Brussels, 5 July 2018
NOTICE TO STAKEHOLDERS
INDUSTRIAL SECURITY
The United Kingdom submitted on 29 March 2017 the notification of its intention to withdraw from the Union pursuant to Article 50 of the Treaty on European Union. This means that, unless a ratified withdrawal agreement1 establishes another date, all Union primary and secondary law will cease to apply to the United Kingdom from 30 March 2019, 00:00h (CET) (‘the withdrawal date’).2 The United Kingdom will then become a ‘third country’.3
Preparing for the withdrawal is not just a matter for EU and national authorities but also for private parties.
In view of the considerable uncertainties, in particular concerning the content of a possible withdrawal agreement, candidates or tenderers, contractors or subcontractors (in the case of classified contracts) and applicants and beneficiaries (in the case of classified grant agreements) are reminded of legal repercussions, which need to be considered when the United Kingdom becomes a third country.
Please note that this notice does not address:
a) access to procurement by natural and legal persons established in a third country, as set out in Article 119 of Regulation (EU, Euratom) No 966/2012 of the European Parliament and of the Council of 25 October 2012 on the financial rules applicable to the general budget of the Union;4 and
b) restrictions on access to procurement as provided for in EU legislation to protect the essential interests of the security of the EU or public security.
1 Negotiations are ongoing with the United Kingdom with a view to reaching a withdrawal agreement.
2 Furthermore, in accordance with Article 50(3) of the Treaty on European Union, the European Council, in agreement with the United Kingdom, may unanimously decide that the Treaties cease to apply at a later date.
3 A third country is a country not member of the EU.
4 OJ L 298, 26.10.2012, p. 1.
Subject to any transitional arrangement that may be contained in a possible withdrawal agreement,5 as of the withdrawal date, the United Kingdom’s status with regard to the rules on industrial security6 for procurement procedures, classified contracts and classified grant procedures/classified grant agreements with the Commission and other institutions and bodies applying Commission Decision (EU, Euratom) 2015/444 of 13 March 2015 on the security rules for protecting EU classified information changes. This has in particular the following consequences:7 8
1. FACILITY SECURITY CLEARANCE (FSC)
According to Article 44(3) of Commission Decision (EU, Euratom) 2015/444, where EU classified information has to be provided in the course of the procurement or grant award procedure, a facility security clearance is required.
According to Article 44(4) of Commission Decision (EU, Euratom) 2015/444, the contracting or granting authority shall not award a classified contract or grant agreement before having received confirmation about issuance of a facility security clearance by the National Security Authority (NSA), the Designated Security Authority (DSA) or any other competent security authority of the Member State in which the contractor, subcontractor, or beneficiary is registered.
As of the withdrawal date, facility security clearances issued by the United Kingdom NSA, DSA or other competent security authority are no longer valid for the purposes of Commission Decision (EU, Euratom) 2015/444.
This could, under the terms of the classified contract/grant agreement that was signed, constitute a ground for termination, unless the contractor/beneficiary has taken appropriate remedial measures, such as the assignment of the contract to an economic operator or, in the case of a consortium being granted the contract, the rearrangement of action tasks within that consortium to a participant which holds, as from the withdrawal date, a facility security clearance
5 The arrangements contained in the draft withdrawal agreement, which includes a transition period, agreed at negotiator’s level between the EU and the UK and published on 19 March 2018, provide, in Article 122(7)(b) for specific rules on the access to certain security related sensitive information during the transition period (https://ec.europa.eu/commission/sites/betapolitical/files/draft_agreement_coloured.pdf). The text of the withdrawal agreement, however, still needs to be fully agreed and ratified.
6 “Industrial security” is defined as “the application of measures to ensure the protection of EU classified information within the framework of classified contracts [or] within the framework of classified grant agreements”, Article 39(1) of Commission Decision (EU, Euratom) 2015/444 of 13 March 2015 on the security rules for protecting EU classified information, OJ L 72, 17.3.2015, p. 53.
7 Similar rules have been adopted by other institutions and bodies, cf. in particular Council Decision 2013/488/EU of 23 September 2013 on the security rules for protecting EU classified information (OJ L 274, 15.10.2013, p. 1) and Decision of the High Representative of the Union for Foreign Affairs and Security Policy of 19 September 2017 on the security rules for the European External Action Service (OJ C 126, 10.04.2018, p. 1).
8 This notice does not address industrial security aspects in national procurement. For these aspects, see the “Notice to Stakeholders – Withdrawal of the United Kingdom and EU rules in the field of public procurement” (https://ec.europa.eu/info/brexit/brexit-preparedness_en?page=1).
issued by an EU-27 Member State; or
issued by a third country with which a security of information agreement covering industrial security aspects has been concluded, which provides for the recognition of a facility security clearance for companies registered on its territory.
Where an award procedure is ongoing on the withdrawal date, tenderers or applicants that cannot comply with their security obligations will be rejected.
2. PERSONNEL SECURITY CLEARANCE (PSC)
Article 43 of Commission Decision (EU, Euratom) 2015/444 provides that classified contracts or classified grant agreements shall include provisions indicating that staff of a contractor, subcontractor or beneficiary who, for the performance of the classified contract, subcontract or grant agreement, require access to EU classified information, shall be security cleared at the relevant level by the NSA, DSA or any other competent authority of the Member State in which the contractor, subcontractor, or beneficiary is registered.
According to Article 44(3) of Commission Decision (EU, Euratom) 2015/444, where EU classified information has to be provided in the course of the procurement or grant procedure, a personnel security clearance is required.
As of the withdrawal date, the personnel security clearances issued by the United Kingdom NSA, DSA or other competent security authority are no longer valid for the purposes of Commission Decision (EU, Euratom) 2015/444.
This could, under the terms of the classified contract/grant agreement that was signed, constitute a ground for termination, unless the contractor/ beneficiary has taken appropriate remedial measures, such as ensuring that the staff concerned holds, as from the withdrawal date, a personnel security clearance
issued by an EU-27 Member State; or
issued by a third country with which a security of information agreement covering industrial security aspects has been concluded, which provides for the recognition of a personnel security clearance.
Where an award procedure is ongoing on the withdrawal date, tenderers or applicants that cannot comply with their security obligations will be rejected.
3. SUBCONTRACTS
It is recalled that, according to Article 46(2) and (3) of Commission Decision (EU, Euratom) 2015/444, the contractor or beneficiary shall obtain permission from the contracting authority, before sub-contracting any parts of a classified contract or grant agreement, and shall not provide EU classified information to a sub-contractor without the prior written consent of the contracting authority. No subcontract involving access to EU classified information may be awarded to subcontractors registered in a third country, unless there is a particular regulatory framework for the security of information.
Non-compliance with this obligation could, under the terms of the classified contract/grant agreement that was signed, constitute a ground for termination, unless the contractor/beneficiary has taken appropriate remedial measures (such as ensuring that the subcontract is changed to a subcontractor with security clearance issued by an EU-27 Member State or third country with a security agreement).
Where an award procedure is ongoing on the withdrawal date, tenderers or applicants with subcontracts that do not comply with the security requirements will be rejected.
European Commission Directorate-General Human Resources and Security.
The Legal Materials contain European Union public sector information. EU public information is reproduced pursuant to Commission Decision of 12 December 2011 on the reuse of Commission documents (2011/833/EU) (the EU Decision)
Contact McMahon Legal