REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL on the evaluation of the European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) in accordance with Article 39 of Regulation (EU) 2018/1726
Date: 2026-01-26
Institutions: Directorate-General for Migration and Home Affairs, European Commission
Subjects: European Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice, European security, Schengen Information System, area of freedom, security and justice, exchange of information, external border of the EU, illegal migration, operation of the Institutions, personal data, rights of aliens

EN 

  EN 

   EUROPEAN COMMISSION  Brussels, 26.1.2026  COM(2026) 32 final  REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL on the evaluation of the European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) in accordance with Article 39 of Regulation (EU) 2018/1726 {SWD(2026) 980 final}  
 
 
1.  Introduction 

The growing complexity of migration, border  management,  and internal  security across the 
European Union has long required robust, scalable, and reliable information systems. As the 
Schengen  area  expanded  and  the  need  for  shared  databases  to  support  visa  management, 
asylum processing, and police cooperation increased, it became clear by the late 2000s that a 
dedicated  authority  was  needed  to  manage  the  EU’s  large-scale  IT  systems  securely  and 
efficiently. Therefore, the European Union Agency for the Operational Management of Large-
Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) was established in 
2011 through Regulation (EU) No 1077/20111. 

Initially, eu-LISA oversaw the operational management of existing large-scale IT systems in 
the area of freedom, security and justice, namely the second generation Schengen Information 
System (SIS II), the Visa Information System (VIS), and the European Asylum Dactyloscopy 
Database  (Eurodac).  It  was  also  entrusted  with  potentially  supporting  the  development  and 
operation of additional IT systems.  

Since becoming operational in 2012, the Agency has gradually expanded its capabilities to meet 
the  growing  demand  for  secure,  reliable,  and  scalable  IT  solutions  in  migration,  border 
management, and internal security. A key milestone in this expansion was the amendment of 
the  eu-LISA  Regulation  in  2015,  which  updated  the  Agency's  responsibilities  related  to 
Eurodac.  This  change  was  made  through  the  adoption  of  Regulation  (EU)  No  603/2013 
(Eurodac recast Regulation), which introduced new requirements for the Agency's work in this 
area2. 

By  the  mid-2010s,  a  series  of  pressing  challenges  emerged  that  tested  the  EU’s  migration, 
border  management  and  internal  security  frameworks.  The  2015–2016  migration  crisis 
significantly strained asylum and border management infrastructures, while a heightened threat 
of terrorism underscored the need for an enhanced control of the external borders and real-time 
information sharing between national authorities. In addition, the risks of identity fraud and 
data  fragmentation  across  different  EU-level  systems  became  a  growing  concern.  These 
challenges revealed the limitations of existing systems and coordination models, underscoring 
the need for a more effective and adaptable approach.  
In  response,  the  eu-LISA’s  mandate  was  revised  through  Regulation  (EU)  2018/17263 
(hereinafter  referred  to  as  ‘the  eu-LISA  Regulation’  or  “current  Regulation”). The  revision, 
which was based on the first evaluation of the Agency’s mandate4, was not simply an upgrade, 

1 Regulation (EU) No 1077/2011 of the European Parliament and the Council of 25 October 2011 establishing a 
European Union Agency for the operational management of large-scale IT systems in the area of freedom, security 
and justice (OJ L 286, 01.11.2011, p. 1-17). 
2  Regulation  (EU)  No 603/2013  of  the  European  Parliament  and  of  the  Council  of  26 June  2013  on  the 
establishment  of  'Eurodac'  for  the  comparison  of  fingerprints  for  the  effective  application  of  Regulation  (EU) 
No 604/2013  establishing  the  criteria  and  mechanisms  for  determining  the  Member  State  responsible  for 
examining  an  application  for  international  protection  lodged  in  one  of  the  Member  States  by  a  third-country 
national  or  a  stateless  person  and  on  requests  for  the  comparison  with  Eurodac  data  by  Member  States'  law 
enforcement authorities and Europol for law enforcement purposes, and amending Regulation (EU) No 1077/2011 
establishing a European Agency for the operational management of large-scale IT systems in the area of freedom, 
security and justice (recast) (OJ L 180, 29.6.2013, p. 1–30) 
3  Regulation  (EU)  2018/1726  of  the  European  Parliament  and  of  the  Council  of  14  November  2018  on  the 
European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, 
Security  and  Justice  (eu-LISA),  and  amending  Regulation  (EC)  No  1987/2006  and  Council  Decision 
2007/533/JHA and repealing Regulation (EU) No 1077/2011, (OJ L 295, 21.11.2018, p. 99–137). 
4 European Commission 2017, Report from the Commission to the European Parliament and the Council on the 
functioning  of  the  European  Agency  for  the  operational  management  of  largescale  IT  systems  in  the  area  of 
freedom, security and justice (eu-LISA), COM(2017) 346 final, Brussels. 

1 

 
 
 
but a necessary strategic adjustment to equip the Agency to address the evolving migration and 
security landscape. 

The current eu-LISA  Regulation  maintains the Agency’s core  objective of contributing  to  a 
high-level security within the area of freedom, security and justice, including by facilitating 
border management and law enforcement. Furthermore, the current Regulation expanded the 
Agency’s mandate, notably to include the development and management of new large-scale 
systems,  such  as  the  Entry/Exit  System  (EES)  and  the  European  Travel  Information  and 
Authorisation  System  (ETIAS).  It  also  tasked  the Agency  with  the  implementation  of  the 
interoperability framework between the justice and home affairs IT systems, i.e. a landmark 
initiative to eliminate the data silos that have hampered effective policy implementation. 

Article 39 of the eu-LISA Regulation calls for an evaluation of the performance of the Agency 
in relation to its objectives, mandate, locations and tasks with a view to identifying potential 
areas for improvement.  
The Commission carried out the supporting study between October 2023 and November 20245, 
covering the period from the entry into force of the current eu-LISA Regulation in 2018 until 
March 2024. The evaluation also  compared the situation with the period between 2012 and 
2018 before the current regulation entered into force. While the study formally concluded in 
2024, the evaluation integrates developments up to June 2025. Extending the evaluation period 
allowed the Commission to reflect the significant organisational and management changes that 
the Agency underwent in parallel to the study, thereby ensuring that the assessment captures 
the  most  recent  progress  and  provides  a  more  comprehensive  and  accurate  picture  of  the 
Agency’s performance. The current evaluation is based on a broad consultation involving the 
European  Commission,  staff  and  contractors  of  eu-LISA,  Member  States  authorities 
participating  in  the  governance  bodies  of  eu-LISA  (including  Advisory  Groups,  Project 
Management Boards and Management Board members) from both the home affairs and justice 
domains, EU Agencies (including the European Border and Coast Guard Agency and Eurojust), 
the  European  Public  Prosecutor’s  Office  (EPPO),  the  European  Data  Protection  Supervisor 
(EDPS), and national data protection authorities.  

This evaluation assessed the performance of the Agency in relation to its objectives, mandate, 
location and tasks. It also included an analysis of the legal and policy frameworks governing 
eu-LISA and focussed on the performance of the tasks, the organisation set-up, including the 
governance  and  locations  of  the  Agency,  and  the  management  of  economic,  human  and 
technical resources. Furthermore, the evaluation analysed the relevance and the added value of 
the Agency for the EU, by assessing to what extent the new mandate of the Agency, introduced 
in 2018, has contributed to achieving the objectives of the Agency, and to which extent it has 
supported Member States in the development and implementation of the large-scale IT systems 
in the area of freedom, security and justice.  

This report summarises the conclusions that the Commission has drawn from the evaluation of 
the  implementation  of  the  current  eu-LISA  Regulation,  detailed  in  the  Commission  staff 
working document that accompanies the report6. The evaluation takes stock of the state of play 
in  the  implementation  of  the  current  eu-LISA  Regulation  and  identifies  a  series  of  areas  of 
attention for improvement that will feed into the future work of the Commission, eu-LISA and 
the Member States. 

2.  Abstract of the evaluation and key findings. 

5 Study to support the evaluation of Regulation (EU) 2018/1726 of the European Parliament and of the Council 
of 14 November 2018 on eu-LISA. ISBN: 978-92-68-34401-9 
6 SWD(2026) 980 

2 

 
 
 
Despite a complex operational and policy environment—marked by accelerating digitalisation, 
rising security threats, and geopolitical instability—this evaluation concludes with a broadly 
positive assessment of the performance, relevance, coherence, efficiency, and EU added value 
of  eu-LISA.  The Agency  has  proven  indispensable  for  the  implementation  and  operational 
management of large-scale IT systems in the area of freedom, security and justice, supporting 
Member  States  and  EU  institutions  in  delivering  coordinated,  secure,  and  effective  digital 
infrastructure. 

The eu-LISA Regulation remains highly relevant. The Agency’s importance has increased 
in light of developments, such as increased mobility of EU citizens and third-country nationals, 
rapid  technological  advancements,  heightened  cyber-attack  risks,  and  ongoing  geopolitical 
tensions, particularly those linked to the Russian war of aggression against Ukraine and the 
conflicts in the Middle East. 

Since the adoption of the current eu-LISA Regulation, the Agency’s mandate remained relevant 
and has been further strengthened in response to emerging security and migration challenges. 
By way of amendments to the eu-LISA Regulation, the Agency was entrusted with additional 
responsibilities  relating  to  new  IT  systems,  including  EES,  ETIAS,  the  e-CODEX  system7, 
ECRIS-TCN8, revised VIS9, the Joint Investigation Teams Collaboration Platform (JITs CP)10, 
and the new Eurodac11. These systems were designed to facilitate information exchange and 
enhance cross-border cooperation among relevant authorities across the EU. Additionally, the 
Agency’s responsibilities have been expanded to include the development and management of 
the interoperability of the large-scale IT systems12. Furthermore, the Agency has started to carry 
out  operational  tasks  for  the  existing  systems,  including  24/7  duty  system,  to  ensure  their 
efficient and resilient functioning. Significantly, the updated mandate also empowered eu-LISA 

7 Regulation (EU) 2022/850 of the European Parliament and of the Council of 30 May 2022 on a computerised 
system for the cross-border electronic exchange of data in the area of judicial cooperation in civil and criminal 
matters (e-CODEX system) and amending Regulation (EU) 2018/1726 (OJ L 150, 01.06.2012, p. 1-19) 
8  Regulation  (EU)  2019/816  of  the  European  Parliament  and  of  the  Council  of  17  April  2019  establishing  a 
centralised  system  for  the  identification  of  Member  States  holding  conviction  information  on  third-country 
nationals and stateless persons (ECRIS-TCN) to supplement the European Criminal Records Information System 
and amending Regulation (EU) 2018/1726 (OJ L 135, 22.5.2019, p. 1-26) 
9 Regulation (EC) No 767/2008 as last amended by Regulation (EU) 2021/1134 of the European Parliament and 
of  the  Council  of  7 July  2021  amending  Regulations  (EC)  No 767/2008,  (EC)  No 810/2009,  (EU) 2016/399, 
(EU) 2017/2226, (EU) 2018/1240, (EU) 2018/1860, (EU) 2018/1861, (EU) 2019/817 and (EU) 2019/1896 of the 
European Parliament and of the Council and repealing Council Decisions 2004/512/EC and 2008/633/JHA, for 
the purpose of reforming the Visa Information System (OJ L 248, 13.7.2021, p. 11–87) 
10  Regulation  (EU)  2023/969  of  the  European  Parliament  and  of  the  Council  of  10 May  2023  establishing  a 
collaboration  platform  to  support  the  functioning  of  joint  investigation  teams  and  amending  Regulation 
(EU) 2018/1726 (OJ L 132, 17.5.2023, p. 1-20) 
11 Regulation (EU) 2024/1358 of the European Parliament and of the Council of 14 May 2024 on the establishment 
of ‘Eurodac’ for the comparison of biometric data in order to effectively apply Regulations (EU) 2024/1351 and 
(EU) 2024/1350 of the European Parliament and of the Council and Council Directive 2001/55/EC and to identify 
illegally staying third-country nationals and stateless persons and on requests for the comparison with Eurodac 
data  by  Member  States’  law  enforcement  authorities  and  Europol  for  law  enforcement  purposes,  amending 
Regulations (EU) 2018/1240 and (EU) 2019/818 of the European Parliament and of the Council and repealing 
Regulation (EU) No 603/2013 of the European Parliament and of the Council (OJ L, 2024/1358, 22.5.2024) 
12 Regulation (EU) 2019/817 of the European Parliament and of the Council of 20 May 2019 on establishing a 
framework for interoperability between EU information systems in the field of borders and visa and amending  
Regulations (EC) No 767/2008, (EU) 2016/399, (EU) 2017/2226, (EU) 2018/1240, (EU) 2018/1726 and (EU) 
2018/1861 of the European Parliament and of the Council and Council Decisions 2004/512/EC and 2008/633/JHA 
(OJ, L 135, 22.5.2019, p. 27-84) Regulation (EU) 2019/818 of the European Parliament and of the Council of 20 
May 2019 on establishing a framework for interoperability between EU information systems in the field of police 
and judicial cooperation, asylum and migration and amending Regulations (EU) 2018/1726, (EU) 2018/1862 and 
(EU) 2019/816 (OJ L, 135, 22.5.2019, p. 85-135) 

3 

 
 
 
to support Member States and the European Commission upon request and to bolster its role 
through research monitoring activities and pilot testing.  

The  current  evaluation  confirms  that  eu-LISA’s  mandate  remains  relevant  and  aligned  with 
operational  needs,  including  as  regard  the  development  of  new  IT  systems.  The  evaluation 
concludes that eu-LISA’s activities in relation to research remain relevant, however, the Agency 
should prioritise those that have a direct impact on the operation or development of large-scale 
IT  systems  it  manages.  The  Agency’s  should  nevertheless  maintain  strong  operational 
performance as a key factor determining its ongoing relevance in the future. 

The assessment of eu-LISA’s effectiveness is  mixed. While eu-LISA performs well in the 
management of existing large-scale IT systems, with positive stakeholder feedback on service 
continuity and incident response, there is an important scope for improvement concerning the 
development of new systems. 

The effectiveness of the current eu-LISA Regulation in achieving its objectives varies across 
different tasks: 

-  The operational management of existing systems is generally very effective, and it has 

been identified as a strength. 

-  The  development  of  new  systems  is  less  effective,  with  the  Agency  encountering 
challenges related to, for example, contractor management, internal coordination, and 
resource  allocation. These  challenges  have  resulted  in  significant  delays,  notably  in 
relation to the EES, ETIAS, ECRIS-TCN and revised VIS. 

-  The effectiveness of the Agency in conducting tasks that are not related to the systems 
is  mixed,  with  positive  outputs  in  research  monitoring,  but  the  limited  use  of  pilot 
testing  and  ad  hoc  support  to  the  European  Commission  and  Member  States,  as 
provided in Articles 15 and 16 of the current eu-LISA Regulation. 

The assessment of eu-LISA’s efficiency presents a nuanced picture. While the Agency has 
demonstrated  strong  efficiency  in  the  operational  management  of  existing  large-scale  IT 
systems, there remains considerable scope for improvement in the development and delivery 
of  new  systems.  Challenges  in  this  area  largely  stem  from  complexities  in  contractor 
management and difficulties with adhering to timelines for major projects, such as the EES and 
the ETIAS. 

From an organisational and governance perspective, eu-LISA overall operates efficiently and 
continuously strives to  optimise its internal  processes. Nonetheless,  certain structural  issues 
have been identified that hinder the Agency’s optimal performance. These include a rigid unit-
based organisational model, oversized teams, and overlapping responsibilities, particularly in 
stakeholder  engagement. Additionally, eu-LISA’s operations  are  fragmented across different 
locations  in Tallinn,  Strasbourg  and  Sankt  Johann  im  Pongau. These  factors  have,  at  times, 
contributed  to  inefficiencies,  notably  in  contract  management  and  oversight,  as  well  as 
recruitment of the Agency’s staff. The Agency’s governance framework is inherently complex 
and can generate substantial administrative overhead. While this complexity is to some extent 
justified by the need to ensure robust coordination across Member States and EU institutions 
concerns  have  been  raised  about  the  administrative  burden  resulting  from  meeting-heavy 
schedules. The evaluation concludes that streamlining governance mechanisms and enhancing 
coordination  among  governance  bodies  could  generate  valuable  synergies,  reducing 
organisational overhead. At the same time, eu-LISA’s excessive reliance on external contractors 
for  technical  delivery  poses  persistent  challenges,  limiting  its  ability  to  effectively  oversee 
complex IT projects. Addressing this dependency by boosting internal knowledge, improving 

4 

 
 
talent  retention,  and  strengthening  project  ownership  is  essential  for  ensuring  long-term 
organisational resilience. 

eu-LISA is recognised for its competent management of operational IT systems. Stakeholders 
consistently confirm the Agency’s capacity to swiftly address and mitigate incidents, ensuring 
service  continuity.  However,  there  is  scope  for  improvement  to  enhance  efficiency  through 
finding a strategic balance between handling support functions in-house and outsourcing them 
to external providers. In contrast, the efficiency of new IT systems development has been more 
challenging. For instance, the EES project experienced multiple delays and quality challenges, 
which  hindered  timely  delivery  and  early  handover. Although  stakeholder  feedback  is  not 
overtly critical, satisfaction levels of the Agency’s efficiency in terms of system development 
lag behind those for operational management. 

The current eu-LISA Regulation is to a large extent legally coherent both internally and 
externally.  Only  a  limited  number  of  challenges  have  been  identified  in  relation  to  its 
coherence with  other legal  acts, most notably concerning its interaction with  the e-CODEX 
Regulation. The e-CODEX Regulation imposes specific operational constraints. For example, 
it  requires  that  e-CODEX  management  is  exclusively  conducted  in  Tallinn  and  that  all 
resources allocated to the e-CODEX are committed in their entirety to that system, in order to 
provide for the respect of the principle of the independence of the judiciary13. These provisions 
hamper the efficient operational management of the system by eu-LISA, showing areas where 
regulatory adjustments could enhance administrative flexibility and operational synergies. 

The  broader  legal  environment  in  which  eu-LISA  operates  is  inherently  complex,  with  the 
multitude of overlapping legal instruments that the Agency must navigate. These include the 
current  eu-LISA  Regulation  itself,  each  system’s  establishing  Regulations,  as  well  as 
overarching  frameworks  on  data  protection,  financial  management,  human  resources,  and 
Artificial Intelligence. To ensure seamless governance and operational integrity, it is crucial 
that the eu-LISA Regulation is aligned and coherent with the respective legal bases governing 
each system. Internally, the evaluation found no significant challenges regarding coherence.  

Finally,  the  evaluation  concludes  that  the  objectives  of  the  current  eu-LISA  Regulation 
could  have  not  been  achieved  sufficiently  by  Member  States  acting  alone.  The  current 
mandate of eu-LISA plays a pivotal role in advancing the Agency’s core mission: to contribute 
to  a  high  level  of  security  within  the  area  of  freedom,  security,  and  justice,  notably  by 
facilitating  border  management  and  law  enforcement  cooperation.  By  centralising  the 
operational  management  of  multiple  large-scale  IT  systems,  eu-LISA  not  only  supports 
Member  States  in  their  implementation  efforts  but  also  leverages  significant  economies  of 
scale, fostering greater efficiency and consistency across the Union. The evaluation finds that, 
despite opportunities for improvement in the development of new systems, the absence of an 
EU  level  agency  like  eu-LISA  would  lead  to  a  drastically  more  fragmented  IT  landscape, 
compromising  the  security  and  interoperability  essential  to  the  justice  and  home  affairs 
domains. Accordingly, the evaluation confirms the EU added value of the current Regulation. 

The evaluation, however, underlined the need for the Agency to remain flexible and adaptive 
through stronger performance in research monitoring and development that would contribute 
to new IT-based solutions. In this respect, eu-LISA – instead of carrying out only pure research 
activities – should strengthen its capacity to monitor technological and research developments 
as well as to establish a robust technological watch function, which will allow the Agency to 

13 Article 14(2) of Regulation (EU) 2022/850 of the European Parliament and of the Council of 30 May 2022 on 
a computerised system for the cross-border electronic exchange of data in the area of judicial cooperation in civil 
and criminal matters (e-CODEX system) and amending Regulation (EU) 2018/1726 (OJ L 150/1, 01.06.2022). 

5 

 
 
 
identify emerging solution that may be relevant for the systems it manages, such as AI or cloud 
technology. By doing so, eu-LISA would be able to ensure that innovative technologies  are 
identified early, evaluated for their potential, and integrated efficiently into its systems where 
relevant. Additionally, the Agency should enhance its cooperation with third-country actors and 
international organizations, and refine its internal organisation, to maintain its efficiency and 
effectiveness in a rapidly evolving environment. 

3.  Conclusions and recommendations 

The evaluation concluded that the current mandate and objectives of eu-LISA remain largely 
adequate.  While  the  Agency  has  demonstrated  effective  performance  in  fulfilling  several 
aspects  of  its  mandate,  opportunities  for  improvement  remain  in  the  areas  of  effectiveness, 
efficiency, and coherence. 

Challenges  persist  particularly  in  the  development  of  IT  systems.  There  is  also  scope  for 
improvement as regard the alignment of the current eu-LISA Regulation with other relevant 
legal  instruments,  notably  the  e-CODEX  Regulation,  cooperation  with  international 
organisations,  as  well  as  piloting,  testing,  and  ad  hoc  support  to  Member  States.  These 
challenges are linked to a range of internal factors, including strategic planning, budget and 
human resources management, technology infrastructure, contractor oversight, and aspects of 
the Agency’s organisational and governance structure. 

Taking  these  findings  and  the  complex  operating  environment  into  account,  the  evaluation 
confirms that, at this stage, eu-LISA’s mandate remains appropriate. Since the adoption of the 
current eu-LISA Regulation, the Agency has successfully delivered two of the critical systems, 
the  renewed  Schengen  Information  System  and  the  Entry/Exit  System,  as  well  as  the  first 
component of the Interoperability framework (the shared Biometric Matching Service), while 
four  others  (ECRIS-TCN,  Eurodac,  ETIAS  and  the  Common  Identity  Repository)  are 
scheduled  for  operational  launch  in  2026.  Although  modifications  to  eu-LISA's  current 
mandate could be beneficial in some areas, any significant alterations to the mandate at this 
stage could divert the Agency from its core objectives and jeopardise its capacity to deliver the 
planned  priority  IT  systems  on  time,  resulting  in  a  further  delay  in  the  rollout  of  the 
Interoperability Framework.  

In particular, modifying eu-LISA's mandate by amending the current eu-LISA Regulation in 
the near future would pose significant challenges at both strategic and operational levels: 

- 

- 

Increased  risk  exposure:  Modifying  the  mandate,  particularly Article  16(4)  of  the 
current  eu-LISA  Regulation14,  regarding  ad  hoc  support  to  Member  States,  could 
heighten  the Agency's  risk  exposure.  While  greater  flexibility  in  this  area  may  be 
desirable, the evaluation suggests that eu-LISA should prioritise completing its ongoing 
projects before taking on additional tasks. Any new tasks assigned to eu-LISA through 
a modification of Article 16(4) would increase the likelihood of further delays in the 
Interoperability Project. 
Instability  and  delays:  Introducing  a  revised  mandate  at  this  time  could  create 
instability  given  the  Agency’s  commitment  and  task  to  deliver  four  large-scale  IT 

14 Article 16(4) of the current eu-LISA Regulation provides that ‘a group of at least five Member States may 
entrust the Agency with the task of developing, managing or hosting a common IT component to assist them in 
implementing technical aspects of obligations deriving from Union law on decentralised systems in the area of 
freedom,  security  and  justice.  Those  common IT  solutions shall  be  without  prejudice  to the  obligations of  the 
requesting Member States under the applicable Union law, in particular with regard to the architecture of those 
systems’. 

6 

 
 
 
systems and one interoperability component within the next two years. A change in the 
mandate at this moment would likely increase the risks of delays. 

-  Budgetary constraints: An amendment to the mandate does not automatically mean 
additional resources. Therefore, any increase in tasks would necessitate commensurate 
financial support, including a new Legislative and Financial Statement, which would 
also increase financial instability.  

Certain weaknesses identified in the evaluation, such as the cooperation with third-countries or 
the use of innovative technological solutions for the operation and management of the systems, 
including  the  use  of  cloud  technology,  would  require  a  change  of  eu-LISA’s  mandate.  In 
contrast, a large number of other issues identified can be addressed operationally without an 
immediate  mandate  change.  Therefore,  while  the  Agency  would  benefit  from  a  targeted 
revision  of  its  mandate,  most  of  the  immediate  shortcomings  identified  can  be  addressed 
through operational changes, providing the Agency with the necessary stability to deliver on 
the more time pressing projects. 

The evaluation finds that not amending the mandate at this stage could, for now, better 
serve eu-LISA to deliver effectively and efficiently on its ongoing tasks. Therefore, eu-LISA 
should prioritise organisational stability and strategic operational improvement. The challenges 
identified in the evaluation that may require a mandate revision can be addressed once eu-LISA 
has  completed  its  most  pressing  tasks,  such  as  delivering  the  planned  IT  systems  and 
implementing the interoperability architecture. 

Based on this conclusion, the evaluation put forward a list of 54 recommendations (under the 
heading  ‘global  assessment  of  the  areas  of  attention’)15.  The  priority  order  of  the 
recommendations  in  the  list  is  based  on  (1)  their  urgency;  (2)  their  feasibility;  and  (3)  the 
evaluation criteria. Considering the evaluation’s finding that the mandate changes could create 
further  risks  and  impediments  for  eu-LISA  in  the  current  context,  mandate-related 
recommendations have been de-prioritised in the short term.  

On  this  basis,  the  evaluation  has  identified  the  following  11  recommendations,  to  be 
implemented by eu-LISA, as the most important. They can be implemented without changes 
to the current eu-LISA mandate and will contribute directly to organisational stability and the 
timely delivery of the Agency’s tasks. These are: 

-  develop  a  target  operating  model  (TOM)  to  help  eu-LISA  operate  effectively  while 
managing risks, making decisions quickly, and ensuring clarity in responsibilities, in 
particular, in the event of incidents and emergencies. 

-  develop and implement a comprehensive medium-term human resources strategy. 
-  establish and implement a medium to long-term technology strategy. 
- 
- 

implement a multiannual portfolio management approach. 
improve  resource  planning  functionalities,  e.g.  through  establishing  processes  and 
using appropriate tools to address incomplete view of staff allocation and steering. 
-  deploy an integrated tool for the development cycle (such as JiraTM) across eu-LISA 
and  contractors  to  streamline  project  management  and  collaboration,  minimising 
disruptions, optimising workflows, and ensuring relevance. 

-  establish and implement a medium-term sourcing and outsourcing strategy. 
-  Strengthen existing capacities concerning in-house legal services. 

15   Study to support the evaluation of Regulation (EU) 2018/1726 of the European Parliament and of the 
Council of 14 November 2018 on eu-LISA. ISBN: 978-92-68-34401-9 

7 

 
 
 
-  update the service catalogue with full descriptions of services and define clear roles and 

- 

responsibilities for service owners and managers. 
improve  visibility  about  current  resource  allocation,  project  status,  processes, 
bottlenecks, shortages, to enable more informed discussion about the prioritisation of 
projects, also at political level. 

-  decrease dependency from external contractors, while increasing project ownership and 

knowledge retention. 

The Commission invites eu-LISA to develop an action plan to implement all recommendations 
identified.  

8