On 6 August 2026, the Secretary-General of the Council approved the French cryptographic product IPSEC GATEWAY MISTRAL, version 9.2, for protecting EU classified information at the level RESTREINT UE/EU RESTRICTED. The approval, issued as an information note to EU delegations, allows EU institutions and member states to use the gateway for restricted-level data, provided that the evaluator's recommendations are incorporated into the relevant Security Operating Procedures. The decision is based on Article 10(6) of the Council Security Rules (Council Decision 2013/488/EU of 23 September 2013) and applies exclusively to RESTREINT UE/EU RESTRICTED information, not to higher classification levels.
The approval follows the standard procedure for accrediting cryptographic products under the Council's security framework. The Council Security Rules, adopted in 2013, establish the legal basis for protecting EU classified information and delegate authority to the Secretary-General to approve specific products. This is the first such approval recorded in recent months, and it reflects the ongoing need to update and certify secure communication tools used by EU institutions and member states.
The product, developed in France, will now be available for use across EU bodies and national administrations handling RESTREINT-level information. The condition attached to the approval—that evaluator recommendations be integrated into Security Operating Procedures—ensures that the product is deployed in a manner consistent with the security assessment. This requirement is standard practice and aims to mitigate any residual risks identified during evaluation.
For stakeholders, the approval has direct implications. EU institutions and member state authorities gain a new, certified tool for secure communications at the restricted level, potentially improving interoperability and reducing reliance on older or less flexible systems. However, the condition imposes an administrative burden: each user entity must update its Security Operating Procedures to reflect the evaluator's guidance, which may require additional time and resources. For the French manufacturer, the approval opens the EU market for this product, though it remains limited to the RESTREINT level, which may constrain its commercial appeal compared to products certified for higher classification levels.
The approval is a procedural step within the Council's security framework, and no further institutional follow-up is required. The General Secretariat of the Council will maintain the list of approved products, and future updates or renewals will be communicated through similar information notes. The decision does not affect other classification levels, and any extension would require a separate approval process.