The EU Council has formally authorised the use of the French cryptographic product 'ZONECENTRAL Q.2023.x' for protecting classified information at the RESTREINT UE/EU RESTRICTED level, according to an information note published on 2 October 2026. The approval, granted by the Council Secretary-General under Article 10(6) of the Council Security Rules (Council Decision 2013/488/EU), is conditional on the integration of the evaluator's recommendations into the Security Operating Procedures. This decision impacts EU institutions and member states handling sensitive but non-critical classified data, as well as the French vendor and other cryptographic product suppliers.
Document Details and Legal Basis The information note, issued by the General Secretariat of the Council, confirms the approval following a security evaluation. The legal basis is Article 10(6) of Council Decision 2013/488/EU, which governs the protection of EU classified information. The decision is a formal administrative act, not a legislative measure, and applies specifically to the RESTREINT UE level—the lowest tier of EU classification, covering information whose unauthorised disclosure could be disadvantageous to EU interests.
Policy Orientations and Trade-offs The approval reflects a balance between security and operational efficiency. By endorsing a national product, the Council leverages existing French expertise, potentially reducing costs and development time compared to an EU-wide solution. However, this may create a dependency on a single member state's technology, raising concerns about interoperability and long-term sovereignty. The conditional nature of the approval—requiring the incorporation of evaluator recommendations—ensures that security standards are met without delaying deployment.
Impact on Stakeholders - EU institutions and member states: Gain access to a vetted cryptographic tool for protecting RESTREINT UE information, enhancing secure communications. However, they must adapt their Security Operating Procedures to include the evaluator's recommendations, which may impose administrative burdens. - French vendor (likely a defence or tech firm): Benefits from official EU endorsement, potentially boosting market credibility and sales. The conditional approval may require additional compliance costs. - Other cryptographic product suppliers: Face increased competition as the French product gains EU-wide acceptance. They may need to seek similar approvals to remain competitive. - EU taxpayers: Indirectly benefit from cost efficiencies if the product reduces the need for bespoke EU solutions. However, if interoperability issues arise, future integration costs could offset savings.
Expected Institutional Follow-up The Council's decision is final for the approval process. Next steps involve the relevant EU bodies and member states updating their Security Operating Procedures to reflect the evaluator's recommendations. The European Commission and the European External Action Service may also consider the product for their own classified communications. No further legislative action is required, but the Council may monitor implementation through its security committee.
← Atlas › News › Defence