and the digital procedural standards, as well as the supporting products listed in Annex II. Article 9 further clarifies that the handover should also ensure that any intellectual property rights or usage rights relating to the e-CODEX system and the supporting products listed in Annex II are transferred, so as to enable eu-LISA to carry out its functions. However, for the main software components of the system, a contractual transfer should not be needed, as the Domibus software is open source and covered by the EUPL licence. Article 10 provides for requirements on security, giving the overall responsibility for the security of the e-CODEX system to eu-LISA when performing its operational management tasks. eu-LISA must ensure that the e-CODEX system implements the principles of security and data protection by design and by default. It further clarifies that responsibility for the security of data transmitted through an authorised e-CODEX access point lies with the entity operating the access point. Article 11 provides that an e-CODEX Advisory Group (AG) will be set up by eu-LISA, which will assist with the work on the e-CODEX system. The AG will provide eu-LISA with necessary expertise related to the e-CODEX system and will also follow up on the state of implementation in the Member States, among other issues. Article 12 establishes a Programme Management Board (PMB) which will assist eu-LISA Management Board to ensure the adequate management of the e-CODEX system. The PMB will act as an intermediary body between the Advisory Groups and eu-LISA’s Management Board. It will in particular monitor the handover activities to ensure a timely takeover of the system by eu-LISA. The PMB will also ensure appropriate prioritisation of the work on the e-CODEX system and mediate in relation to potential contentious issues. Article 13 gives eu-LISA the task of providing training on the technical use of the e-CODEX system. Article 14 details the information that Member States and the Commission are obliged to provide to eu-LISA: a list of the cross-border civil procedures and criminal procedures for which they use the e-CODEX system; the extent to which the e-CODEX system can be used for each cross-border civil and criminal procedure; the number of business messages sent and received by each authorised e-CODEX access point operating in their territory; and the number and type of incidents encountered by entities operating authorised e‑CODEX access points in the territory of the Member State and impacting the security of the e‑CODEX system. Article 15 lays down rules on monitoring and reporting. Every two years, eu-LISA must provide the Commission with reports on the e-CODEX system, using information from the Member States. In addition, the Commission must submit a report on the e-CODEX system three years after the takeover and every four years after that. Article 16 governs the amendments to Regulation (EU) 2018/1726 for eu-LISA’s new responsibilities and tasks with the e-CODEX system. Article 17 concerns the comitology procedure to be used, based on a standard provision. Article 18 stipulates that the costs incurred for the e-CODEX system’s operational management are to be borne by the general budget of the European Union. In contrast, the Member States will bear the costs of maintaining a list of authorised e-CODEX access points at national level and the costs of designating the e‑CODEX correspondents in accordance with Article 7. The costs of setting up and operating e-CODEX system at national level in accordance with Article 8 will be borne by the entities operating authorised e-CODEX access points.

Article 19 provides that the Regulation would enter into force on the twentieth day following that of its publication in the Official Journal of the European Union. Annex I lists the legal acts falling within the scope of this Regulation. Annex II lists the supporting software products to be handed over to eu-LISA in accordance with Article 9. 2020/0345 (COD) Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on a computerised system for communication in cross-border civil and criminal proceedings (e-CODEX system), and amending Regulation (EU) 2018/1726



(Text with EEA relevance) THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION, Having regard to the Treaty on the Functioning of the European Union, and in particular Article 81(2) and Article 82(1) thereof, Having regard to the proposal from the European Commission, After transmission of the draft legislative act to the national parliaments, Acting in accordance with the ordinary legislative procedure, Whereas: (1)Ensuring an effective access of citizens and businesses to justice and facilitating judicial cooperation between the Member States are among the main objectives of the EU’s Area of Freedom, Security and Justice enshrined in Title V of the Treaty. (2)It is thus important that appropriate channels are developed to ensure that justice systems can efficiently cooperate in a digital way. Therefore, it is essential to establish, at Union level, an information technology instrument that allows swift, direct, interoperable, reliable and secure cross-border electronic exchange of case related data. Such a system, enabling citizens and businesses to exchange documents and evidence in digital form with judicial or other competent authorities, when provided forby national or Union law, should contribute to improving access to justice. (3)There are tools which have been developed for the digital exchange of case related data, without replacing or requiring costly modifications to the existing back-end systems already established in the Member States. The e-Justice Communication via On-line Data Exchange (e-CODEX) system is the main such tool developed to date. (4)The e-CODEX system is a tool specifically designed to facilitate the cross-border electronic exchange of messages in the justice area. In the context of increased digitalisation of proceedings in civil and criminal matters, the aim of the e-CODEX system is to improve the efficiency of cross-border communication between the competent authorities and facilitate access to justice of citizens and businesses. It has been managed up to date by a consortium of Member States and organisations with funding from Union programmes (5)The e-CODEX system consists of two software elements: the Domibus Gateway software for the exchange of messages with other gateways and the Domibus connector software, which provides a number of functionalities related to the transmission of messages between national systems. The gateway is based on the eDelivery building block maintained by the Commission, while the operational management of the connector is carried out by a consortium of Member States and organisations with funding from Union Programmes (the entity managing the e-CODEX system). The connector software provides functions such as verification of electronic signatures via a security library and proof of delivery. In addition, the entity managing the e-CODEX system has developed templates for digital forms to be used in the specific civil and criminal procedures for which it has piloted the e-CODEX system. (6)Given the importance of the e-CODEX system for cross-border exchanges in the justice area in the Union, there should be a sustainable Union legal framework establishing the e-CODEX system and providing rules regarding its functioning and development. Such legal framework should clearly define and frame the components of the e-CODEX system in order to guarantee its technical sustainability. The system should define the IT components of an access point, which should consist of a gateway for the purpose of secure communication with other identified gateways and a connector for the purpose of supporting the message exchanges. It should also include digital procedural standards consisting of the business process models and templates defining the electronic format of the documents used in the context of those procedures to support the use of e-CODEX access points for legal procedures provided for by legal acts adopted in the area of judicial cooperation and to enable the exchange of information between the access points.

(7)Since it is necessary to ensure the long term sustainability of the e-CODEX system and its governance while taking into account the independence of the national judiciaries, an appropriate entity for the operational management of the system should be designated. (8)The most appropriate entity for the operational management of the system is an agency, since its governance structure allows for the involvement of Member States in the operational management of the system through participation in the Agency's Management Board, Advisory Groups and Programme Management Boards. The European Union Agency for the operational management of large-scale IT systems in the area of freedom, security and justice (eu-LISA) established by Regulation (EU) 2018/1726 of the European Parliament and of the Council has relevant experience in managing large-scale IT Systems. eu-LISA should therefore be entrusted with the operational management of the e-CODEX system. It is also necessary to adjust the existing governance structure of eu-LISA by adapting the responsibilities of its Management Board and by establishing an e-CODEX Advisory Group. Regulation (EU) 2018/1726 should therefore be amended accordingly. A specific Programme Management Board should also be established. (9)According to Article 19 of Regulation (EU) 2018/1726 the role of the Management Board of eu-LISA is to ensure that all decisions and actions of the Agency affecting large-scale IT systems in the area of freedom, security and justice respect the principle of independence of the judiciary. The governance structure of the Agency and financing scheme further guarantee the respect of that principle. Ìt is also important to involve the legal professions and other stakeholders in the governance of the e-CODEX system through the Programme Management Board. (10)Given eu-LISA's priority tasks of developing and managing the Entry/Exit System (EES), the European Travel Information and Authorisation System (ETIAS), the European Criminal Records Information System for Third Country Nationals (ECRIS-TCN), the revised Schengen Information System (SIS), the Visa Information System (VIS) and Eurodac, as well as the strategic task to establish a framework for interoperability between EU information systems, eu-LISA should not take over the responsibility for the e-CODEX system earlier than on 1 July 2023. (11)The e-CODEX system can be used in cross-border civil and criminal proceedings. However, given its open source nature, it could also be used in other situations. This Regulation should not apply to any use of the e-CODEX system which is not based on the legal acts listed in Annex I. (12)eu-LISA should have responsibility for the components of the e-CODEX system, except for the operational management of the Domibus Gateway software, since that software is currently provided on a cross-sectoral basis within the eDelivery building block by the Commission. eu-LISA should take over full responsibility for the operational management of the Domibus Connector software and the digital procedural standards from the entity managing the e-CODEX system. Given that the Domibus Gateway and the Domibus Connector are integral components of e-Codex, eu-LISA should assure compatibility of the connector with the latest version of the gateway. To that end, the Commission should include eu-LISA in the relevant governance body of the eDelivery building block from the moment of the entry into force of this Regulation. (13)In order to ensure uniform conditions for the implementation of this Regulation, implementing powers should be conferred on the Commission. Those powers should be exercised in accordance with Regulation (EU) No 182/2011 of the European Parliament and of the Council. The implementing acts adopted in that framework should establish the minimum technical specifications and standards, including on security, underpinning the components of the e-CODEX system; establish the service level requirements for the activities carried out by eu-LISA and other necessary technical specifications for these activities; and establish the modalities of the handover/takeover process. Implementing acts could also establish the technical arrangements supporting the use of the e-CODEX system in the procedures in the area of judicial cooperation. (14)eu-LISA's specific responsibilities in relation to the operational management of the e‑CODEX system should be laid down. (15)The Member States should maintain a list of authorised e-CODEX access points operated within their territory, and communicate them to eu-LISA in order to enable the interaction between them in the context of the relevant procedures. The Commission should maintain a similar list of authorised e-CODEX access points operated by the Union institutions, bodies and agencies for the same reason. The entities operating the access points at national level may be public authorities, organisations representing legal practitioners or private companies. Bearing in mind the decentralised nature of the e-CODEX system, while eu-LISA should ensure the operational management of the e-CODEX system, the responsibility for setting up and operating the authorised e‑CODEX access points should lie exclusively with the entities operating the relevant access points. The entities operating the authorised e-CODEX access point should bear the responsibility for any damage resulting from the operation of the authorised e‑CODEX access point. (16)The national systems interconnected via the e-CODEX system should allow for monitoring its efficiency and effectiveness by providing a mechanism to monitor the outputs, results and impacts of instruments that enable the transmission of electronic data in the context of cross-border civil and criminal proceedings in the Union. The systems connected to the authorised e-CODEX access points should therefore be able to systematically collect and maintain comprehensive data on the use of cross-border civil and criminal proceedings in accordance with the relevant provisions of the legal acts listed in Annex I. This should not only alleviate the work of the Member States in collecting the relevant data and ensure mutual accountability and transparency, but also significantly facilitate the ex-post monitoring of the legal acts adopted in the area of civil and criminal cooperation by the Commission. The collected information should only encompass aggregated data and should not constitute personal data. (17)eu-LISA should maintain a high level of security when carrying out its tasks. When undertaking further technical evolutions of software, eu-LISA should implement the principles of security by design and data protection by design and by default, in accordance with Regulation (EU) 2018/1725. The entities operating the authorised e-CODEX access point should bear the responsibility for the security of the data transmitted via their access points. (18)In case classified information needs to be processed using the e-CODEX system, the system would need to be accredited in accordance with eu-LISA information security rules. (19)In order to allow eu-LISA to prepare the takeover adequately, the entity managing the e-CODEX system should prepare by 31 December 2022 a handover document setting out the detailed arrangements for the transfer of the e-CODEX system, including the criteria for a successful handover process and its completion, in accordance with implementing acts adopted by the Commission pursuant to this Regulation. The handover document should cover the components of the e‑CODEX system including the gateway, the connector and the digital procedural standards, as well as the relevant supporting products. The Commission should monitor the handover/takeover process in order to ensure its compliance with the implementing acts and the handover document, and the takeover should only take place once the Commission has declared that the process has been successfully completed. After submitting the handover document and until the successful handover of the e-CODEX system to eu-LISA, the entity managing the e-CODEX system should not deliver any new release but should only ensure corrective maintenance activities of the e-CODEX system. (20)The handover should also ensure that any intellectual property rights or usage rights relating to the e-CODEX system and the relevant supporting products are transferred so as to enable eu-LISA to carry out its responsibilities under this Regulation. However, for the main software components of the system, a contractual transfer should not be needed, as the Domibus software is open source and covered by the European Union Public Licence (EUPL). (21)In order for the Commission to be able to evaluate the e-CODEX system on a regular basis, eu-LISA should report to the Commission every two years on the technical evolution and the technical functioning of the e-CODEX system. In order to feed into that report, Member States should provide eu-LISA with the relevant information concerning the access points operated in their territory and the Commission should provide similar information concerning the access points operated by Union institutions, bodies and agencies. (22)This Regulation should not provide any specific legal basis for processing personal data. Any processing of personal data performed in the framework of this Regulation should be in accordance with the applicable data protection rules. Regulation (EU) 2016/679 of the European Parliament and the Council and Directive (EU) 2016/680 of the European Parliament and the Council, apply to the processing of personal data carried out by e-CODEX access points, operated by authorised e-CODEX access points which are established within the territory of the Member States according to this Regulation. (23)Regulation (EU) 2018/1725 of the European Parliament and of the Council applies to the processing of personal data carried out by Union institutions, bodies and agencies in the context of this Regulation. (24)In accordance with Articles 1 and 2 of Protocol No 22 on the position of Denmark, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, Denmark is not taking part in the adoption of this Regulation and is not bound by it or subject to its application. (25)In accordance with Articles 1, 2 and 4a(1) of Protocol No 21 on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, and without prejudice to Article 4 of that Protocol, Ireland is not taking part in the adoption of this Regulation and is not bound by it or subject to its application. [or]

(26)In accordance with Article 3 and Article 4a(1) of Protocol No 21 on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, Ireland has notified its wish to take part in the adoption and application of this Regulation. (27)The European Data Protection Supervisor was consulted and delivered an opinion on …, HAVE ADOPTED THIS REGULATION: CHAPTER 1

General Provisions Article 1

Subject matter This Regulation establishes a decentralised IT system for cross-border communication for the purpose of facilitating electronic exchange of documents, requests, legal forms, evidence or other information in a secure and reliable manner in cross-border civil and criminal proceedings (e-Justice Communication via Online Data EXchange - e-CODEX system). It lays down rules on the following: (a)the definition and composition of the e-CODEX system; (b)the operational management of the e-CODEX system by the European Agency for the operational management of large-scale IT systems in the area of freedom, security and justice (eu-LISA); (c)the responsibilities of the Commission, Member States and the entities operating authorised e-CODEX access points. Article 2

Scope This Regulation shall apply to the electronic transmission of information in the context of cross-border civil and criminal proceedings by means of the e‑CODEX system in accordance with the legal acts adopted in the area of judicial cooperation listed in Annex I. Article 3

Definitions For the purpose of this Regulation, the following definitions shall apply: (a)‘e-CODEX access point’ means the access point software installed on a hardware infrastructure, able to transmit and receive information to and from other e-CODEX access points in a trusted manner; (b)‘authorised e-CODEX access point’ means an e-CODEX access point which has been notified to eu-LISA in accordance with Article 5(4) or Article 7(1) and which is operating a digital procedural standard as referred to in Article 4(3); (c)‘entity operating an authorised e-CODEX access point’ means a Union institution, body or agency, a national public authority or legal person which is operating an authorised e-CODEX access point; (d)‘connected system’ means an IT system which is connected to an e-CODEX access point for the purpose of communicating with other e-CODEX access points; (e)‘central testing platform’ means an e-CODEX access point used exclusively for testing, that provides a set of functions which can be used by entities operating authorised e-CODEX access points to verify the correct operation of their access points and the correct use of the e-CODEX digital procedural standards in the connected systems linked to these access points;

(f)‘business process model’ means a graphical and textual representation of a conceptual model of several related, structured activities or tasks, along with the relevant data models, and the sequence in which the activities or tasks have to be performed, in order to achieve a meaningful interaction between two or more parties; (g)‘operational management’ means all the tasks necessary to keep the e‑CODEX system functioning in accordance with this Regulation. CHAPTER 2

Composition, functions and responsibilities in relation to the e-CODEX system Article 4

Composition of the e-CODEX system 1.The e-CODEX system shall be composed of an e-CODEX access point and digital procedural standards. 2.The e-CODEX access point shall be composed of: (a)a gateway consisting of a software, based on a common set of protocols, enabling the secure exchange of information over a telecommunications network with other gateways using the same common set of protocols; (b)a connector, making it possible to link connected systems to the gateway referred to in point (a), and consisting of a software, based on a common set of open protocols, enabling the following: (i)structuring, logging and linking of messages; (ii)the verification of their integrity and authenticity; (iii)the creation of time-linked evidences of receipt for the exchanged messages. 3.A digital procedural standard shall consist of the business process models and the templates defining the electronic format of the documents used in the context of the procedures laid down by legal acts listed in Annex I. Article 5

Responsibilities of the Commission 1.By 31 December 2022 the Commission shall establish, by means of implementing acts: (a)the minimum technical specifications and standards, including on security, underpinning the components of the e-CODEX system referred to in Article 4; (b)the service level requirements for the activities to be carried out by eu-LISA in accordance with Article 6 as well as other necessary technical specifications for those activities. (c)the specific arrangements of the handover/takeover process referred to in Article 9. 2.The Commission may adopt implementing acts establishing detailed technical specifications on the digital procedural standards defined in Article 4(3). 3.The implementing acts referred to in paragraphs 1 and 2 shall be adopted in accordance with the examination procedure referred to in Article 17(2). 4.The Commission shall maintain a list of authorised e-CODEX access points which are operated by Union institutions, bodies and agencies, and the cross-border civil and criminal procedures as well as forms which each access point is authorised to apply. It shall notify the changes to eu-LISA without delay, without prejudice to the annual notification provided for in Article 14.

5.The Commission shall designate up to five e-CODEX correspondents. Only e-CODEX correspondents shall be entitled to request and receive technical support referred to in Article 6(2)(f) from eu-LISA in relation to the e-CODEX system operated by Union institutions, bodies and agencies. Article 6

Responsibilities of eu-LISA 1.eu-LISA shall be responsible for the operational management of the components of the e-CODEX system referred to in Article 4(2)(b) and (3) and of the supporting software listed in Annex II. 2.The operational management of the e-CODEX system shall consist in particular of the following: (a)development, maintenance, bug fixing and distribution to the authorised e‑CODEX access points of the software products referred to in paragraph 1; (b)development, maintenance, distribution and updates of all documentation relating to the components of the e-CODEX system and its supporting software products referred to in paragraph 1 to the authorised e-CODEX access points; (c)development, maintenance, update and distribution to the authorised e-CODEX access points of a configuration file containing an exhaustive list of authorised e-CODEX access points, including the procedures and forms each of these access points is authorised to apply; (d)technical changes to e-CODEX and addition of new features, published as new versions of e-CODEX, in order to respond to emerging requirements laid down by the implementing acts referred to in Article 5(2) or by the the e-CODEX Advisory Group; (e)support and coordination of testing activities, including connectivity, involving the authorised e-CODEX access points; (f)technical support for the e-CODEX correspondents in relation to the e-CODEX system; (g)maintenance and distribution to the authorised e-CODEX access points of the business process models, of the templates defining the electronic format of documents referred to in Article 4(3) and of the underlying pre-defined collection of data models; (h)publication on the eu-LISA website of a list of the authorised e-CODEX access points, which have been notified to eu-LISA, and the cross-border civil and criminal procedures each of these access points is authorised to apply; (i)respond to requests for technical advice and support from the Commission services in the context of the preparation of the implementing acts provided for in Article 5(2); (j)preparation and distribution to the authorised e-CODEX access points of new business process models and templates defining the electronic format of documents referred to in Article 4(3), including by organising and facilitating workshops with the e-CODEX correspondents. 3.eu-LISA shall be responsible for the following additional tasks: (a)provision, operation and maintenance in eu-LISA's technical sites of the hardware and software IT infrastructure necessary for carrying out its tasks; (b)provision, operation and maintenance of a central testing platform; (c)informing the general public through the Internet about e-CODEX, by means of a set of large-scale communication channels, such as websites or social media platforms; (d)preparation, update and online distribution of non-technical information relating to the e-CODEX system and the activities carried out by eu-LISA. 4.eu-LISA shall make resources available on an on-call basis during business hours to provide a single point of contact to which the authorised e-CODEX access points can notify security issues. Following such notifications, eu-LISA shall analyse the security issue and, if necessary, inform the authorised e-CODEX access points impacted by that security issue.

Article 7

Responsibilities of the Member States 1.Member States shall maintain a list of authorised e-CODEX access points, operated within their territory, and the cross-border civil and criminal procedures as well as forms which each access point is authorised to apply. They shall notify the changes to eu-LISA without delay, without prejudice to the annual notification provided for in Article 14. 2.Each Member State shall designate up to five e-CODEX correspondents. Only those correspondents shall be entitled to request and receive the technical support referred to in Article 6(2)(f). Article 8

Responsibilities of entities operating authorised e-CODEX access points 1.The entity operating an authorised e-CODEX access point shall be responsible for its secure set-up and operation. This responsibility shall include the necessary adaptations to the connector referred to in Article 4(2)(b) to make it compatible with any connected systems and any other necessary technical adaptations to its connected systems. 2.The entity operating an authorised e-CODEX access point shall provide for a mechanism in its connected system(s) allowing for the retrieval of relevant data on the use of cross-border civil and criminal procedures in accordance with the relevant provisions of the legal acts listed in Annex I. 3.The responsibility for any damage resulting from the operation of an authorised e-CODEX access point and any connected systems shall be borne by the entity operating that authorised e-CODEX access point. Article 9

Handover and takeover 1.The entity managing the e-CODEX system shall, by 31 December 2022at the latest, submit a common handover document to eu-LISA specifying the detailed arrangements for the transfer of the e-CODEX system, including the criteria for a successful handover process and completion and related documentation, as established by the implementing acts pursuant to Article 5(1)(c), including provisions on intellectual property rights or usage rights relating to the e-CODEX system and the supporting software listed in Annex II enabling eu-LISA to carry out its responsibilities in accordance with Article 6. 2.During not more than six months after the delivery of the handover document referred to in paragraph 1 a handover/takeover process shall take place between the entity managing the e-CODEX system and eu-LISA. During that period, the entity managing the e-CODEX system shall retain full responsibility for the e-CODEX system and shall ensure that only corrective maintenance activities are performed in the system, excluding any other types of changes to the system. It shall, in particular, not deliver any new release of the e-CODEX system. 3.The Commission shall monitor the handover/takeover process in order to ensure that the detailed arrangements of the process are correctly implemented by the entity managing the e-CODEX system and eu-LISA, on the basis of the criteria referred to in paragraph 1. 4.eu-LISA shall take over responsibility for the e-CODEX system at the date when the Commission has declared the successful completion of the handover/takeover process referred to in paragraph 2 and not earlier than on 1 July 2023. Article 10

Security 1.After the successful takeover of the e-CODEX system, eu-LISA shall be responsible for maintaining a high level of security when carrying out its tasks, including the security of the hardware and software IT infrastructure referred to in Article 6(3). In particular, eu-LISA shall ensure that an e-CODEX security plan is established and maintained and that the e-CODEX system is operated according to this security plan, taking into account the classification of the information processed in e-CODEX and eu-LISA information security rules. Such a plan shall provide for regular security inspections and audits including software security assessments of the e-CODEX system with the participation of the entities operating an e-CODEX access point. 2.When carrying out its responsibilities, eu-LISA shall implement the principles of security by design and data protection by design and by default. Classified information shall not be transmitted via e-CODEX, unless eu-LISA accredits the system and the competent national security authorities of the Member States accredit the access points. 3.The entity operating an authorised e-CODEX access point shall have the exclusive responsibility for the security of that access point, including the security of data transmitted through it. It shall without delay notify any security issue to eu-LISA and to the Member State that maintains the list of authorised e-CODEX access points where that access point is listed, or, in the case of an access point operated by a Union institution, body or agency, to the Commission. eu-LISA shall develop security rules and guidance regarding e-CODEX access points. The entity operating an authorised e-CODEX access point shall provide eu-LISA with statements proving its compliance with the rules for the security of e-CODEX access points. Those statements shall be updated on a yearly basis, or whenever a change is otherwise required. Article 11

e-CODEX Advisory Group 1.As from 1 January 2023, the e-CODEX Advisory Group established pursuant to Article 27(dc) of Regulation (EU) 2018/1726 shall provide eu-LISA with the necessary expertise related to the e-CODEX system, in particular in the context of preparation of its annual work programme and its annual activity report. It shall also follow up on the state of implementation in the Member States. The Advisory Group shall be informed of any security issues.

2.During the handover/takeover process the e-CODEX Advisory Group shall meet regularly, at least every second month, until the takeover process is successfully completed. 3.The e-CODEX Advisory Group shall report after each meeting to the Programme Management Board. It shall provide the technical expertise to support the tasks of the Programme Management Board and shall follow up on the state of implementation in the Member States. 4.The e-CODEX Advisory Group shall involve in its work the professional organisations and other stakeholders, which participated in the management of the e-CODEX system at the time of its handover. Article 12

Programme Management Board 1.By 1 January 2023, the Management Board of eu-LISA shall establish an e-CODEX Programme Management Board composed of ten members. 2.The Programme Management Board shall be composed of eight members appointed by the Management Board, the Chair of the Advisory Group referred to in Article 11 and one member appointed by the Commission. The Management Board shall ensure that the members it appoints to the Programme Management Board have the necessary experience and expertise regarding the e-CODEX system. 3.eu-LISA shall participate in the work of the Programme Management Board. To that end, representatives of eu-LISA shall attend the meetings of the Programme Management Board in order to report on work regarding the e-CODEX system and on any other related work and activities. 4.The Programme Management Board shall meet at least once every three months, and more often when necessary. It shall ensure the adequate management of the e‑CODEX system, in particular during the handover/takeover process and with regard to the implementation of the acts adopted pursuant to Article 5(2). The Programme Management Board shall submit written reports regularly and if possible every second month to the Management Board of eu-LISA on the progress of the project. The Programme Management Board shall have no decision-making power nor any mandate to represent the members of the Management Board. 5.The Programme Management Board shall establish its rules of procedure which shall include in particular rules on: (a)choice of the chair; (b)meeting venues; (c)preparation of meetings; (d)admission of experts to the meetings, including professional organisations and other stakeholders, participating in the management of the e-CODEX system at the moment of its handover; (e)communication plans ensuring that non-participating members of the Management Board are kept fully informed. 6.The chairmanship of the Programme Management Board shall be held by a Member State which is fully bound by the legal acts listed in Annex I and using e-CODEX within their scope, as well as fully bound by the legal acts governing the development, establishment, operation and use of all the large-scale IT systems managed by eu-LISA. 7.All travel and subsistence expenses incurred by the members of the Programme Management Board shall be paid by eu-LISA. Article 10 of the eu-LISA Rules of Procedure shall apply mutatis mutandis. 8.The Programme Management Board's secretariat shall be ensured by eu-LISA. Article 13

Training eu-LISA shall perform tasks related to the provision of training on the technical use of the e‑CODEX system in accordance with Regulation (EU) 2018/1726, including provision of online training material. Article 14

Notifications

1.By 31 January of every year after the successful takeover of the e-CODEX system by eu-LISA, Member States shall notify eu-LISA of the following information: (a)the list of authorised e-CODEX access points which are operated within their territory, and the cross-border civil and criminal procedures and forms which each e-CODEX access point is authorised to apply, as referred to in Article 7(1); (b)a list of the cross-border civil and criminal procedures for which they use the e-CODEX system, and the extent to which the e-CODEX system can be used for each of these procedures; (c)the number of messages sent and received by each authorised e‑CODEX access point operating within their territory, grouped by corresponding authorised e-CODEX access point and cross-border civil and criminal procedure; (d)the number and type of incidents encountered by entities operating authorised e-CODEX access points within the territory of the Member State and impacting the security of the e-CODEX system. 2.By 31 January of every year after the successful takeover of the e-CODEX system by eu-LISA, the Commission shall notify eu-LISA of the following information: (a)the list of authorised e-CODEX access points that are operated by Union institutions, bodies and agencies, and the cross-border civil and criminal procedures and forms that each e-CODEX access point is authorised to apply, referred to in Article 5(4); (b)a list of the cross-border civil and criminal procedures for which they use the e-CODEX system, and the extent to which the e-CODEX system can be used for each of these procedures; (c)the number of messages sent and received by each authorised e‑CODEX access point operated by Union institutions, bodies and agencies, grouped by corresponding authorised e-CODEX access point and cross-border civil and criminal procedure; (d)the number and type of incidents encountered by entities operating authorised e-CODEX access points that are operated by Union institutions, bodies and agencies and impacting the security of the e-CODEX system. Article 15

Monitoring and reporting 1.For the first time two years after it takes over responsibility for the e-CODEX system, and every two years thereafter, eu-LISA shall submit a report to the Commission on the technical functioning and use of the e-CODEX system, including the security of the system. 2.eu-LISA shall consolidate the data received from the Commission and the Member States pursuant to Article 14 and provide the following indicators as part of the report provided for in paragraph 1: (a)the list and number of cross-border civil and criminal procedures for which the e-CODEX system has been used during the reporting period; (b)the number of authorised e-CODEX access points for each Member State and for each civil and criminal procedure; (c)the steps of the cross-border civil and criminal procedures for which the e-CODEX system can be used, for each Member State; (d)the number of messages sent through the system for each civil and criminal procedure between each of the authorised e-CODEX access points; (e)the number and type of incidents impacting the security of the e-CODEX system and compliance information with the e-CODEX security plan. 3.For the first time, three years after eu-LISA takes over responsibility for the e‑CODEX system, and every four years thereafter, the Commission shall produce an overall evaluation of the e-CODEX system. That overall evaluation shall include an assessment of the application of this Regulation and an examination of results achieved against objectives, and may propose possible future actions. At the time of the first evaluation, the Commission shall also reexamine the role of the Programme Management Board and its continuation. The Commission shall transmit the evaluation report to the European Parliament and the Council. Article 16

Amendments to Regulation (EU) 2018/1726

Regulation (EU) 2018/1726 is amended as follows: (1)in Article 1, the following paragraph 4a is inserted: “4a. The Agency shall be responsible for the development, operational management, including technical evolutions, of the computerised system for communication in cross-border civil and criminal proceedings (e-CODEX system.)”; (2)the following Article 8b is inserted: “Article 8b Tasks related to the e-CODEX system In relation to the e-CODEX system, the Agency shall perform: (a)the tasks conferred on it by Regulation (EU) No XXX/20XX of the European Parliament and of the Council*; (b)tasks relating to training on the technical use of the e-CODEX system, including provision of online training materials. __________ * on a computerised system for communication in cross-border civil and criminal proceedings (e-CODEX system), and amending Regulation (EU) 2018/1726 (OJ L …).”; (3)in Article 14, paragraph 1 is replaced by the following: “1.The Agency shall monitor developments in research relevant for the operational management of SIS II, VIS, Eurodac, the EES, ETIAS, DubliNet, ECRIS-TCN, e-CODEX and other large-scale IT systems as referred to in Article 1(5).” (4)in Article 19, paragraph 1 is amended as follows: (a)point (ff) is replaced by the following: “(ff)adopt reports on the technical functioning of the following: (i)SIS pursuant to Article 60(7) of Regulation (EU) 2018/1861 of the European Parliament and of the Council* and Article 74(8) of Regulation (EU) 2018/1862 of the European Parliament and of the Council**; (ii)VIS pursuant to Article 50(3) of Regulation (EC) No 767/2008 and Article 17(3) of Decision 2008/633/JHA; (iii)EES pursuant to Article 72(4) of Regulation (EU) 2017/2226; (iv)ETIAS pursuant to Article 92(4) of Regulation (EU) 2018/1240;

(v)ECRIS-TCN and of the ECRIS reference implementation pursuant to Article 36(8) of Regulation (EU) 2019/816 of the European Parliament and of the Council***; (vi)the interoperability components pursuant to Article 78(3) of Regulation (EU) 2019/817 and Article 74(3) of Regulation (EU) 2019/818; (vii)the e‑CODEX system pursuant to Article 14(1) of Regulation (EU) XXX of 20XX [this Regulation] __________ * Regulation (EU) 2018/1861 of the European Parliament and of the Council of 28 November 2018 on the establishment, operation and use of the Schengen Information System (SIS) in the field of border checks, and amending the Convention implementing the Schengen Agreement, and amending and repealing Regulation (EC) No 1987/2006 (OJ L 312, 7.12.2018, p. 14). ** Regulation (EU) 2018/1862 of the European Parliament and of the Council of 28 November 2018 on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters, amending and repealing Council Decision 2007/533/JHA, and repealing Regulation (EC) No 1986/2006 of the European Parliament and of the Council and Commission Decision 2010/261/EU. (OJ L 312, 7.12.2018, p. 56). *** Regulation (EU) 2019/816 of the European Parliament and of the Council of 17 April 2019 establishing a centralised system for the identification of Member States holding conviction information on third-country nationals and stateless persons (ECRIS-TCN) to supplement the European Criminal Records Information System and amending Regulation (EU) 2018/1726 (OJ L 135, 22.5.2019, p. 1).” ; (b)point (mm) is replaced by the following: “(mm)ensure annual publication of the following: (i)the list of competent authorities authorised to search directly the data contained in SIS pursuant to Article 41(8) of Regulation (EU) 2018/1861 and Article 56(7) of Regulation (EU) 2018/1862, together with the list of Offices of the national systems of SIS (N.SIS) and SIRENE Bureaux pursuant to Article 7(3) of Regulation (EU) 2018/1861 and Article 7(3) of Regulation (EU) 2018/1862 respectively; (ii)the list of competent authorities pursuant to Article 65(2) of Regulation (EU) 2017/2226; (iii)the list of competent authorities pursuant to Article 87(2) of Regulation (EU) 2018/1240; (iv)the list of central authorities pursuant to Article 34(2) of Regulation (EU) 2019/816; (v)the list of authorities pursuant to Article 71(1) of Regulation (EU) 2019/817 and Article 67(1) of Regulation (EU) 2019/818; (vi)the list of authorised e-CODEX access points pursuant to Article 6(2)(h) of Regulation (EU) XXX of 20XX [on the e-CODEX system – this Regulation];”; (5)in Article 27(1), the following point (dc) is inserted: “(dc)e-CODEX Advisory Group;”. CHAPTER 3

Final provisions Article 17

Committee procedure 1.The Commission shall be assisted by a committee. That committee shall be a committee within the meaning of Regulation (EU) No 182/2011.

2.Where reference is made to this paragraph, Article 5 of Regulation (EU) No 182/2011 shall apply. Article 18

Costs 1.The costs incurred in the performance of the tasks referred to in Article 6 shall be borne by the general budget of the European Union. 2.The costs for the tasks referred to in Article 7 and Article 8 shall be borne by the Member States and the entities operating authorised e-CODEX access points respectively. Article 19

Entry into force This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union. This Regulation shall be binding in its entirety and directly applicable in the Member States in accordance with the Treaties. Done at Brussels, For the European Parliament For the Council The President The President LEGISLATIVE FINANCIAL STATEMENT 1.FRAMEWORK OF THE PROPOSAL/INITIATIVE 1.1.Title of the proposal/initiative 1.2.Policy area(s) concerned in the ABM/ABB structure 1.3.Nature of the proposal/initiative 1.4.Objective(s) 1.5.Grounds for the proposal/initiative 1.6.Duration and financial impact

1.7.Management mode(s) planned 2.MANAGEMENT MEASURES 2.1.Monitoring and reporting rules 2.2.Management and control system 2.3.Measures to prevent fraud and irregularities 3.ESTIMATED FINANCIAL IMPACT OF THE PROPOSAL/INITIATIVE 3.1.Heading(s) of the multiannual financial framework and expenditure budget line(s) affected 3.2.Estimated impact on expenditure 3.2.1.Summary of estimated impact on expenditure 3.2.2.Estimated impact on operational appropriations 3.2.3.Estimated impact on appropriations of an administrative nature 3.2.4.Compatibility with the current multiannual financial framework 3.2.5.Third-party contributions 3.3.Estimated impact on revenue LEGISLATIVE FINANCIAL STATEMENT 1.FRAMEWORK OF THE PROPOSAL/INITIATIVE 1.1.Title of the proposal/initiative Regulation of the European Parliament and of the Council on a computerised system for communication in cross-border civil and criminal proceedings (e-CODEX system), and amending Regulation (EU) 2018/1726 1.2.Policy area(s) concerned (Programme cluster) Investing in People, Social Cohesion & Values, Justice, Rights and Values

1.3.The proposal/initiative relates to: ◻ a new action ◻ a new action following a pilot project/preparatory action ⌧ the extension of an existing action ◻ a merger or redirection of one or more actions towards another/a new action 1.4.Grounds for the proposal/initiative 1.4.1.Requirement(s) to be met in the short or long term including a detailed timeline for roll-out of the implementation of the initiative The goal of this legal proposal is to establish the e-CODEX system and entrust eu‑LISA (“the Agency”) with its operational management, and further technical evolutions of the system within the Agency’s responsibilities laid down in Article 6. e-CODEX was developed between 2010 and 2016 by 21 EU Member States with the participation of other countries/territories and organisations. The total cost of the project development was about 24 million EUR of which 50% were funded by EU grants and 50% by the participating Member States. An additional 2 million EUR were awarded for maintaining e-CODEX between 2016 and 2018 (Me-CODEX project) and an additional 3 million EUR were made available through a grant for maintenance of the system between 2019 and 2021 (Me-CODEX II project). A handover of e-CODEX to eu-LISA is envisaged to take place in the first half of 2023. Therefore, a further maintenance project will be needed to cover the need of the system’s maintenance in the 2021-2023 period. The system is and will continue to be operated by its users (Member States) in a decentralised way, with each Member State operating one or multiple e-CODEX access points. To establish an access point, a Member State would use the software products maintained by eu-LISA and will receive from eu-LISA technical assistance during the phases of installation and configuration of the access point. eu-LISA will also provide support to operational deployments of access points. The Commission retains its policy-related role in monitoring and steering the work taking place in eu-LISA, defining the high-level elements of the e-CODEX system through implementing acts and working towards establishing the e-CODEX system as the secure communication channel used for judicial cooperation in the context of a list of cross-border judicial procedures in the EU. Short term requirement: eu-LISA to become operational with respect to the execution of the tasks defined in Article 6 by 30 June 2023. Long term requirement: The gradual establishment of the e-CODEX system as the main digital solution for cross-border cooperation between judicial authorities and cross-border judicial procedures in the European Union. 1.4.2.Added value of Union involvement (it may result from different factors, e.g. coordination gains, legal certainty, greater effectiveness or complementarities). For the purposes of this point 'added value of Union involvement' is the value resulting from Union intervention which is additional to the value that would have been otherwise created by Member States alone. Reasons for action at European level (ex-ante): In the absence of EU action, there is a risk that Member States develop national IT systems independently, leading to a lack of interoperability between them. Operational management and further technical evolutions at EU level is the only way to achieve an interoperable system for cross-border communication between judicial authorities. Expected generated EU added value (ex-post): The e-CODEX pilots carried out by Member States show the potential of the system for digitalising procedures such as the European Small Claims or European Payment Order in the civil law area, or for the exchange of Mutual Legal Assistance requests and European Investigation Orders in the criminal area. Having e-CODEX managed by eu-LISA will contribute to eliminating these limiting factors by: Providing an off the shelf solution which will generate economies of scale as the EU will have to maintain only one IT solution for secure cross-border communication in the judicial area. Thus, the costs for Member States to digitalise their cross-border procedures are expected to decrease and to become less of a barrier. Where Member States do not have tools available to fulfil the system requirements, reference implementations based on e-CODEX could be provided by the EU. Establishing e-CODEX as a stable sustainable solution will generate trust from the Member States that investments in local systems to be connected to e-CODEX will not be short lived and thus will have the potential to generate the expected return on investment. Further EU legislative proposals for digitalisation of judicial processes could already indicate e-CODEX as the preferred IT system for cross-border communication, which would facilitate the later implementation process.

1.4.3.Lessons learned from similar experiences in the past Without a stable and clearly defined governance structure and operational set-up, systems such as e-CODEX, even if deemed extremely useful by all the participants, never evolve beyond their pilot status to provide true EU added value. 1.4.4.Compatibility and possible synergy with other appropriate instruments The initiative comes to support the digitalisation of a list of legal acts adopted in the area of judicial cooperation by helping to establish a secure communication channel between the competent authorities that are involved in their application. The e-CODEX system is one of the key components of the Commission’s e-Justice policy to enhance access to and efficiency of justice in and across Member States and is included in the e-Justice 2019-2023 Action Plan European e-Justice. In the context of a Digital Single Market that aims to provide high-speed, secure and trustworthy infrastructures and services, solutions for fostering e-Justice were part of the 2016 eGovernment Action Plan. The e-Justice portal, a one-stop shop for judicial information in the EU, offers citizens in Member States where electronic transmission is allowed, the possibility of submitting small claims for European payment orders electronically, using the e-CODEX system. e-CODEX is one of the e-Justice Digital Service Infrastructures within the Connecting Europe Facility (CEF) programme. Moreover, one of the components of e-CODEX has been taken up and maintained by the Commission as part of the eDelivery building block within CEF, which shows that it is a useful system not only for justice, but also in other areas. So far e-CODEX has been developed and maintained with EU financing or co-financing. With the adoption of this proposal, further financing by grants will no longer be necessary, leading to cost savings for the EU budget. In terms of synergies, this proposal will ensure that the EU Member States can benefit from the investments that were already made in order to create the e-CODEX system and also avoid incurring further costs for the development of another system to fulfil the same business need in the judicial area. 1.5.Duration and financial impact ◻ limited duration –◻ in effect from [DD/MM]YYYY to [DD/MM]YYYY –◻ Financial impact from YYYY to YYYY for commitment appropriations and from YYYY to YYYY for payment appropriations. ⌧ unlimited duration –Implementation with a start-up period from 2022 to 2023, –followed by full-scale operation. 1.6.Management mode(s) planned ◻ Direct management by the Commission –◻ by its departments, including by its staff in the Union delegations; –◻ by the executive agencies

◻ Shared management with the Member States ⌧ Indirect management by entrusting budget implementation tasks to: –◻ third countries or the bodies they have designated; –◻ international organisations and their agencies (to be specified); –◻ the EIB and the European Investment Fund; –⌧ bodies referred to in Articles 70 and 71 of the Financial Regulation; –◻ public law bodies; –◻ bodies governed by private law with a public service mission to the extent that they provide adequate financial guarantees; –◻ bodies governed by the private law of a Member State that are entrusted with the implementation of a public-private partnership and that provide adequate financial guarantees; –◻ persons entrusted with the implementation of specific actions in the CFSP pursuant to Title V of the TEU, and identified in the relevant basic act. –If more than one management mode is indicated, please provide details in the ‘Comments’ section. Comments eu-LISA shall ensure the operational management of the e-CODEX system within the meaning of Article 6 of this Regulation. 2.MANAGEMENT MEASURES 2.1.Monitoring and reporting rules Specify frequency and conditions. Article 15 of the Regulation – Monitoring and reporting – sets out the obligation for the Agency to report to the Commission its activities pertaining to the e-CODEX system. This specific tool comes to supplement the existing mechanisms set forth in Article 39of the Regulation (EU) 2018/1726 that establishes the Agency. 2.2.Management and control system(s) 2.2.1.Justification of the management mode(s), the funding implementation mechanism(s), the payment modalities and the control strategy proposed

This Regulation does not affect the existing management mode(s) where the Agency is concerned. 2.2.2.Information concerning the risks identified and the internal control system(s) set up to mitigate them The main risk in the short term is whether eu-LISA has the capacity to cope with the additional tasks stemming from this Regulation in a timely fashion, considering its current priority tasks of developing and managing the Entry/Exit System (EES), the European Travel Information and Authorisation System (ETIAS), the European Criminal Records Information System for third country nationals (ECRIS-TCN), the modernised Schengen Information System (SIS), the Visa Information System (VIS) and Eurodac. This risk is mitigated by delaying the end of the handover phase of e-CODEX to eu-LISA to 1 July 2023, and by the fact that the scope of the transfer proposed under this Regulation is comparatively small, and resources are not shared with and are independent from those concerning other on-going legal proposals. 2.2.3.Control method(s) envisaged As a Union Agency, eu-LISA applies adequate horizontal control methods of decentralised agencies. The eu-LISA Financial Rules, which are based on the Framework Financial Regulation for agencies sets out the appointment of an internal auditor and internal audit requirements. Any implementing act extending the judicial procedures covered by e-CODEX shall include a revised legislative financial statement ensuring the assignment of proper financial and human resources to eu-LISA. eu-LISA implements an Internal Control Framework based on the Internal Control Framework of the European Commission and on the original Committee of Sponsoring Organisations’ integrated internal control framework. The Single Programming Document must provide information on the internal control systems, while the Consolidated Annual Activity Report (CAAR) must contain information on the efficiency and effectiveness of the internal control systems, including as regards risk assessment. Internal supervision is also provided by eu-LISA’s Internal Audit Capability, on the basis of an annual audit plan notably taking into consideration the assessment of risks in eu-LISA. 2.2.4.Estimation and justification of the cost-effectiveness of the controls (ratio of "control costs ÷ value of the related funds managed"), and assessment of the expected levels of risk of error (at payment & at closure) This Regulation does not affect the cost-effectiveness of the existing controls where the Agency is concerned. 2.3.Measures to prevent fraud and irregularities Specify existing or envisaged prevention and protection measures, e.g. from the Anti-Fraud Strategy. As a Union Agency, eu-LISA applies adequate horizontal measures to prevent fraud, corruption and other unlawful activities, as provided for by Article 50 of Regulation (EU) 2018/1726. 3.ESTIMATED FINANCIAL IMPACT OF THE PROPOSAL/INITIATIVE 3.1.Heading of the multiannual financial framework and new expenditure budget line(s) proposed Heading of multiannual financial framework Budget line Type of

expenditure Contribution Number

[…][Heading………………………...……………] Diff./Non-diff. from EFTA countries from candidate countries from third countries within the meaning of Article [21(2)(b)] of the Financial Regulation 2 07 07 Justice Non-diff. NO NO NO NO 7 20 01 Administrative expenditure of the Commission Non-diff. NO NO NO NO 3.2.Estimated impact on expenditure 3.2.1.Summary of estimated impact on expenditure

EUR million (to three decimal places) Heading of multiannual financial

framework 2 ‘Cohesion & Values’ eu-LISA 2021 2022 2023 2024 2025 2026 2027 Post 2027 TOTAL SPECIFIC OBJECTIVE No 1: Maintain and further evolve the e-CODEX system Commitments (1) 0 0.053 1.430 1.831 1.831 1.789 1.789 1.789 8.723 Payments (2) 0 0.053 1.430 1.831 1.831 1.789 1.789 1.789 8.723 TOTAL appropriations under HEADING 2 of the multiannual financial framework Commitments =1+1a+3a 0 0.053 1.430 1.831 1.831 1.789 1.789 1.789 8.723 Payments =2+2a+3a 0 0.053 1.430 1.831 1.831 1.789 1.789 1.789 8.723



Heading of multiannual financial

framework 7 ‘Administrative expenditure of the Commission’ EUR million (to three decimal places) DG Justice and Consumers 2021 2022 2023 2024 2025 2026 2027 Post 2027 TOTAL Human resources 0 0.075 0.150 0.150 0.150 0.150 0.150 0.150 0.825 Other administrative expenditure 0 0.084 0.007 0.007 0.007 0.007 0.007 0.007 0.119 TOTAL appropriations under HEADING 7 of the multiannual financial framework (Total commitments = Total payments) 0 0.159 0.157 0.157 0.157 0.157 0.157 0.157 0.944 E