The Council of the European Union has formally approved the French cryptographic product "CRYHOD Q.2021.x" for protecting classified information at the RESTREINT UE/EU RESTRICTED level, according to an information note published on 2 October 2026. The decision, taken by the Secretary-General, authorises the use of this product for securing EU classified information, subject to the integration of evaluator recommendations into Security Operating Procedures. This approval impacts EU institutions and member states handling restricted information, as well as the French manufacturer of the cryptographic product.
Document Details The information note, issued under the authority of the Secretary-General of the Council, cites Article 10(6) of the Council Security Rules established by Council Decision 2013/488/EU. The document is a formal administrative decision, not a legislative act, and it imposes a mandatory requirement: the product may only be used if the Security Operating Procedures incorporate the recommendations made by the evaluator. No numerical targets or deadlines are specified.
Policy Orientations and Trade-offs The approval balances security needs with operational efficiency. By endorsing a national product, the Council leverages existing French expertise and infrastructure, potentially reducing costs and time compared to developing an EU-wide solution. However, this creates a dependency on a single member state's technology, which may raise concerns about sovereignty and interoperability for other member states. The condition to embed evaluator recommendations ensures a baseline security standard, but the lack of a common EU certification framework could lead to fragmentation in cryptographic approvals across the Union.
Impact on Stakeholders - EU institutions and agencies: They gain access to an approved cryptographic tool for handling restricted information, enhancing their ability to secure communications. However, they must adapt their Security Operating Procedures to incorporate the evaluator's recommendations, which may require administrative adjustments. - French manufacturer (likely a defence/tech firm): The approval opens a market within EU institutions, providing a competitive advantage and potential revenue. Yet, the product's use is limited to the RESTREINT UE level, restricting its commercial scope. - Other EU member states: They may face pressure to accept a non-domestic product for their own restricted information handling, potentially raising interoperability issues. Conversely, they benefit from a vetted solution without bearing development costs. - EU taxpayers: The decision avoids the expense of developing a new EU-wide cryptographic system, but long-term costs may arise if future interoperability or security updates require additional investments.
Expected Institutional Follow-up The Council's decision is final and does not require further legislative steps. However, the European Commission and the European External Action Service may issue guidelines on integrating the product into their respective security frameworks. The Council's Security Committee will monitor compliance with the evaluator's recommendations. No further action by the European Parliament or other institutions is anticipated, as this falls under the Council's executive authority.
← Atlas › News › Defence