The European Commission has published its 2025 annual report on the implementation of Regulation (EC) No 300/2008 on common rules in the field of civil aviation security, detailing progress in innovation, technology, and security baseline updates. The report, released on 13 July 2026, covers activities in 2025 and highlights legislative amendments, cyber incident responses, and compliance monitoring affecting Member States, airports, air carriers, and other entities.
The Commission prepared a legislative amendment in 2025 to establish a more efficient mechanism for sharing information on aviation security occurrences. Approximately 9,200 cyber incidents were reported globally affecting aviation stakeholders, including an attack on Collins Aerospace's MUSE system that impacted multiple major European airports. In response, the Commission conducted a risk assessment on detection equipment under Article 22 of the NIS2 Directive, identifying 13 risk scenarios such as vendor lock-in and vulnerabilities from remote maintenance. An Action Plan on Drone and Counter Drone Security was also developed in 2025.
The EU Conflict Zone Alerting System held four quarterly meetings and five ad hoc urgent meetings in 2025, issuing two new EASA Conflict Zone Information Bulletins and withdrawing four. Implementing Regulation (EU) 2025/920, adopted in May 2025, amended Implementing Regulation (EU) 2015/1998 to strengthen air cargo and mail security measures. Several airports were removed from lists of third countries recognised as applying equivalent security standards: Kangerlussuaq airport in Greenland, Guernsey, Isle of Man and Jersey airports, and Ben Gurion airport in Israel.
The Union database on supply chain security contained nearly 40,000 records at the end of 2025, with 99.95% availability. Around 146 million PLACI filings were recorded, leading to about 990 requests for screening but no requests for not loading goods. The Commission inspected seven Member States' appropriate authorities and carried out 12 initial airport inspections in 2025; no follow-up inspections were conducted. Three assessments of third country airports were performed in the United States and the Faroe Islands.
The report notes that while implementation continued steadily, areas such as access control and screening still require improvement. The Commission's findings will inform future legislative and operational measures to enhance aviation security across the EU.