The Council has approved the use of the French cryptographic product CRYHOD Q.2023.x for protecting information classified at the RESTREINT UE/EU RESTRICTED level, according to an information note published on 2 October 2026. The decision, taken under Article 10(6) of the Council Security Rules (Council Decision 2013/488/EU), authorises the product for safeguarding EU classified information up to the RESTRICTED level, conditional on integrating the evaluator's recommendations into the relevant Security Operating Procedures. This approval impacts EU institutions and member states handling classified information, as well as the French manufacturer of the cryptographic product.
Document Details and Legal Basis The information note, issued by the Council, specifies that the approval is granted under Article 10(6) of Council Decision 2013/488/EU, which governs the security rules for protecting EU classified information. The document does not specify the Council formation or Presidency that processed the approval, nor does it indicate a meeting date. The decision is a mandatory authorisation for the use of the product within the EU security framework.
Policy Orientations and Trade-offs The approval reflects a balance between security and operational efficiency. By authorising a national cryptographic product, the Council leverages existing national expertise while ensuring compliance with EU security standards. However, this may create a cleavage between standardisation across member states and reliance on a single national supplier. The conditional requirement to incorporate evaluator recommendations into Security Operating Procedures aims to mitigate risks but may impose administrative burdens on user entities.
Impact on Stakeholders - EU institutions and agencies: They gain a new tool for protecting RESTRICTED information, potentially improving operational security. However, they must update their Security Operating Procedures to reflect the evaluator's recommendations, incurring administrative costs. - Member states: Those using the product benefit from a certified solution, but non-French states may face interoperability concerns or prefer alternative national products. - French manufacturer (CRYHOD): The approval opens a market within EU institutions, providing commercial benefits. However, the conditional requirements may necessitate additional documentation or support. - EU taxpayers: Indirectly benefit from enhanced security of classified information, though costs of implementation are borne by user entities.
Expected Institutional Follow-up The Council's decision is final for the approval of this product. User entities must now update their Security Operating Procedures to incorporate the evaluator's recommendations before deploying the product. No further institutional reaction is required, but the European Commission or other bodies may issue guidance on implementation. This approval does not preclude future evaluations of other cryptographic products.
← Atlas › News › Defence