COMMISSION IMPLEMENTING REGULATION (EU) 2024/1255 of 3 May 2024 amending Implementing Regulation (EU) 2015/1998 as regards certain detailed measures for the implementation of the common basic standards on aviation security

COMMISSION IMPLEMENTING REGULATION (EU) 2024/1255

of 3 May 2024

amending Implementing Regulation (EU) 2015/1998 as regards certain detailed measures for the implementation of the common basic standards on aviation security

(Text with EEA relevance)

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EC) No 300/2008 of the European Parliament and of the Council of 11 March 2008 on common rules in the field of civil aviation security and repealing Regulation (EC) No 2320/2002 (1), and in particular Article 4(3) thereof,

Whereas:

(1) Experience gained with the implementation of Commission Implementing Regulation (EU) 2015/1998 (2) has shown the need for minor amendments to the implementing measures of certain common basic standards on aviation security.

(2) The surface transport between the premises of regulated agents, known consignors and air carriers, of air cargo and mail to which the required security controls have been applied, is in many cases outsourced by such entities to external hauliers, operating on their behalf. Certain conditions and rules allowing the use of hauliers, as well as certain obligations for such hauliers are already set out in the Annex to Implementing Regulation (EU) 2015/1998.

(3) There is a need for more clarity in terms of visibility, accountability and oversight by the appropriate authorities of hauliers and the operations they perform to maintain the integrity of the air cargo and mail secure supply chain in the Union. For that purpose, requirements for approval and oversight of hauliers should be introduced into the Annex to Implementing Regulation (EU) 2015/1998.

(4) The requirements for approved hauliers should not impose unnecessary administrative and operational burden on both entities and appropriate authorities. The provisions setting out those requirements should also take into account the experience of the Member States that have established an approval and oversight scheme for hauliers operating at national level.

(5) In order to allow for a gradual introduction of the regime of approved hauliers in the Union, the current requirements to which hauliers are subject to should continue to apply until 31 December 2026. That would facilitate the preparation for mandatory implementation of the approved hauliers regime by both appropriate authorities and the relevant entities subjected to them.

(6) Attachments 3-B, 4-B, 5-A and 6-F to the Annex to Implementing Regulation (EU) 2015/1998 list the third countries recognised as applying security standards equivalent to the common basic standards on aviation security.

Official Journal of the European Union

EN L series

2024/1255 6.5.2024

ELI: http://data.europa.eu/eli/reg_impl/2024/1255/oj 1/18

(1) OJ L 97, 9.4.2008, p. 72, ELI: http://data.europa.eu/eli/reg/2008/300/oj (2) Commission Implementing Regulation (EU) 2015/1998 of 5 November 2015 laying down detailed measures for the implementation

of the common basic standards on aviation security (OJ L 299, 14.11.2015, p. 1, ELI: http://data.europa.eu/eli/reg_impl/2015/1998/ oj).

(7) The Commission has verified that the airport of Svalbard (unincorporated area of the Kingdom of Norway), meets the criteria set out in Part E of the Annex to Commission Regulation (EC) No 272/2009 (3), with regard to screening of passengers and cabin baggage, screening of hold baggage, cargo and mail and aircraft security.

(8) It is therefore necessary to add Svalbard Airport to the lists in Attachments 3-B, 4-B, 5-A and 6-F to the Annex to Implementing Regulation (EU) 2015/1998.

(9) Commission Implementing Regulation (EU) 2023/566 (4) introduced the requirement for explosive trace detection (ETD) equipment deployed from 1 September 2014 to also detect chemicals as of 1 July 2024. Experience in the ongoing implementation of the preparatory steps shows that the date of 1 July 2024 needs to be postponed by 15 months, in order to ensure compliance with that requirement and allowing a smooth upgrade of the deployed equipment by all users, without posing an undue risk to aviation security.

(10) Furthermore, certain detailed aviation security measures should be clarified, harmonised or simplified in order to improve legal clarity, standardise the common interpretation of the relevant provisions and further ensure the best implementation of the common basic standards on aviation security.

(11) Implementing Regulation (EU) 2015/1998 should therefore be amended accordingly.

(12) The measures provided for in this Regulation are in accordance with the opinion of the Committee established by Article 19 of Regulation (EC) No 300/2008,

HAS ADOPTED THIS REGULATION:

Article 1

The Annex to Implementing Regulation (EU) 2015/1998 is amended in accordance with the Annex to this Regulation.

Article 2

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at Brussels, 3 May 2024.

For the Commission The President

Ursula VON DER LEYEN

EN OJ L, 6.5.2024

2/18 ELI: http://data.europa.eu/eli/reg_impl/2024/1255/oj

(3) Commission Regulation (EC) No 272/2009 of 2 April 2009 supplementing the common basic standards on civil aviation security laid down in the Annex to Regulation (EC) No 300/2008 of the European Parliament and of the Council (OJ L 91, 3.4.2009, p. 7, ELI: http://data.europa.eu/eli/reg/2009/272/oj).

(4) Commission Implementing Regulation (EU) 2023/566 of 10 March 2023 amending Implementing Regulation (EU) 2015/1998 as regards certain detailed measures for the implementation of the common basic standards on aviation security (OJ L 74, 13.3.2023, p. 47, ELI: http://data.europa.eu/eli/reg_impl/2023/566/oj).

ANNEX

The Annex to Implementing Regulation (EU) 2015/1998 is amended as follows:

(1) in the list in Attachment 3-B, the following entry is inserted after the entry for Jersey:

‘Kingdom of Norway, in regard to Svalbard Airport’;

(2) in the list in Attachment 4-B, the following entry is inserted after the entry for Jersey:

‘Kingdom of Norway, in regard to Svalbard Airport’;

(3) in the list in Attachment 5-A, the following entry is inserted after the entry for Jersey:

‘Kingdom of Norway, in regard to Svalbard Airport’;

(4) the following points 6.0.5 and 6.0.6 are added:

‘6.0.5. For the purposes of this Annex, “approved haulier” means an entity that ensures, on behalf of a regulated agent or known consignor, the surface transport and protection of air cargo and mail consignments to which security controls have previously been applied and whose procedures meet common security rules and standards sufficient to maintain the integrity of the consignments.

6.0.6. For the purposes of this Annex, “limited storage” means the overall time strictly necessary for an approved haulier to perform the transhipment of cargo and mail from one means of transport onto the one used for the subsequent portion of the surface transport of that shipment.

For the purposes of the definition in the first paragraph, the “strictly necessary time”:

(a) includes the time needed to carry out the related handling operations and complete the administrative formalities;

(b) where logistically necessary, includes a brief storage of the consignment between the two means of transport during which the consignment is kept protected from unauthorised interference in accordance with points 6.5.2, 6.6.1 and 6.6.2;

(c) does not include any storage operations other than those referred to in point (b), unless the haulier is also approved as regulated agent.’;

(5) point 6.1.4 is replaced by the following:

‘6.1.4. Access into the security restricted areas of cargo and mail shall be granted only after having established to which of the following categories the entity transporting the consignment from landside belongs:

(a) a regulated agent;

(b) a known consignor;

(c) a haulier appointed in accordance with point 6.6.1.1(c), transporting consignments to which security controls have previously been applied;

(d) an approved haulier;

(e) neither of the entities referred to in points (a) to (d).

Point (c) shall apply until 31 December 2026.’;

(6) in point 6.3.1.1, fourth paragraph, point (d) is replaced by the following:

‘(d) the protection and transportation of consignments to a haulier that meets the requirements of points 6.5 and 6.6, as applicable.’;

OJ L, 6.5.2024 EN

ELI: http://data.europa.eu/eli/reg_impl/2024/1255/oj 3/18

(7) point 6.3.1.9 is added:

‘6.3.1.9. Upon request by the appropriate authority, the regulated agent shall provide documentary evidence of the existing agreements in place with any approved haulier that provides transport on its behalf. If required by the approving appropriate authority, the regulated agent shall additionally maintain a list containing, for each approved haulier with whom it has entered into a transport agreement, at least the unique alphanumeric identifier, the initial date of validity of the agreement and, if applicable, its expiry date.

The list shall be available for inspection by the appropriate authority.’;

(8) point 6.3.2.9 is replaced by the following:

‘6.3.2.9. A regulated agent shall ensure that all staff are recruited in accordance with the requirements of Chapter 11 and appropriately trained in accordance with the relevant job specifications. For the purposes of training, staff with unsupervised access to identifiable air cargo or identifiable air mail to which the required security controls have been applied shall be considered as staff implementing security controls. Drivers with no access or with supervised access to identifiable air cargo or identifiable air mail to which the required security controls have been applied shall at least receive security awareness training in accordance with point 11.2.7.’;

(9) the following point 6.3.2.10 is added:

‘6.3.2.10. Security controls to be applied by a regulated agent shall also be subject to the additional provisions laid down in Implementing Decision C(2015) 8005.’;

(10) the following point 6.4.1.8 is added:

‘6.4.1.8. Upon request by the appropriate authority, the known consignor shall provide documentary evidence of the existing agreements in place with any approved haulier that provides transport on its behalf. If required by the approving appropriate authority, the known consignor shall additionally maintain a list containing, for each approved haulier with whom it has entered into a transport agreement, at least the unique alphanumeric identifier, the initial date of validity of the agreement and, if applicable, its expiry date.

The list shall be available for inspection by the appropriate authority.’;

(11) in point 6.4.2.1, point (b) is replaced by the following:

‘(b) all staff implementing security controls and all staff with unsupervised access to identifiable air cargo or identifiable air mail to which the required security controls have been applied are recruited in accordance with the requirements of Chapter 11 and have received security training in accordance with point 11.2.3.9. Drivers with no access or with supervised access to identifiable air cargo or identifiable air mail to which the required security controls have been applied shall at least receive security awareness training in accordance with point 11.2.7; and’;

(12) the following point 6.4.2.3 is added:

‘6.4.2.3. Security controls to be applied by a known consignor shall also be subject to the additional provisions laid down in Implementing Decision C(2015) 8005.’;

(13) point 6.5 is replaced by the following:

‘6.5 APPROVED HAULIERS

6.5.1. Approval of hauliers

6.5.1.1. Hauliers shall be approved by the appropriate authority.

The applicant, either a natural or legal person, shall seek approval from the appropriate authority of the Member State in which the residential or registered address of the applicant, whichever applies, is located. Foreign branches of the same applicant, or of its subsidiaries, shall seek approval from the appropriate authority of the Member State where the registered address of that foreign branch or subsidiary is located.

EN OJ L, 6.5.2024

4/18 ELI: http://data.europa.eu/eli/reg_impl/2024/1255/oj

6.5.1.2 The applicant shall submit a security programme to the appropriate authority concerned. The programme shall describe the methods and procedures which are to be followed by the haulier in order to comply with the requirements of Regulation (EC) No 300/2008 and its implementing acts. It shall include detailed provisions and procedures at least covering:

(1) general information, including organisation, person responsible for security, quality control, cooperation with authorities, reporting and other plans and instructions;

(2) protection of cargo during collection, handling, limited storage, transport and delivery;

(3) recruitment and training of staff, including training records and evidence of successful completion of background checks as applicable;

(4) measures to prevent an unlawful interference in respect of air cargo and mail consignments to which security controls have been applied and actions to be taken in the event of such interference.

The programme shall also describe how compliance with those provisions and procedures is to be monitored by the haulier itself.

The programme shall be drawn up by using the standardised template set out in Attachment 6-K – Security programme of the approved haulier. Entities seeking approval that plan to perform haulier operations in a Member State different from that where they are registered and approved shall have their security programme drawn up also in English.

The applicant shall also submit the “Declaration of commitments – approved haulier” as set out in Attachment 6-D. That declaration shall be signed by the applicant’s legal representative or by the person responsible for security.

The signed declaration shall clearly state the location or the locations to which it refers and be kept by the appropriate authority concerned.

6.5.1.3. After the submission of the security programme and its successful assessment establishing relevance and completeness thereof, the applicant shall be subject to an on-site verification, in order to assess compliance with the requirements of Regulation (EC) No 300/2008 and its implementing acts. The on-site verification shall include the monitoring of the relevant operations and procedures implemented by the haulier without deficiencies, during collection, handling, limited storage, transport and delivery of consignments, as applicable. The on-site verification shall cover at least one of the operational locations belonging to the haulier’s network.

The appropriate authority shall specify in its national civil aviation security programme referred to in Article 10 of Regulation (EC) No 300/2008 if the assessment of the security programme and the on-site verification shall be performed by the authority itself or by an EU aviation security validator acting on its behalf.

At the conclusion of the on-site verification, the appropriate authority, or the EU aviation security validator acting on its behalf, shall draft a validation report by using the standardised checklist set out in Attachment 6-L.

If the on-site verification is performed by an EU aviation security validator, the validation report and the independence declaration – EU aviation security validator set out in Attachment 11-A shall be submitted to the appropriate authority within not more than one month from the on-site visit.

OJ L, 6.5.2024 EN

ELI: http://data.europa.eu/eli/reg_impl/2024/1255/oj 5/18

If applicable and necessary in order to monitor the relevant operations and procedures implemented by the haulier, the approving Member State may request the assistance and support of the appropriate authority of another Member State where certain operations take place. With the consent of the approving Member State, an on-site verification of those operations may be performed by an EU aviation security validator acting on behalf of the appropriate authority of the Member State where certain operations take place. The concerned Member States shall coordinate the timely performance of that on-site verification, agree on its extent and content, and establish modalities for the exchange of information on the outcomes thereof. In such case, the validation report covering these operations, consisting of the checklist set out in Attachment 6-L, and where applicable accompanied by the independence declaration – EU aviation security validator set out in Attachment 11-A, shall be:

(a) drawn up in English or in another Union official language, as agreed between the concerned Member States;

(b) submitted to the approving appropriate authority within not more than one month from the on-site visit.

Once the approving appropriate authority has successfully completed the steps referred to in this point and determined that the applicant complies with the requirements of Regulation (EC) No 300/2008 and its implementing acts, it shall grant the status of approved haulier for a maximum period of five years. In doing so, the appropriate authority shall ensure that the necessary details of the haulier are entered into the “Union database on supply chain security” not later than the next working day. When making the database entry the appropriate authority shall give each registered address a unique alphanumeric identifier in the standard format.

A haulier shall not be considered approved until its details are listed in the “Union database on supply chain security”.

6.5.1.4. As an alternative to the procedure laid down in point 6.5.1.3 and only in case of first approval, after the successful assessment of the security programme establishing its relevance and completeness, the appropriate authority may subject the applicant to a documentation-based audit consisting of a thorough interview with the person designated as responsible for the implementation of the security programme and the relevant operations and procedures implemented. If the appropriate authority determines that the applicant is in compliance with the requirements of Regulation (EC) No 300/2008 and its implementing acts, it shall grant the status of approved haulier for a maximum and non-renewable period of one year, within which the haulier shall be subject to an on-site verification, as set out in point 6.5.1.3.

After the completion of the on-site verification, if the appropriate authority determines that that the applicant is in compliance with the requirements of Regulation (EC) No 300/2008 and its implementing acts, it shall grant the status of approved haulier for a maximum period of five years.

If the on-site verification does not take place within one year time for reasons beyond the haulier’s responsibility, the approving appropriate authority may extend the status for a period not exceeding three months. At the end of the extension period, the appropriate authority shall suspend the status of the haulier and not re-activate it until the on-site verification is successfully completed.

6.5.1.5. If the appropriate authority is not satisfied with the information provided and assessed under points 6.5.1.2, 6.5.1.3 and 6.5.1.4, as applicable, then it shall promptly notify the reasons to the entity seeking approval as an approved haulier.

6.5.1.6. An approved haulier shall designate at least one person who shall be responsible for the implementation of the submitted security programme and the relevant operations and procedures implemented. That person shall have successfully completed an enhanced background check in accordance with point 11.1.1(b).

EN OJ L, 6.5.2024

6/18 ELI: http://data.europa.eu/eli/reg_impl/2024/1255/oj

6.5.1.7. An approved haulier shall be subject to a reapproval procedureat regular intervals not exceeding 5 years in order to assess whether it still complies with the requirements of Regulation (EC) No 300/2008 and its implementing acts. The procedure shall include an examination of the security programme and an on-site verification in accordance with point 6.5.1.3.

An inspection by the approving appropriate authority in accordance with its national quality control programme may be considered an on-site verification provided that it covers all the requirements necessary for approval.

6.5.1.8. Where the approving appropriate authority or another appropriate authority identifies deficiencies in the implementation of the haulier operations, it shall promptly inform the haulier thereof and request to rectify the deficiencies. Where the rectification is not achieved within a reasonable timeframe or the deficiencies are deemed to have a significant impact on the security of the supply chain, the approving appropriate authority shall suspend or withdraw the status of approved haulier, as appropriate.

Where the appropriate authority that has granted the approval is no longer satisfied that the approved haulier complies with the requirements of Regulation (EC) No 300/2008 and its implementing acts, it shall withdraw the status of approved haulier.

Immediately after withdrawal, and in any case within 24 hours of the withdrawal, the approving appropriate authority shall ensure that the approved haulier’s change of status is indicated in the “Union database on supply chain security”.

6.5.1.9. An approved haulier, approved in accordance with point 6.5 of this Annex, shall be recognised as such in all Member States.

6.5.2. Security controls to be applied by an approved haulier

6.5.2.1. An approved haulier shall ensure that:

(a) at its premises and at the locations where operations and procedures are implemented there is a level of security sufficient to protect identifiable air cargo and identifiable air mail to which security controls have previously been applied;

(b) all staff who perform transport of cargo and mail have received general security awareness training in accordance with point 11.2.7;

(c) all staff referred to in point (b) who are also granted unsupervised access to cargo and mail to which the required security controls have been applied, have received security training in accordance with point 11.2.3.9 and successfully completed a background check in accordance with point 11.1.2(b);

(d) identifiable air cargo and identifiable air mail to which security controls have previously been applied is protected from unauthorised interference or tampering during collection, handling, limited storage, transport and delivery.

6.5.2.2 In order to ensure that consignments to which the required security controls have been applied are protected from unauthorised interference during the operations performed by the approved haulier, all the following requirements shall apply:

(a) the consignments shall be packed or sealed by the regulated agent or known consignor so as to ensure that any tampering would be evident. Where this is not possible, alternative protection measures that ensure the integrity of the consignment shall be taken;

(b) the load compartment shall be searched immediately prior to loading and the integrity of that search shall be maintained until loading is completed;

OJ L, 6.5.2024 EN

ELI: http://data.europa.eu/eli/reg_impl/2024/1255/oj 7/18

(c) the cargo load compartment of the vehicle in which the consignments are to be transported shall be locked or sealed or curtain sided vehicles shall be secured with TIR cords so as to ensure that any tampering would be evident, or the load area of flatbed vehicles shall be kept under observation;

(d) each driver shall carry an identity card, passport, driving licence or other document, containing a photograph of the person, which has been issued or recognised by the national authorities. The card or document shall be used to establish the identity of the person receiving or delivering the consignments;

(e) drivers shall not make unscheduled stops between collection and delivery. Where that is unavoidable, the driver shall check the security of the load and the integrity of locks or seals, or both, on their return. If the driver discovers any evidence of interference, they shall notify both their supervisor and the recipient of the air cargo or mail;

(f) transport shall not be subcontracted to a third party, unless the third party is itself an approved haulier in accordance with point 6.5 or a regulated agent in accordance with point 6.3;

(g) no other services of handling air cargo (such as limited storage or protection) shall be subcontracted to any other party other than a regulated agent.

6.5.3. Date of application

6.5.3.1 As from 1 January 2027, surface transport within the Union of air cargo and mail consignments to which security controls have previously been applied, including transport by means of a vehicle under an air waybill and a flight number of the air carrier on whose behalf the transport is carried out, in accordance with the air cargo road feeder service model, shall be performed only by:

(a) a regulated agent, with its own means and resources as described in its security programme and confirmed during the on-site verification in the approval process;

(b) a known consignor, for cargo and mail originated by itself, with its own means and resources as described in its security programme and confirmed during the on-site verification in the approval process;

(c) a haulier who has been approved by an appropriate authority in accordance with point 6.5. and has entered into a transport agreement either with the regulated agent or known consignor on whose behalf the transport is performed, or in the case of an air cargo road feeder service activity, directly with the relevant air carrier on whose behalf the transport is carried out.

The first paragraph shall not apply to transportation within security restricted areas at airports.’;

(14) in point 6.6.1.1, the second and third paragraphs are replaced by the following:

‘Where the haulier has been approved by an appropriate authority in accordance with point 6.5, the haulier declaration referred to in the first paragraph, point (c), of this point, may be replaced by verification of the status of the approved haulier in the “Union database on supply chain security”.

The first paragraph, point (c), shall apply until 31 December 2026.’;

(15) the following Attachment 6-D is inserted:

‘ATTACHMENT 6-D

DECLARATION OF COMMITMENTS – APPROVED HAULIER

In accordance with Regulation (EC) No 300/2008 of the European Parliament and of the Council (1) on common rules in the field of civil aviation security and its implementing acts,

I declare that,

— to the best of my knowledge, the information contained in the company’s security programme is true and accurate;

EN OJ L, 6.5.2024

8/18 ELI: http://data.europa.eu/eli/reg_impl/2024/1255/oj

— the practices and procedures set out in the security programme will be implemented and maintained at all locations covered by the programme;

— the security programme will be adjusted and adapted to comply with all future relevant changes to Union legislation, unless [name of company] informs [name of appropriate authority] that it no longer wishes to trade as an approved haulier;

— [name of company] will inform [name of appropriate authority] in writing of:

(a) minor changes to its security programme, such as company name or person responsible for security or contact details, promptly and at least within 10 working days;

(b) major planned changes, such as procedural changes that might affect its compliance with relevant Union or national legislation or change of site or address, at least 15 working days prior to their commencement or the planned change;

— in order to ensure compliance with relevant Union legislation, [name of company] will cooperate fully with all inspections, as required, and provide access to all documents, as requested by inspectors;

— [name of company] will inform [name of appropriate authority] of any serious security breaches and of any suspicious circumstances which may be relevant to air cargo or air mail security, in particular any attempt to conceal prohibited articles in consignments or interference with secure transport, or both;

— [name of company] will ensure that all relevant staff receive training in accordance with Chapter 11 of the Annex to Commission Implementing Regulation (EU) 2015/1998 (2) and are aware of their security responsibilities under the company’s security programme;

— [name of company] will inform [name of appropriate authority] if:

(a) it ceases trading;

(b) it is no longer involved in transportation of air cargo/air mail;

(c) it can no longer meet the requirements of the relevant Union legislation.

I accept full responsibility for this declaration.

Name:

Position in company:

Name and registered address of the company:

Date:

Signature:

_____________ (1) Regulation (EC) No 300/2008 of the European Parliament and of the Council of 11 March 2008 on common

rules in the field of civil aviation security and repealing Regulation (EC) No 2320/2002 (OJ L 97, 9.4.2008, p. 72, ELI: http://data.europa.eu/eli/reg/2008/300/oj).

(2) Commission Implementing Regulation (EU) 2015/1998 of 5 November 2015 laying down detailed measures for the implementation of the common basic standards on aviation security (OJ L 299, 14.11.2015, p. 1, ELI: http://data.europa.eu/eli/reg_impl/2015/1998/oj).’;

OJ L, 6.5.2024 EN

ELI: http://data.europa.eu/eli/reg_impl/2024/1255/oj 9/18

(16) in the list 6-Fi in Attachment 6-F, the following entry is inserted before the entry Montenegro:

‘Kingdom of Norway, in regard to Svalbard Airport’;

(17) the following attachments 6-K and 6-L are added:

‘ATTACHMENT 6-K

SECURITY PROGRAMME OF THE APPROVED HAULIER

Introduction

This template for approved haulier security programme is designed to help you describe and assess your existing security precautions based on the criteria for hauliers set out in point 6.5 of Implementing Regulation (EU) 2015/1998. It is intended to enable you to ensure that you meet the requirements before you are subject to an official verification.

The applicant shall submit a security programme to the appropriate authority concerned. The programme shall describe the methods and procedures which are to be followed by the haulier in order to comply with the requirements of Regulation (EC) No 300/2008 and its implementing acts.

The approved haulier security programme shall be protected from unauthorised access and only used on a company-internal basis, as it contains security-relevant information. All persons entrusted with aviation security tasks must have demonstrable knowledge of the content as well as the ability to apply it.

Instructions for completion:

— If specified procedures do not apply to your operating site, that must be indicated in the approved haulier security programme.

— Insofar as you make changes to a chapter of this security programme in the future, note the date of change of the respective chapter in the table of contents and submit the entire haulier security programme with the changes to the appropriate authority that has given your approval. In addition, changes to the approved haulier security programme must be highlighted in colour.

Table of contents

Chapter Contents Date of the last modification

1 Contact details

2 Personnel

3 Transport and protection of air cargo and mail

4 Limited storage/transhipment of air cargo and mail

5 Internal quality assurance

6 Insider threat and security culture

7 Attachments: national requirements

CHAPTER 1

Contact details

1.1 Name, registered address and contact details of the haulier

Please indicate the name, full address and contact details (telephone, email address, etc.) of the company headquarters. Please note that your company will be approved under the official company name entered in the commercial register. Small or sole traders are approved as hauliers under their first and last names (as stated in the trade licence).

EN OJ L, 6.5.2024

10/18 ELI: http://data.europa.eu/eli/reg_impl/2024/1255/oj

Please indicate the VAT/Chamber of Commerce number/Corporate registration number (as applicable).

1.2 Person responsible for the implementation of the security programme of the approved haulier (security manager)

Please indicate name and contact details (telephone, email address, etc.) of the person responsible for the compilation of the security programme, its implementation, and the compliance therewith.

1.3 Self-presentation of the company

Please provide detailed information on the specific business activities of your company, in particular:

— the types of cargo you transport (e.g. live animals, perishable goods, dangerous goods, etc.);

— whether or not you subcontract (or intend to subcontract) the transport of air cargo or air mail to which security controls have been applied to third parties (i.e. another approved haulier or regulated agent).

1.4 Operating sites (to be completed if not identical to 1.1)

1.4.1 Please indicate:

— the name and full address of all the operating sites in the Member State (if applicable);

— the approximate number of employees on each operating site (at the time of establishing this security programme);

— the type and approximate share of operations carried out on each operational site (as a percentage of the total).

1.4.2 Please indicate:

— the name and full address of all the operating sites in each Member State other than the approving Member State (if applicable);

— the approximate number of employees on each operating site (at the time of establishing this security programme);

— the type and approximate share of operations carried out on each operational site (as a percentage of the total).

CHAPTER 2

Personnel

The personnel recruitment procedure and training are carried out in accordance with Chapter 11 of the Annex to Implementing Regulation (EU) 2015/1998, as described below.

2.1 Recruitment

Please describe the personnel recruitment procedure in place and how it ensures compliance with points 11.1.8, 11.1.9 and 11.1.10 of the Annex to Implementing Regulation (EU) 2015/1998.

Recruitment and training records, including results of any assessment tests, must be kept for at least the duration of the contract. Please describe how your procedures ensure compliance with point 11.1.10 of the Annex to Implementing Regulation (EU) 2015/1998.

2.2 Background check

A successful enhanced background check is required for the person responsible for the implementation of the security programme of the approved haulier (security manager), as indicated in point 1.2.

OJ L, 6.5.2024 EN

ELI: http://data.europa.eu/eli/reg_impl/2024/1255/oj 11/18

A successful background check is required for persons having unescorted access to air cargo and mail to which the required security controls have been applied, as well as for persons implementing protection and any other security controls in respect of that air cargo and mail. Whether an enhanced or a standard background check has to be completed shall be determined by the appropriate authority approving the haulier in accordance with applicable national rules.

Please describe the background check procedure for the different categories of personnel and how the procedure ensures that the relevant staff has a valid background check at all times.

If a person fails a background check or the background check is withdrawn by the competent authority, the access and entry rights of the person are immediately withdrawn and this person will no longer be deployed for activities that require the successful completion of a background check. Please describe the relevant procedure applicable in such cases.

2.3. Categories of personnel and training

The following categories of personnel exist and are subject to the relevant training specifications contained in the following points of the Annex to Implementing Regulation (EU) 2015/1998:

— person responsible for the implementation of the security programme of the approved haulier (security manager): training in accordance with point 11.2.5;

— personnel with unsupervised or unescorted access performing collection, carriage, limited storage and delivery of air cargo or air mail to which security controls have been applied: training in accordance with point 11.2.3.9;

— personnel with supervised or escorted access performing collection, carriage, limited storage and delivery of air cargo or air mail to which security controls have been applied: training in accordance with point 11.2.7;

— personnel with no access to air cargo or air mail to which security controls have been applied, involved in the transport or limited storage thereof: training in accordance with point 11.2.7.

Recurrent training of personnel must be carried out in accordance with point 11.4.3(a) of the Annex to Implementing Regulation (EU) 2015/1998.

The personnel includes both the company’s own personnel and personnel from service providers deployed at the operating site.

The approved haulier ensures that an up-to-date list of the personnel referred to in this point and the relevant training records are made available to the appropriate authority on request at any time.

Please describe the procedure and measures taken to ensure compliance with the requirements of this point at all times.

CHAPTER 3

Transport and protection of air cargo and mail

When collecting, transporting and delivering air cargo or air mail to which security controls have been applied, the haulier must ensure that it implements the requirements of point 6.5.2.1, 6.5.2.2 and 6.6 of the Annex to the Implementing Regulation (EU) 2015/1998 in its operations.

Please describe how the haulier ensures compliance with those legal provisions.

Please describe the actions implemented by the haulier where there is any reason to believe that a consignment to which security controls have been applied has been subject to an unlawful interference or has not been protected in accordance with point 6.6 of the Annex to Implementing Regulation (EU) 2015/1998, or both.

EN OJ L, 6.5.2024

12/18 ELI: http://data.europa.eu/eli/reg_impl/2024/1255/oj

CHAPTER 4

Limited storage/Transhipment of air cargo and mail

In accordance with point 6.0.6 of the Annex to Implementing Regulation (EU) 2015/1998 “limited storage” means the overall time strictly necessary for an approved haulier to perform the transhipment of cargo and mail from one means of transport onto the one used for the subsequent portion of the surface transport of that shipment.

During the limited storage the consignment shall be kept protected from unauthorised interference in accordance with points 6.5.2, 6.6.1 and 6.6.2 of the Annex to Implementing Regulation (EU) 2015/1998.

Please indicate whether or not the haulier performs limited storage operations. If applicable:

— please describe all types and means of storage used at each of the locations where that applies (e.g. warehouse, container, etc.), the reasons for their use and the relevant procedures in place;

— please explain how air cargo and mail to which security controls have been applied is protected from unauthorised interference during limited storage;

— please describe the actions implemented by the haulier where there is any reason to believe that a consignment to which security controls have been applied has been subject to an unlawful interference or has not been protected in accordance with points 6.5.2, 6.6.1 and 6.6.2 of the Annex to Implementing Regulation (EU) 2015/1998, or both.

CHAPTER 5

Internal quality assurance conducted by the approved haulier

The approved haulier must carry out internal quality assurance regularly, in accordance with national requirements.

The approved haulier must indicate the person responsible for aviation security internal quality activities (if different from the person indicated in point 1.2).

The approved haulier must ensure that the statutory requirements for the protection of air cargo or air mail to which security controls have been applied are complied with and that the procedures described in the security programme are up to date. To that end, the haulier must draw up an internal quality report.

Please list and describe the quality control activities performed, ensuring that they include and cover the following:

— scope and frequency of the quality control activities;

— areas and items to be checked;

— weighting of the individual deficiencies (e.g. minor, serious or very serious deficiency);

— responsibilities for rectification of deficiencies and deadlines for completion, as well as any escalation procedures.

The approved haulier shall ensure that the records of aviation security internal quality activities are made available to the appropriate authority on request at any time.

CHAPTER 6

Insider threat and security culture

To combat and mitigate the threat of internal offenders (insider threat), the approved haulier must lay down appropriate internal regulations and related preventive measures to raise awareness and promote a culture of security.

OJ L, 6.5.2024 EN

ELI: http://data.europa.eu/eli/reg_impl/2024/1255/oj 13/18

To that end, the haulier implements preventive measures to identify insider threat and radicalization and to counter those threats, as well as systems for the assessment of incidents relevant to aviation security. The measures taken and the assessment systems are being continuously analysed and corrected, in accordance with the following:

— please indicate name and contact details of the person (if different from the person indicated in point 1.2) or the function responsible for the coordination of those measures;

— please indicate name and contact details of the person (if different from the person indicated in point 1.2) or the function responsible for assessing incoming reports and for initiating and coordinating the measures to be derived from them;

— please describe the personnel awareness measures and information on the internal reporting system.

CHAPTER 7

Attachments: national requirements

Please include any information and policy or regulatory documents established at national level that the approved haulier shall comply with.

ATTACHMENT 6-L

VALIDATION CHECKLIST FOR APPROVED HAULIERS

Completion notes

When completing this checklist, please note that if the answer to any question presented in bold type is NO, the validation MUST be assessed as a FAIL, unless the question does not apply.

Please note that questions on this checklist are of two types: (1) those where a negative response will automatically mean that you cannot be accepted as an approved haulier and (2) those which will be used to build up a general picture of the security provisions of the haulier to allow the validator to reach an overall conclusion. The areas where a “fail” will automatically be recorded are indicated by the requirements indicated in bold type. If there is a “fail” on the requirements indicated in bold type, the reasons will be given to the haulier, as well as advice on adjustments needed in order to pass.

PART 1

Organisation and responsibilities

1.1 Date of validation

dd/mm/yyyy

1.2 Date of previous validation and unique alphanumeric identifier (UAI) where applicable

dd/mm/yyyy

UAI

1.3 Name of organisation to be validated

Name: VAT/chamber of commerce number/corporate registration number (if applicable):

1.4 Geographical scope of operations: Does the applicant have more than one site in the Member State from which it is seeking approval?

YES or NO

If YES, list all the sites in this Member State

EN OJ L, 6.5.2024

14/18 ELI: http://data.europa.eu/eli/reg_impl/2024/1255/oj

Indicate for each site the approximate total number of:

— all employees

— the employees dealing with secure air cargo and mail

— the type and share of operations carried out (as a percentage of the total)

1.5 Geographical scope of operations: Is the applicant also operating in Member State(s) other than the one from which it is seeking the approval?

YES or NO

If YES, list all sites in other Member States:

Approximate number of employees on each site

Indicate the type and share of operations in each of the other Member States (as a percentage of the total)

1.6 Address of site(s) to be validated and reason for the selection in case of multiple sites. NB. this can also include site(s) in other Member State(s) [add rows as necessary]

Reason for selection of the site

Number/Unit/Building

Street

Town

Postcode

Country

1.7 Main address of organisation (if different from site to be validated) in the approving Member State

Number/Unit/Building

Street

Town

Postcode

Country

1.8 Name and title of person responsible for air cargo/air mail security

Name

Job title

1.9 Contact telephone number

Tel. no.

1.10 Contact email address

Email

OJ L, 6.5.2024 EN

ELI: http://data.europa.eu/eli/reg_impl/2024/1255/oj 15/18

PART 2

Staff recruitment and training

Aim: To ensure that all personnel required to do so have been subject to an appropriate background check as well as trained in accordance with Chapter 11 of the Annex to Implementing Regulation (EU) 2015/1998.

2.1 Does the appointment process for the named person responsible for the application and supervision of the implementation of security controls at the site include a requirement for an enhanced background check in accordance with point 11.1.1(b) of the Annex to Implementing Regulation (EU) 2015/1998?

YES or NO

If YES, describe

2.2 Is there a recruitment procedure to ensure that all staff with unsupervised or unescorted access to identifiable air cargo or air mail to which the required security controls have been applied completed a background check in accordance with point 11.1.2(b) of the Annex to Implementing Regulation (EU) 2015/1998, and to the extent required by the approving appropriate authority?

YES or NO

If YES, describe

2.3 Is there a recruitment procedure to ensure that all staff who do not have unsupervised or unescorted access to and perform transport or limited storage of cargo or mail to which the required security controls have been applied have received general security awareness training in accordance with point 11.2.7 of the Annex to Implementing Regulation (EU) 2015/1998?

YES or NO

If YES, describe

2.4 Is there a recruitment procedure to ensure that all staff with unsupervised or unescorted access to identifiable air cargo or air mail to which the required security controls have been applied have received security training in accordance with point 11.2.3.9 of the Annex to Implementing Regulation (EU) 2015/1998?

YES or NO

If YES, describe

2.5 Does the appointment process for the named person responsible for the application and supervision of the implementation of security controls at the site include a security train­ ing in accordance with point 11.2.5 of the Annex to Implementing Regulation (EU) 2015/1998?

YES or NO

If YES, describe

2.6 Do staff (as referred to in points 2.3, 2.4 and 2.5) receive recurrent training in accordance with the frequency established for this training?

YES or NO

If YES, describe

EN OJ L, 6.5.2024

16/18 ELI: http://data.europa.eu/eli/reg_impl/2024/1255/oj

2.7 Assessment – Are the measures sufficient to ensure that all staff with access to identifiable air cargo or air mail have been properly recruited and trained in accordance with Chapter 11 of the Annex to Implementing Regulation (EU) 2015/1998?

YES or NO

If NO, specify reasons

PART 3

Transportation

Aim: To protect identifiable air cargo or air mail from unauthorised interference or tampering.

3.1 Is the haulier transporting the air cargo or air mail on behalf of a regulated agent or a known consignor, or both?

YES or NO

3.2 Is the haulier using a subcontractor for transport?

YES or NO

If YES, describe how does the haulier verify that the contractor itself is an approved haulier or a regulated agent?

3.3 Is the cargo compartment of the transport vehicle securable?

YES or NO

If YES, describe how

3.4 (a) Where the cargo compartment of the transport vehicle is securable, are numbered seals used?

YES or NO

(b) Where numbered seals are used, is access to the seals controlled and the numbers recorded when applied?

YES or NO

If YES, describe how

3.5 Assessment: Are the measures sufficient to protect air cargo or air mail from unauthorised interference during transportation?

YES or NO

If NO, specify reasons

PART 4

Limited storage/Transhipment

Aim: To protect identifiable air cargo or air mail from unauthorised interference or tampering during limited storage.

4.1 Is limited storage or transhipment performed by the haulier?

OJ L, 6.5.2024 EN

ELI: http://data.europa.eu/eli/reg_impl/2024/1255/oj 17/18

YES or NO

If YES, describe the type of storage used or measures for transhipment, or both:

4.2 Is the air cargo or air mail kept protected from unauthorised interference during the lim­ ited storage or transhipment in accordance with points 6.5.2, 6.6.1 and 6.6.2 of the Annex to Implementing Regulation (EU) 2015/1998?

YES or NO

If YES, describe the measures to protect the air cargo or air mail:

4.3 Assessment: Are the limited storage or transhipment procedures sufficient to protect identifiable air cargo or air mail from unauthorised interference or tampering, or both?

YES or NO

If NO, specify reasons

PART 5

Assessment (and notification)

Pass/Fail

Where the overall assessment is a fail, list the areas where the haulier fails to achieve the required stan­ dard of security or has a specific vulnerability. Also, provide advice on the adjustments needed to achieve the required standard and thus to pass.

Signed

(Name of validator)’;

(18) in point 11.1.5, the second paragraph is replaced by the following:

‘Whenever an enhanced background check is required, it shall be fully completed before the person undergoes the training referred to in points 11.2.3.1 to 11.2.3.5.’;

(19) in point 12.6.2, the second paragraph is replaced by the following:

‘The standard for ETD equipment for the detection of chemicals, that uses particulate sampling, shall apply as of 1 October 2025 to ETD equipment deployed from 1 September 2014.’.

EN OJ L, 6.5.2024

18/18 ELI: http://data.europa.eu/eli/reg_impl/2024/1255/oj