On 6 August 2026, the Council's Secretary-General approved the German cryptographic product SINA Workstation S version 3.5.x (all sub-versions from 3.5.7.1) for protecting EU classified information at the RESTREINT UE/EU RESTRICTED level. The approval, communicated in an information note dated 7 August 2026 from the General Secretariat to delegations, allows EU institutions to use this specific product for RESTREINT UE/EU RESTRICTED data, provided that the evaluator's recommendations are incorporated into the corresponding Security Operating Procedures. This decision impacts EU institutions and bodies that handle classified information at this level, as well as the German manufacturer of the product, which gains a formal endorsement for use across the EU's institutional framework.
The approval is based on Article 10(6) of the Council Security Rules, established by Council Decision 2013/488/EU of 23 September 2013, which governs the use of cryptographic products for protecting EU classified information. The decision applies exclusively to the RESTREINT UE/EU RESTRICTED classification level, the lowest tier of EU classified information, and does not extend to higher classification levels such as CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET. The condition attached to the approval—that the evaluator's recommendations be integrated into Security Operating Procedures—ensures that the product is used in accordance with the security requirements identified during evaluation.
This approval is a procedural step within the EU's ongoing efforts to maintain a secure and interoperable framework for handling classified information. It follows the established practice of evaluating and approving cryptographic products from EU member states, allowing national products to be used across EU institutions when they meet the required security standards. The decision is expected to facilitate the secure exchange of RESTREINT UE/EU RESTRICTED information among EU institutions and member state authorities, particularly in operational contexts where such information is routinely shared.
For EU institutions, the approval provides a new, vetted tool for protecting RESTREINT UE/EU RESTRICTED data, potentially reducing reliance on other products and enhancing interoperability with German authorities. For the manufacturer, the approval represents a significant market access opportunity within the EU's institutional framework, potentially boosting the product's adoption across member states. However, the condition requiring the integration of evaluator recommendations into Security Operating Procedures may impose additional administrative and procedural burdens on institutions adopting the product, as they must ensure their security protocols align with the evaluator's guidance. The decision does not affect the classification levels above RESTREINT UE/EU RESTRICTED, where separate approvals would be required.
No further institutional steps are anticipated following this approval, as the decision is final and immediately applicable. The Council's General Secretariat will likely update its internal registers of approved cryptographic products, and EU institutions may begin using the product once their Security Operating Procedures are adjusted accordingly.