26.9.2022

Official Journal of the European Union

L 248/3

COMMISSION DELEGATED REGULATION (EU) 2022/1644

of 7 July 2022

supplementing Regulation (EU) 2017/625 of the European Parliament and of the Council with specific requirements for the performance of official controls on the use of pharmacologically active substances authorised as veterinary medicinal products or as feed additives and of prohibited or unauthorised pharmacologically active substances and residues thereof

(Text with EEA relevance)

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2017/625 of the European Parliament and the Council of 15 March 2017 on official controls and other official activities performed to ensure the application of food and feed law, rules on animal health and welfare, plant health and plant protection products, amending Regulations (EC) No 999/2001, (EC) No 396/2005, (EC) No 1069/2009, (EC) No 1107/2009, (EU) No 1151/2012, (EU) No 652/2014, (EU) 2016/429 and (EU) 2016/2031 of the European Parliament and of the Council, Council Regulations (EC) No 1/2005 and (EC) No 1099/2009 and Council Directives 98/58/EC, 1999/74/EC, 2007/43/EC, 2008/119/EC and 2008/120/EC, and repealing Regulations (EC) No 854/2004 and (EC) No 882/2004 of the European Parliament and of the Council, Council Directives 89/608/EEC, 89/662/EEC, 90/425/EEC, 91/496/EEC, 96/23/EC, 96/93/EC and 97/78/EC and Council Decision 92/438/EEC (Official Controls Regulation) (1), and in particular Article 19(2), point (a), thereof,

Whereas:

(1)

Regulation (EU) 2017/625 lays down rules for the performance of official controls and other official activities by the competent authorities of the Member States to verify compliance with Union legislation in the area of food and feed safety. In particular, Article 9 of that Regulation requires competent authorities to perform official controls on all operators regularly, on a risk basis and with an appropriate frequency. Article 109 of that Regulation obliges Member States to ensure that official controls are performed by the competent authorities on the basis of a multi-annual national control plan (‘MANCP’). Regulation (EU) 2017/625 furthermore specifies the general content of the MANCP, including the requirement for Member States to provide in their MANCP official controls on the use of pharmacologically active substances authorised as veterinary medicinal products or as feed additives and of prohibited or unauthorised pharmacologically active substances and residues thereof. Regulation (EU) 2017/625 empowers the Commission to lay down specific requirements for the performance of those official controls, including, where appropriate, the range of samples and the stage of production, processing and distribution where the samples have to be taken, having regard to the hazards and risks related to the substances referred to in Article 19(1) of that Regulation.

(2)

Regulation (EU) 2017/625 repealed Council Directive 96/23/EC (2) with effect from 14 December 2019 and lays down the relevant transitional measures. Those transitional measures provide that, until 14 December 2022, competent authorities are to continue to perform the official controls necessary in accordance with Directive 96/23/EC to detect the presence of certain substances and groups of residues. Specifically, the transitory measures set requirements for Member States’ monitoring plans for the detection of residues or substances within its scope.

(3)	This Regulation ensures the continuity of the rules laid down in Directive 96/23/EC concerning official controls of residues of substances having a pharmacological action, of their metabolites and of other substances transmissible to animal products that are likely to be harmful to human health.

(4)

This Regulation sets rules for the range of samples and the stage of production, processing and distribution at which the samples are to be taken as regards the use of pharmacologically active substances authorised as veterinary medicinal products or as feed additives and of prohibited or unauthorised pharmacologically active substances and residues thereof.

(5)

In order to ensure that controls are effectively targeted in all Member States, it is appropriate to set out rules on the combinations of substance groups and commodity groups to be sampled by Member States and the sampling strategy, including criteria to define the content of national risk-based plans and randomised surveillance plans and the performance of the related official controls.

(6)

Commission Implementing Regulation (EU) 2022/1646 (3) lays down the uniform practical arrangements for the performance of official controls as regards the use of pharmacologically active substances authorised as veterinary medicinal products or as feed additives and of prohibited or unauthorised pharmacologically active substances and residues thereof and also specifies the content and arrangements of the MANCP as regards these substances and residues

(7)

Articles 4, 5 and 6 of Implementing Regulation (EU) 2022/1646 specify the content of national risk-based plans and randomised surveillance plan focused on official controls on the use of pharmacologically active substances authorised as veterinary medicinal products or as feed additives and of prohibited or unauthorised pharmacologically active substances and residues thereof. These plans should contain, inter alia, the list of combinations of substances and species, products and matrices which are included in the control plans for which the rules for that selection are defined in this Delegated Regulation. Member States should include in their national plans also sampling strategy for which criteria mentioned in this Delegated Regulation should be taken into account.

(8)	As the rules laid down in the Annexes to Directive 96/23/EC on measures to monitor certain substances and residues thereof in live animals and products of animal origin are to be applied until 14 December 2022, this Regulation should apply from 15 December 2022,

HAS ADOPTED THIS REGULATION:

Article 1

For the purposes of this Regulation, the definitions laid down in Regulation (EC) No 178/2002 of the European Parliament and of the Council (4), Commission Delegated Regulation (EU) 2019/2090 (5) and Commission Implementing Regulation (EU) 2021/808 (6) apply.

In addition, the following definitions apply:

(1)

‘official sample’ means a sample taken by the competent authority, which bears, for the purposes of examination of the residues or substances listed in Annex I, a reference to the species, the type, the quantity concerned, the method of collection and particulars identifying the sex of the animal and the origin of the animal or of the product of animal origin, as applicable.

(2)	‘targeted sampling’ means taking official sample or samples with the aim of maximising the possibility of detecting non-compliance with maximum residue limits or maximum levels, established under Union legislation for pharmacologically active substances.

(3)	‘random sampling’ means the taking of an official sample or samples under statistical consideration to provide representative data

(4)	‘suspect sampling’ means taking official samples as a follow-up to non-compliant control results or as the follow-up to any suspected or established non-compliance with Union rules on pharmacologically active substances, as laid down in Regulation (EU) 2019/2090.

(5)	‘matrix’ means the material from which a sample is taken, including animal body parts, fluids, excrements, tissues, products of animal origin, animal by-products, animal feed and water.

(6)	‘food-producing animals’ means animals bred, raised, kept, slaughtered or harvested for the purposes of producing food.

(7)	‘residue’ means a residue of substances having a pharmacological action, of metabolites of such substances, degradation products of such substances and of other related substances present in animals or products of animal origin.

Article 2

1. Member States shall control the use of pharmacologically active substances authorised as veterinary medicinal products or as feed additives and the presence of prohibited or unauthorised pharmacologically active substances and residues thereof listed in Annex I.

2. For national risk-based control plans for production in the Member States, as specified in Article 4 of Implementing Regulation (EU) 2022/1646, Member States shall control combinations of substance groups and commodity groups in accordance with Annex II to this Regulation and they shall adopt a sampling strategy in accordance with the criteria set out in Annex III to this Regulation.

3. For national randomised surveillance plans for production in the Member States, as specified in Article 5 of Implementing Regulation (EU) 2022/1646, Member States shall control combinations of substance groups and commodity groups in accordance with Annex IV to this Regulation and they shall adopt a sampling strategy in accordance with the criteria set out in Annex V to this Regulation.

4. For national risk-based control plans for third country imports, as specified in Article 6 of Implementing Regulation (EU) 2022/1646, Member States shall control combinations of substance groups and commodity groups in accordance with Annex VI to this Regulation and they shall adopt a sampling strategy in accordance with the criteria set out in Annex VII to this Regulation.

Article 3

References to Annexes II and III to Directive 96/23/EC shall be construed as references to this Regulation.

Article 4

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

It shall apply from 15 December 2022.

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at Brussels, 7 July 2022.

For the Commission

The President

Ursula VON DER LEYEN

(1) OJ L 95, 7.4.2017, p. 1.

(2) Council Directive 96/23/EC of 29 April 1996 on measures to monitor certain substances and residues thereof in live animals and animal products and repealing Directives 85/358/EEC and 86/469/EEC and Decisions 89/187/EEC and 91/664/EEC (OJ L 125, 23.5.1996, p. 10).

(3) Commission Implementing Regulation (EU) 2022/1646 of 7 July 2022 on uniform practical arrangements for the performance of official controls as regards the use of pharmacologically active substances authorised as veterinary medicinal products or as feed additives and of prohibited or unauthorised pharmacologically active substances and residues thereof, on specific content of multi-annual national control plans and specific arrangements for their preparation (See page 32 of this Official Journal).

(4) Regulation (EC) No 178/2002 of the European Parliament and of the Council of 28 January 2002 laying down the general principles and requirements of food law, establishing the European Food Safety Authority and laying down procedures in matters of food safety (OJ L 31, 1.2.2002, p. 1).

(5) Commission Delegated Regulation (EU) 2019/2090 of 19 June 2019 supplementing Regulation (EU) 2017/625 of the European Parliament and Council regarding cases of suspected or established non-compliance with Union rules applicable to the use or residues of pharmacologically active substances authorised in veterinary medicinal products or as feed additives or with Union rules applicable to the use or residues of prohibited or unauthorised pharmacologically active substances (OJ L 317, 9.12.2019, p. 28).

(6) Commission Implementing Regulation (EU) 2021/808 of 22 March 2021 on the performance of analytical methods for residues of pharmacologically active substances used in food-producing animals and on the interpretation of results as well as on the methods to be used for sampling and repealing Decisions 2002/657/EC and 98/179/EC (OJ L 180, 21.5.2021, p. 84).

ANNEX I

Group A – Prohibited or unauthorised pharmacologically active substances in food-producing animals

Substances with hormonal and thyrostatic action and beta agonists the use of which is prohibited under Council Directive 96/22/EC (1):

(a)	Stilbenes;

(b)	Antithyroid agents;

(c)

Steroids;

(d)	Resorcylic acid lactones, including zeranol;

(e)	Beta-agonists.

Prohibited substances listed in Table 2 of the Annex to Regulation (EU) No 37/2010:

(a)	Chloramphenicol;

(b)	Nitrofurans;

(c)	Dimetridazole, metronidazole, ronidazole and other nitro-imidazoles;

(d)	Other substances.

Pharmacologically active substances, not listed in Table 1 of the Annex to Regulation (EU) No 37/2010 (2) or substances not authorised for use in feed for food-producing animals in the Union according to Regulation (EU) No 1831/2003 of the European Parliament and of the Council (3):

(a)

Dyes;

(b)	Plant protection products as defined in Regulation (EU) No 1107/2009 of the European Parliament and of the Council (4) and biocides as defined in Regulation (EU) No 528/2012 of the European Parliament and of the Council (5) which may be used in animal husbandry of food-producing animals;

(c)	Antimicrobial substances;

(d)	Coccidiostats, histomonostats and other antiparasitic agents;

(e)	Protein and peptide hormones;

(f)	Anti-inflammatory substances, sedatives and any other pharmacologically active substances;

(g)	Antiviral substances.

Group B – Pharmacologically active substances authorised for use in food-producing animals

Pharmacologically active substances listed in Table 1 of the Annex to Regulation (EU) No 37/2010:

(a)	Antimicrobial substances;

(b)	Insecticides, fungicides, anthelmintics and other antiparasitic agents;

(c)	Sedatives;

(d)	Non-steroidal anti-inflammatory drugs (NSAIDs), corticosteroids and glucocorticoids;

(e)	Other pharmacologically active substances.

Coccidiostats and histomonostats authorised according to Union legislation, for which maximum levels and maximum residue limits are set under Union legislation

(1) Council Directive 96/22/EC of 29 April 1996 concerning the prohibition on the use in stockfarming of certain substances having a hormonal or thyrostatic action and of ß-agonists, and repealing Directives 81/602/EEC, 88/146/EEC and 88/299/EEC (OJ L 125, 23.5.1996, p. 3).

(2) Commission Regulation (EU) No 37/2010 of 22 December 2009 on pharmacologically active substances and their classification regarding maximum residue limits in foodstuffs of animal origin (OJ L 15, 20.1.2010, p. 1).

(3) Regulation (EC) No 1831/2003 of the European Parliament and of the Council of 22 September 2003 on additives for use in animal nutrition (OJ L 268, 18.10.2003, p. 29).

(4) Regulation (EC) No 1107/2009 of the European Parliament and of the Council of 21 October 2009 concerning the placing of plant protection products on the market and repealing Council Directives 79/117/EEC and 91/414/EEC (OJ L 309, 24.11.2009, p. 1).

(5) Regulation (EU) No 528/2012 of the European Parliament and of the Council of 22 May 2012 concerning the making available on the market and use of biocidal products (OJ L 167, 27.6.2012, p. 1).

ANNEX II

Criteria for the selection of specific combination of substance groups and commodity groups for national risk-based control plan for production in the Member States (as referred to in Article 2(2))

A. Group A substances

Combinations of substance groups and commodity groups:

	Commodity group
Substance group by reference to Annex I	Bovine, ovine and caprine	Porcine	Equine	Poultry	Aquaculture (finfish, crustaceans and other aquaculture products)	Raw bovine, ovine and caprine milk	Hen eggs and other eggs	Rabbits, farmed game and, reptiles and insects	Honey	Casings (*1)
A(1), point (a)	X	X						X (*2)
A(1), point (b)	X	X	X					X (*3)
A(1), point (c)	X	X	X		X (*4)			X (*3)
A(1), point (d)	X	X						X (*3)
A(1), point (e)	X	X	X	X				X (*3)
A(2)	X	X	X	X	X	X	X	X	X	X
A(3), point (a)					X
A(3), point (b)	X	X	X	X	X	X	X	X	X
A(3), point (c)	X	X	X	X	X	X	X	X (*2)	X
A(3), point (d)	X	X		X			X	X (*2)
A(3), point (e)
A(3), point (f)	X	X	X	X	X	X	X	X	X
A(3), point (g)

—	The residue or substance groups shall be analysed in samples drawn from food-producing animals including, where appropriate, their excrements, body fluids and unprocessed animal products, feed, water and animal by-products.

—	When there are indications or suspicions that illegal treatments may take place for residue or substance groups in species or products not covered by the table of this Annex, these controls shall be also included in the risk-based control plan for production in the Member States.

Criteria for selecting specific substances for testing within each substance group:

—

frequency of the detection of non-compliance in the Member State or reported in the results from other Member States, or in third countries’ samples, especially when reported under the Rapid Alert System for Food and Feed (‘RASFF’) or the Administrative Assistance and Cooperation System (‘AAC’) or where there is evidence that substances not authorised for use in food-producing animals in the Union are used in third countries;

—	availability of suitable laboratory methods and analytical standards;

—	pharmacologically active substances likely to be misused in order to increase production or increase feed conversion efficiency;

—	prohibited or unauthorised substances for which there are indications of misuse;

—

possible risk for consumers or certain population groups arising from consumption of residues present in food, taking into account the relevant information available from, inter alia, the European Medicines Agency, European Food Safety Authority and the Codex Alimentarius Joint Expert Committee on Food Additives or in absence of such information, other sources of information such as scientific publications or national risk assessment.

Criteria for the selection of animals and products of animal origin:

—	indication of the use of specific pharmacologically active substances, including mutilations at the ears or the tail or the presence of injection sites;

—	secondary sexual characteristics, behavioural changes, signs of disease or chronic disorders, different health status of specific animals within a group;

—	sex, age and pregnancy status of the animals;

—	veterinary history of the animal and health certificate;

—	animals showing a good physical conformation and well-developed muscles with little fat.

B. Group B substances

Criteria for selecting specific substances for testing within each substance group:

—	frequency of the detection of non-compliance in the Member State’s samples, in other Member States’ samples or in third countries’ samples, especially when reported under the RASFF or AAC;

—	availability of suitable laboratory methods and analytical standard;

—	information on the quantities of veterinary medicinal products produced, imported, exported, marketed and sold for a specific food-producing animal species;

—	information on the veterinary medicinal product distribution chain, the national register of pharmacologically active substances authorised as veterinary medicinal products or feed additives, information on the most popular prescribing patterns;

—	the likelihood of misuse of the pharmacologically active substances;

—	maximum residue limits and maximum levels for pharmacologically active substances and feed additives including restrictions (e.g. not for use in lactating animals);

—	formulations of veterinary medicinal products for which long withdrawal periods, post-animal treatment, have been established to ensure that edible unprocessed animal products comply with EU MRLs;

—	possible treatment of food-producing animals under Articles 113 and 114 of Regulation (EU) 2019/6 of the European Parliament and of the Council (1).

Criteria for the selection of substance groups and animals and products of animal origin:

—	information on the marketing authorisations for veterinary medicinal products containing pharmacologically active substances for specific animal species and production classes;

—	information on the marketing authorisations for feed additives for specific animal species and production classes;

—	information on the frequency of the use of substances from specific substance categories in specific animal species;

—	frequency of the detection of non-compliance for residues of pharmacologically active substances and feed additives per production category;

—	information on the rates of antimicrobial resistance in certain animal production sectors.

(*1) As defined in Commission Delegated Regulation (EU) 2020/692 of 30 January 2020 supplementing Regulation (EU) 2016/429 of the European Parliament and of the Council as regards rules for entry into the Union, and the movement and handling after entry of consignments of certain animals, germinal products and products of animal origin (OJ L 174, 3.6.2020, p. 379).

(*2) Not relevant for insects

(*3) Relevant only for reptiles

(*4) Relevant only for finfish

(1) Regulation (EU) 2019/6 of the European Parliament and of the Council of 11 December 2018 on veterinary medicinal products and repealing Directive 2001/82/EC (OJ L 4, 7.1.2019, p. 43).

ANNEX III

Criteria for sampling strategy for national risk-based control plan for production in the Member States (as referred to in Article 2(2))

Sampling shall be carried out in variable intervals spread evenly over all months of the year or relevant production period. In this context, it shall be considered that a number of pharmacologically active substances are administered only in particular seasons.

Sampling shall be performed at or close to slaughter, collection or harvest. However, for Group A substances sampling should also be performed at any relevant stage in the life cycle of the animals.

All samples shall be targeted according to the criteria laid down in the national control plan. For Group A substances, sampling shall be targeted at detection of illegal treatment with prohibited or unauthorised substances – thus animals which are most likely to have been treated are preferentially selected over those animals which are not, and, as much of this sampling is carried out on farm, samples of drinking water and feed may be appropriate in addition to inedible materials such as blood, urine, faeces, hair etc.

For Group B substances, samples shall comprise only edible tissues/products (the objective is to verify compliance with maximum residue limits and maximum levels). Sampling shall be targeted on products from those animals, which are most likely to have been treated with a specific pharmacologically active substance or substance within therapeutic class of veterinary medicinal products.

Samples from injection sites can be appropriate to control the illegal use of substances. In case samples are taken from injection sites, this shall be clearly mentioned when reporting analytical results from these samples.

Criteria for the selection of the animals or products to be controlled for each food business operator to be controlled:

—	history of non-compliance of the farm or producer;

—	shortcomings in the application of veterinary medicinal products, deficiencies identified in previous controls, reported increase of losses of animals on the farm, animal health status of the farm, epidemiological status of the region;

—	information on the farming system, fattening system, breed and sex of the animals;

—	common practices with regard to the administration of particular pharmacologically active substances in the respective farm or production system;

—	indications of the use of pharmacologically active substances;

—	the absence or the unreliability of own-checks, the membership of quality assurance schemes (when available) and results of testing under such schemes;

—	evidence of insufficient supervision of the farm by veterinarians;

—	representative sampling regardless the size of the food business operator.

Criteria for the selection of slaughterhouses, cutting plants, establishments for the milk production, establishments for the production and placing on the market of aquaculture products, establishments for honey and egg and egg packing centres from which samples should be taken:

—	the criteria listed under points A.2 and B.1 of Annex II and point 6 of this Annex;

—	the respective establishments’ share of the country’s total production volume;

—	non-compliance identified in earlier controls on the use of pharmacologically active substances and residues thereof in animals and animal products;

—	origins and transport routes of the slaughtered animals, milk, eggs or honey;

—	absence of participation in quality assurance programmes (when available);

—	the scope and results of own-checks for residues.

When taking the samples, efforts shall be made to avoid multiple sampling (i.e. the taking of several different samples from a single animal/product (unless the different samples are analysed for a different group of substances), or sampling several animals/products from a single producer on a given day when samples could be drawn from animals/products from several producers which would satisfy the targeting criteria) unless the operator has been identified on the basis of the criteria included in point 6 or an appropriate justification has been provided in the control plan. The compliance with the planned frequency of checks shall be ensured.

ANNEX IV

Criteria for the selection of specific combination of substance groups and commodity groups for national randomised surveillance plan for production in the Member States (as referred to in Article 2(3))

Group A substances

Samples taken are of combination of substance groups and commodity groups in addition to what is not provided for in the Member States’ risk-based national plan for production in the Member States.

Group B substances

Combinations of substance groups and commodity groups:

Substance group	Bovine, ovine and caprine	Porcine	Equine	Poultry	Aquaculture (finfish, crustaceans and other aquaculture products)	Raw bovine, ovine and caprine milk	Hen eggs and other eggs	Rabbits, farmed game, reptiles and insects	Honey
B1a	X	X	X	X	X	X	X	X	X
B1b	X	X	X	X	X	X	X	X	X
B1c	X	X	X					X
B1d	X	X	X	X		X		X
B1e	X	X	X	X	X	X	X	X	X
B2	X	X	X	X		X	X	X

Each sample for a specific type of animal or product shall be analysed for as wide range of the substance groups listed in the table included in this Annex as practically feasible.

It shall be ensured that for a specific type of animal or product all substance groups listed in the table are covered by the surveillance plan. The controls shall be performed for as many pharmacologically active substances as possible, for which maximum residue limits have been set in Table 1 of the Annex to Regulation (EU) No 37/2010 or for feed additives, for which maximum residue limits and maximum levels have been set pursuant to Regulation (EC) No 1831/2003.

ANNEX V

Criteria for sampling strategy for national randomised surveillance plan for production in the Member States (as referred to in Article 2(3)

Sampling shall be random and shall be performed at or close to slaughter, collection or harvest and representative of the Member States’ production/consumption pattern:

—

for Group A substances, sampling shall be performed throughout the production process of food-producing animals and unprocessed products of animal origin on live food-producing animals, their body parts, excrements and body fluids and in tissue, products of animal origin, animal by-products, animal feed and water, whichever matrix is the most relevant,

—	for Group B substances, only fresh or frozen meat, edible offal, eggs, milk or honey (as close as possible to the production date), which have not undergone further processing or mixing, shall be sampled.

In case several substance categories are to be analysed in one sample, the sample size shall be adjusted accordingly.

ANNEX VI

Criteria for the selection of specific combination of substance groups and commodity groups for national risk-based control plan for third country imports (as referred to in Article 2(4))

The relevant criteria listed in Annex II

Information where available and relevant, on:

—	the RASFF notifications and AAC system for residues in imported food;

—	the outcome of Commission controls in third countries;

—	level of guarantees provided by the importer on the compliance of imported food of animal origin with Union legislation on pharmacologically active substances including compliance with Union maximum residue limits and maximum levels or attestations on non-use of certain substances;

—	records of non-compliances for individual food business operators or importers identified in earlier Member State import controls.

Relevant information provided by the Commission services, where available, on:

—

the use in the third country of pharmacologically active substances that are prohibited or not authorised in the Union, existence of information on the restrictions on such use, administration practices for veterinary medicinal products (e.g. with or without the involvement of authorised animal health professionals);

—	the distribution of veterinary medicinal products and whether they are available over the counter or are subject to a veterinary prescription;

—	whether there is an obligation to keep veterinary medicinal product treatment records on farms in the third country;

—	whether and how animals are identified (and can thus be linked to treatments).

ANNEX VII

Criteria for sampling strategy for national risk-based control plan for third country imports (as referred to in Article 2(4))

Sampling shall be targeted according to rules set out in Annex VI, supplemented by the relevant rules laid down in Annex III.

—	For Group A substances, sampling shall be targeted at detecting the illegal treatment with prohibited or unauthorised substances.

—	For Group B substances, sampling shall be targeted at controlling the compliance with maximum residue limits or maximum levels for residues of pharmacologically active substances established under Union legislation.

Samples shall be taken at the point of entry into the Union.

26.9.2022

Official Journal of the European Union

L 248/18

COMMISSION DELEGATED REGULATION (EU) 2022/1645

of 14 July 2022

laying down rules for the application of Regulation (EU) 2018/1139 of the European Parliament and of the Council, as regards requirements for the management of information security risks with a potential impact on aviation safety for organisations covered by Commission Regulations (EU) No 748/2012 and (EU) No 139/2014 and amending Commission Regulations (EU) No 748/2012 and (EU) No 139/2014

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1139 of the European Parliament and of the Council of 4 July 2018 on common rules in the field of civil aviation and establishing a European Union Aviation Safety Agency, and amending Regulations (EC) No 2111/2005, (EC) No 1008/2008, (EU) No 996/2010, (EU) No 376/2014 and Directives 2014/30/EU and 2014/53/EU of the European Parliament and of the Council, and repealing Regulations (EC) No 552/2004 and (EC) No 216/2008 of the European Parliament and of the Council and Council Regulation (EEC) No 3922/91 (1), and in particular Articles 19(1) point (g) and 39(1) point (b) thereof.

Whereas:

(1)	In accordance with the essential requirements set out in Annex II, point 3.1(b), to Regulation (EU) 2018/1139, design and production organisations are to implement and maintain a management system to manage safety risks.

(2)

In addition, in accordance with the essential requirements set out in Annex VII, points 2.2.1 and 5.2, to Regulation (EU) 2018/1139, aerodrome operators and organisations responsible for the provision of apron management services are to implement and maintain a management system to manage safety risks.

(3)

The safety risks referred to in recitals (1) and (2) may derive from different sources, including design and maintenance flaws, human performance aspects, environmental threats and information security threats. Therefore, the management systems implemented by the organisations as referred to in recitals (1) and (2), should take into account not only safety risks stemming from random events, but also safety risks deriving from information security threats where existing flaws may be exploited by individuals with a malicious intent. Those information security risks are constantly increasing in the civil aviation environment as the current information systems are becoming more and more interconnected, and increasingly becoming the target of malicious actors.

(4)	The risks associated with those information systems are not limited to possible attacks to the cyberspace, but encompass also threats which may affect processes and procedures as well as the performance of human beings.

(5)	A significant number of organisations already use international standards, such as ISO 27001, in order to address the security of digital information and data. These standards may not fully address all the specificities of civil aviation.

(6)	Therefore, it is appropriate to set out requirements for the management of information security risks with a potential impact on aviation safety.

(7)

It is essential that those requirements cover the different aviation domains and their interfaces since aviation is a highly interconnected system of systems. Therefore, they should apply to all the organisations that are already required to have a management system in accordance with the existing Union aviation safety legislation.

(8)	The requirements laid down in this Regulation should be consistently applied across all aviation domains, while creating a minimal impact on the Union aviation safety legislation already applicable to those domains.

(9)

The requirements laid down in this Regulation should be without prejudice to information security and cybersecurity requirements laid down in point 1.7 of the Annex to Commission Implementing Regulation (EU) 2015/1998 (2) and in Article 14 of Directive (EU) 2016/1148 of the European Parliament and of the Council (3).

(10)	The definition on information security used for the purposes of this legal act should not be interpreted as divergent from the definition of security of network and information systems laid down in Directive (EU) 2016/1148.

(11)

In order to avoid duplication of legal requirements, where organisations covered by this Regulation are already subject to security requirements arising from other Union acts referred to in recital (9), which are, in their effect equivalent to the provisions laid down in this Regulation, compliance with those security requirements should be considered to constitute compliance with the requirements laid down in this Regulation.

(12)

Organisations covered by this Regulation that are already subject to security requirements arising from Implementing Regulation (EU) 2015/1998 should also comply with the requirements of Annex I (Part IS.D.OR.230 ‘Information security external reporting scheme’) to this Regulation as Implementing Regulation (EU) 2015/1998 does not contain any provisions related to external reporting of information security incidents.

(13)	Commission Regulations (EU) No 748/2012 (4) and (EU) No 139/2014 (5) should be amended in order to establish the link between the management systems prescribed in the regulations listed above and the information security management requirements prescribed by this Regulation.

(14)	In order to provide organisations with sufficient time to ensure compliance with the new rules and procedures introduced by this Regulation, this Regulation should apply from 3 years after the date of entry into force.

(15)	The requirements laid down by this Regulation are based on Opinion No 03/2021 (6), issued by the Agency in accordance with Article 75(2) points (b) and (c) and Article 76(1) of Regulation (EU) 2018/1139.

(16)	In accordance with Article 128(4) of Regulation (EU) 2018/1139, the Commission consulted experts designated by each Member State in accordance with the principles laid down in the Inter-institutional Agreement of 13 April 2016 on Better Law-Making (7),

HAS ADOPTED THIS REGULATION:

Article 1

Subject matter

This Regulation sets out the requirements to be met by the organisations referred to in Article 2 in order to identify and manage information security risks with potential impact on aviation safety which could affect information and communication technology systems and data used for civil aviation purposes and to detect information security events and identify those which are considered information security incidents with potential impact on aviation safety and respond to, and recover from, those information security incidents.

Article 2

Scope

1. This Regulation applies to the following organisations:

(a)

production organisations and design organisations subject to Subparts G and J of Section A of Annex I (Part 21) to Regulation (EU) No 748/2012, except design and production organisations that are solely involved in the design and/or production of ELA2 aircraft as defined in Article 1(2), point (j) of Regulation (EU) No 748/2012;

(b)	aerodrome operators and apron management service providers subject to Annex III ‘Part Organisation Requirements (Part-ADR.OR)’ to Regulation (EU) No 139/2014.

2. This Regulation is without prejudice to information security and cybersecurity requirements laid down in point 1.7 of the Annex to Implementing Regulation (EU) 2015/1998 and in Article 14 of Directive (EU) 2016/1148.

Article 3

Definitions

For the purpose of this Regulation, the following definitions shall apply:

(1)	‘information security’ means the preservation of confidentiality, integrity, authenticity and availability of network and information systems;

(2)	‘information security event’ means an identified occurrence of a system, service or network state indicating a possible breach of the information security policy or failure of information security controls, or a previously unknown situation that can be relevant for information security;

(3)	‘incident’ means any event having an adverse effect on the security of network and information systems as defined in Article 4(7) of Directive (EU) 2016/1148;

(4)

‘information security risk’ means the risk to organisational civil aviation operations, assets, individuals, and other organisations due to the potential of an information security event. Information security risks are associated with the potential that threats will exploit vulnerabilities of an information asset or group of information assets;

(5)	‘threat’ means a potential violation of information security which exists when there is an entity, circumstance, action or event that could cause harm;

(6)	‘vulnerability’ means a flaw or weakness in an asset or a system, procedures, design, implementation, or information security measures that could be exploited and results in a breach or violation of the information security policy.

Article 4

Requirements arising from other Union legislation

1. Where an organisation referred to in Article 2 complies with security requirements laid down in Article 14 of Directive (EU) 2016/1148 that are equivalent to the requirements laid down in this Regulation, compliance with those security requirements shall be considered to constitute compliance with the requirements laid down in this Regulation.

2. Where an organisation referred to in Article 2 is an operator or an entity referred to in the national civil aviation security programmes of Member States laid down in accordance with Article 10 of Regulation (EC) No 300/2008 of the European Parliament and of the Council (8), the cybersecurity requirements contained in point 1.7 of the Annex to Implementing Regulation (EU) 2015/1998 are considered to be equivalent to the requirements laid down in this Regulation, except as regards point IS.D.OR.230 of the Annex to this Regulation that shall be complied with.

3. The Commission, after consulting EASA and the Cooperation Group referred to in Article 11 of Directive (EU) 2016/1148, may issue guidelines for the assessment of the equivalence of requirements laid down in this Regulation and Directive (EU) 2016/1148.

Article 5

Competent authority

1. The authority responsible for certifying and overseeing compliance with this Regulation shall be:

(a)	with regard to organisations referred to in Article 2, point (a), the competent authority designated in accordance with Annex I (Part 21) to Regulation (EU) No 748/2012;

(b)	with regard to organisations referred to in Article 2, point (b), the competent authority designated in accordance with Annex III (Part-ADR.OR) to Regulation (EU) No 139/2014.

2. Member States, may for the purposes of this Regulation, designate an independent and autonomous entity to fulfil the assigned role and responsibilities of the competent authorities referred to in paragraph 1. In that case, coordination measures shall be established between that entity and the competent authorities, as referred to in paragraph 1, to ensure effective oversight of all the requirements to be met by the organisation.

Article 6

Amendment to Regulation (EU) No 748/2012

Annex I (Part 21) to Regulation (EU) No 748/2012 is amended as follows:

(1)

the Table of Contents is amended as follows:

(a)

the following heading is inserted after heading 21.A.139:

‘21.A.139A

Information security management system’;

(b)

the following heading is inserted after heading 21.A.239:

‘21.A.239A

Information security management system’;

(2)

the following point 21.A.139A is inserted after point 21.A.139:

‘21.A.139A

Information security management system

In addition to the production management system required by point 21.A.139, the production organisation shall establish, implement and maintain an information security management system in accordance with Commission Delegated Regulation (EU) 2022/1645 (*1) in order to ensure the proper management of information security risks which may have an impact on aviation safety.

(*1) Commission Delegated Regulation (EU) 2022/1645 of 14 July 2022 laying down rules for the application of Regulation (EU) 2018/1139 of the European Parliament and of the Council, as regards requirements for the management of information security risks with a potential impact on aviation safety for organisations covered by Commission Regulations (EU) No 748/2012 and (EU) No 139/2014 and amending Commission Regulations (EU) No 748/2012 and (EU) No 139/2014 (OJ L 248, 26.9.2022, p. 18).’;"

(3)

the following point 21.A.239A is inserted after point 21.A.239:

‘21.A.239A

Information security management system

In addition to the design management system required by point 21.A.239, the design organisation shall establish, implement and maintain an information security management system in accordance with Commission Delegated Regulation (EU) 2022/1645 in order to ensure the proper management of information security risks which may have an impact on aviation safety.’.

Article 7

Amendment to Regulation (EU) No 139/2014

Annex III (Part-ADR.OR) to Regulation (EU) No 139/2014 is amended as follows:

(1)

the following point ADR.OR.D.005A is inserted after point ADR.OR.D.005:

‘ADR.OR.D.005A

Information security management system

The aerodrome operator shall establish, implement and maintain an information security management system in accordance with Delegated Regulation (EU) 2022/1645 (*2) in order to ensure the proper management of information security risks which may have an impact on aviation safety.

(*2) Commission Delegated Regulation (EU) 2022/1645 of 14 July 2022 laying down rules for the application of Regulation (EU) 2018/1139 of the European Parliament and of the Council, as regards requirements for the management of information security risks with a potential impact on aviation safety for organisations covered by Commission Regulations (EU) No 748/2012 and (EU) No 139/2014 and amending Commission Regulations (EU) No 748/2012 and (EU) No 139/2014 (OJ L 248, 26.9.2022, p. 18).’;"

(2)

point ADR.OR.D.007 is replaced by the following:

‘ADR.OR.D.007

Management of aeronautical data and aeronautical information

(a)

As part of its management system, the aerodrome operator shall implement and maintain a quality management system covering the following activities:

(1)	its aeronautical data activities;

(2)	its aeronautical information provision activities.

(b)	As part of its management system, the aerodrome operator shall establish a security management system to ensure the security of operational data it receives, or produces, or otherwise employs, so that access to that operational data is restricted only to those authorised.

(c)

The security management system shall define the following elements:

(1)	the procedures relating to data security risk assessment and mitigation, security monitoring and improvement, security reviews and lesson dissemination;

(2)	the means designed to detect security breaches and to alert personnel with appropriate security warnings;

(3)	the means of controlling the effects of security breaches and of identifying recovery action and mitigation procedures to prevent reoccurrence.

(d)	The aerodrome operator shall ensure the security clearance of its personnel with respect to aeronautical data security.

(e)	The aspects related to information security shall be managed in accordance with point ADR.OR.D.005A.’;

(3)

the following point ADR.OR.F.045A is inserted after point ADR.OR.F.045:

‘ADR.OR.F.045A

Information security management system

The organisation responsible for the provision of AMS shall establish, implement and maintain an information security management system in accordance with Delegated Regulation (EU) 2022/1645 in order to ensure the proper management of information security risks which may have an impact on aviation safety.’.

Article 8

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

It shall apply from 16 October 2025.

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at Brussels, 14 July 2022.

For the Commission

The President

Ursula VON DER LEYEN

(1) OJ L 212, 22.8.2018, p. 1.

(2) Commission Implementing Regulation (EU) 2015/1998 of 5 November 2015 laying down detailed measures for the implementation of the common basic standards on aviation security (OJ L 299, 14.11.2015, p. 1).

(3) Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union (OJ L 194, 19.7.2016, p. 1).

(4) Commission Regulation (EU) No 748/2012 of 3 August 2012 laying down implementing rules for the airworthiness and environmental certification of aircraft and related products, parts and appliances, as well as for the certification of design and production organisations (OJ L 224, 21.8.2012, p. 1).

(5) Commission Regulation (EU) No 139/2014 of 12 February 2014 laying down requirements and administrative procedures related to aerodromes pursuant to Regulation (EC) No 216/2008 of the European Parliament and of the Council (OJ L 44, 14.2.2014, p. 1).

(6) https://www.easa.europa.eu/document-library/opinions

(7) OJ L 123, 12.5.2016, p. 1.

(8) Regulation (EC) No 300/2008 of the European Parliament and of the Council of 11 March 2008 on common rules in the field of civil aviation security and repealing Regulation (EC) No 2320/2002 (OJ L 97, 9.4.2008, p. 72).

ANNEX

INFORMATION SECURITY – ORGANISATION REQUIREMENTS

[PART-IS.D.OR]

IS.D.OR.100

Scope

IS.D.OR.200

Information security management system

IS.D.OR.205

Information security risk assessment

IS.D.OR.210

Information security risk treatment

IS.D.OR.215

Information security internal reporting scheme

IS.D.OR.220

Information security incidents – detection, response, and recovery

IS.D.OR.225

Response to findings notified by the competent authority

IS.D.OR.230

Information security external reporting scheme

IS.D.OR.235

Contracting of information security management activities

IS.D.OR.240

Personnel requirements

IS.D.OR.245

Record-keeping

IS.D.OR.250

Information security management manual (ISMM)

IS.D.OR.255

Changes to the information security management system

IS.D.OR.260

Continuous improvement

IS.D.OR.100 Scope

This Part establishes the requirements to be met by the organisations referred to in Article 2 of this Regulation.

IS.D.OR.200 Information security management system (ISMS)

(a)

In order to achieve the objectives set out in Article 1, the organisation shall set up, implement and maintain an information security management system (ISMS) which ensures that the organisation:

(1)	establishes a policy on information security setting out the overall principles of the organisation with regard to the potential impact of information security risks on aviation safety;

(2)	identifies and reviews information security risks in accordance with point IS.D.OR.205;

(3)	defines and implements information security risk treatment measures in accordance with point IS.D.OR.210;

(4)	implements an information security internal reporting scheme in accordance with point IS.D.OR.215;

(5)

defines and implements, in accordance with point IS.D.OR.220, the measures required to detect information security events, identifies those events which are considered incidents with a potential impact on aviation safety except as permitted by point IS.D.OR.205(e), and responds to, and recovers from, those information security incidents;

(6)	implements the measures that have been notified by the competent authority as an immediate reaction to an information security incident or vulnerability with an impact on aviation safety;

(7)	takes appropriate action, in accordance with point IS.D.OR.225, to address findings notified by the competent authority;

(8)	implements an external reporting scheme in accordance with point IS.D.OR.230 in order to enable the competent authority to take appropriate actions;

(9)	complies with the requirements contained in point IS.D.OR.235 when contracting any part of the activities referred to in point IS.D.OR.200 to other organisations;

(10)	complies with the personnel requirements laid down in point IS.D.OR.240;

(11)	complies with the record-keeping requirements laid down in point IS.D.OR.245;

(12)	monitors compliance of the organisation with the requirements of this Regulation and provides feedback on findings to the accountable manager or, in the case of design organisations, to the head of the design organisation, in order to ensure effective implementation of corrective actions;

(13)	protects, without prejudice to applicable incident reporting requirements, the confidentiality of any information that the organisation may have received from other organisations, according to its level of sensitivity.

(b)	In order to continuously meet the requirements referred to in Article 1, the organisation shall implement a continuous improvement process in accordance with point IS.D.OR.260.

(c)

The organisation shall document, in accordance with point IS.D.OR.250, all key processes, procedures, roles and responsibilities required to comply with point IS.D.OR.200(a) and establish a process for amending that documentation. Changes to those processes, procedures, roles and responsibilities shall be managed in accordance with point IS.D.OR.255.

(d)

The processes, procedures, roles and responsibilities established by the organisation in order to comply with point IS.D.OR.200(a) shall correspond to the nature and complexity of its activities, based on an assessment of the information security risks inherent to those activities, and may be integrated within other existing management systems already implemented by the organisation.

(e)

Without prejudice to the obligation to comply with the reporting requirements contained in Regulation (EU) No 376/2014 of the European Parliament and of the Council (1) and the requirements of point IS.D.OR.200 (a) (13), the organisation may be granted approval by the competent authority not to implement the requirements referred to in points (a) to (d)) and the related requirements contained in points IS.D.OR.205 through IS.D.OR.260, if it demonstrates to the satisfaction of that authority that its activities, facilities and resources, as well as the services it operates, provides, receives and maintains, do not pose any information security risks with a potential impact on aviation safety neither to itself nor to other organisations. The approval shall be based on a documented information security risk assessment carried out by the organisation or a third party in accordance with point IS.D.OR.205 and reviewed and approved by its competent authority.

The continued validity of that approval will be reviewed by the competent authority following the applicable oversight audit cycle and whenever changes are implemented in the scope of work of the organisation.

IS.D.OR.205 Information security risk assessment

(a)

The organisation shall identify all of its elements, which could be exposed to information security risks. That shall include:

(1)	the organisation’s activities, facilities and resources, as well as the services the organisation operates, provides, receives or maintains;

(2)	the equipment, systems, data and information that contribute to the functioning of the elements listed in point (1).

(b)	The organisation shall identify the interfaces that it has with other organisations, and which could result in the mutual exposure to information security risks.

(c)

With regard to the elements and interfaces referred to in points (a) and (b), the organisation shall identify the information security risks which may have a potential impact on aviation safety. For each identified risk, the organisation shall:

(1)	assign a risk level according to a predefined classification established by the organisation;

(2)	associate each risk and its level with the corresponding element or interface identified in accordance with points (a) and (b).

The predefined classification referred to in point (1) shall take into account the potential of occurrence of the threat scenario and the severity of its safety consequences. Based on that classification, and taking into account whether the organisation has a structured and repeatable risk management process for operations, the organisation shall be able to establish whether the risk is acceptable or needs to be treated in accordance with point IS.D.OR.210.

In order to facilitate the mutual comparability of risks assessments, the assignment of the risk level pursuant to point (1) shall take into account relevant information acquired in coordination with the organisations referred to in point (b).

(d)

The organisation shall review and update the risk assessment carried out in accordance with points (a), (b) and (c) in any of the following situations:

(1)	there is a change in the elements subject to information security risks;

(2)	there is a change in the interfaces between the organisation and other organisations, or in the risks communicated by the other organisations;

(3)	there is a change in the information or knowledge used for the identification, analysis and classification of risks;

(4)	there are lessons learnt from the analysis of information security incidents.

IS.D.OR.210 Information security risk treatment

(a)

The organisation shall develop measures to address unacceptable risks identified in accordance with point IS.D.OR.205, implement them in a timely manner and check their continued effectiveness. Those measures shall enable the organisation to:

(1)	control the circumstances that contribute to the effective occurrence of the threat scenario;

(2)	reduce the consequences on aviation safety associated with the materialisation of the threat scenario;

(3)	avoid the risks.

Those measures shall not introduce any new potential unacceptable risks to aviation safety.

(b)

The person referred to in point IS.D.OR.240 (a) and (b) and other affected personnel of the organisation shall be informed of the outcome of the risk assessment carried out in accordance with point IS.D.OR.205, the corresponding threat scenarios and the measures to be implemented.

The organisation shall also inform organisations with which it has an interface in accordance with point IS.D.OR.205(b) of any risk shared between both organisations.

IS.D.OR.215 Information security internal reporting scheme

(a)	The organisation shall establish an internal reporting scheme to enable the collection and evaluation of information security events, including those to be reported pursuant to point IS.D.OR.230.

(b)

That scheme and the process referred to in point IS.D.OR.220 shall enable the organisation to:

(1)	identify which of the events reported pursuant to point (a) are considered information security incidents or vulnerabilities with a potential impact on aviation safety;

(2)	identify the causes of, and contributing factors to, the information security incidents and vulnerabilities identified in accordance with point (1), and address them as part of the information security risk management process in accordance with points IS.D.OR.205 and IS.D.OR.220;

(3)	ensure an evaluation of all known, relevant information relating to the information security incidents and vulnerabilities identified in accordance with point (1);

(4)	ensure the implementation of a method to distribute internally the information as necessary.

(c)

Any contracted organisation which may expose the organisation to information security risks with a potential impact on aviation safety shall be required to report information security events to the organisation. Those reports shall be submitted using the procedures established in the specific contractual arrangements and shall be evaluated in accordance with point (b).

(d)	The organisation shall cooperate on investigations with any other organisation that has a significant contribution to the information security of its own activities.

(e)	The organisation may integrate that reporting scheme with other reporting schemes it has already implemented.

IS.D.OR.220 Information security incidents – detection, response and recovery

(a)

Based on the outcome of the risk assessment carried out in accordance with point IS.D.OR.205 and the outcome of the risk treatment performed in accordance with point IS.D.OR.210, the organisation shall implement measures to detect incidents and vulnerabilities that indicate the potential materialisation of unacceptable risks and which may have a potential impact on aviation safety. Those detection measures shall enable the organisation to:

(1)	identify deviations from predetermined functional performance baselines;

(2)	trigger warnings to activate proper response measures, in case of any deviation.

(b)

The organisation shall implement measures to respond to any event conditions identified in accordance with point (a) that may develop or have developed into an information security incident. Those response measures shall enable the organisation to:

(1)	initiate the reaction to the warnings referred to in point (a)(2) by activating predefined resources and course of actions;

(2)	contain the spread of an attack and avoid the full materialisation of a threat scenario;

(3)	control the failure mode of the affected elements defined in point IS.D.OR.205(a).

(c)

The organisation shall implement measures aimed at recovering from information security incidents, including emergency measures, if needed. Those recovery measures shall enable the organisation to:

(1)	remove the condition that caused the incident, or constrain it to a tolerable level;

(2)	reach a safe state of the affected elements defined in point IS.D.OR.205(a) within a recovery time previously defined by the organisation.

IS.D.OR.225 Response to findings notified by the competent authority

(a)

After receipt of the notification of findings submitted by the competent authority, the organisation shall:

(1)	identify the root cause or causes of, and contributing factors to, the non-compliance;

(2)	define a corrective action plan;

(3)	demonstrate the correction of the non-compliance to the satisfaction of the competent authority.

(b)	The actions referred to in point (a) shall be carried out within the period agreed with the competent authority.

IS.D.OR.230 Information security external reporting scheme

(a)	The organisation shall implement an information security reporting system that complies with the requirements laid down in Regulation (EU) No 376/2014 and its delegated and implementing acts if that Regulation is applicable to the organisation.

(b)

Without prejudice to the obligations of Regulation (EU) No 376/2014, the organisation shall ensure that any information security incident or vulnerability, which may represent a significant risk to aviation safety, is reported to their competent authority. Furthermore:

(1)	where such an incident or vulnerability affects an aircraft or associated system or component, the organisation shall also report it to the design approval holder;

(2)	where such an incident or vulnerability affects a system or constituent used by the organisation, the organisation shall report it to the organisation responsible for the design of the system or constituent.

(c)

The organisation shall report the conditions referred to in point (b) as follows:

(1)	a notification shall be submitted to the competent authority and, if applicable, to the design approval holder or to the organisation responsible for the design of the system or constituent, as soon as the condition has been known to the organisation;

(2)

a report shall be submitted to the competent authority and, if applicable, to the design approval holder or to the organisation responsible for the design of the system or constituent, as soon as possible, but not exceeding 72 hours from the time the condition has been known to the organisation, unless exceptional circumstances prevent this.

The report shall be made in the form defined by the competent authority and shall contain all relevant information about the condition known to the organisation;

(3)

a follow-up report shall be submitted to the competent authority and, if applicable, to the design approval holder or to the organisation responsible for the design of the system or constituent, providing details of the actions the organisation has taken or intends to take to recover from the incident and the actions it intends to take to prevent similar information security incidents in the future.

The follow-up report shall be submitted as soon as those actions have been identified, and shall be produced in the form defined by the competent authority.

IS.D.OR.235 Contracting of information security management activities

(a)

The organisation shall ensure that when contracting any part of the activities referred to in point IS.D.OR.200 to other organisations, the contracted activities comply with the requirements of this Regulation and the contracted organisation works under its oversight. The organisation shall ensure that the risks associated with the contracted activities are appropriately managed.

(b)	The organisation shall ensure that the competent authority can have access upon request to the contracted organisation to determine continued compliance with the applicable requirements laid down in this Regulation.

IS.D.OR.240 Personnel requirements

(a)

The accountable manager of the organisation or, in the case of design organisations, the head of the design organisation, designated in accordance with Regulation (EU) No 748/2012 and Regulation (EU) No 139/2014 as referred to in points 1(a) and (b) of Article 2 of this Regulation, shall have corporate authority to ensure that all activities required by this Regulation can be financed and carried out. That person shall:

(1)	ensure that all necessary resources are available to comply with the requirements of this Regulation;

(2)	establish and promote the information security policy referred to in point IS.D.OR.200(a)(1);

(3)	demonstrate a basic understanding of this Regulation.

(b)

The accountable manager or, in the case of design organisations, the head of the design organisation, shall appoint a person or group of persons to ensure that the organisation is in compliance with the requirements of this Regulation, and shall define the extent of their authority. That person or group of persons shall report directly to the accountable manager or, in the case of design organisations, to the head of the design organisation, and shall have the appropriate knowledge, background and experience to discharge their responsibilities. It shall be determined in the procedures who deputises for a particular person in the case of lengthy absence of that person.

(c)	The accountable manager or, in the case of design organisations, the head of the design organisation shall appoint a person or group of persons with the responsibility to manage the compliance monitoring function referred to in point IS.D.OR.200(a)(12).

(d)

Where the organisation shares information security organisational structures, policies, processes and procedures, with other organisations or with areas of their own organisation which are not part of the approval or declaration, the accountable manager or, in the case of design organisations, the head of the design organisation, may delegate its activities to a common responsible person.

In such a case, coordination measures shall be established between the accountable manager of the organisation or, in the case of design organisations, the head of the design organisation, and the common responsible person to ensure adequate integration of the information security management within the organisation.

(e)	The accountable manager or the head of the design organisation, or the common responsible person referred to in point (d), shall have corporate authority to establish and maintain the organisational structures, policies, processes and procedures necessary to implement point IS.D.OR.200.

(f)	The organisation shall have a process in place to ensure that they have sufficient personnel on duty to carry out the activities covered by this Annex.

(g)	The organisation shall have a process in place to ensure that the personnel referred to in point (f) have the necessary competence to perform their tasks.

(h)	The organisation shall have a process in place to ensure that personnel acknowledge the responsibilities associated with the assigned roles and tasks.

(i)	The organisation shall ensure that the identity and trustworthiness of the personnel who have access to information systems and data subject to the requirements of this Regulation are appropriately established.

IS.D.OR.245 Record-keeping

(a)

The organisation shall keep records of its information security management activities

(1)

The organisation shall ensure that the following records are archived and traceable:

(i)	any approval received and any associated information security risk assessment in accordance with point IS.D.OR.200(e);

(ii)	contracts for activities referred to in point IS.D.OR.200(a)(9);

(iii)

records of the key processes referred to in point IS.D.OR.200(d);

(iv)	records of the risks identified in the risk assessment referred to in point IS.D.OR.205 along with the associated risk treatment measures referred to in point IS.D.OR.210;

(v)	records of information security incidents and vulnerabilities reported in accordance with the reporting schemes referred to in points IS.D.OR.215 and IS.D.OR.230;

(vi)	records of those information security events which may need to be reassessed to reveal undetected information security incidents or vulnerabilities.

(2)	The records referred to in point (1)(i) shall be retained at least until 5 years after the approval has lost its validity.

(3)	The records referred to in point (1)(ii) shall be retained at least until 5 years after the contract has been amended or terminated.

(4)	The records referred to in point (1)(iii), (iv) and (v) shall be retained at least for a period of 5 years.

(5)	The records referred to in point (1)(vi) shall be retained until those information security events have been reassessed in accordance with a periodicity defined in a procedure established by the organisation.

(b)

The organisation shall keep records of qualification and experience of its own staff involved in information security management activities

(1)	The personnel’s qualification and experience records be retained for as long as the person works for the organisation, and for at least 3 years after the person has left the organisation.

(2)	Members of the staff shall, upon their request, be given access to their individual records. In addition, upon their request, the organisation shall provide them with a copy of their individual records on leaving the organisation.

(c)	The format of the records shall be specified in the organisation’s procedures.

(d)

Records shall be stored in a manner that ensures protection from damage, alteration and theft, with information being identified, when required, according to its security classification level. The organisation shall ensure that the records are stored using means to ensure integrity, authenticity and authorised access.

IS.D.OR.250 Information security management manual (ISMM)

(a)

The organisation shall make available to the competent authority an information security management manual (ISMM) and, where applicable, any referenced associated manuals and procedures, containing:

(1)

a statement signed by the accountable manager or, in the case of design organisations, by the head of the design organisation, confirming that the organisation will at all times work in accordance with this Annex and with the ISMM. If the accountable manager or, in the case of design organisations, the head of the design organisation, is not the chief executive officer (CEO) of the organisation, then such CEO shall countersign the statement;

(2)	the title(s), name(s), duties, accountabilities, responsibilities and authorities of the person or persons referred to in point IS.D.OR.240(b) and (c);

(3)	the title, name, duties, accountabilities, responsibilities and authorities of the common responsible person referred to in point IS.D.OR.240(d), if applicable;

(4)	the information security policy of the organisation as referred to in point IS.D.OR.200(a)(1);

(5)	a general description of the number and categories of staff and of the system in place to plan the availability of staff as required by point IS.D.OR.240;

(6)	the title(s), name(s), duties, accountabilities, responsibilities and authorities of the key persons responsible for the implementation of point IS.D.OR.200, including the person or persons responsible for the compliance monitoring function referred to in point IS.D.OR.200(a)(12);

(7)	an organisation chart showing the associated chains of accountability and responsibility for the persons referred to in points (2) and (6);

(8)	the description of the internal reporting scheme referred to in point IS.D.OR.215;

(9)

the procedures that specify how the organisation ensures compliance with this Part, and in particular:

(i)	the documentation point IS.D.OR.200(c);

(ii)	the procedures that define how the organisation controls any contracted activities referred to in point IS.D.OR.200(a)(9);

(iii)

the ISMM amendment procedure defined in point (c);

(10)	the details of currently approved alternative means of compliance.

(b)	The initial issue of the ISMM shall be approved and a copy shall be retained by the competent authority. The ISMM shall be amended as necessary to remain an up-to-date description of the ISMS of the organisation. A copy of any amendments to the ISMM shall be provided to the competent authority.

(c)	Amendments to the ISMM shall be managed in a procedure established by the organisation. Any amendments that are not included within the scope of this procedure and any amendments related to the changes referred to in point IS.D.OR.255(b), shall be approved by the competent authority.

(d)	The organisation may integrate the ISMM with other management expositions or manuals it holds, provided there is a clear cross reference that indicates which portions of the management exposition or manual correspond to the different requirements contained in this Annex.

IS.D.OR.255 Changes to the information security management system

(a)	Changes to the ISMS may be managed and notified to the competent authority in a procedure developed by the organisation. This procedure shall be approved by the competent authority.

(b)

With regard to changes to the ISMS not covered by the procedure referred to in point (a), the organisation shall apply for and obtain an approval issued by the competent authority.

With regard to these changes:

(1)	the application shall be submitted before any such change takes place, in order to enable the competent authority to determine continued compliance with this Regulation and to amend, if necessary, the organisation certificate and related terms of approval attached to it;

(2)	the organisation shall make available to the competent authority any information it requests to evaluate the change;

(3)	the change shall be implemented only upon receipt of a formal approval by the competent authority;

(4)	the organisation shall operate under the conditions prescribed by the competent authority during the implementation of such changes.

IS.D.OR.260 Continuous improvement

(a)	The organisation shall assess, using adequate performance indicators, the effectiveness and maturity of the ISMS. That assessment shall be carried out on a calendar basis predefined by the organisation or following an information security incident.

(b)

If deficiencies are found following the assessment carried out in accordance with point (a), the organisation shall take the necessary improvement measures to ensure that the ISMS continues to comply with the applicable requirements and maintains the information security risks at an acceptable level. In addition, the organisation shall reassess those elements of the ISMS affected by the adopted measures.

(1) Regulation (EU) No 376/2014 of the European Parliament and of the Council of 3 April 2014 on the reporting, analysis and follow-up of occurrences in civil aviation, amending Regulation (EU) No 996/2010 of the European Parliament and of the Council and repealing Directive 2003/42/EC of the European Parliament and of the Council and Commission Regulations (EC) No 1321/2007 and (EC) No 1330/2007 (OJ L 122, 24.4.2014, p. 18).

26.9.2022

Official Journal of the European Union

L 248/32

COMMISSION IMPLEMENTING REGULATION (EU) 2022/1646

of 23 September 2022

on uniform practical arrangements for the performance of official controls as regards the use of pharmacologically active substances authorised as veterinary medicinal products or as feed additives and of prohibited or unauthorised pharmacologically active substances and residues thereof, on specific content of multi-annual national control plans and specific arrangements for their preparation

(Text with EEA relevance)

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Whereas:

(1)

Regulation (EU) 2017/625 lays down rules for the performance of official controls and other official activities by the competent authorities of the Member States to verify compliance with Union legislation in the area of food and feed safety. In particular, Article 9 of that Regulation requires competent authorities to perform official controls on all operators regularly, on a risk basis and with an appropriate frequency. Article 109 of that Regulation obliges Member States to ensure that official controls are performed by the competent authorities on the basis of a multi-annual national control plan (‘MANCP’). Regulation (EU) 2017/625 furthermore specifies the general content of the MANCP, including the requirement for Member States to provide in their MANCP official controls on the use of pharmacologically active substances authorised as veterinary medicinal products or as feed additives and of prohibited or unauthorised pharmacologically active substances and residues thereof. Regulation (EU) 2017/625 empowers the Commission to lay down specific additional content of the MANCP and specific additional arrangements for its preparation, as well as a uniform minimum frequency of official controls, having regard to the hazards and risks related to substances referred to in Article 19(1) of that Regulation.

(2)

Regulation (EU) 2017/625 repealed Council Directive 96/23/EC (2) with effect from 14 December 2019 and lays down the relevant transitional measures. Those transitional measures provide that, until 14 December 2022, competent authorities are to continue to perform official controls necessary in accordance with Directive 96/23/EC to detect the presence of certain substances and groups of residues. Specifically, the transitory measures set requirements for Member States’ monitoring plans for the detection of residues or substances within its scope.

(3)

This Regulation ensures the continuity of the rules laid down in Directive 96/23/EC concerning the content of the MANCP and its preparation, as well as the minimum frequency of official controls, as regards official controls of residues of substances having a pharmacological action, of their metabolites and of other substances transmissible to animal products that are likely to be harmful to human health.

(4)

Regulation (EU) 2019/6 of the European Parliament and the Council (3) establishes the regulatory framework for the placing on the market, manufacturing, import, export, supply, distribution, pharmacovigilance, control and the use of veterinary medicinal products. Furthermore, pharmacologically active substances, which are not authorised in veterinary medicinal products, may not be used in food-producing animals in the EU, with the exception of substances that are essential for the treatment of equine animals as provided for in Commission Regulation (EC) No 1950/2006 (4).

(5)

Member States are required to include controls on the use of pharmacologically active substances authorised as veterinary medicinal products or as feed additives and of prohibited or unauthorised pharmacologically active substances and residues thereof in both food-producing animals and in products of animal origin in their MANCPs. In order to ensure harmonised and effective controls among Member States to combat the illegal use of growth and productivity promoters in kept animals in all Member States, uniform practical arrangements for the MANCPs should be further defined.

(6)

In order to verify compliance with Union legislation on the use of pharmacologically active substances authorised as veterinary medicinal products or as feed additives and of prohibited or unauthorised pharmacologically active substances and residues thereof, Member States shall carry out risk-based controls on food-producing animals and products of animal origin, produced in Member States or entering the Union from third countries. Those controls shall be included in each Member State’s MANCP and comprise three plans: a risk-based control plan for production in the Member State, a risk-based control plan for third-country imports, and, in order to collect information useful to orientate future risk-based controls for production in the Member States, Member States should include a randomised surveillance plan.

(7)

Commission Delegated Regulation (EU) 2022/1644 (5) lays down rules for the performance of official controls as regards the range of samples and the stage of production, processing and distribution at which the samples are to be taken as regards the use of pharmacologically active substances authorised as veterinary medicinal products or as feed additives and of prohibited or unauthorised pharmacologically active substances and residues thereof.

(8)

Both the sampling strategy and risk criteria for defining the content of the risk-based control plan for production in the Member State should be set in accordance with Delegated Regulation (EU) 2022/1644 and a justification should be included in that plan regarding the implementation of the risk criteria. Where, in the course of the execution of this control plan during a specific year, new information becomes available on illegal treatments, for example through the surveillance plan, Member States should update the risk-based control plan for production in the Member State without delay in order to ensure responsible use of pharmacologically active substances and a high level of human health protection. In order to guarantee a uniform minimum frequency of controls, this Regulation should define minimum control frequencies to be included in the MANCP.

(9)

Member States shall also include in their MANCPs a dedicated surveillance plan, based on random sampling and testing for a wide range of pharmacologically active substances authorised as veterinary medicinal products or as feed additives and of prohibited or unauthorised pharmacologically active substances and residues thereof which might not be included in the risk-based national plans.

(10)	For the surveillance plan, it is appropriate that about 8 000 samples across the Union are taken. The controls and the associated sampling should be apportioned across the Member States. Those minimum sampling frequencies should be included in the MANCP.

(11)

In order to ensure that the results obtained under the surveillance plan are comparable, this plan should specify the type of analytical methods to be used and the method requirements. For the surveillance plan for prohibited and unauthorised substances, in addition to confirmatory methods, targeted and non-targeted screening methods are effective to identify unexpected illegal uses of authorised, prohibited and unauthorised pharmacologically active substances. For the surveillance plan for authorised substances, screening or confirmatory methods capable of quantifying residues below the maximum residue limit (‘MRL’) should be used and the concentrations which are quantified below the MRL should be reported in addition to those at or above the MRL.

(12)

In addition to controls on Member States’ production, Member States should include a control plan for products, which are intended for the entry into the Union from third countries in their MANCP in order to verify the effectiveness of third countries’ residue controls and the compliance of imported products of animal origin with the Union rules. In order to guarantee a uniform minimum frequency of the controls carried out under the plan for third-country imports and to ensure that they are carried out at least at a frequency which is equal to the control frequency for risk-based control plan for production in Member States, this Regulation should define the minimum frequencies for those controls to be applied by Member States, through whose border control posts the animals and products of animal origin enter the Union.

(13)

In order to ensure a harmonised and comprehensive content of the MANCP on the use of pharmacologically active substances authorised as veterinary medicinal products or as feed additives and of prohibited or unauthorised pharmacologically active substances in food-producing animals and residues thereof in animals and products of animal origin, the relevant aspects of its content should be defined.

(14)

Sampling procedures, handling and transport conditions have an influence on the ability to detect the presence of pharmacologically active substances authorised as veterinary medicinal products or as feed additives and of prohibited or unauthorised pharmacologically active substances and residues thereof in samples. Therefore, Member States should follow the rules laid down in Commission Implementing Regulation (EU) 2021/808 (6).

(15)

It is necessary to ensure that the analytical results gathered under the control plans as regards the use of pharmacologically active substances authorised as veterinary medicinal products or as feed additives and of prohibited or unauthorised pharmacologically active substances and residues thereof and the interpretation of the results are comparable. Therefore, the plans should describe the analytical methods to be used as well as their performance requirements, in accordance with the provisions of Implementing Regulation (EU) 2021/808.

(16)

In order to ensure that Member States’ risk-based control plans for both Union production and for third-country imports, as well as their surveillance plans for production in the Member States, comply with this Regulation, Member States should submit these control plans to the Commission for evaluation annually. The Commission should communicate its comments to the Member States if needed. Member States should prepare a revised and updated plan incorporating the comments no later than 31 March of the following year. However, where the Commission considers that the plans would impair the effectiveness of official controls, it should be able to request the Member State to submit an updated plan addressing the Commission’s comments at an earlier date.

(17)

In accordance with Article 33 of Regulation (EC) No 178/2002 of the European Parliament and of the Council (7), the data collected by the Member States through official controls in respect of the use of pharmacologically active substances authorised as veterinary medicinal products or as feed additives and of prohibited or unauthorised pharmacologically active substances and residues thereof must be submitted to the European Food Safety Authority (‘EFSA’). In order to allow for the monitoring of recent data, all Member States should submit data on a regular basis and by the same date.

(18)	Commission Decision 97/747/EC (8), fixing levels and frequencies of sampling in addition to those provided for in the Annexes to Directive 96/23/EC, should be repealed as its provisions are replaced by the provisions of this Regulation.

(19)	As the rules laid down in the Annexes to Directive 96/23/EC on measures to monitor certain substances and residues thereof in live animals and products of animal origin are to be applied until 14 December 2022, this Regulation should apply from 15 December 2022.

(20)	The measures provided for in this Regulation are in accordance with the opinion of the Standing Committee on Plants, Animals, Food and Feed,

HAS ADOPTED THIS REGULATION:

CHAPTER I

SUBJECT MATTER, SCOPE AND DEFINITIONS

Article 1

Subject matter

For the purpose of official controls on the use of pharmacologically active substances authorised as veterinary medicinal products or as feed additives and of prohibited or unauthorised pharmacologically active substances and residues thereof, this Regulation lays down the following:

(a)	the annual uniform minimum sampling frequency as part of official controls, having regard to the hazards and risks related to the substances concerned;

(b)	specific additional arrangements and specific additional content for the Member States’ multi-annual national control plan (‘MANCP’), in addition to those provided for in Article 110 of Regulation (EU) 2017/625.

Article 2

Definitions

For the purposes of this Regulation, the definitions in Regulation (EC) No 178/2002, Commission Delegated Regulation (EU) 2019/2090 (9), Implementing Regulation (EU) 2021/808 and Delegated Regulation (EU) 2022/1644 apply.

CHAPTER II

SPECIFIC ADDITIONAL CONTENT OF THE MANCP

Article 3

General provisions

Member States shall ensure that the part of the MANCP concerning the performance of official controls on the use of pharmacologically active substances authorised as veterinary medicinal products or as feed additives and of prohibited or unauthorised pharmacologically active substances and residues thereof in live animals and products of animal origin contains the following:

(a)	a ‘national risk-based control plan for production in the Member States’, as set out in Article 4;

(b)	a ‘national randomised surveillance plan for production in the Member States’ as set out in Article 5;

(c)	a ‘national risk-based control plan for third-country imports’ as set out in Article 6.

Article 4

National risk-based control plan for production in the Member States

Member States shall prepare a national risk-based control plan for substances in groups A and B of Annex I to Delegated Regulation (EU) 2022/1644 to verify compliance of food-producing animals and products of animal origin produced in the Member States with Union legislation governing the use of pharmacologically active substances authorised as veterinary medicinal products or as feed additives and of prohibited or unauthorised pharmacologically active substances and residues thereof and the applicable maximum residue limits (‘MRL’) and maximum levels (‘ML’) in food.

The national risk-based control plan for production in the Member States shall contain the following:

(a)	the list of combinations of substances and species, products and matrices in accordance with Annex II to Delegated Regulation (EU) 2022/1644;

(b)	the sampling strategy as decided by the Member State in accordance with Annex III to Delegated Regulation (EU) 2022/1644;

(c)	the actual sampling frequencies as decided by the Member State taking into account the annual minimum control frequencies laid down in Annex I;

(d)	the analytical methods to be used and their performance characteristics;

(e)	the detailed information referred to in Article 7(1) and (2).

Pursuant to Article 111(2) of Regulation (EU) 2017/625, during the course of the execution of the MANCP, Member States shall review the national risk-based plan for production in the Member States to take account of illegal treatments identified, in particular, through the surveillance plan.

Article 5

National randomised surveillance plan for production in the Member States

Member States shall prepare a national randomised surveillance plan for the control of production in the Member States, ensuring random monitoring for a wide range of substances.

The national randomised surveillance plan for production in each Member State shall contain the following:

(a)	the list of combinations of substances and species, products and matrices in accordance with Annex IV to Delegated Regulation (EU) 2022/1644;

(b)	the sampling strategy as decided by the Member State set out in accordance with Annex V to Delegated Regulation (EU) 2022/1644;

(c)	the actual sampling frequencies as decided by the Member State taking into account the minimum sampling frequencies prescribed in Annex II to this Regulation;

(d)	the detailed information referred to in Article 7(1).

In accordance with the requirements for methods of analysis provided for in Implementing Regulation (EU) 2021/808, Member State shall use analytical methods for the analysis of pharmacologically active substances authorised as veterinary medicinal products or as feed additives and of prohibited or unauthorised pharmacologically active substances and residues thereof in products of animal origin, which provide quantitative or semi-quantitative results, including when these residues are identified and quantified at levels below the MRL.

Member States shall include reporting requirements for the controls on the use of authorised substances, which ensure the reporting of all concentrations at or above the detection capability for screening (‘CCβ’) of the method, while ensuring that the lowest CCβ, which is reasonably achievable, is obtained for the methods, which are used to perform the screening analyses. For testing carried out with confirmatory methods only, all quantifiable results shall be reported. In case of use of targeted and non-targeted screening methods, Member States shall report on the use and the findings of these analytical methods.

Article 6

National risk-based control plan for third-country imports

Member States shall prepare a national risk-based control plan for food-producing animals and products of animal origin entering into the Union and intended for placing on the Union market through their border control posts (‘BCP’) and other points of entry such as on vessels according to Commission Implementing Regulation (EU) 2019/627 (10) to verify compliance with Union legislation on the use of pharmacologically active substances as listed in Annex I to Delegated Regulation (EU) 2022/1644 and compliance with applicable MRLs and MLs.

Controls on the use of pharmacologically active substances authorised as veterinary medicinal products or as feed additives and of prohibited or unauthorised pharmacologically active substances and residues thereof shall be carried out as part of the official controls at BCP provided for in Article 47 and Article 65 of Regulation (EU) 2017/625.

The national risk-based control plan for third-country imports shall contain the following:

(a)	the list of combinations of substances and species, products and matrices in accordance with Annex VI to Delegated Regulation (EU) 2022/1644;

(b)	the sampling strategy as decided by the Member State in accordance with Annex VII to Delegated Regulation (EU) 2022/1644;

(c)

the actual sampling frequencies for controls carried out at BCP as decided by the Member State taking into account the annual minimum sampling frequencies in accordance with Annex III to this Regulation. The samples taken for the purpose of official controls carried out pursuant to Article 65(1), (2) and (4) of Regulation (EU) 2017/625, shall, however, not be considered as samples contributing to reach the minimum sampling frequencies of Annex III of this Regulation;

(d)	the analytical methods to be used and their performance characteristics;

(e)	the detailed information referred to in Article 7(1) and (2).

Article 7

Additional content of the national risk-based control plans and randomised surveillance plan

1. The national risk-based control plans, referred to in Articles 4 and 6, and national randomised surveillance plan, referred to in Article 5, shall specify the following information:

(a)	the details on species to be sampled and on place of sampling;

(b)	information on the national legislation on the use of pharmacologically active substances and, in particular, on their prohibition or authorisation, distribution and placing on the market and the rules governing their administration, in so far as such legislation is not harmonised;

(c)	information about the competent authorities responsible for the implementation of the plans;

(d)	the type of follow-up measures taken by the competent authorities with regard to animals or products of animal origin in which non-compliant residues have been detected in the previous years

The national risk based control plans referred to in Articles 4 and 6 shall, in addition to the information specified in paragraph 1, provide the following:

(a)

a justification for the selected substances, species, products and matrices included in the plans on the basis of the criteria listed in Annexes II and VI to Delegated Regulation (EU) 2022/1644, including a justification on how the criteria listed in those Annexes were taken into account, even if no changes were made compared to the plan of the previous year;

(b)	a justification on how information from an overview of the non-compliances in the relevant Member State of the previous three calendar years provided by EFSA was taken into account for optimising the plan.

Member States do not need submit information already provided in the general part of the MANCP or described in Union legislation according to Article 110(2) of Regulation (EU) 2017/625.

CHAPTER III

SUBMISSION AND EVALUATION OF THE PLANS AND SUBMISSION OF DATA BY THE MEMBER STATES

Article 8

Submission and evaluation of the control plans

By 31 March of each year, Member States shall submit, in an agreed format, revised and updated national risk-based control plans and randomised surveillance plan for the current calendar year to the Commission electronically.

The Commission shall evaluate those plans on the basis of this Regulation and Delegated Regulation (EU) 2022/1644 and shall communicate its evaluation together with comments or recommendations, where needed, to each Member State within 4 months of receipt of the plans.

Member States shall provide the Commission with updated versions of the respective plans, outlining how the Commission’s comments have been taken into account, at the latest by 31 March of the following year. Where a Member State decides not to update its control plans based on the Commission’s comments, it shall justify its position.

Where the Commission considers that the plans would impair the effectiveness of official controls, updated versions of the concerned plans shall be submitted earlier upon request of, and within a reasonable time period set by the Commission.

Article 9

Submission of data by the Member State

By 30 June of each year, Member States shall transmit to EFSA all data from the previous year, including compliant results of screening methods where no confirmatory analyses were performed, gathered under the control plans referred to in Article 3.

By 31 August each year, the data validation, review and final acceptance in EFSA data repository systems shall be finalised by each Member State.

CHAPTER IV

GENERAL PROVISIONS

Article 10

Repeal of Decision 97/747/EC

Decision 97/747/EC is hereby repealed.

Article 11

References

References to Articles 3, 4, 5, 6, 7 and 8 of Directive 96/23/EC and Annexes I and IV to that Directive and to Decision 97/747/EC shall be construed as references to this Regulation.

Article 12

Entry into force and application

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

It shall apply from 15 December 2022.

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at Brussels, 23 September 2022.

For the Commission

The President

Ursula VON DER LEYEN

(1) OJ L 95, 7.4.2017, p. 1.

(3) Regulation (EU) 2019/6 of the European Parliament and the Council of 11 December 2018 on veterinary medicinal products and repealing Directive 2001/82/EC (OJ L 4, 7.1.2019, p. 43).

(4) Commission Regulation (EC) No 1950/2006 of 13 December 2006 establishing, in accordance with Directive 2001/82/EC of the European Parliament and of the Council on the Community code relating to veterinary medicinal products, a list of substances essential for the treatment of equidae and of substances bringing added clinical benefit (OJ L 367, 22.12.2006, p. 33).

(5) Commission Delegated Regulation (EU) 2022/1644 of 7 July 2022 supplementing Regulation (EU) 2017/625 of the European Parliament and of the Council with specific requirements for the performance of official controls on the use of pharmacologically active substances authorised as veterinary medicinal products or as feed additives and of prohibited or unauthorised pharmacologically active substances and residues thereof (see page 3 of this Official Journal).

(7) Regulation (EC) No 178/2002 of the European Parliament and of the Council of 28 January 2002 laying down the general principles and requirements of food law, establishing the European Food Safety Authority and laying down procedures in matters of food safety (OJ L 31, 1.2.2002, p. 1).

(8) 97/747/EC: Commission Decision of 27 October 1997 fixing the levels and frequencies of sampling provided for by Council Directive 96/23/EC for the monitoring of certain substances and residues thereof in certain animal products (OJ L 303, 6.11.1997, p. 12).

(9) Commission Delegated Regulation (EU) 2019/2090 of 19 June 2019 supplementing Regulation (EU) 2017/625 of the European Parliament and Council regarding cases of suspected or established non-compliance with Union rules applicable to the use or residues of pharmacologically active substances authorised in veterinary medicinal products or as feed additives or with Union rules applicable to the use or residues of prohibited or unauthorised pharmacologically active substances (OJ L 317, 9.12.2019, p. 28).

(10) Commission Implementing Regulation (EU) 2019/627 of 15 March 2019 laying down uniform practical arrangements for the performance of official controls on products of animal origin intended for human consumption in accordance with Regulation (EU) 2017/625 of the European Parliament and of the Council and amending Commission Regulation (EC) No 2074/2005 as regards official controls (OJ L 131, 17.5.2019, p. 51).

ANNEX I

Minimum sampling frequency per Member State in the national risk-based control plan for production in the Member States (as referred to in Article 4(c))

The minimum number of samples is as follows:

	Sampling frequency – Group A substances
Bovine	Minimum 0,25 % of the slaughtered animals (minimum 25 % of the samples to be taken from live animals on the farm and minimum 25 % of the samples to be taken at the slaughterhouse)
Sheep and goats	Minimum 0,01 % of the slaughtered animals per species
Porcine	Minimum 0,02 % of the slaughtered animals
Equine	Minimum 0,02 % of the slaughtered animals
Poultry	For each category of poultry considered (broiler chickens, spent hens, turkeys and other poultry) minimum 1 sample per 400 tons of annual production (deadweight)
Aquaculture (finfish, crustaceans and other aquaculture products)	Minimum 1 sample per 300 tonnes of annual production of aquaculture for the first 60 000 tonnes of production and then 1 additional sample for each additional 2 000 tonnes
Bovine, ovine and caprine milk	Minimum 1 sample per 30 000 tonnes of annual production of milk per species
Hen eggs and other eggs	Minimum 1 sample per 2 000 tonnes of annual production of eggs per species
Rabbits, farmed game, reptiles and insects	Minimum 1 sample per 100 tonnes of annual production (dead weight) of rabbits, farmed game or reptiles for the first 3 000 tonnes of production and 1 sample for each additional 1 000 tonnes Minimum 1 sample per 25 tonnes annual production of insects
Honey	Minimum 1 sample per 50 tonnes of annual production for the first 5 000 tonnes of production and then 1 additional sample for each additional 500 tonnes
Casings (*)	Minimum 1 sample per 300 tonnes of annual production

	Sampling frequency – Group B substances
Bovine	Minimum 0,10 % of the slaughtered animals
Sheep and goats	Minimum 0,02 % of the slaughtered animals per species
Porcine	Minimum 0,02 % of the slaughtered animals
Equine	Minimum 0,02 % of the slaughtered animals
Poultry	For each category of poultry considered (broiler chickens, spent hens, turkeys and other poultry) minimum 1 sample per 500 tonnes of annual production (deadweight)
Aquaculture (finfish, crustaceans and other aquaculture products)	Minimum 1 sample per 300 tonnes of annual production of aquaculture for the first 60 000 tonnes of production and then 1 additional sample for each additional 2 000 tonnes
Bovine, ovine and caprine milk	Minimum 1 sample per 30 000 tonnes of annual production of milk per species
Hen eggs and other eggs	Minimum 1 sample per 2 000 tonnes of annual production of eggs per species
Rabbits, farmed game, reptiles and insects	Minimum 1 sample per 50 tonnes of annual production (dead weight) of rabbits, farmed game or reptiles for the first 3 000 tonnes of production and 1 sample for each additional 500 tonnes Minimum 1 sample per 25 tonnes annual production of insects
Honey	Minimum 1 sample per 50 tonnes of annual production for the first 5 000 tonnes of production and then 1 additional sample for each additional 500 tonnes

Additional provisions

(a)

If relevant to verify compliance with Union legislation on the use of prohibited or unauthorised pharmacologically active substances, Member States may take samples from feed, water or another relevant matrix or environment and counted towards achieving the minimum sampling frequencies provided for in this Annex.

(b)

Controls on each combination of sub-groups of Group A substances and commodity groups as listed in Annex II to Delegated Regulation (EU) 2022/1644 shall be annually performed in minimum 5 % of the samples taken in accordance to the table of this Annex for that commodity group. This minimum percentage does not apply to casings and it does not apply to group A(3), point (f) for all commodity groups.

(c)	For the Group B substances, the selection of specific substances for testing within each substance group is to be decided according to criteria listed in Annex II to Delegated Regulation (EU) 2022/1644.

(d)	Within bovine, ovine and caprine group, the samples shall be taken from all species, taking into account their relative production volume. Sampling shall cover both animals for dairy production and for meat production.

(e)	Within the poultry group, samples shall be taken from broiler chickens, spent hens, turkey and other poultry, taking into account their relative production volume.

(f)	Within the aquaculture group, samples shall be taken from fresh and seawater aquaculture species, taking into account their relative production volume.

(g)	When there is a reason to believe that pharmacologically active substances are being applied to the other aquaculture products, then these species must be included in the sampling plan in proportion to their production as additional samples to those taken for finfish farming products.

(h)	The necessary number of targeted samples shall be taken in order to achieve the prescribed sampling frequency. This refers to the number of animals sampled (or group of animals likely to be treated in a certain group (e.g. fish)) irrespective of number of tests carried our per sample.

(i)

When substances from Group A and Group B are analysed in one sample from a single animal, this sample can be taken into account towards the minimum sampling frequency for both groups (Group A and Group B) given that it can be documented, and that the risk criteria for Group A and Group B are the same. If another sample of another matrix is taken from the same animal for the analysis of group A and/or group B substances, the result is not taken into account towards the minimum sampling frequency. However in case substances from Group A are analysed in a sample of one matrix from a single animal and substances from Group B are analysed in a sample of another matrix from the same animal, then both samples can be taken into account towards the minimum sampling frequency for both groups (Group A and Group B) given that it can be documented, and that the risk criteria for Group A and Group B have been applied.

(j)	Suspect samples taken during the follow-up of a non-compliance in accordance with Regulation (EU) 2019/2090 shall not be counted in order to achieve the prescribed sampling frequency for the risk-based plan for EU production.

(k)	For calculating the minimum sampling frequencies, Member States shall use the most recent production data available, at least from previous or at maximum from penultimate year, adjusted, if relevant, to reflect known evolutions in production since the data were made available.

(l)

In case the sampling frequency calculated in accordance with this Annex would represent less than five samples per year, sampling may be carried out once per two years. In case that, within a two-year period, the production corresponding to a minimum of one sample is not reached, a minimum of one sample once per two years shall be analysed provided that production takes place for that species or product in the Member State.

(m)

Samples taken for the purposes of other control plans relevant for analysis on pharmacologically active substances and residues thereof (e.g. on contaminants, on pesticide residues, etc.) may also be used for controls on pharmacologically active substances provided that the requirements concerning the controls on pharmacologically active substances are complied with.

(*) As defined in Commission Delegated Regulation (EU) 2020/692 of 30 January 2020 supplementing Regulation (EU) 2016/429 of the European Parliament and of the Council as regards rules for entry into the Union, and the movement and handling after entry of consignments of certain animals, germinal products and products of animal origin (OJ L 174, 3.6.2020, p. 379).

ANNEX II

Minimum sampling frequency per Member State in the national randomised surveillance plan for production in the Member States (as referred to in Article 5(c))

The minimum number of samples is as follows:

Member State	Minimum number of samples	Member State	Minimum number of samples
Belgium	195	Lithuania	50
Bulgaria	120	Luxembourg	10
Czechia	180	Hungary	165
Denmark	100	Malta	10
Germany	1 425	Netherlands	300
Estonia	25	Austria	150
Ireland	85	Poland	650
Greece	185	Portugal	175
Spain	805	Romania	335
France	1 150	Slovenia	35
Croatia	70	Slovakia	95
Italy	1 050	Finland	95
Cyprus	15	Sweden	175
Latvia	35	United Kingdom (Northern Ireland) (*)	30

Additional provisions:

(a)	The samples taken under its surveillance plan shall be distributed over the different species and products according to the proportion they represent under the national production and consumption.

(b)	25 % of the samples, taken under this plan, shall be analysed for Group A substances.

(c)	75 % of the samples, taken under this plan, shall be analysed for Group B substances.

(*) In accordance with the Agreement on the withdrawal of the United Kingdom of Great Britain and Northern Ireland from the European Union and the European Atomic Energy Community, and in particular Article 5(4) of the Protocol on Ireland/Northern Ireland in conjunction with Annex 2 to that Protocol, for the purposes of this Regulation, references to Member States include the United Kingdom in respect of Northern Ireland

ANNEX III

Minimum sampling frequency per Member State in the national risk-based control plan for third-country imports (as referred to in Article 6(c))

The minimum sampling frequency can be used as a part of a monitoring plan at border control posts in accordance with point 5 of Annex II to Commission Implementing Regulation (EU) 2019/2130 (1).

Controls carried out under the established emergency measures and the intensified official controls, on the basis of Article 53 of Regulation (EC) No 178/2002 and of Article 65(4) of Regulation (EU) 2017/625, shall not be counted towards achieving the minimum sampling frequencies laid down in this Annex.

Controls of food products from certain third countries listed in Annex II to Commission Implementing Regulation (EU) 2019/2129 (2), with which the Union has concluded agreements of equivalence for physical checks, shall not be counted towards achieving the minimum sampling frequencies laid down in this Annex.

The minimum number of samples is as follows:

	Sampling frequency for Group A and Group B substances
Bovine (includes live animals, meat, minced meat, mechanically separated meat, meat preparations and meat products)	Minimum 7 % of the imported consignments
Ovine/caprine (includes live animals, meat, minced meat, mechanically separated meat, meat preparations and meat products)	Minimum 3 % of the imported consignments
Porcine (includes live animals, meat, minced meat, mechanically separated meat, meat preparations and meat products)	Minimum 3 % of the imported consignments
Equine (includes live animals intended for slaughter for human consumption, meat, minced meat, mechanically separated meat, meat preparations and meat products)	Minimum 3 % of the imported consignments
Poultry (*) (includes live animals, poultry meat and poultry meat products)	Minimum 7 % of the imported consignments
Aquaculture (finfish, crustaceans and other aquaculture products)	Minimum 7 % of the imported consignments
Milk (includes raw milk, dairy products, colostrum and colostrum-based products of all species)	Minimum 7 % of the imported consignments
Eggs (includes eggs and egg products from all bird species)	Minimum 12 % of the imported consignments
Rabbits, farmed and wild game (**), reptiles and insects (includes live animals, meat and meat products of the mentioned species and products derived from these species)	Minimum 12 % of the imported consignments for each species
Honey (includes honey and other apiculture products)	Minimum 7 % of the imported consignments
Casings (***)	Minimum 2 % of the imported consignments

Additional provisions:

(a)	For calculating the minimum sampling frequencies listed in this Annex, Member States shall use the most recent data of the number of consignments entering the Union through their border control posts, at least from previous or at maximum from penultimate year.

(b)

In case the number of consignments entering the Union is lower than the number of consignments corresponding to one sample, the sampling once per two or three years may be performed. In case the number of consignments entering the Union over a three-year period is lower than the number of consignments corresponding to one sample, at least one sample once per three years shall be taken.

(c)

(1) Commission Implementing Regulation (EU) 2019/2130 of 25 November 2019 establishing detailed rules on the operations to be carried out during and after documentary checks, identity checks and physical checks on animals and goods subject to official controls at border control posts (OJ L 321, 12.12.2019, p. 128).

(2) Commission Implementing Regulation (EU) 2019/2129 of 25 November 2019 establishing rules for the uniform application of frequency rates for identity checks and physical checks on certain consignments of animals and goods entering the Union (OJ L 321, 12.12.2019, p. 122).

(*) As defined in point 1.3 of Annex I to Regulation (EC) No 853/2004 of the European Parliament and of the Council of 29 April 2004 laying down specific hygiene rules for food of animal origin (OJ L 139, 30.4.2004, p. 55).

(**) As defined in points 1.5 and 1.6 of Annex I to Regulation (EC) No 853/2004 of the European Parliament and of the Council of 29 April 2004 laying down specific hygiene rules for food of animal origin (OJ L 139, 30.4.2004, p. 55).

(***) As defined in Commission Delegated Regulation (EU) 2020/692 of 30 January 2020 supplementing Regulation (EU) 2016/429 of the European Parliament and of the Council as regards rules for entry into the Union, and the movement and handling after entry of consignments of certain animals, germinal products and products of animal origin (OJ L 174, 3.6.2020, p. 379).

26.9.2022

Official Journal of the European Union

L 248/46

COMMISSION IMPLEMENTING DIRECTIVE (EU) 2022/1647

of 23 September 2022

amending Directive 2003/90/EC as regards a derogation for organic varieties of agricultural plant species suitable for organic production

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Council Directive 2002/53/EC of 13 June 2002 on the common catalogue of varieties of agricultural plant species (1), and in particular Article 7(2)(a) and (b) thereof,

Whereas:

(1)

Commission Directive 2003/90/EC (2) aims to ensure that the varieties of agricultural plant species that Member States include in their national catalogues comply with the protocols established by the Community Plant Variety Office (‘CPVO’). In particular, those protocols aim to ensure compliance with the rules concerning the characteristics to be covered as a minimum by the examination and the minimum conditions for examining certain varieties of agricultural plant species to establish distinctness, uniformity and stability (‘DUS’). For the species not covered by the CPVO protocols, that Directive aims to ensure compliance with test guidelines of the International Union for Protection of New Varieties of Plants (‘UPOV’).

(2)	Amongst others, varieties of agricultural plant species are to comply with the conditions, laid down in Annex III to Directive 2003/90/EC, concerning the examination of the value for cultivation and use (‘VCU’).

(3)

There is a need to ensure that producers can use organic varieties suitable for organic production resulting from organic breeding activities. Some of them meet the DUS criteria of all other varieties of the same species, but other varieties intended for organic production are characterised by a high level of genetic and phenotypical diversity between individual reproductive units.

(4)

Therefore, the standards for uniformity defined in the existing DUS protocols and guidelines of the CPVO and UPOV are not suitable for organic varieties for organic production, which are characterised by a high level of genetic and phenotypical diversity. Furthermore, there is a need to establish principles for the VCU examination that correspond to the demands of the organic sector.

(5)	It is therefore necessary to offer the possibility to deviate from the existing DUS examination protocols and to provide for requirements for VCU examination that are more adapted for organic varieties suitable for organic production.

(6)

Therefore, it should be possible to adjust the existing protocols for variety examination for certain species to meet the needs of the organic agriculture. It is therefore appropriate to derogate from certain provisions of Article 1 of Commission Directive 2003/90/EC and to lay down specific requirements for the VCU examination.

(7)

Member States should report, to the Commission and the other Member States, by 31 December of each year, until 31 December 2030, on the number of applications and results of the DUS and VCU examinations, in order to ensure a regular review of those requirements and further assess the need to amend, remove or also apply them to other species.

(8)	Directive 2003/90/EC should therefore be amended accordingly.

(9)	Competent authorities and the professional operators concerned should have sufficient time to adequately prepare before national provisions transposing this Directive start applying.

(10)	The measures provided for in this Directive are in accordance with the opinion of the Standing Committee on Plants, Animals, Food and Feed,

HAS ADOPTED THIS DIRECTIVE:

Article 1

Amendments to Directive 2003/90/EC

Directive 2003/90/EC is amended as follows:

(1)

Article 1 is amended as follows:

(a)

paragraph 2 is replaced by the following:

‘2. As regards distinctness, uniformity and stability, and without prejudice to the second subparagraph:

(a)	the species listed in Annex I shall comply with the conditions laid down in the “Protocols for distinctness, uniformity and stability tests” of the Administrative Council of the Community Plant Variety Office (CPVO) listed in that Annex;

(b)	the species listed in Annex II shall comply with the test guidelines for the conduct of tests for distinctness, uniformity and stability of the International Union for the Protection of New Varieties of Plants (UPOV) listed in that Annex.

By way of derogation from the first subparagraph, as regards uniformity, the organic varieties suitable for organic production, which belong to the species listed in Annex IV, Part A, may comply instead with the conditions listed in Part B of that Annex.

Member States shall report, to the Commission and the other Member States, by 31 December of each year, until 31 December 2030, on the number of applications for variety registrations and results of the examinations for distinctness, uniformity and stability (DUS) concerning those organic varieties’;

(b)

in paragraph 3, the following second and third subparagraphs are added:

‘By way of derogation from the first subparagraph, as regards the value for cultivation or use, organic varieties suitable for organic production, which belong to the species listed in Annex IV, Part A, may, comply instead with the conditions laid down in Part B of that Annex.;

Member States shall report, to the Commission and the other Member States, by 31 December of each year, until 31 December 2030, on the number of applications and results of the examinations for the value of cultivation and use (VCU) concerning those organic varieties’;

(2)	The text set out in the Annex to this Directive is added as Annexes IV and V.

Article 2

Transposition

1. Member States shall adopt and publish, by 30 June 2023 at the latest, the laws, regulations and administrative provisions necessary to comply with this Directive. They shall forthwith communicate to the Commission the text of those provisions.

They shall apply those provisions from 1 July 2023.

When Member States adopt those provisions, they shall contain a reference to this Directive or be accompanied by such a reference on the occasion of their official publication. Member States shall determine how such reference is to be made.

2. Member States shall communicate to the Commission the text of the main provisions of national law, which they adopt in the field covered by this Directive.

Article 3

Entry into force

This Directive shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

Article 4

Addressees

This Directive is addressed to the Member States.

Done at Brussels, 23 September 2022.

For the Commission

Stella KYRIAKIDES

Member of the Commission

(1) OJ L 193, 20.7.2002, p. 1.

(2) Commission Directive 2003/90/EC of 6 October 2003 setting out implementing measures for the purposes of Article 7 of Council Directive 2002/53/EC as regards the characteristics to be covered as a minimum by the examination and the minimum conditions for examining certain varieties of agricultural plant species (OJ L 254, 8.10.2003, p. 7).

ANNEX

‘ANNEX IV

PART A

List of species referred to in the second subparagraph of Article 1(2)

Barley

Maize

Rye

Wheat

PART B

Specific provisions concerning tests for distinctness, uniformity and stability for organic varieties of agricultural plant species suitable for organic production

1. General rule

The following shall apply to organic varieties of agricultural plant species suitable for organic production:

1.1.

As regards distinctness and stability, all characteristics of the protocols and guidelines referred to in Annexes I and II shall be observed and described.

1.2.

As regards uniformity, all characteristics of the protocols and guidelines referred to in Annexes I and II shall be observed and described and the following shall apply to the characteristics listed under point 2:

(a)	those characteristics may be assessed in a less stringent way;

(b)	where for those characteristics a derogation from the respective technical protocol is provided for in that point 2, the level of uniformity within the variety shall be similar to the level of uniformity of comparable varieties of common knowledge in the Union.

2. Derogation from technical protocols

2.1. Barley

For the varieties belonging to the species barley (Hordeum vulgare L.), the following DUS characteristics of the CPVO protocol CPVO/TP-019/5 of the tested variety may deviate from the following DUS requirements for uniformity:

CPVO No 5	—	Flag leaf: anthocyanin colouration of auricles
CPVO No 8	—	Flag leaf: glaucosity of sheath
CPVO No 9	—	Awns: anthocyanin coloration of tips
CPVO No 10	—	Ear: glaucosity
CPVO No 12	—	Grain: anthocyanin coloration of nerves of lemma
CPVO No 16	—	Sterile spikelet: attitude
CPVO No 17	—	Ear: shape
CPVO No 20	—	Awn: length
CPVO No 21	—	Rachis: length of first segment
CPVO No 22	—	Rachis: curvature of first segment
CPVO No 23	—	Median spikelet: length of glume and its awn relative to grain
CPVO No 25	—	Grain: spiculation of inner lateral nerves of dorsal side of lemma

2.2. Maize

For the varieties belonging to the species maize (Zea mays L.) the following DUS characteristics of the CPVO protocol CPVO-TP/002/3 of the tested variety may deviate from the following DUS requirements for uniformity:

CPVO No 1	—	First leaf: anthocyanin coloration of sheath
CPVO No 2	—	First leaf: shape of apex
CPVO No 8	—	Tassel: anthocyanin coloration of glumes excluding base
CPVO No 9	—	Tassel: anthocyanin coloration of anthers
CPVO No 10	—	Tassel: angle between main axis and lateral branches
CPVO No 11	—	Tassel: curvature of lateral branches
CPVO No 15	—	Stem: anthocyanin coloration of brace roots
CPVO No 16	—	Tassel: density of spikelets
CPVO No 17	—	Leaf: anthocyanin coloration of sheath
CPVO No 18	—	Stem: anthocyanin coloration of internodes
CPVO No 19	—	Tassel: length of main axis above lowest lateral branch
CPVO No 20	—	Tassel: length of main axis above highest lateral branch
CPVO No 21	—	Tassel: length of lateral branch

2.3. Rye

For the varieties belonging to the species rye (Secale cereale L.), the following DUS characteristics of the CPVO protocol CPVO-TP/058/1 of the tested variety may deviate from the following DUS requirements for uniformity:

CPVO No 3	—	Coleoptile: anthocyanin coloration
CPVO No 4	—	Coleoptile: length
CPVO No 5	—	First leaf: length of sheath
CPVO No 6	—	First leaf: length of blade
CPVO No 8	—	Flag leaf: glaucosity of sheath
CPVO No 10	—	Leaf next to flag leaf: length of blade
CPVO No 11	—	Leaf next to flag leaf: width of blade
CPVO No 12	—	Ear: glaucosity
CPVO No 13	—	Stem: hairiness below ear

2.4. Wheat

For the varieties belonging to the species wheat (Triticum aestivum L. subsp. aestivum.), the following DUS characteristics of the CPVO protocol CPVO-TP/003/5 of the tested variety may deviate from the following DUS requirements for uniformity:

CPVO No 3	—	Coleoptile: anthocyanin coloration
CPVO No 6	—	Flag leaf: anthocyanin coloration of auricles
CPVO No 8	—	Flag leaf: glaucosity of sheath
CPVO No 9	—	Flag leaf: glaucosity of blade
CPVO No 10	—	Ear: glaucosity
CPVO No 11	—	Culm: glaucosity of neck
CPVO No 20	—	Ear: shape in profile
CPVO No 21	—	Apical rachis segment: area of hairiness on convex surface
CPVO No 22	—	Lower glume: shoulder width
CPVO No 23	—	Lower glume: shoulder shape
CPVO No 24	—	Lower glume: length of beak
CPVO No 25	—	Lower glume: shape of beak
CPVO No 26	—	Lower glume: area of hairiness on internal surface

ANNEX V

PART A

List of species referred to in the second subparagraph of Article 1(3)

Barley

Maize

Rye

Wheat

PART B

Conditions to be fulfilled – Value of cultivation and use for organic varieties suitable for organic production

The examination for cultivation and use shall be conducted under organic conditions, in accordance with the provisions of Regulation (EU) 2018/848, and in particular with the general principles under Article 5(d), (e), (f) and (g) and plant production rules under Article 12.

The specific needs and objectives of organic agriculture shall be taken into account in variety examination and in the evaluation of examination results. Disease resistance or tolerance, and adaptation to diverse local soil and climate conditions, shall be examined.

Where competent authorities are not able to provide for an examination under organic conditions, or for the examination of certain characteristics, including disease susceptibility, testing may be carried out pursuant to one of the following points:

(a)	under the supervision of the competent authority on organic breeders premises or organic farms;

(b)	under low-input conditions and with minimum treatments;

(c)	in another Member State, if bilateral agreements between Member States have been concluded to achieve testing under organic conditions.

The value of a variety for cultivation or use shall be considered as satisfactory if, when compared to other organic varieties suitable for organic production accepted in the catalogue of the Member State in question, its qualities, taken as a whole, offer, at least as far as production in any given region is concerned, a clear improvement either for cultivation or for uses which can be made of the crops or the products derived therefrom. Superior characteristics for the agricultural production, as regards farming practices and food or feed production that present advantages for organic agriculture, shall be considered as particularly valuable for the VCU examination.

The competent authority shall provide for different examination conditions that are adapted to specific needs of organic agriculture and shall examine to the extent of its capacity specific traits and characteristics, at the applicant’s request, if reproducible methods are available.

’

26.9.2022

Official Journal of the European Union

L 248/52

COMMISSION IMPLEMENTING DIRECTIVE (EU) 2022/1648

of 23 September 2022

amending Directive 2003/91/EC as regards a derogation for organic varieties of vegetable species suitable for organic production

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Council Directive 2002/55/EC of 13 June 2002 on the marketing of vegetable seed (1), and in particular Article 7(2)(a) and (b) thereof,

Whereas:

(1)

Commission Directive 2003/91/EC (2) aims to ensure that the varieties of vegetable plant species that Member States include in their national catalogues comply with the protocols established by the Community Plant Variety Office (‘CPVO’). In particular, those protocols aim to ensure compliance with the rules concerning the characteristics to be covered as a minimum by the examination and the minimum conditions for examining certain varieties of vegetable species to establish distinctness, uniformity and stability (‘DUS’). For the species not covered by the CPVO protocols, that Directive aims to ensure compliance with test guidelines of the International Union for Protection of New Varieties of Plants (‘UPOV’).

(2)

(3)	Therefore, the standards for uniformity defined in the existing DUS protocols and guidelines of the CPVO and UPOV are not suitable for organic varieties for organic production, which are characterised by a high level of genetic and phenotypical diversity.

(4)

It is therefore necessary to offer the possibility to deviate from the existing DUS examination protocols so that they are more adapted for organic varieties suitable for organic production. Therefore, it should be possible to adjust the existing protocols for variety examination for certain species to meet the needs of the organic agriculture. It is therefore appropriate to derogate from certain provisions of Article 1 of Directive 2003/91/EC.

(5)

Member States should report, to the Commission and the other Member States, by 31 December of each year, until 31 December 2030, on the number of applications and results of the DUS examinations, in order to ensure a regular review of those requirements and further assess the need to amend, remove or also apply them to other species.

(6)	Directive 2003/91/EC should therefore be amended accordingly.

(7)	Competent authorities and the professional operators concerned should have sufficient time to adequately prepare before national provisions transposing this Directive start applying.

(8)	The measures provided for in this Directive are in accordance with the opinion of the Standing Committee on Plants, Animals, Food and Feed,

HAS ADOPTED THIS DIRECTIVE:

Article 1

Amendments to Directive 2003/91/EC

Directive 2003/91/EC is amended as follows:

(1)

Article 1, paragraph 2 is replaced by the following:

‘2. As regards distinctness, uniformity and stability:

(a)	the species listed in Annex I shall comply with the conditions laid down in the ‘Protocols for distinctness, uniformity and stability tests’ of the Administrative Council of the Community Plant Variety Office (CPVO) listed in that Annex;

(b)	the species listed in Annex II shall comply with the test guidelines for the conduct of tests for distinctness, uniformity and stability of the International Union for the Protection of New Varieties of Plants (UPOV) listed in that Annex.

By way of derogation from the first subparagraph, as regards uniformity, the organic varieties suitable for organic production, which belong to the species listed in Annex III, Part A, may comply instead with the conditions listed in Part B of that Annex.

(2)	The text set out in the Annex to this Directive is added as Annex III.

Article 2

Transposition

They shall apply those provisions from 1 July 2023.

2. Member States shall communicate to the Commission the text of the main provisions of national law, which they adopt in the field covered by this Directive.

Article 3

Entry into force

This Directive shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

Article 4

Addressees

This Directive is addressed to the Member States.

Done at Brussels, 23 September 2022.

For the Commission

Stella KYRIAKIDES

Member of the Commission

(1) OJ L 193, 20.7.2002, p. 33.

(2) Commission Directive 2003/91/EC of 6 October 2003 setting out implementing measures for the purposes of Article 7 of Council Directive 2002/55/EC as regards the characteristics to be covered as a minimum by the examination and the minimum conditions for examining certain varieties of vegetable species (OJ L 254, 8.10.2003, p. 11).

ANNEX

‘ANNEX III

PART A

List of species referred to in the second subparagraph of Article 1(2)

Carrot

Kohlrabi

PART B

Specific provisions concerning tests for distinctness, uniformity and stability for organic varieties of vegetable species suitable for organic production

1. General rule

The following shall apply to organic varieties of vegetable species suitable for organic production

1.1.

As regards distinctness and stability, all characteristics of the protocols and guidelines referred to in Annexes I and II shall be observed and described.

1.2.

(a)	those characteristics may be assessed in a less stringent way;

(b)	where for those characteristics a derogation from the respective technical protocol is provided for in that point 2, the level of uniformity within the variety shall be similar to the level of uniformity of comparable varieties of common knowledge in the Union.

2. Derogation from technical protocols

2.1. Carrot

For the varieties belonging to species carrot (Daucus carota L.) the following DUS characteristics of the CPVO protocol CPVO-TP/049/3 of the tested variety may deviate from the following DUS requirements for uniformity:

CPVO No 4	–	Leaf: division
CPVO No 5	–	Leaf: intensity of green colour
CPVO No 19	–	Root: diameter of core relative to total diameter
CPVO No 20	–	Root: colour of core
CPVO No 21	–	Excluding varieties with white core; Root: intensity of colour of core
CPVO No 28	–	Root: time of coloration of tip
CPVO No 29	–	Plant: height of primary umbel at time of its flowering

2.2. Kohlrabi

For the varieties belonging to species kohlrabi (Brassica oleracea L.) the following DUS characteristics of the CPVO protocol CPVO-TP/065/1 Rev. of the tested variety may deviate from the following DUS requirements for uniformity of the respective CPVO technical protocol:

CPVO No 2	–	Seedling: intensity of green coloration of cotyledons
CPVO No 6	–	Petiole: attitude
CPVO No 8	–	Leaf blade: length
CPVO No 9	–	Leaf blade: width
CPVO No 10	–	Leaf blade: shape of apex
CPVO No 11	–	Leaf blade: division to midrib (on lower part of leaf)
CPVO No 12	–	Leaf blade: number of margin incisions (on upper part of leaf)
CPVO No 13	–	Leaf blade: depth of margin incision (on upper part of leaf)
CPVO No 14	–	Leaf blade: shape in cross section
CPVO No 19	–	Kohlrabi: number of inner leave.

’

		ISSN 1977-0677
Official Journal of the European Union		L 248

English edition	Legislation	Volume 65 26 September 2022

Contents		II Non-legislative acts	page
		INTERNATIONAL AGREEMENTS
	*	Council Decision (EU) 2022/1643 of 20 September 2022 on the signing, on behalf of the Union, of the Comprehensive Air Transport Agreement between the Member States of the Association of Southeast Asian Nations, and the European Union and its Member States	1
		REGULATIONS
	*	Commission Delegated Regulation (EU) 2022/1644 of 7 July 2022 supplementing Regulation (EU) 2017/625 of the European Parliament and of the Council with specific requirements for the performance of official controls on the use of pharmacologically active substances authorised as veterinary medicinal products or as feed additives and of prohibited or unauthorised pharmacologically active substances and residues thereof ( 1 )	3
	*	Commission Delegated Regulation (EU) 2022/1645 of 14 July 2022 laying down rules for the application of Regulation (EU) 2018/1139 of the European Parliament and of the Council, as regards requirements for the management of information security risks with a potential impact on aviation safety for organisations covered by Commission Regulations (EU) No 748/2012 and (EU) No 139/2014 and amending Commission Regulations (EU) No 748/2012 and (EU) No 139/2014	18
	*	Commission Implementing Regulation (EU) 2022/1646 of 23 September 2022 on uniform practical arrangements for the performance of official controls as regards the use of pharmacologically active substances authorised as veterinary medicinal products or as feed additives and of prohibited or unauthorised pharmacologically active substances and residues thereof, on specific content of multi-annual national control plans and specific arrangements for their preparation ( 1 )	32
		DIRECTIVES
	*	Commission Implementing Directive (EU) 2022/1647 of 23 September 2022 amending Directive 2003/90/EC as regards a derogation for organic varieties of agricultural plant species suitable for organic production	46
	*	Commission Implementing Directive (EU) 2022/1648 of 23 September 2022 amending Directive 2003/91/EC as regards a derogation for organic varieties of vegetable species suitable for organic production	52
		DECISIONS
	*	Political and Security Committee Decision (CFSP) 2022/1649 of 20 September 2022 extending the mandate of the Head of Mission of the European Union CSDP mission in Niger (EUCAP Sahel Niger/1/2022)	57