Commission Implementing Regulation (EU) 2026/449 of 27 February 2026 amending Implementing Regulation (EU) 2015/1998 as regards certain detailed measures for the implementation of the common basic standards on aviation security

ANNEX
ANNEX
The Annex to Implementing Regulation (EU) 2015/1998 is amended as follows:
(1)
in point 1.2.2.2, point (b) is replaced by the following:
“(b)
a valid crew identification card of a crew member employed by a Union air carrier or a foreign air carrier within the meaning of Article 3, points 4 and 5, of Regulation (EC) No 300/2008; or”;
(2)
point 1.2.2.3 is replaced by the following:
“1.2.2.3.
Access to security restricted areas may be granted to private pilots, and where applicable accompanying crew, performing non-commercial flights operated with an aircraft that has previously landed at the airport, in order to access it for the purposes of departing, or for the time strictly necessary to undertake operational maintenance of the aircraft. In order to be granted access:
(a)
their pilot licence shall be checked prior to entry;
(b)
their access is limited to the area where their aircraft is parked and the distances between the terminal or access point and the aircraft;
(c)
they shall be escorted when that is locally required for crew and passengers of general aviation operations.
Without prejudice to the obligations in points (b) and (c), a private pilot falling under the operational conditions described in this point may be granted access to security restricted areas where in possession of a valid airport identification card as referred to in point 1.2.2.2 (c) or a valid national identification card issued in accordance with the requirements laid down in points 1.2.3 and 11.2.6.”;
(3)
point 1.2.2.6 is replaced by the following:
“1.2.2.6.
In order to be granted access to security restricted areas a vehicle shall display a valid vehicle pass. The vehicle pass shall be checked before a vehicle is granted access to security restricted areas to ensure that it is valid and corresponds to the vehicle.”;
(4)
in point 1.4.3.2, point (a) is replaced by the following:
“(a)
explosive detection dogs, unless the procedure described in point 1.4.5 of the Annex to Implementing Decision C(2015) 8005 applies; and”;
(5)
the following points are inserted:
“3.0.9.
For the purpose of this Chapter, ‘supplementary station procedures’ means a document established by a foreign air carrier in order to meet the requirements of the national civil aviation security programme of the Member State from or to where it operates commercial flights.
3.0.10.
Without prejudice to Article 13 of Regulation (EC) No 300/2008, the appropriate authority shall ensure that foreign carriers providing service to and from the territory of its Member State establish, implement and maintain written supplementary station procedures that meet the requirements of its national civil aviation security programme, unless these requirements are already addressed in the air carrier security programme.”;
(6)
the following point is inserted:
“6.0.9.
For the purposes of this Annex, ‘hermetically sealed container’ means a container whose design and sealing characteristics prevent the exchange of particles or vapours of its content with the outer environment, even if the container itself is delivered as packed within a container, pallet or cargo or supplies composition which is non-hermetically sealed.”;
(7)
point 6.2.1.3 is replaced by the following:
“6.2.1.3.
Consignments consisting of items as defined in point 6.0.9 whose nature, packaging or container would significantly impair or prevent either the detection of prohibited articles or to analyse the material, substance or items contained therein during the application of Attachments 6-J and 12-H to the Annex to Implementing Decision C(2015) 8005, shall be accepted as air cargo or mail by the receiving regulated agent or air carrier, as applicable, only under one of the following conditions:
(a)
they are originated and delivered by a known consignor in accordance with point 6.4;
(b)
they are processed through an entity acting as retailing shipper of such consignments that has not originated them;
(c)
they are selected by a regulated agent, in accordance with point 6.3.2.3 (b);
(d)
where allowed by the appropriate authority and notified to the Commission, they are subject to a combination of screening and other appropriate security controls, as defined by the appropriate authority.
The shipper referred to in the first paragraph, point (b), shall be approved by the appropriate authority as known consignor exclusively to those specific operations. The approval shall cover the specific operations and confirm the fulfilment of the requirements laid down in point 6.4.2 at both the site of the shipper and of the originating manufacturer of the consignments.
First paragraph, point (d), shall apply until 31 December 2027.”
(8)
the following point is inserted:
“6.2.1.7.
The screening of cargo and mail shall also be subject to the additional provisions laid down in Implementing Decision C(2015) 8005.”;
(9)
points 6.8.1.6 to 6.8.1.9 are deleted;
(10)
points 6.8.4.10, 6.8.4.11 and 6.8.4.12 are deleted;
(11)
point 8.1.2.3 is amended as follows:
(a)
point (c) is replaced by the following:
“(c)
x-ray equipment applied in accordance with Attachment 6-J to the Annex to Implementing Decision C(2015) 8005;”
(b)
point (e) is replaced by the following:
“(e)
ETD equipment applied in accordance with Attachment 6-J to the Annex to Implementing Decision C(2015) 8005, and in combination with point (a) of this point;”
(c)
point (g) is replaced by the following:
“(g)
EVD equipment applied in accordance with Attachment 6-J to the Annex to Implementing Decision C(2015) 8005, and in combination with point (a) of this point.”
(12)
the following point is inserted:
“8.1.2.4.
Supplies consisting of items as defined in point 6.0.9 whose nature, packaging or container would significantly impair or prevent either the detection of prohibited articles or to analyse the material, substance or items contained therein during the application of Attachments 6-J and 12-H to the Annex to Implementing Decision C(2015) 8005, shall be accepted as in-flight supplies by the receiving regulated supplier or air carrier, as applicable, only under one of the following conditions:
(a)
they are originated by a known supplier;
(b)
where allowed by the appropriate authority and notified to the Commission, they are subject to a combination of screening and other appropriate security controls, as defined by the appropriate authority.
First paragraph, point (b), shall apply until 31 December 2027.”
(13)
in point 8.1.4.4, the second paragraph is replaced by the following:
“Validations must be recorded and, where not otherwise stated in this Regulation, must take place before designation and repeated every 3 years thereafter.”;
(14)
in point 8.1.4.5, point (a) is replaced by the following:
“(a)
an on-site visit of the supplier every 3 years; or”;
(15)
the following point is inserted:
“8.1.4.8.
An inspection by the appropriate authority in accordance with its national quality control programme may be considered as on-site visit of the supplier, provided it covers the validation of the implementation of the security programme confirming the absence of deficiencies. Following the inspection, the appropriate authority shall provide the entity with an appropriate evidence of the successful revalidation, which shall be made available to the designating entity.”;
(16)
point 9.0.2 is replaced by the following:
“9.0.2
For the purposes of this Chapter:
(a)
‘airport supplies’ means all items intended to be sold, used or made available for any purpose or activity in the security restricted area of airports, other than ‘items carried by persons other than passengers’;
(b)
‘regulated supplier of airport supplies’ means a supplier whose procedures meet common security rules and standards sufficient to allow delivery of airport supplies to security restricted area as well as to perform screening of airport supplies;
(c)
‘known supplier of airport supplies’ means a supplier whose procedures meet common security rules and standards sufficient to allow delivery of airport supplies to security restricted areas.”;
(17)
point 9.1.2.3 is amended as follows:
(a)
point (c) is replaced by the following:
“(c)
x-ray equipment applied in accordance with Attachment 6-J to the Annex to Implementing Decision C(2015) 8005;”
(b)
point (e) is replaced by the following:
“(e)
ETD equipment applied in accordance with Attachment 6-J to the Annex to Implementing Decision C(2015) 8005, and in combination with point (a) of this point;”
(c)
point (g) is replaced by the following:
“(g)
EVD equipment applied in accordance with Attachment 6-J to the Annex to Implementing Decision C(2015) 8005, and in combination with point (a) of this point.”;
(18)
the following point is inserted:
“9.1.2.4.
Supplies consisting of items as defined in point 6.0.9 whose nature, packaging or container would significantly impair or prevent either the detection of prohibited articles or to analyse the material, substance or items contained therein during the application of Attachments 6-J and 12-H to the Annex to Implementing Decision C(2015) 8005, shall be accepted as airport supplies by the receiving airport operator or by the regulated supplier, as applicable, only under one of the following conditions:
(a)
they are originated by a known supplier;
(b)
where allowed by the appropriate authority and notified to the Commission, they are subject to a combination of screening and other appropriate security controls as defined by the appropriate authority.
First paragraph, point (b), shall apply until 31 December 2027.”;
(19)
points 9.1.3 and 9.1.4 are replaced by the following:
“9.1.3.
Approval of regulated suppliers
9.1.3.1.
Regulated suppliers shall be approved by the appropriate authority.
The approval as a regulated supplier shall be site specific.
Any entity that ensures the security controls as referred to in point 9.1.5 and performs screening of airport supplies shall be approved as a regulated supplier.
9.1.3.2.
The following procedure shall apply for the approval of regulated suppliers:
(a)
the entity shall seek approval from the appropriate authority of the Member State in which its site is located in order to be granted the status of regulated supplier.
The applicant shall submit a security programme to the appropriate authority concerned. The programme shall describe the methods and procedures which are to be followed by the supplier in order to comply with point 9.1.5. The programme shall also describe how compliance with those methods and procedures is to be monitored by the supplier itself.
The applicant shall also submit the ‘Declaration of commitments – regulated supplier of airport supplies’ as contained in Attachment 9-A. That declaration shall be signed by the legal representative or by the person responsible for security.
The signed declaration shall clearly state the location of the site or sites to which it refers and be retained by the appropriate authority concerned;
(b)
the appropriate authority, or an EU aviation security validator acting on its behalf, shall examine the security programme and then make an on-site verification of the sites specified in order to assess whether the applicant complies with point 9.1.5;
(c)
where the appropriate authority is satisfied with the information provided in accordance with points (a) and (b), it shall ensure that the necessary details of the regulated supplier are entered into the Union database on supply chain security not later than the next working day. When making the database entry, the appropriate authority shall give each approved site a unique alphanumeric identifier in the standard format. Where the appropriate authority is not satisfied, the reasons shall promptly be notified to the entity seeking approval as a regulated supplier;
(d)
a regulated supplier shall not be considered as approved until its details are listed in the Union database on supply chain security.
9.1.3.3.
A regulated supplier shall be re-validated at regular intervals not exceeding 5 years. That shall include an on-site verification in order to assess whether the regulated supplier still complies with point 9.1.5.
An inspection at the premises of the regulated supplier by the appropriate authority in accordance with its national quality control programme may be considered as an on-site verification, provided that it covers all the requirements of point 9.1.5.
9.1.3.4.
Where the appropriate authority is no longer satisfied that the regulated supplier complies with point 9.1.5, it shall withdraw the status of regulated supplier for the specified sites.
9.1.3.5.
Without prejudice to the right of each Member State to apply more stringent measures in accordance with Article 6 of Regulation (EC) No 300/2008, a regulated supplier approved in accordance with point 9.1.3 shall be recognised in all Member States.
9.1.4.
Designation of known suppliers
9.1.4.1.
Any entity (‘the supplier’) that ensures the security controls as referred to in point 9.1.5 but does not perform any screening of airport supplies shall be designated as a known supplier by the airport operator.
9.1.4.2.
In order to be designated as a known supplier, the supplier must provide the airport operator with:
(a)
the ‘Declaration of commitments – known supplier of airport supplies’ as contained in Attachment 9-B. This declaration shall clearly state the location of the site or sites to which it refers and be signed by the legal representative;
(b)
the security programme covering the security controls as referred to in point 9.1.5.
9.1.4.3.
All known suppliers must be designated on the basis of validations of:
(a)
the relevance and completeness of the security programme in respect of point 9.1.5;
(b)
the implementation of the security programme without deficiencies.
As a legal proof of the designation, the appropriate authority may require airport operators to enter the necessary details of the known suppliers they designate into the ‘Union database on supply chain security’ not later than the next working day. When making the database entry, the airport operator shall give each designated site a unique alphanumeric identifier in the standard format.
Access into the security restricted areas of airport supplies may only be granted after having established the status of the supplier. That shall be done by verifying in the ‘Union database on supply chain security’, where applicable, or by using an alternative mechanism delivering the same objective.
Where the appropriate authority or the airport operator is no longer satisfied that the known supplier complies with point 9.1.5, the airport operator shall withdraw the status of known supplier without delay.
9.1.4.4.
The appropriate authority shall define in its national civil aviation security programme as referred to in Article 10 of Regulation (EC) No 300/2008 whether the validations of the security programme and its implementation are to be performed by a national auditor, an EU aviation security validator, or a person acting on behalf of the airport operator appointed and trained for that purpose.
Validations must be recorded and, where not otherwise stated in this Regulation, must take place before designation and repeated every 3 years thereafter.
If the validation is not done on behalf of the airport operator any record thereof must be made available to it.
9.1.4.5.
The validation of the implementation of the security programme confirming the absence of deficiencies shall consist of either:
(a)
an on-site visit of the supplier every 3 years; or
(b)
regular checks upon access to the security restricted area of supplies delivered by that known supplier, starting after the designation, including:
—
a verification that the person delivering supplies on behalf of the known supplier was properly trained;
—
a verification that the supplies are properly secured;
—
screening of the supplies in the same way as supplies coming from an unknown supplier.
Those checks must be carried out in an unpredictable manner and take place at least either once every three months or on 20 % of the known supplier’s deliveries to the airport operator.
Option (b) may only be used where the appropriate authority defined in its national civil aviation security programme that the validation is to be performed by a person acting on behalf of the airport operator.
9.1.4.6.
The methods applied and procedures to be followed during and after designation shall be laid down in the security programme of the airport operator.
9.1.4.7.
The airport operator shall keep:
(a)
a list of all known suppliers it has designated indicating the expiry date of their designation;
(b)
the signed declaration, a copy of the security programme, and any reports recording its implementation for each known supplier, at least until 6 months after the expiry of its designation.
Upon request, those documents shall be made available to the appropriate authority for compliance monitoring purposes.
9.1.4.8.
An inspection by the appropriate authority in accordance with its national quality control programme may be considered as on-site visit of the supplier, provided it covers the validation of the implementation of the security programme confirming the absence of deficiencies. Following the inspection, the appropriate authority shall provide the entity with an appropriate evidence of the successful revalidation, which shall be made available to the designating entity.”;
(20)
the following point is inserted:
“9.1.5.
Security controls to be applied by a regulated supplier, a known supplier or an airport operator
9.1.5.1.
A regulated supplier or known supplier of airport supplies or an airport operator delivering airport supplies to the security restricted area shall:
(a)
appoint a person responsible for security in the company;
(b)
ensure that persons with access to airport supplies receive general security awareness training in accordance with point 11.2.7 before being given access to those supplies;
(c)
ensure that persons implementing screening of airport supplies receive training in accordance with point 11.2.3.3 and persons implementing other security controls in respect of airport supplies receive training in accordance with point 11.2.3.10;
(d)
prevent unauthorised access to its premises and airport supplies;
(e)
reasonably ensure that no prohibited articles are concealed in airport supplies;
(f)
apply tamper-evident seals to, or physically protect, all vehicles or containers that transport airport supplies.
The first paragraph, point (f), shall not apply during airside transportation.
9.1.5.2.
Where a regulated supplier or known supplier uses another company that is not a known supplier to the airport operator for transporting supplies to the airport, the regulated supplier or known supplier shall ensure that all security controls listed in this point are adhered to.”;
(21)
Attachment 9-A is replaced by the following:
“
ATTACHMENT 9-A
DECLARATION OF COMMITMENTS
REGULATED SUPPLIER OF AIRPORT SUPPLIES
In accordance with Regulation (EC) No 300/2008 of the European Parliament and of the Council  ( *1 ) and its implementing acts,
I declare that:
—
to the best of my knowledge, the information contained in the company’s security programme is true and accurate;
—
the practices and procedures set out in this security programme will be implemented and maintained at all sites covered by the programme;
—
this security programme will be adjusted and adapted to comply with all future relevant changes to Union legislation, unless [name of company] informs [name of appropriate authority] that it no longer wishes to screen and deliver airport supplies (and thus no longer wishes to trade as a regulated supplier);
—
[name of company] will inform [name of appropriate authority] in writing of:
(a)
minor changes to its security programme, such as company name, person responsible for security or contact details, promptly but at least within 10 working days;
(b)
major planned changes, such as new screening procedures, major building works which might affect its compliance with relevant Union legislation or change of site/address, at least 15 working days prior to their commencement/the planned change;
—
in order to ensure compliance with relevant Union legislation, [name of company] will cooperate fully with all inspections, as required, and provide access to all documents, as requested by inspectors;
—
[name of company] will inform [name of appropriate authority] of any serious security breaches and of any suspicious circumstances which may be relevant to airport supplies, in particular any attempt to conceal prohibited articles in supplies;
—
[name of company] will ensure that all relevant staff receive training in accordance with Chapter 11 of the Annex to Implementing Regulation (EU) 2015/1998 and are aware of their security responsibilities under the company’s security programme;
—
[name of company] will inform [name of appropriate authority] if:
(a)
it ceases trading;
(b)
it no longer screens airport supplies;
(c)
it can no longer meet the requirements of the relevant Union legislation.
I shall accept full responsibility for this declaration.
Name:
Position in company:
Date:
Signature:
( *1 )   Regulation (EC) No 300/2008 of the European Parliament and of the Council of 11 March 2008 on common rules in the field of civil aviation security and repealing Regulation (EC) No 2320/2002 ( OJ L 97, 9.4.2008, p. 72 , ELI http://data.europa.eu/eli/reg/2008/300/oj ).”;"
(22)
the following Attachment is added:
“
ATTACHMENT 9-B
DECLARATION OF COMMITMENTS
KNOWN SUPPLIER OF AIRPORT SUPPLIES
In accordance with Regulation (EC) No 300/2008 of the European Parliament and of the Council  ( *2 ) and its implementing acts,
I declare that
—
[name of company] will:
(a)
appoint a person responsible for security in the company;
(b)
ensure that persons with access to airport supplies receive general security awareness training in accordance with point 11.2.7 before being given access to those supplies;
(c)
ensure that persons implementing security controls other than screening in respect of airport supplies receive training in accordance with point 11.2.3.10;
(d)
prevent unauthorised access to its premises and airport supplies;
(e)
reasonably ensure that no prohibited articles are concealed in airport supplies;
(f)
apply tamper-evident seals to, or physically protect, all vehicles or containers that transport airport supplies (this point will not apply during airside transportation).
When using another company that is not a known supplier to the airport operator for transporting supplies, [name of company] will ensure that all security controls listed above are adhered to,
—
in order to ensure compliance, [name of company] will cooperate fully with all inspections, as required, and provide access to all documents, as requested by inspectors;
—
[name of company] will inform [the airport operator] of any serious security breaches and of any suspicious circumstances which may be relevant to airport supplies, in particular any attempt to conceal prohibited articles in supplies;
—
[name of company] will ensure that all relevant staff receive training in accordance with Chapter 11 of the Annex to Implementing Regulation (EU) 2015/1998 and are aware of their security responsibilities;
—
[name of company] will inform [the airport operator] if:
(a)
it ceases trading;
(b)
it can no longer meet the requirements of the relevant Union legislation.
I shall accept full responsibility for this declaration.
Legal representative
Name:
Date:
Signature:
( *2 )   Regulation (EC) No 300/2008 of the European Parliament and of the Council of 11 March 2008 on common rules in the field of civil aviation security and repealing Regulation (EC) No 2320/2002 ( OJ L 97, 9.4.2008, p. 72 , ELI http://data.europa.eu/eli/reg/2008/300/oj ).”;"
(23)
in point 11.1.1, the second paragraph is deleted;
(24)
point 12.0.5.4 is replaced by the following:
“12.0.5.4.
The Commission may grant the ‘EU Stamp’ marking status to security equipment referred to in point 12.0.5.3, under the condition that it has received and validated the evidence submitted by the Member State that such security equipment meets the standards set out in this Chapter.”;
(25)
point 12.4.2.1 is replaced by the following:
“12.4.2.1.
All EDS equipment shall fulfil the following requirements:
(a)
equipment installed before 1 September 2022 must at least meet standard 3;
(b)
equipment installed from 1 September 2022 to 31 August 2027 must at least meet standard 3.1;
(c)
equipment installed from 1 September 2027 must at least meet standard 3.2.”;
(26)
point 12.4.2.2 is deleted;
(27)
in point 12.6.2, second paragraph, the words ‘1 October 2025’ are replaced by the words ‘31 December 2026’;
(28)
point 12.9.1.1 is replaced by the following:
“12.9.1.1.
An explosive detection dog (EDD) shall be able to detect and indicate specified materials set in Attachment 12-D to the Annex to Implementing Decision C(2015) 8005.”;
(29)
point 12.9.1.4 is replaced by the following:
“12.9.1.4.
An EDD and its handler may be used for screening if the handler has successfully completed the theoretical exam, if the EDD has successfully completed the odour recognition test and if they have been approved in combination as a team.”;
(30)
point 12.9.1.8 is replaced by the following:
“12.9.1.8.
After approval by the appropriate authority, an EDD team may be used for security screening only for the methodology and the area(s) for which it has been approved.”;
(31)
point 12.9.2.5 is replaced by the following:
“12.9.2.5.
An EDD used for the detection of explosive materials shall be marked by the implantation of a transponder  ( *3 ) allowing the unique identification of the EDD.
( *3 )   Regulation (EU) No 576/2013 of the European Parliament and of the Council of 12 June 2013 on the non-commercial movement of pet animals and repealing Regulation (EC) No 998/2003 ( OJ L 178, 28.6.2013, p. 1 , ELI: http://data.europa.eu/eli/reg/2013/576/oj ).”;"
(32)
points 12.9.3.3 to 12.9.3.6 are replaced by the following:
“12.9.3.3.
The training shall be conducted by instructors qualified in accordance with point 11.5.
12.9.3.4.
Dogs to be trained for explosive detection shall only be used for that purpose.
12.9.3.5.
During training, real explosive or training aids representing explosive materials shall be used.
12.9.3.6.
Persons handling real explosive or training aids shall receive proper training so as to prevent contamination.”;
(33)
points 12.9.3.11 and 12.9.3.12 are replaced by the following:
“12.9.3.11.
Recurrent training for an EDD team shall be performed at intervals of at least every 6 weeks. The minimum duration of the recurrent training shall be no less than 4 hours in any 6 weeks period. That requirement does not apply in the case where an EDD is subject to recognition training of all materials listed in Attachment 12-D to the Annex to Implementing Decision C(2015) 8005 on at least a weekly basis.
12.9.3.12.
During recurrent training, real explosive or training aids representing explosive materials shall be used.”;
(34)
points 12.9.3.14 and 12.9.3.15 are replaced by the following:
“
Operational Training for EDD Teams
12.9.3.14.
When EDD is deployed in the screening duties, the EDD shall be subject to training in each operational area, as referred to in Attachment 12-F to the Annex to Implementing Decision C(2015) 8005, where the team is deployed to ensure that it meets the performance set in Attachment 12-D to the Annex to Implementing Decision C(2015) 8005.
12.9.3.15.
Training in the operational area as listed in Attachment 12-F to the Annex to Implementing Decision C(2015) 8005 shall be done on a continuous random basis during the deployment period and shall measure EDD’s detection performance by means of approved training aids in each area where the EDD is deployed.”;
(35)
the following point is inserted:
“12.9.3.16.
Training shall be performed on already screened and secured items.”;
( *1 )   Regulation (EC) No 300/2008 of the European Parliament and of the Council of 11 March 2008 on common rules in the field of civil aviation security and repealing Regulation (EC) No 2320/2002 ( OJ L 97, 9.4.2008, p. 72 , ELI http://data.europa.eu/eli/reg/2008/300/oj ).”;
( *2 )   Regulation (EC) No 300/2008 of the European Parliament and of the Council of 11 March 2008 on common rules in the field of civil aviation security and repealing Regulation (EC) No 2320/2002 ( OJ L 97, 9.4.2008, p. 72 , ELI http://data.europa.eu/eli/reg/2008/300/oj ).”;
( *3 )   Regulation (EU) No 576/2013 of the European Parliament and of the Council of 12 June 2013 on the non-commercial movement of pet animals and repealing Regulation (EC) No 998/2003 ( OJ L 178, 28.6.2013, p. 1 , ELI: http://data.europa.eu/eli/reg/2013/576/oj ).”;”
Commission Implementing Regulation (EU) 2026/449 of 27 February 2026 amending Implementing Regulation (EU) 2015/1998 as regards certain detailed measures for the implementation of the common basic standards on aviation security

Schedules & Appendices

Cite this act
