On 6 August 2026, the Secretary-General of the Council approved the German cryptographic product atmedia Link Encryptor, version 3.4, for protecting EU classified information at the level RESTREINT UE/EU RESTRICTED. The approval, issued as an information note to delegations, allows EU institutions to use the product for data classified up to and including RESTREINT UE/EU RESTRICTED, provided that users follow the evaluator’s recommendations in the corresponding Security Operating Procedures. The decision is based on Article 10(6) of the Council Security Rules (Council Decision 2013/488/EU of 23 September 2013). The approval covers only this classification level; no other levels are included.
The approval follows the standard procedure for accrediting cryptographic products for EU classified information, as established by the Council Security Rules. The product, developed by the German company atmedia, has undergone evaluation to ensure it meets the security requirements for RESTREINT UE/EU RESTRICTED data. The condition that users must adhere to the evaluator’s recommendations ensures that the product is used in a manner that maintains the security of the information. This approval is part of the ongoing effort to provide EU institutions with a range of approved cryptographic solutions for protecting sensitive information.
The decision impacts several stakeholders. EU institutions and bodies, including the Council, Commission, and agencies, can now deploy atmedia Link Encryptor v3.4 for RESTREINT UE/EU RESTRICTED communications, offering an additional secure option. National authorities of EU member states, which handle EU classified information, may also benefit from the approval, though they are not directly bound by it. The German manufacturer, atmedia, gains a formal endorsement that could enhance its market position within the EU. Finally, EU taxpayers indirectly fund the security infrastructure that relies on such approved products, ensuring that public funds are spent on vetted solutions.
The approval is a formal administrative act, not a legislative measure, and does not introduce new policy orientations. It is a routine but necessary step to maintain the security of EU classified information. No further institutional follow-up is required; the product is now available for use by EU institutions, subject to the stated conditions.