HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"EN
1.11.2011 Official
Journal
of
the
European
Union L
286/1
I
(Legislative acts)
REGULATIONS
REGULATION (EU) No 1077/2011 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL
of 25 October 2011
establishing a European Agency for the operational management of large-scale IT systems in the
area of freedom, security and justice
THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE
Management Authority is to be responsible for the oper
EUROPEAN UNION,
ational management of Central SIS II and certain aspects
of the communication infrastructure.
Having regard to the Treaty on the Functioning of the European
Union and in particular Article 74, Article 77(2)(a) and (b),
(2) The
Visa
Information
System
(VIS)
was
established
by
Article 78(2)(e), Article 79(2)(c), Article 82(1)(d), Article 85(1),
Council Decision 2004/512/EC of 8 June 2004 estab
Article 87(2)(a) and Article 88(2) thereof,
lishing the Visa Information System (VIS) ( 4 ). Regulation
(EC) No 767/2008 of the European Parliament and of the
Council of 9 July 2008 concerning the Visa Information
System (VIS) and the exchange of data between Member
Having regard to the proposal from the European Commission,
States on short-stay visas (VIS Regulation) ( 5 ) provides
that the Commission is to be responsible, during a tran
sitional period, for the operational management of the
VIS. After that transitional period, a Management
After transmission of the draft legislative act to the national
Authority is to be responsible for the operational
parliaments,
management of the Central VIS and of the national
interfaces and for certain aspects of the communication
infrastructure.
Acting in accordance with the ordinary legislative procedure ( 1 ),
(3) Eurodac
was
established
by
Council
Regulation
(EC)
No 2725/2000 of 11 December 2000 concerning the
Whereas:
establishment of ‘Eurodac’ for the comparison of
fingerprints for the effective application of the Dublin
Convention ( 6 ). Council Regulation (EC) No 407/2002 ( 7 )
lays down necessary implementing rules.
(1) The
second-generation
Schengen
Information
System
(SIS II) was established by Regulation (EC)
No 1987/2006 of the European Parliament and of the
Council of 20 December 2006 on the establishment,
(4) It
is
necessary
to
establish
a
Management
Authority
in
order to ensure the operational management of SIS II,
operation and use of the second generation Schengen
VIS and Eurodac and of certain aspects of the communi
Information System (SIS II) ( 2 ) and by Council Decision
cation infrastructure after the transitional period, and
2007/533/JHA of 12 June 2007 on the establishment,
potentially that of other large-scale information tech
operation and use of the second generation Schengen
nology (IT) systems in the area of freedom, security
Information System (SIS II)
( 3 ). Regulation (EC)
and justice, subject to the adoption of separate legislative
No 1987/2006 and Decision 2007/533/JHA provide
instruments.
that the Commission is to be responsible, during a tran
sitional period, for the operational management of
Central SIS II. After that transitional period, a
( 4 ) OJ L 213, 15.6.2004, p. 5.
( 5 ) OJ L 218, 13.8.2008, p. 60.
( 6 ) OJ L 316, 15.12.2000, p. 1.
( 1 ) Position of the European Parliament of 5 July 2011 (not yet
( 7 ) Council Regulation (EC) No 407/2002 of 28 February 2002 laying
published in the Official Journal) and Decision of the Council of
down certain rules to implement Regulation (EC) No 2725/2000
12 September 2011.
concerning the establishment of ‘Eurodac’ for the comparison of
( 2 ) OJ L 381, 28.12.2006, p. 4.
fingerprints for the effective application of the Dublin Convention
( 3 ) OJ L 205, 7.8.2007, p. 63.
(OJ L 62, 5.3.2002, p. 1).

---

L 286/2
EN
Official Journal of the European Union
1.11.2011
(5) With
a
view
to
achieving
synergies,
it
is
necessary
to
required by the tasks entrusted to it, which are not of a
provide for the operational management of those large-
normative nature. Those responsibilities should be
scale IT systems in a single entity, benefiting from
without prejudice to the normative tasks reserved to
economies of scale, creating critical mass and ensuring
the Commission alone or to the Commission assisted
the highest possible utilisation rate of capital and human
by a Committee in the respective legislative instruments
resources.
governing the systems operationally managed by the
Agency.
(6)
In the joint statements accompanying the SIS II and VIS
legislative instruments, the European Parliament and the
Council invited the Commission to present, following an
(11) In
addition,
the
Agency
should
perfom
tasks
relating
to
impact assessment, the necessary legislative proposals
training on the technical use of SIS II, VIS and Eurodac
entrusting an agency with the long-term operational
and other large-scale IT systems which might be
management of Central SIS II and of certain aspects of
entrusted to it in the future.
the communication infrastructure, and of the VIS.
(12) Furthermore,
the
Agency
could
also
be
made
responsible
(7) Since
the
Management
Authority
should
have
legal,
for the preparation, development and operational
administrative and financial autonomy it should be estab
management of additional large-scale IT systems in appli
lished in the form of a regulatory agency (Agency) having
cation of Articles 67 to 89 of the Treaty on the Func
legal personality. As was agreed, the seat of the Agency
tioning of the European Union (TFEU). The Agency
should be in Tallinn (Estonia). However, since the tasks
should be entrusted with such tasks only by means of
relating to technical development and the preparation for
subsequent and separate legislative instruments, preceded
the operational management of SIS II and VIS are carried
by an impact assessment.
out in Strasbourg (France) and a backup site for those IT
systems has been installed in Sankt Johann im Pongau
(Austria), this should continue to be the case. Those two
sites should also be the locations, respectively, where the
(13) The Agency should be responsible for monitoring
tasks relating to technical development and operational
research and for carrying out pilot schemes, in
management of Eurodac should be carried out and where
accordance with Article 49(6)(a) of Council Regulation
a backup site for Eurodac should be established. Those
(EC, Euratom) No 1605/2002 of 25 June 2002 on the
two sites should also be the locations, respectively, for
Financial Regulation applicable to the general budget of
the technical development and operational management
the European Communities (
of other large-scale IT systems in the area of freedom,

1 ), for large-scale IT systems
in application of Articles 67 to 89 TFEU, at the specific
security and justice, and, if so provided in the relevant
and precise request of the Commission. When tasked
legislative instrument, for a backup site capable of
with carrying out a pilot scheme, the Agency should
ensuring the operation of a large-scale IT system in the
pay particular attention to the European Union
event of failure of that system.
Information Management Strategy.
(8) Consequently,
the
tasks
of
the
Management
Authority
set
out in Regulations (EC) No
1987/2006 and (EC)
(14) Entrusting
the
Agency
with
the
operational
management
No 767/2008 should be exercised by the Agency.
of large-scale IT systems in the area of freedom, security
Those tasks include further technical development.
and justice should not affect the specific rules applicable
to those systems. In particular, the specific rules
governing the purpose, access rights, security measures
and further data protection requirements for each large-
(9) In
accordance
with
Regulations
(EC)
No
2725/2000
and
scale IT system the operational management of which the
(EC) No 407/2002, a central Unit has been established
Agency is entrusted with, are fully applicable.
within the Commission which is responsible for the
operation of the central database of Eurodac and other
tasks relating to it. In order to exploit synergies, the
Agency should take over the Commission’s tasks
relating to the operational management of Eurodac
(15) The
Member
States
and
the
Commission
should
be
repre
including certain tasks relating to the communication
sented on a Management Board, in order to control the
infrastructure as from the date on which the Agency
functions of the Agency effectively. The Management
takes up its responsibilities.
Board should be entrusted with the necessary functions,

in particular to adopt the annual work programme, carry
out its functions relating to the Agency’s budget, adopt
the financial rules applicable to the Agency, appoint an
(10) The
core
function
of
the
Agency
should
be
to
fulfil
the
Executive Director and establish procedures for taking
operational management tasks for SIS II, VIS and
decisions relating to the operational tasks of the
Eurodac and, if so decided, other large-scale IT systems
Agency by the Executive Director.
in the area of freedom, security and justice. The Agency
should also be responsible for technical measures
( 1 ) OJ L 248, 16.9.2002, p. 1.

---

EN
1.11.2011 Official
Journal
of
the
European
Union L
286/3
(16) As
regards
SIS
II,
the
European
Police
Office
(Europol)
and discharge procedures should be applicable. The
and the European Judicial Cooperation Unit (Eurojust),
auditing of accounts and of the legality and regularity
both having the right to access and search directly data
of the underlying transactions should be undertaken by
entered into SIS II in application of Decision
the Court of Auditors.
2007/533/JHA, should have observer status at the
meetings of the Management Board when a question in
relation to the application of Decision 2007/533/JHA is
on the agenda. Europol and Eurojust should each be able
(21) Within
the
framework
of
their
respective
competences,
to appoint a representative to the SIS II Advisory Group
the Agency should cooperate with other agencies of the
established under this Regulation.
Union, in particular those established in the area of

freedom, security and justice, and, in particular, the
European Union Agency for Fundamental Rights. It
should also consult and follow up the recommendations
(17) As regards VIS, Europol should have observer status at
of the European Network and Information Security
the meetings of the Management Board, when a question
Agency regarding network security, where appropriate.
in relation to the application of Council Decision
2008/633/JHA of 23 June 2008 concerning access for
consultation of the Visa Information System (VIS) by
designated authorities of Member States and by Europol
(22) When ensuring the development and the operational
for the purposes of the prevention, detection and inves
management of large-scale IT systems, the Agency
tigation of terrorist offences and of other serious criminal
should follow European and international standards
offences (
taking into account the highest professional

1 ) is on the agenda. Europol should be able to
appoint a representative to the VIS Advisory Group
requirements, in particular the European Union
established under this Regulation.
Information Management Strategy.
(18) Member States should have voting rights on the
(23) Regulation
(EC)
No
45/2001
of
the
European
Parliament
Management Board of the Agency concerning a large-
and of the Council of 18 December 2000 on the
scale IT system, if they are bound under Union law by
protection of individuals with regard to the processing
any legislative instrument governing the development,
of personal data by the Community institutions and
establishment, operation and use of that particular
bodies and on the free movement of such data ( 3 )
system. Denmark should also have voting rights
should apply to the processing of personal data by the
concerning a large-scale IT system, if it decides under
Agency. The European Data Protection Supervisor should
Article 4 of the Protocol (No 22) on the position of
be able to obtain from the Agency access to all
Denmark, annexed to the Treaty on European Union
information necessary for his or her enquiries. In
(TEU) and the TFEU, (Protocol on the position of
accordance with Article 28 of Regulation (EC)
Denmark) to implement the legislative instrument
No 45/2001, the Commission consulted the European
governing the development, establishment, operation
Data Protection Supervisor, who delivered his opinion
and use of that particular system in its national law.
on 7 December 2009.
(19) Member States should appoint a Member to the Advisory
(24) In
order
to
ensure
the
transparent
operation
of
the
Group concerning a large-scale IT system, if they are
Agency, Regulation (EC) No
1049/2001 of the
bound under Union law by any legislative instrument
European Parliament and of the Council of 30 May
governing the development, establishment, operation
2001 regarding public access to European Parliament,
and use of that particular system. Denmark should, in
Council and Commission documents ( 4 ) should apply to
addition, appoint a Member to the Advisory Group
the Agency. The activities of the Agency should be
concerning a large-scale IT system, if it decides under
subject to the scrutiny of the European Ombudsman in
Article 4 of the Protocol on the position of Denmark
accordance with Article 228 TFEU.
to implement the legislative instrument governing the
development, establishment, operation and use of that
particular system in its national law.
(25) Regulation (EC) No
1073/1999 of the European
Parliament and of the Council of 25 May 1999
concerning investigations conducted by the European
(20) In order to guarantee
its full autonomy and inde
Anti-Fraud Office (OLAF)
( 5 ) should apply to the
pendence, the Agency should be granted an autonomous
Agency, which should accede to the Interinstitutional
budget with revenue from the general budget of the
Agreement of 25 May 1999 between the European
European Union. The financing of the Agency should
Parliament, the Council of the European Union and the
be subject to an agreement by the budgetary authority
Commission of the European Communities concerning
as set out in point 47 of the Interinstitutional Agreement
internal investigations by the European Anti-Fraud
of 17 May 2006 between the European Parliament, the
Office (OLAF) ( 6 ).
Council and the Commission on budgetary discipline and
sound financial management ( 2 ). The Union budgetary
( 3 ) OJ L 8, 12.1.2001, p. 1.
( 4 ) OJ L 145, 31.5.2001, p. 43.
( 1 ) OJ L 218, 13.8.2008, p. 129.
( 5 ) OJ L 136, 31.5.1999, p. 1.
( 2 ) OJ C 139, 14.6.2006, p. 1.
( 6 ) OJ L 136, 31.5.1999, p. 15.

---

L 286/4
EN
Official Journal of the European Union
1.11.2011
(26) The Agency’s host Member States should provide the best
Schengen acquis, Denmark shall, in accordance with
possible conditions to ensure the proper functioning of
Article 4 of that Protocol, decide within a period of 6
the Agency, for example including multilingual,
months of the date of adoption of this Regulation
European-oriented schooling and appropriate transport
whether it will implement it in its national law. In
connections.
accordance with Article 3 of the Agreement between
the European Community and the Kingdom of
Denmark on the criteria and mechanisms for establishing
the State responsible for examining a request for asylum
(27) In order to ensure open and transparent employment
lodged in Denmark or any other Member State of the
conditions and equal treatment of staff, the Staff Regu
European Union and ‘Eurodac’ for the comparison of
lations of Officials of the European Union (Staff Regu
fingerprints for the effective application of the Dublin
lations of Officials) and the Conditions of Employment of
Convention ( 3 ), Denmark is to notify the Commission
Other Servants of the European Union (Conditions of
whether it will implement the contents of this Regu
Employment), laid down in Regulation (EEC, Euratom,
lation, insofar as it relates to Eurodac.
ECSC) No 259/68 ( 1 ) (together referred to as the ‘Staff
Regulations’), should apply to the staff and to the
Executive Director of the Agency, including the rules of
professional secrecy or other equivalent duties of confi
(33) Insofar as its provisions relate to SIS II as governed by
dentiality.
Decision 2007/533/JHA, the United Kingdom is taking
part in this Regulation, in accordance with Article 5(1) of
Protocol (No 19) on the Schengen acquis integrated into
the framework of the European Union, annexed to the
(28) The Agency is a body set up by the Union in the sense of
TEU and to the TFEU (Protocol on the Schengen acquis),
Article 185(1) of Regulation (EC, Euratom)
and Article 8(2) of Council Decision 2000/365/EC of
No 1605/2002 and should adopt its financial rules
29 May 2000 concerning the request of the United
accordingly.
Kingdom of Great Britain and Northern Ireland to take
part in some of the provisions of the Schengen acquis ( 4 ).
(29) Commission
Regulation
(EC,
Euratom)
No
2343/2002
( 2 )
on the framework Financial Regulation for the bodies
Insofar as its provisions relate to SIS II as governed by
referred to in Article 185 of Regulation (EC, Euratom)
Regulation (EC) No 1987/2006 and to VIS, which
No 1605/2002 should apply to the Agency.
constitute developments of provisions of the Schengen
acquis in which the United Kingdom does not take part in
accordance with Decision 2000/365/EC, the United
Kingdom requested, by letter of 5 October 2010 to the
(30) Since the objectives of this Regulation, namely the estab
President of the Council, to be authorised to take part in
lishment of an Agency at Union level responsible for the
the adoption of this Regulation, in accordance with
operational management and where appropriate the
Article 4 of the Protocol on the Schengen acquis. By
development of large-scale IT systems in the area of
virtue of Article 1 of Council Decision 2010/779/EU of
freedom, security and justice cannot be sufficiently
14 December 2010 concerning the request of the United
achieved by the Member States and can therefore, by
Kingdom of Great Britain and Northern Ireland to take
reason of the scale and effects of the action, be better
part in some of the provisions of the Schengen acquis
achieved at Union level, the Union may adopt measures
relating to the establishment of a European Agency for
in accordance with the principle of subsidiarity as set out
the operational management of large-scale IT systems in
in Article 5 TEU. In accordance with the principle of
the area of freedom, security and justice ( 5 ), the United
proportionality, as set out in that Article, this Regulation
Kingdom has been authorised to take part in this Regu
does not go beyond what is necessary to achieve those
lation.
objectives.
Furthermore, insofar as its provisions relate to Eurodac,
(31) This
Regulation
respects
fundamental
rights
and
observes
the United Kingdom has notified, by letter of
the principles recognised by the Charter of Fundamental
23 September 2009 to the President of the Council, its
Rights of the European Union in accordance with
wish to take part in the adoption and application of this
Article 6(1) TEU.
Regulation, in accordance with Article 3 of Protocol
(No 21) on the position of the United Kingdom and
Ireland in respect of the area of freedom, security and
justice, annexed to the TEU and to the TFEU (Protocol on
(32) In accordance with Articles 1 and 2 of the Protocol on
the position of the United Kingdom and Ireland). The
the Position of Denmark, Denmark is not taking part in
United Kingdom therefore takes part in the adoption of
the adoption of this Regulation and is not bound by it or
this Regulation, is bound by it and subject to its appli
subject to its application. Given that this Regulation,
cation.
insofar as it relates to SIS II and VIS, builds upon the
( 3 ) OJ L 66, 8.3.2006, p. 38.
( 1 ) OJ L 56, 4.3.1968, p. 1.
( 4 ) OJ L 131, 1.6.2000, p. 43.
( 2 ) OJ L 357, 31.12.2002, p. 72.
( 5 ) OJ L 333, 17.12.2010, p. 58.

---

EN
1.11.2011 Official
Journal
of
the
European
Union L
286/5
(34) Insofar
as
its
provisions
relate
to
SIS
II
as
governed
by
(36) As regards Switzerland, this Regulation constitutes,
Regulation (EC) No 1987/2006 and to VIS, this Regu
insofar as it relates to SIS II and VIS, a development of
lation constitutes a development of provisions of the
the provisions of the Schengen acquis within the meaning
Schengen acquis in which Ireland does not take part, in
of the Agreement between the European Union, the
accordance with Council Decision 2002/192/EC of
European Community and the Swiss Confederation on
28 February 2002 concerning Ireland’s request to take
the Swiss Confederation’s association with the implemen
part in some of the provisions of the Schengen acquis ( 1 ).
tation, application and development of the Schengen
acquis ( 5 ) which fall within the area referred to in
Article 1, points A, B and G of Decision 1999/437/EC
read in conjunction with Article 3 of Council Decision
Ireland has not requested to take part in the adoption of
2008/146/EC (
this Regulation, in accordance with Article 4 of the

6 ). As regards Eurodac, this Regulation
constitutes a new measure related to Eurodac within
Protocol on the Schengen acquis. Ireland is therefore
the meaning of the Agreement between the European
not taking part in the adoption of this Regulation and
Community and the Swiss Confederation concerning
is not bound by it or subject to its application to the
the criteria and mechanisms for establishing the State
extent that its measures develop provisions of the
responsible for examining a request for asylum lodged
Schengen acquis as they relate to SIS II as governed by
in a Member State or in Switzerland (
Regulation (EC) No 1987/2006 and to VIS.

7 ). Consequently,
subject to its decision to implement it in their internal
legal order, the delegation of the Swiss Confederation
should participate in the Management Board of the
Insofar as its provisions relate to Eurodac, in accordance
Agency. In order to determine further detailed rules, for
with Articles 1 and 2 of the Protocol on the position of
example voting rights, allowing for the participation of
the United Kingdom and Ireland, Ireland is not taking
the Swiss Confederation in the activities of the Agency, a
part in the adoption of this Regulation and is not bound
further arrangement should be concluded between the
by it or subject to its application. Since it is not possible,
Union and the Swiss Confederation.
under these circumstances, to ensure the applicability of
this Regulation to Ireland in its entirety, as required by
Article 288 TFEU, Ireland is not taking part in the
adoption of this Regulation and is not bound by it or
subject to its application, without prejudice to its rights
(37) As regards Liechtenstein, this Regulation constitutes,
under the aforementioned Protocols.
insofar as it relates to SIS II and VIS, a development of
the provisions of the Schengen acquis within the meaning
of the Protocol between the European Union, the
European Community, the Swiss Confederation and the
(35) As regards Iceland and Norway, this Regulation
Principality of Liechtenstein on the accession of the Prin
constitutes, insofar as it relates to SIS II and VIS, a devel
cipality of Liechtenstein to the Agreement between the
opment of the provisions of the Schengen acquis within
European Union, the European Community and the
the meaning of the Agreement concluded by the Council
Swiss Confederation on the Swiss Confederation’s
of the European Union and the Republic of Iceland and
association with the implementation, application and
the Kingdom of Norway concerning the latters’
development of the Schengen acquis ( 8 ) which fall
association with the implementation, application and
within the area referred to in Article 1, points A, B
development of the Schengen acquis ( 2 ) which fall
and G of Decision 1999/437/EC read in conjunction
within the area referred to in Article 1, points A, B
with Article 3 of Council Decision 2011/350/EU ( 9 ). As
and G of Council Decision 1999/437/EC of 17 May
regards Eurodac, this Regulation constitutes a new
1999 on certain arrangements for the application of
measure related to Eurodac within the meaning of the
that Agreement ( 3 ). As regards Eurodac, this Regulation
Protocol between the European Community, the Swiss
constitutes a new measure related to Eurodac within the
Confederation and the Principality of Liechtenstein on
meaning of the Agreement between the European
the accession of the Principality of Liechtenstein to the
Community and the Republic of Iceland and the
Agreement between the European Community and the
Kingdom of Norway concerning the criteria and
Swiss Confederation concerning the criteria and
mechanisms for establishing the State responsible for
mechanisms for establishing the State responsible for
examining a request for asylum lodged in a Member
examining a request for asylum lodged in a Member
State or in Iceland or Norway ( 4 ). Consequently, subject
State or in Switzerland ( 10 ). Consequently, the delegation
to their decision to implement it in their internal legal
of the Principality of Liechtenstein should participate in
order, delegations of the Republic of Iceland and the
the Management Board of the Agency. In order to
Kingdom of Norway should participate in the
determine further detailed rules, for example voting
Management Board of the Agency. In order to
rights, allowing for the participation of the Principality
determine further detailed rules, for example voting
of Liechtenstein in the activities of the Agency, a further
rights, allowing for the participation of the Republic of
arrangement should be concluded between the Union
Iceland and the Kingdom of Norway in the activities of
and the Principality of Liechtenstein,
the Agency, a further arrangement should be concluded
between the Union and these States.
( 5 ) OJ L 53, 27.2.2008, p. 52.
( 6 ) OJ L 53, 27.2.2008, p. 1.
( 1 ) OJ L 64, 7.3.2002, p. 20.
( 7 ) OJ L 53, 27.2.2008, p. 5.
( 2 ) OJ L 176, 10.7.1999, p. 36.
( 8 ) OJ L 160, 18.6.2011, p. 21.
( 3 ) OJ L 176, 10.7.1999, p. 31.
( 9 ) OJ L 160, 18.6.2011, p. 19.
( 4 ) OJ L 93, 3.4.2001, p. 40.
( 10 ) OJ L 160, 18.6.2011, p. 39.

---

L 286/6
EN
Official Journal of the European Union
1.11.2011
HAVE ADOPTED THIS REGULATION:
(e) a high level of data protection, in accordance with the
applicable rules, including specific provisions for each
large-scale IT system;
CHAPTER I
SUBJECT MATTER
(f) an appropriate level of data and physical security, in
accordance with the applicable rules, including specific
Article 1
provisions for each large-scale IT system; and
Establishment of the Agency
(g) the use of an adequate project management structure for
1. A
European
agency
for
the
operational
management
of
efficiently developing large-scale IT systems.
large-scale IT systems in the area of freedom, security and
justice (the Agency) is hereby established.
CHAPTER II
2. The
Agency
shall
be
responsible
for
the
operational
TASKS
management of the second-generation Schengen Information
Article 3
System (SIS II), the Visa Information System (VIS) and Eurodac.
Tasks relating to SIS II
In relation to SIS II, the Agency shall perform:
3. The
Agency
may
also
be
made
responsible
for
the
prep
aration, development and operational management of large-
scale IT systems in the area of freedom, security and justice
(a) the tasks conferred on the Management Authority by Regu
other than those referred to in paragraph 2, only if so
lation (EC) No 1987/2006 and Decision 2007/533/JHA;
provided by relevant legislative instruments, based on Articles
and
67 to 89 TFEU, taking into account, where appropriate, the
developments in research referred to in Article 8 of this Regu
lation and the results of pilot schemes referred to in Article 9 of
(b) tasks relating to training on the technical use of SIS II, in
this Regulation.
particular for SIRENE-staff (SIRENE — Supplementary
Information Request at the National Entries) and training
of experts on the technical aspects of SIS II in the
4. Operational
management
shall
consist
of
all
the
tasks
framework of Schengen evaluation.
necessary to keep large-scale IT systems functioning in
accordance with the specific provisions applicable to each of
them, including responsibility for the communication infra
Article 4
structure used by them. Those large-scale IT systems shall not
Tasks relating to VIS
exchange data or enable sharing of information or knowledge,
unless so provided in a specific legal basis.
In relation to VIS, the Agency shall perform:
(a) the tasks conferred on the Management Authority by Regu
Article 2
lation (EC) No 767/2008 and Decision 2008/633/JHA; and
Objectives
Without prejudice to the respective responsibilities of the
(b) tasks relating to training on the technical use of VIS.
Commission and of the Member States under the legislative
instruments governing large-scale IT systems, the Agency shall
ensure:
Article 5
Tasks relating to Eurodac
(a) effective, secure and continuous operation of large-scale IT
In relation to Eurodac, the Agency shall perform:
systems;
(a) the tasks conferred on the Commission as the authority
responsible for the operational management of Eurodac in
(b) the efficient and financially accountable management of
accordance with Regulations (EC) No 2725/2000 and (EC)
large-scale IT systems;
No 407/2002;
(c) an adequately high quality of service for users of large-scale
(b) tasks relating to the communication infrastructure, namely:
IT systems;
supervision, security and coordination of relations between
the Member States and the provider; and
(d) continuity and uninterrupted service;
(c) tasks relating to training on the technical use of Eurodac.

---

EN
1.11.2011 Official
Journal
of
the
European
Union L
286/7
Article 6
Article 8
Tasks relating to the preparation, development and
Monitoring of research
operational management of other large-scale IT systems
1. The
Agency
shall
monitor
the
developments
in
research
When entrusted with the preparation, development and oper
relevant for the operational management of SIS II, VIS, Eurodac
ational management of other large-scale IT systems referred to
and other large-scale IT systems.
in Article 1(3), the Agency shall perform tasks relating to
training on the technical use of those systems, as appropriate.
2. The
Agency
shall
on
a
regular
basis
keep
the
European
Parliament, the Council, the Commission, and, where data
Article 7
protection issues are concerned, the European Data Protection
Supervisor, informed of the developments referred to in
Tasks relating to the communication infrastructure
paragraph 1.
1. The
Agency
shall
carry
out
the
tasks
relating
to
the
communication infrastructure conferred on the Management
Authority by the legislative instruments governing the devel
Article 9
opment, establishment, operation and use of large-scale IT
systems referred to in Article 1(2).
Pilot schemes
1. Only
upon
the
specific
and
precise
request
of
the
Commission, which shall have informed the European
2. According to the legislative instruments referred to in
Parliament and the Council at least 3 months in advance, and
paragraph 1, the tasks regarding the communication infra
after a decision by the Management Board, the Agency may, in
structure (including the operational management and security)
accordance with Article 12(1)(l), carry out pilot schemes as
are divided between the Agency and the Commission. In order
referred to in Article 49(6)(a) of Regulation (EC, Euratom)
to ensure coherence between the exercise of their respective
No
1605/2002, for the development or the operational
responsibilities, operational working arrangements shall be
management of large-scale IT systems, in the application of
made between the Agency and the Commission and reflected
Articles 67 to 89 TFEU.
in a Memorandum of Understanding.
The Agency shall on a regular basis keep the European
3. The
communication
infrastructure
shall
be
adequately Parliament, the Council and, where data protection issues are
managed and controlled in order to protect it from threats,
concerned, the European Data Protection Supervisor, informed
and to ensure its security and that of large-scale IT systems,
of the evolution of the pilot schemes referred to in the first
including that of data exchanged through the communication
subparagraph.
infrastructure.
2. Financial
appropriations
for
pilot
schemes
as
requested
by
4. Appropriate
measures
including
security
plans
shall
be the Commission shall be entered in the budget for no more
adopted, inter alia, to prevent the unauthorised reading,
than two successive financial years.
copying, modification or deletion of personal data during
transfers of personal data or transport of data media, in
particular by means of appropriate encryption techniques. No
system-related operational information shall circulate in the
CHAPTER III
communication infrastructure without encryption.
STRUCTURE AND ORGANISATION
Article 10
5. Tasks
relating
to
the
operational
management
of
the
Legal status
communication infrastructure may be entrusted to external
private-sector entities or bodies in accordance with Regulation
1. The
Agency
shall
be
a
Union
body
and
shall
have
legal
(EC, Euratom) No 1605/2002. In such a case, the network
personality.
provider shall be bound by the security measures referred to
in paragraph 4 and shall have no access to SIS II, VIS or
Eurodac operational data, or to the SIS II-related SIRENE
exchange, by any means.
2. In each of the Member States, the Agency shall enjoy the
most extensive legal capacity accorded to legal persons under
national law. It may, in particular, acquire or dispose of
movable and immovable property and may be a party to
6. Without
prejudice
to
the
existing
contracts
on
the legal proceedings. It may also conclude agreements concerning
network of SIS II, VIS and Eurodac, the management of the
the seat of the Agency and the sites set up in accordance with
encryption keys shall remain within the competence of the
paragraph 4 with the Member States on whose territories the
Agency and shall not be outsourced to any external private-
seat and the technical and backup sites are situated (host
sector entity.
Member States).

---

L 286/8
EN
Official Journal of the European Union
1.11.2011
3. The
Agency
shall
be
represented
by
its
Executive
Director.
(c) establish the Agency’s organisational structure after
consulting the Commission;
4. The seat of the Agency shall be Tallinn, Estonia.
(d) establish the rules of procedure of the Agency after
consulting the Commission;
The tasks relating to development and operational management
referred to in Article 1(3) and Articles 3, 4, 5 and 7 shall be
carried out in Strasbourg, France.
(e) approve, following a proposal by the Executive Director,
the Headquarters Agreement concerning the seat of the
Agency and Agreements concerning the technical and
A backup site capable of ensuring the operation of a large-scale
backup sites set up in accordance with Article 10(4) to
IT system in the event of a failure of such a system shall be
be signed by the Executive Director with the host
installed in Sankt Johann im Pongau, Austria, if a backup site is
Member States;
provided for in the legislative instrument governing its devel
opment, establishment, operation and use.
(f) in agreement with the Commission, adopt the necessary
Article 11
implementing measures referred to in Article 110 of the
Staff Regulations of Officials;
Structure
1. The
Agency’s
administrative
and
management
structure
shall comprise:
(g) adopt the necessary implementing measures on the
secondment of national experts to the Agency;
(a) a Management Board;
(h) adopt a multi-annual work programme based on the tasks
referred to in Chapter II on the basis of a draft submitted
(b) an Executive Director;
by the Executive Director as referred to in Article 17, after
consulting the Advisory Groups referred to in Article 19,
and following receipt of the Commission’s opinion. The
(c) Advisory Groups.
multi-annual work programme shall, without prejudice to
the annual budgetary procedure, include a multi-annual
budget estimate and ex ante evaluations in order to
structure the objectives and the different stages of the
2. The
Agency’s
structure
shall
also
include:
multi-annual planning;
(a) a Data Protection Officer;
(i) adopt a multi-annual staff policy plan and a draft annual
work programme and submit them by 31 March each year
to the Commission and the budgetary authority;
(b) a Security Officer;
(c) an Accounting Officer.
(j) by
30
September
each
year,
and
after
receiving
the
opinion
of the Commission, adopt by a two-thirds majority of its
members with the right to vote, and in accordance with the
annual budgetary procedure and the Union legislative
Article 12
programme in areas under Articles 67 to 89 TFEU, the
Functions of the Management Board
Agency’s annual work programme for the following year;
and ensure that the adopted work programme is trans
1. In
order
to
ensure
that
the
Agency
carry
out
its
tasks,
the
mitted to the European Parliament, the Council and the
Management Board shall:
Commission and published;
(a) appoint, and if appropriate dismiss, the Executive Director,
(k) by 31 March each year, adopt the Agency’s annual activity
in accordance with Article 18;
report for the previous year comparing, in particular, the
results achieved with the objectives of the annual work
programme and transmit it by 15 June of the same year
(b) exercise disciplinary authority over the Executive Director
to the European Parliament, the Council, the Commission
and oversee his performance including the implementation
and the Court of Auditors; the annual activity report shall
of the Management Board’s decisions;
be published;

---

EN
1.11.2011 Official
Journal
of
the
European
Union L
286/9
(l) carry out its functions relating to the Agency’s budget,
(x) compile statistics on the work of the Central Unit of
including the implementation of pilot schemes as referred
Eurodac pursuant to Article 3(3) of Regulation (EC)
to in Article 9, pursuant to Article 32, Article 33(6) and
No 2725/2000;
Article 34;
(y) ensure annual publication of the list of competent
(m) adopt the financial rules applicable to the Agency in
authorities authorised to search directly the data
accordance with Article 34;
contained in SIS II pursuant to Article 31(8) of Regulation
(EC) No
1987/2006 and Article 46(8) of Decision
2007/533/JHA, together with the list of Offices of the
national systems of SIS II (N.SIS II) and SIRENE Bureaux
(n) appoint an Accounting Officer who shall be functionally
as referred to in Article 7(3) of Regulation (EC)
independent in the performance of his duties;
No 1987/2006 and Article 7(3) of Decision 2007/533/JHA
respectively;
(o) ensure adequate follow-up to the findings and recommen
(z) ensure annual publication of the list of authorities
dations stemming from the various internal or external
designated pursuant to Article 15(2) of Regulation (EC)
audit reports and evaluations;
No 2725/2000;
(p) adopt the necessary security measures, including a security
(aa) perform any other tasks conferred on it in accordance with
plan and a business continuity and disaster recovery plan,
this Regulation.
taking into account the possible recommendations of the
security experts present in the Advisory Groups;
2. The
Management
Board
may
advise
the
Executive
Director
on any matter strictly related to the development or operational
(q) appoint a Security Officer;
management of large-scale IT systems.
Article 13
(r) appoint
a
Data
Protection
Officer
in
accordance
with
Regu
lation (EC) No 45/2001;
Composition of the Management Board
1. The
Management
Board
shall
be
composed
of
one
repre
sentative of each Member State and two representatives of the
(s) adopt, by 22 May 2012, the practical arrangements for
Commission.
implementing Regulation (EC) No 1049/2001;
2. Each
Member
State
and
the
Commission
shall
appoint
the
members of the Management Board as well as alternate
(t) adopt the reports on the technical functioning of SIS II
members, by 22 January 2012. After the expiry of that
pursuant to Article 50(4) of Regulation (EC)
period, the Commission shall convene the Management Board.
No 1987/2006
and
Article
66(4)
of
Decision
In their absence, members shall be represented by their
2007/533/JHA respectively and of VIS pursuant to
alternates.
Article 50(3) of Regulation (EC) No
767/2008 and
Article 17(3) of Decision 2008/633/JHA;
3. The
members
of
the
Management
Board
shall
be
appointed on the basis of the high level of their relevant
(u) adopt the annual report on the activities of the Central
experience and expertise in the field of large-scale IT systems
Unit of Eurodac pursuant to Article 24(1) of Regulation
in the area of freedom, security and justice, and knowledge in
(EC) No 2725/2000;
data protection.
4.
The term of office of the members shall be 4 years. It may
(v) make comments on the European Data Protection Super
be renewed once. Upon expiry of their term of office or in the
visor’s reports on the audits pursuant to Article 45 of
event of their resignation, members shall remain in office until
Regulation (EC) No 1987/2006 and Article 42(2) of Regu
their appointments are renewed or until they are replaced.
lation (EC) No 767/2008 and ensure appropriate follow-up
of the audits;
5. Countries
associated
with
the
implementation,
application
and development of the Schengen acquis and Eurodac-related
(w) publish statistics related to SIS II pursuant to Article 50(3)
measures shall participate in the activities of the Agency. They
of Regulation (EC) No 1987/2006 and Article 66(3) of
shall each appoint one representative and an alternate to the
Decision 2007/533/JHA respectively;
Management Board.

---

L 286/10
EN
Official Journal of the European Union
1.11.2011
Article 14
Article 16
Chairmanship of the Management Board
Voting
1. The Management Board shall elect a Chairperson and a
1. Without
prejudice
to
paragraph
5
of
this
Article,
and
to
deputy Chairperson from among its members.
Article 12(1)(j) and Article 18(1) and (7), decisions of the
Management Board shall be taken by a majority of all its
members with a right to vote.
2. The term of office of the Chairperson and the deputy
Chairperson shall be 2 years. Their term of office may be
renewed once. If, however, their membership of the
Management Board ends at any time during their term of
2. Without
prejudice
to
paragraph
3,
each
member
in
the
office, their term of office shall automatically expire on that
Management Board shall have one vote.
date also.
3. The
Chairperson
and
the
deputy
Chairperson
shall
be 3. Each
member
appointed
by
a
Member
State
which
is
elected only from among those members of the Management
bound under Union law by any legislative instrument
Board who are appointed by Member States which are fully
governing the development, establishment, operation and use
bound under Union law by the legislative instruments
of a large-scale IT system managed by the Agency may vote
governing the development, establishment, operation and use
on a question which concerns that large-scale IT system.
of all large-scale IT systems managed by the Agency.
Article 15
In addition, as regards Denmark, it may vote on a question
which concerns such a large-scale IT system, if it decides
Meetings of the Management Board
under Article 4 of the Protocol on the position of Denmark
to implement the legislative instrument governing the devel
1. The
meetings
of
the
Management
Board
shall
be
convened opment, establishment, operation and use of such a large-
at the request of any of the following:
scale IT system in its national law.
(a) its Chairperson;
4. Regarding
countries
associated
with
the
implementation,
application and development of the Schengen acquis and
(b) at least a third of its members;
Eurodac-related measures, Article 37 shall apply.
(c) the Commission;
5. In
the
case
of
a
disagreement
among
members
about
(d) the Executive Director.
whether a specific large-scale IT system is affected by a vote,
any decision that it is not so affected shall be taken by a two-
thirds majority.
The Management Board shall hold at least one ordinary meeting
every 6 months.
6. The
Executive
Director
shall
not
vote.
2. The
Executive
Director
shall
participate
in
the
meetings
of
the Management Board.
7. More
detailed
voting
arrangements
shall
be
established
in
3. The
members
of
the
Management
Board
may
be
assisted the rules of procedure of the Agency, in particular the
by experts who are members of the Advisory Groups.
conditions under which a member may act on behalf of
another member as well as any quorum requirements, where
appropriate.
4. Europol
and
Eurojust
may
attend
the
meetings
of
the
Management Board as observers when a question concerning
SIS II in relation to the application of Decision 2007/533/JHA
Article 17
is on the agenda. Europol may also attend the meetings of the
Management Board as an observer when a question concerning
Functions and powers of the Executive Director
VIS, in relation to the application of Decision 2008/633/JHA, is
on the agenda.
1. The
Agency
shall
be
managed
and
represented
by
its
Executive Director.
5. The
Management
Board
may
invite
any
other
person
whose opinion may be of interest, to attend its meetings as
an observer.
2. The
Executive
Director
shall
be
independent
in
the
performance of his duties. Without prejudice to the respective
competences of the Commission and the Management Board,
6. The
Agency
shall
provide
the
Management
Board
with
a the Executive Director shall neither seek nor take instructions
secretariat.
from any government or other body.

---

EN
1.11.2011 Official
Journal
of
the
European
Union L
286/11
3. Without
prejudice
to
Article
12,
the
Executive
Director (b) the financial rules applicable to the Agency;
shall assume full responsibility for the tasks entrusted to the
Agency and shall be subject to the procedure for annual
discharge by the European Parliament for the implementation
of the budget.
(c) the multi-annual work programme;
4. The
European
Parliament
or
the
Council
may
invite
the (d) the budget for the coming year, established on the basis of
Executive Director to report on the implementation of his tasks.
activity-based budgeting;
5. The
Executive
Director
shall:
(e) the multi-annual Staff Policy Plan;
(a) ensure the Agency’s day-to-day administration;
(f) the terms of reference for the evaluation referred to in
(b) ensure the Agency’s operation in accordance with this Regu
Article 31;
lation;
(c) prepare and implement the procedures, decisions, strategies,
(g) the practical arrangements for implementing Regulation
programmes and activities adopted by the Management
(EC) No 1049/2001;
Board, within the limits specified by this Regulation, its
implementing rules and the applicable law;
(h) the necessary security measures including a security plan,
(d) establish and implement an effective system enabling regular
and a business continuity and disaster recovery plan;
monitoring and evaluations of:
(i) large-scale IT systems, including statistics; and
(i) reports on the technical functioning of each large-scale IT
system referred to in Article 12(1)(t) and the annual report
on the activities of the Central Unit of Eurodac referred to
(ii) the Agency, including the effective and efficient
in Article 12(1)(u), on the basis of the results of monitoring
achievement of its objectives;
and evaluation;
(e) participate, without the right to vote, in the meetings of the
Management Board;
(j) the annual list, for publication, of competent authorities
authorised to search directly the data contained in SIS II,
including the list of N.SIS II Offices and SIRENE Bureaux,
(f) exercise with respect to the Agency’s staff the powers laid
referred to in Article 12(1)(y) and the list of authorities
down in Article 20(3) and manage staff matters;
referred to in Article 12(1)(z).
(g) without prejudice to Article 17 of the Staff Regulations of
7. The
Executive
Director
shall
perform
any
other
tasks
in
Officials, establish confidentiality requirements in order to
accordance with this Regulation.
comply with Article 17 of Regulation (EC) No 1987/2006,
Article 17 of Decision 2007/533/JHA and Article 26(9) of
Regulation (EC) No 767/2008 respectively and in order to
apply appropriate rules of professional secrecy or other
Article 18
equivalent duties of confidentiality to the Agency’s staff
required to work with Eurodac data;
Appointment of the Executive Director
1. The
Management
Board
shall
appoint
the
Executive
(h) negotiate and, after approval by the Management Board,
Director for a term of office of 5 years from a list of eligible
sign a Headquarters Agreement concerning the seat of the
candidates identified in an open competition organised by the
Agency and Agreements concerning technical and backup
Commission. The selection procedure shall provide for publi
sites with the Governments of the host Member States.
cation in the Official Journal of the European Union and elsewhere
of a call for expressions of interest. The Management Board may
require a repeated procedure if it is not satisfied with the suit
6. The
Executive
Director
shall
submit
to
the
Management ability of any of the candidates retained in the list. The
Board for adoption, in particular, the drafts of the following:
Management Board shall appoint the Executive Director on
the basis of personal merit, experience in the field of large-
scale IT systems and administrative, financial and management
(a) the Agency’s annual work programme and its annual
skills as well as knowledge in data protection. The Management
activity report, after prior consultation of the Advisory
Board shall take its decision to appoint the Executive Director
Groups;
by a two-thirds majority of all its members with a right to vote.

---

L 286/12
EN
Official Journal of the European Union
1.11.2011
2. Before
appointment,
the
candidate
selected
by
the 2. Each
Member
State
which
is
bound
under
Union
law
by
Management Board shall be invited to make a statement
any legislative instrument governing the development, estab
before the competent committee(s) of the European Parliament
lishment, operation and use of a particular large-scale IT
and answer questions from the committee members. After such
system, as well as the Commission, shall appoint one member
a statement, the European Parliament shall adopt an opinion
to the Advisory Group relating to that large-scale IT system, for
setting out its view of the selected candidate. The Management
a three-year term, which may be renewed.
Board shall inform the European Parliament of the manner in
which that opinion has been taken into account. The opinion
shall be treated as personal and confidential until the
appointment of the candidate.
As regards Denmark, it shall also appoint a member to an
Advisory Group relating to a large-scale IT system, if it
decides under Article 4 of the Protocol on the position of
3. In the course of the 9 months preceding the end of the
Denmark to implement the legislative instrument governing
five-year term of office, the Management Board, in close consul
the development, establishment, operation and use of that
tation with the Commission, shall undertake an evaluation in
particular large-scale IT system in its national law.
which it shall assess, in particular, the results achieved during
the Executive Director’s first term of office and how they were
achieved.
Each country associated with the implementation, application
and development of the Schengen acquis, Eurodac-related
4. The Management Board, taking into account the measures and the measures related to other large-scale IT
evaluation report, and only in those cases where it can be
systems which participates in a particular large-scale IT system
justified by the objectives and tasks of the Agency, may
shall appoint a member to the Advisory Group relating to that
extend the term of office of the Executive Director once for
large-scale IT system.
up to 3 years.
3. Europol
and
Eurojust
may
each
appoint
a
representative
5. The
Management
Board
shall
inform
the
European to the SIS II Advisory Group. Europol may also appoint a
Parliament about its intention to extend the Executive Director’s
representative to the VIS Advisory Group.
term of office. Within the month before any such extension, the
Executive Director shall be invited to make a statement before
the competent committee(s) of the European Parliament and
answer questions from the committee members.
4. Members
of
the
Management
Board
shall
not
be
members
of any of the Advisory Groups. The Executive Director or the
Executive Director’s representative shall be entitled to attend all
6. The
Executive
Director
shall
be
accountable
to
the the meetings of the Advisory Groups as observers.
Management Board.
7. The
Management
Board
may
dismiss
the
Executive 5. The
procedures
for
the
operation
and
cooperation
of
the
Director. The Management Board shall take such a decision
Advisory Groups shall be laid down in the Agency’s rules of
by a two-thirds majority of all its members with a right to vote.
procedure.
Article 19
6. When
preparing
an
opinion,
the
members
of
each
Advisory Groups
Advisory Group shall do their best to reach a consensus. If
such a consensus is not reached, the opinion shall consist of
1. The following Advisory Groups shall provide the the reasoned position of the majority of members. The minority
Management Board with expertise relating to large-scale IT
reasoned position(s) shall also be recorded. Article 16(3) and (4)
systems and, in particular, in the context of the preparation
shall apply accordingly. The members representing the countries
of the annual work program and the annual activity report:
associated with the implementation, application and devel
opment of the Schengen acquis and Eurodac-related measures
shall be allowed to express opinions on issues on which they
(a) SIS II Advisory Group;
are not entitled to vote.
(b) VIS Advisory Group;
7. Each
Member
State
and
each
country
associated
with
the
implementation, application and development of the Schengen
(c) Eurodac Advisory Group;
acquis and Eurodac-related measures shall facilitate the activities
of the Advisory Groups.
(d) any other Advisory Group relating to a large-scale IT system
when so provided in the relevant legislative instrument
governing the development, establishment, operation and
8. For the chairmanship of the Advisory Groups, Article 14
use of that large-scale IT system.
shall apply mutatis mutandis.

---

EN
1.11.2011 Official
Journal
of
the
European
Union L
286/13
CHAPTER IV
Article 22
GENERAL PROVISIONS
Headquarters Agreement and Agreements concerning the
technical and backup sites
Article 20
The necessary arrangements concerning the accommodation to
Staff
be provided for the Agency in the host Member States and the
facilities to be made available by those Member States and the
1. The
Staff
Regulations
and
the
rules
adopted
jointly
by
the specific rules applicable in the host Member States to the
Union institutions for the purpose of applying the Staff Regu
Executive Director, the members of the Management Board,
lations shall apply to the staff of the Agency and to the
staff of the Agency and members of their families shall be
Executive Director.
laid down in a Headquarters Agreement concerning the seat
of the Agency and in Agreements concerning the technical
and backup sites, concluded between the Agency and the host
2. For
the
purpose
of
implementing
the
Staff
Regulations, Member States after obtaining the approval of the Management
the Agency shall be considered an agency within the meaning
Board.
of Article 1a(2) of the Staff Regulations of Officials.
Article 23
3. The
powers
conferred
on
the
Appointing
Authority
by
the
Staff Regulations of Officials and on the authority entitled to
Privileges and immunities
conclude contracts by the Conditions of Employment shall be
exercised by the Agency in respect of its own staff.
The Protocol on the Privileges and Immunities of the European
Union shall apply to the Agency.
4. The staff of the Agency shall consist of officials,
temporary staff or contract staff. The Management Board shall
Article 24
give its consent on an annual basis where the contracts that the
Executive Director plans to renew would become indefinite
Liability
pursuant to the Conditions of Employment.
1. The
contractual
liability
of
the
Agency
shall
be
governed
by the law applicable to the contract in question.
5. The
Agency
shall
not
recruit
interim
staff
to
perform
what
are deemed to be sensitive financial duties.
2. The
Court
of
Justice
of
the
European
Union
shall
have
jurisdiction to give judgment pursuant to any arbitration clause
contained in a contract concluded by the Agency.
6. The
Commission
and
the
Member
States
may
second
officials or national experts to the Agency on a temporary
basis. The Management Board shall, taking into account the
multi-annual staff policy plan, adopt the necessary imple
3. In the case of non-contractual liability, the Agency shall,
menting measures for that purpose.
in accordance with the general principles common to the laws
of the Member States, make good any damage caused by its
departments or by its servants in the performance of their
duties.
7. Without
prejudice
to
Article
17
of
the
Staff
Regulations
of
Officials, the Agency shall apply appropriate rules of profes
sional secrecy or other equivalent duties of confidentiality.
4. The
Court
of
Justice
of
the
European
Union
shall
have
jurisdiction in disputes relating to compensation for the damage
referred to in paragraph 3.
8. The
Management
Board
shall,
in
agreement
with
the
Commission, adopt the necessary implementing measures
referred to in Article 110 of the Staff Regulations of Officials.
5. The
personal
liability
of
the
Agency’s
staff
towards
the
Agency shall be governed by the provisions laid down in the
Article 21
Staff Regulations.
Public interest
The members of the Management Board, the Executive Director
Article 25
and the members of the Advisory Groups shall undertake to act
in the public interest. For that purpose they shall issue an
Linguistic regime
annual, written, public statement of commitment.
1. Regulation
No
1
of
15
April
1958
determining
the
languages to be used by the European Economic Community ( 1 )
shall apply to the Agency.
The list of members of the Management Board shall be
published on the Agency’s Internet site.
( 1 ) OJ 17, 6.10.1958, p. 385/58.

---

L 286/14
EN
Official Journal of the European Union
1.11.2011
2. Without prejudice to decisions taken pursuant to
Article 29
Article 342 TFEU, the annual work programme and the
annual activity report referred to in Article 12(1)(j) and (k),
Security rules on the protection of classified information
shall be produced in all official languages of the institutions
and non-classified sensitive information
of the Union.
1. The Agency shall apply the security principles laid down
in Commission Decision 2001/844/EC, ECSC, Euratom of
29 November 2001 amending its internal Rules of
3. The
translation
services
necessary
for
the
activities
of
the Procedure ( 1 ), including the provisions for the exchange,
Agency shall be provided by the Translation Centre for the
processing and storage of classified information, and measures
Bodies of the European Union.
on physical security.
Article 26
2. The
Agency
shall
also
apply
the
security
principles
relating
to the processing of non-classified sensitive information as
Access to documents
adopted and implemented by the Commission.
1. On
the
basis
of
a
proposal
by
the
Executive
Director,
and
not later than 6 months after 1 December 2012, the
Management Board shall adopt rules concerning access to the
Agency’s documents, in accordance with Regulation (EC)
3. The
Management
Board
shall,
pursuant
to
Article
2
and
No 1049/2001.
Article 12(1)(p), decide on the Agency’s internal structure
necessary to fulfil the appropriate security principles.
2. Decisions
taken
by
the
Agency
pursuant
to
Article
8
of
Regulation (EC) No 1049/2001 may give rise to the lodging of
Article 30
a complaint to the European Ombudsman or form the subject
of an action before the Court of Justice of the European Union,
Security of the Agency
under the conditions laid down in Articles 228 and 263 TFEU
respectively.
1. The
Agency
shall
be
responsible
for
the
security
and
the
maintenance of order within the buildings, premises and land
used by it. The Agency shall apply the security principles and
relevant provisions of the legislative instruments governing the
Article 27
development, establishment, operation and use of large-scale IT
systems.
Information and communication
1. The
Agency
shall
communicate
in
accordance
with
the
legislative instruments governing the development, estab
lishment, operation and use of large-scale IT-systems and on
2. The
host
Member
States
shall
take
all
effective
and
its own initiative in the fields within its tasks. It shall ensure
adequate measures to maintain order and security in the
in particular that in addition to the publication specified in
immediate vicinity of the buildings, premises and land used
Article 12(1)(j), (k), (w) and (y) and Article 33(8), the public
by the Agency and shall provide to the Agency the appropriate
and any interested party are rapidly given objective, reliable and
protection, in accordance with the relevant Headquarters
easily understandable information with regard to its work.
Agreement concerning the seat of the Agency and the
Agreements concerning the technical and backup sites, whilst
guaranteeing free access to these buildings, premises and land to
persons authorised by the Agency.
2. The
Management
Board
shall
lay
down
the
practical
arrangements for the application of paragraph 1.
Article 31
Article 28
Evaluation
Data protection
1. Within 3 years from 1 December 2012, and every 4 years
thereafter, the Commission, in close consultation with the
1. Without
prejudice
to
the
provisions
on
data
protection Management Board, shall perform an evaluation of the action
laid down in the legislative instruments governing the devel
of the Agency. The evaluation shall examine the way and extent
opment, establishment, operation and use of large-scale IT
to which the Agency effectively contributes to the operational
systems, the information processed by the Agency in
management of large-scale IT systems in the area of freedom,
accordance with this Regulation shall be subject to Regulation
security and justice and fulfils its tasks laid down in this Regu
(EC) No 45/2001.
lation. The evaluation shall also assess the role of the Agency in
the context of a Union strategy aimed at a coordinated, cost-
effective and coherent IT environment at Union level that is to
2. The
Management
Board
shall
establish
measures
for
the be established in the coming years.
application of Regulation (EC) No 45/2001 by the Agency, and
in particular Section 8 concerning the Data Protection Officer.
( 1 ) OJ L 317, 3.12.2001, p. 1.

---

EN
1.11.2011 Official
Journal
of
the
European
Union L
286/15
2. On
the
basis
of
the
evaluation
referred
to
in
paragraph
1, (a) its draft annual work programme;
the Commission, after consulting the Management Board, shall
issue recommendations regarding changes to this Regulation,
also in order to bring it further in line with the Union
strategy referred to in paragraph 1. The Commission shall
(b) its updated multi-annual Staff Policy Plan, established in line
forward those recommendations, together with the opinion of
with the guidelines set by the Commission;
the Management Board, as well as appropriate proposals to the
European Parliament, the Council and the European Data
Protection Supervisor.
(c) information on the number of officials, temporary and
contract staff as defined in the Staff Regulations for the
years n-1 and n as well as an estimate for the year n+1;
CHAPTER V
FINANCIAL PROVISIONS
(d) information on contributions in kind granted by the host
Article 32
Member States to the Agency;
Budget
1. The
revenue
of
the
Agency
shall
consist,
without
prejudice (e) an estimate of the balance of the outturn account for the
to other types of income, of:
year n-1.
(a) a subsidy from the Union entered in the general budget of
the European Union (Commission section);
7. The
statement
of
estimates
shall
be
forwarded
by
the
Commission to the budgetary authority together with the
draft general budget of the European Union.
(b) a contribution from the countries associated with the imple
mentation, application and development of the Schengen
acquis and Eurodac-related measures;
8. On the basis of the statement of estimates, the
Commission shall enter in the draft general budget of the
European Union the estimates it deems necessary for the estab
(c) any financial contribution from the Member States.
lishment plan and the amount of the subsidy to be charged to
the general budget, which it shall place before the budgetary
authority in accordance with Article 314 TFEU.
2. The
expenditure
of
the
Agency
shall
include,
inter
alia,
staff remuneration, administrative and infrastructure expenses,
operating costs and expenditure relating to contracts or
agreements concluded by the Agency. Each year the Executive
9. The
budgetary
authority
shall
authorise
the
appropriations
Director shall draw up, taking into account the activities carried
for the subsidy to the Agency. The budgetary authority shall
out by the Agency, a draft statement of estimates of the
adopt the establishment plan for the Agency.
Agency’s revenue and expenditure for the following financial
year, together with the establishment plan, and shall transmit
it to the Management Board.
10. The Agency’s budget shall be adopted by the
Management Board. It shall become final following the final
adoption of the general budget of the European Union.
3. Revenue
and
expenditure
of
the
Agency
shall
be
in Where appropriate, it shall be adjusted accordingly.
balance.
4. The
Management
Board,
on
the
basis
of
a
draft
drawn
up 11. Any modification to the budget, including the estab
by the Executive Director, shall adopt a draft statement of
lishment plan, shall follow the same procedure.
estimates of the revenue and expenditure of the Agency for
the following financial year.
12. The
Management
Board
shall,
as
soon
as
possible,
notify
the budgetary authority of its intention to implement any
5. The draft statement of estimates of the Agency’s revenue
project, which may have significant financial implications for
and expenditure and the general guidelines underlying that
the funding of its budget, in particular any projects relating
estimate, shall be transmitted by the Management Board to
to property such as the rental or purchase of buildings. It
the Commission and to the countries associated with the imple
shall inform the Commission thereof as well as the countries
mentation, application and development of the Schengen acquis
associated with the implementation, application and devel
and Eurodac-related measures by 10 February each year and the
opment of the Schengen acquis and Eurodac-related measures.
final statement of estimates by 31 March each year.
If either branch of the budgetary authority intends to issue an
opinion, it shall, within 2 weeks after receipt of the information
on the project, notify the Management Board of its intention to
6. By
31
March
each
year,
the
Management
Board
shall issue such an opinion. In the absence of a reply, the Agency
submit to the Commission and to the budgetary authority:
may proceed with the planned operation.

---

L 286/16
EN
Official Journal of the European Union
1.11.2011
Article 33
11. The
European
Parliament,
on
a
recommendation
from
the Council acting by a qualified majority, shall, before
Implementation of the budget
15 May of year n + 2, give a discharge to the Executive
1. The
Agency’s
budget
shall
be
implemented
by
its Director in respect of the implementation of the budget for
Executive Director.
year n.
Article 34
2. The
Executive
Director
shall
forward
annually
to
the
budgetary authority any information relevant to the outcome
Financial rules
of the evaluation procedures.
The financial rules applicable to the Agency shall be adopted by
the Management Board after consultation of the Commission.
They shall not depart from Regulation (EC, Euratom)
3. The
Agency’s
Accounting
Officer
shall
send
to
the No 2343/2002 unless such departure is specifically required
Commission’s Accounting Officer and the Court of Auditors
for the Agency’s operation and the Commission has given its
by 1 March of the following year the Agency’s provisional
prior consent.
accounts, together with the report on budgetary and financial
management during the year. The Commission’s Accounting
Officer shall consolidate the provisional accounts of the insti
Article 35
tutions and decentralised bodies in accordance with Article 128
of Regulation (EC, Euratom) No 1605/2002.
Combating fraud
1. In
order
to
combat
fraud,
corruption
and
other
unlawful
activities, Regulation (EC) No 1073/1999 shall apply.
4. The
Agency’s
Accounting
Officer
shall
also
send
to
the
budgetary authority, by 31 March of the following year, the
report on budgetary and financial management.
2. The Agency shall accede to the Interinstitutional
Agreement concerning internal investigations by the European
Anti-fraud Office (OLAF) and shall issue, without delay, the
appropriate provisions applicable to all the employees of the
5. On receipt of the Court of Auditors’ observations on the
Agency.
Agency’s provisional accounts, pursuant to Article 129 of Regu
lation (EC, Euratom) No 1605/2002, the Executive Director
shall draw up the Agency’s final accounts under his own
responsibility and forward them to the Management Board for
3. The
decisions
concerning
funding
and
the
implementing
an opinion.
agreements and instruments resulting from them shall explicitly
stipulate that the Court of Auditors and OLAF may carry out, if
necessary, on-the-spot checks among the recipients of the
Agency’s funding and the agents responsible for allocating it.
6. The
Management
Board
shall
deliver
an
opinion
on
the
Agency’s final accounts.
CHAPTER VI
FINAL PROVISIONS
7. By 1 July of the following year, the Executive Director
shall send the final accounts, together with the opinion of the
Article 36
Management Board, to the budgetary authority, the
Commission’s Accounting Officer, the Court of Auditors as
Preparatory actions
well as the countries associated with the implementation, appli
cation and development of the Schengen acquis and Eurodac-
1. The
Commission
shall
be
responsible
for
the
estab
related measures.
lishment and initial operation of the Agency until the latter
has the operational capacity to implement its own budget.
8. The
final
accounts
shall
be
published.
2. For
that
purpose,
until
such
time
as
the
Executive
Director
takes up his duties following his appointment by the
Management Board in accordance with Article 18, the
Commission may assign a limited number of officials
9. The
Executive
Director
shall
send
the
Court
of
Auditors
a including one to fulfil the functions of the Executive Director,
reply to its observations by 30 September. The Executive
Director shall also send that reply to the Management Board.
on an interim basis. The interim Executive Director may be
assigned only once the Management Board is convened, in
accordance with Article 13(2).
10. Upon
the
request
of
the
European
Parliament,
the
Executive Director shall submit the information necessary for
If the interim Executive Director does not comply with the
the smooth application of the discharge procedure for the
obligations laid down in this Regulation, the Management
financial year in question, as laid down in Article 146(3) of
Board may ask the Commission to assign a new interim
Regulation (EC, Euratom) No 1605/2002.
Executive Director.

---

EN
1.11.2011 Official
Journal
of
the
European
Union L
286/17
3. The
interim
Executive
Director
may
authorise
all
payments nature and extent of, and the detailed rules for, the participation
covered by credits provided in the budget of the Agency, once
by countries associated with the implementation, application
approved by the Management Board and may conclude
and development of the Schengen acquis and Eurodac-related
contracts, including staff contracts following the adoption of
measures in the work of the Agency, including provisions on
the Agency’s establishment plan. If justified, the Management
financial contributions, staff and voting rights.
Board may impose restrictions on the interim Executive
Director’s powers.
Article 38
Article 37
Entry into force and applicability
Participation by countries associated with the
This Regulation shall enter into force on the 20th day following
implementation, application and development of the
its publication in the Official Journal of the European Union.
Schengen acquis and Eurodac-related measures
Under the relevant provisions of their association agreements,
The Agency shall take up its responsibilities set out in Articles 3
arrangements shall be made in order to specify, inter alia, the
to 9 from 1 December 2012.
This Regulation shall be binding in its entirety and directly applicable in the Member States in
accordance with the Treaties.
Done at Strasbourg, 25 October 2011.
For the European Parliament
For the Council
The President
The President
J. BUZEK
M. DOWGIELEWICZ

---