Changes from plenary report to adopted text

62. Takes note of the Court’s observations on ESMA’s contract management, particularly six incidents in 2024 where services were provided before contract signing, contravening Article 172(1) of the Financial Regulation; acknowledges that EUR 30 556 in prior payments were irregular, though ESMA highlights low materiality (0,04 % of total payments) and notes internal detection of the cases; notes that all payments (EUR 30 606) were made under existing Framework Contracts, mitigating legal risk;

63. Draws attention to the significant impact of the Digital Operational Resilience Act (DORA), and the Markets in Crypto-Assets Regulation (MiCAR), on the European Banking Authority's (EBA) operational mandates and tasks; notes with concern that initial provisions did not adequately address the funding required for establishing these roles or for the preparatory and implementation phases of related policies; fully supports the view of the Authority that future Legislative Financial Statements must anticipate and provide adequate resources for the timely and effective setup of such complex mandates; urges adequate funding be provided to address this expansion of this mandate;

64. Notes that the procurement procedure led by ESMA, in which the EBA participated as a contracting authority, resulted in the award of a framework contract with a ceiling of EUR 40,2 million in December 2022; notes that a legal application concerning the outcome of the procedure was lodged in January 2023, seeking annulment of the award decision and compensation; welcomes that the judgment of the Court of Justice of the European Union of 29 October 2025 rejected in its entirety the applicant’s requests for annulment and for compensation for damages;

Recommendations

65. Calls on the agencies, in particular to:

– ESMA, to strengthen ex ante controls, enhance monitoring tools, and provide training to prevent future recurrences;

Agencies in the area of Justice and Home affairs

66. Notes that in June 2024, CEPOL experienced a significant cyber-attack that impacted all business areas, leading to the cancellation of 10 onsite training activities and the suspension of all online training for the remainder of the year; notes furthermore that the event not only disrupted CEPOL’s operational activities but it also resulted in additional unplanned expenditures related to incident response, system recovery, and enhanced cybersecurity measures; notes that the security breach was the direct result of a sophisticated cyberattack that targeted CEPOL’s digital infrastructure, and that unauthorised actors gained access to a substantial volume of personal data, compromising its confidentiality, integrity, and availability; emphasises that due to the cyber incident, approximately 99 000 individuals had to be notified directly about the breach of their personal data and that the attack prompted a criminal investigation supported by CERT-EU and Europol; is concerned that despite some circumstantial evidence the threat actor has not been conclusively identified; draws attention to CERT-EU’s advice to rebuild the infrastructure, leading to the implementation of a zero-trust, full-cloud IT environment with new equipment by DG DIGIT within three weeks; notes that CEPOL is currently implementing 42 cybersecurity tasks and projects as part of its Cybersecurity Plan; highlights that ICT security awareness and training sessions have been rolled out to all staff, complemented by regular intranet notifications and updates, as part of standard practice; stresses that cybersecurity failures pose not only operational but also reputational, financial and legal risks for agencies; calls for binding minimum cybersecurity standards and adequate, stable funding to ensure their effective implementation;

67. Stresses that when agencies operate outside the territory of the Union or cooperate with third-country authorities, they remain fully bound by Union law; calls on the Commission to ensure that cooperation agreements, operational arrangements and data-sharing frameworks include enforceable safeguards, monitoring mechanisms and clear reporting obligations to the discharge authority;

69. Notes the underrepresentation of men in the staff of EIGE at just 29 % and 21 % (8 men) in the management board, encourages EIGE to achieve a more balanced gender representation in the future hiring of staff;

70. Takes note of the Court’s observations on EIGE’s management and control systems, including:

– procurement irregularities: points out that in 2024, EIGE applied excessive financial capacity requirements and restrictive selection criteria in a tender procedure for cleaning services that, according to the Court, might have dissuaded or even prevented potential bidders from participating; acknowledges that EIGE highlights that the restrictive criteria was requested by co-contracting authorities (Commission and Parliament) and no potential bidders complained about the selection criteria;

– inadequate tender evaluation: notes that in two procurements (EUR 220 000 and EUR 193 175), EIGE’s evaluation committees failed to properly assess the ability of tenderers to manage expert teams because, in the tender specifications, EIGE had not required tenderers to provide appropriate evidence in this regard risking poor service delivery;

– weak contract oversight: acknowledges that EIGE paid invoices implemented under three "time and means" contracts without verifying the actual days worked, violating Article 45(5) of its financial regulation and exposing it to overpayment risks; notes that EIGE will strengthen ex ante checks accordingly;

71. Notes the Court’s findings concerning eu-LISA, most of which, relate to procurement irregularities initiated in previous years, resulting in irregular payments in 2024 that include:

– irregularities in a negotiated procedure initiated in 2019 and completed in 2020 for the rental of premises in Strasbourg, where the premises' surface area and number of workplaces were below the needs defined in the tender specifications, and the quality of the offer was assessed as very low but not rejected; notes furthermore that the award criteria were also subsequently negotiated with the tenderer, contravening Article 167(3) and point 6.5 of Annex I to the Financial Regulation; highlights that the negotiated procedure and the resulting rental contract are irregular as well as the associated payments that amounted EUR 850 000 in 2024;

– modifications to the financial offers of tenderers during a procurement procedure for electrical and civil works in Strasbourg, affecting the outcome of the procedure and resulting in an irregular contract and related payments amounting EUR 150 000 in 2024;

– changes in pricing elements of financial offers beyond the corrections allowed under Article 151 of the Financial Regulation, decisively affecting the outcome of a tender and resulting in irregular contracts and related payments totalling EUR 1,4 million in 2024;

– reopening of the competition for monitoring and maintenance services in relation to the Visa information system; is concerned by the fact that the winning tenderer (EUR 47,8 million) was five times lower than the second-cheapest (EUR 243,4 million) and 50 times lower than the highest (EUR 2,4 billion), raising concerns about its validity; draws attention to the fact that euLISA set up a working group to review this reopening of the competition that confirmed the assessment by financial officers but reported operational and contractual risks linked to the fact that the agency would have to pay the bulk of the contract price upfront; highlights that the Court has considered this risk to be significant;

– recalls that, following delays in the implementation of the Entry/Exit System (EES), a dispute arose in which the contractor refused to cover additional maintenance costs for certain IT products, leading to a lapse in maintenance coverage between November 2022 and April 2023 and exposing eu-LISA to operational risks; recalls that, to address the immediate risk to business continuity, eu-LISA amended the transversal operations framework contract (TOF) in 2023 to include reinstatement fees, penalties applied when maintenance is not renewed on time, and subsequently paid EUR 5,3 million in 2023 and EUR 1,3 million in 2024 for the renewal of software maintenance and related reinstatement costs which, according to the Agency’s interpretation, should have been borne by the EES contractor; further recalls that, despite the magnitude of the disputed amounts and the continued open status of the Court’s observation, eu-LISA had not initiated litigation against the EES contractor by the end of 2024;

72. Is concerned that persistent irregularities identified in euLISA’s procurement processes demonstrate systemic weaknesses in the agency’s procurement framework; notes euLISA’s acknowledgment of these issues and efforts to strengthen its practices, encourages eu-LISA to formulate a strategy on improving their procurement framework to be shared at the discharge hearings next year, encourages eu-LISA to provide clarity and transparency on the conditions under which re-tendering may not be considered appropriate; encourages eu-LISA to seek expert advice when formulating this new strategy and to consult with other agencies on best practices;

73. Acknowledges that eu-LISA is confronted with substantial challenges and emphasises the necessity to increase its staff to effectively address these challenges and ensure the continuity of its operations and that this should be funded accordingly;

74. Notes the Court’s procurement observation that, in 2020, Eurojust entered into a framework contract for vehicle leasing with a single economic operator, which was not appropriate for the nature of the services required acknowledges the specific contract awarded, as well as all related payments (EUR 64 000 in 2024), was therefore irregular; takes note of Eurojust’s reply that the framework contract referred to in the ECA 2020 report expired on 10 May 2024, and a new framework contract for vehicle leasing is in place since 25 November 2024;

75. Is concerned by the Court’s observations that Eurojust has not updated its business continuity plans since 2021, despite significant changes affecting resources and staff for key processes, including the introduction of SUMMA as a new budgetary, accounting, and financial system; highlights that Eurojust has also not followed the frequency of testing established in its last business continuity plan and currently lacks a coordinated and agreed disaster recovery plan for its IT systems;

76. Notes that Eurojust’s mandate is set to expand in the future, including to a third state and that the agency is handling an increasing number of criminal cases annually; acknowledges that, in view of these developments, Eurojust needs to increase its staffing levels in order to ensure comprehensive case coverage and the uninterrupted continuity of its operations and that corresponding funding should be made available;

77. In addition, notes the Court’s observation that Eurojust did not adopt a proper financing decision prior to launching procurement procedures for operational expenditure, undermining effective planning and oversight and contravening Articles 32(1) and 72(3)(b) of Eurojust’s financial rules; welcomes Eurojust’s commitment to publish an approved annual procurement plan of all procedures on its website, covering both operational and administrative expenditure, starting from 2026;

78. Notes that, in October 2025, the General Court of the European Union (‘General Court’) annulled two decisions by Eurojust rejecting a temporary staff member’s request for assistance due to alleged psychological harassment by ten colleagues including his Administrative Director; is aware that the Court ruled that Eurojust violated its duty of diligence under Article 24 of the Staff Regulations by splitting this staff member’s inquiry into two separate administrative processes, thereby failing to conduct a holistic, contextual investigation of interconnected harassment claims; notes that while the Court annulled the decisions to allow a proper reassessment, it dismissed the compensation claims;

80. Notes the Court’s observation that Europol irregularly reimbursed value-added tax (VAT) under operational grants paid to national police forces acting as public authorities, contrary to Article 186(4)(c) of the Financial Regulation, which does not allow VAT reimbursement to public entities acting in that capacity; takes note of Europol’s explanation that it followed Commission guidance at the time, which allowed VAT to be considered eligible under operational grants, and welcomes the decision to exclude VAT from all new grant agreements initiated by the end of 2024;

81. Welcomes that Europol’s Operational Task Forces (OTFs) and Joint Investigative Teams (JITs) mechanisms were instrumental in dismantling the encrypted communication platform Matrix, demonstrating their complementary yet distinct roles in combating transnational organised crime; notes that the operation began as an OTF in June 2024 between the Netherlands, France, Lithuania, Italy, and Spain, facilitating intelligence-sharing and monitoring of criminal activity; highlights that the transition to a JIT under Eurojust enabled formal investigative coordination, resulting in arrests, seizures, and the decryption of 2,3 million messages in 33 languages; observes that German authorities provided technical support, while Spanish, French, and Dutch police collaborated throughout the investigation; is of the opinion that this case underscores the effectiveness of cross-border cooperation in disrupting illicit networks and the need for sustained investment in law enforcement capabilities to address evolving criminal tactics;

82. Notes that in May 2025 the discharge of the European Union Agency for Asylum (EUAA) was postponed due to findings by the OLAF regarding governance and stability; notes that a confidential investigation by OLAF found that senior management at the EUAA agency bypassed staff regulations and that OLAF investigators have noted that such hiring practices are in breach of the Union's Staff Regulations;

83. Takes note of the EUAA status report of 31 October 2025 on the implementation of corrective actions, as agreed between the Executive Director and the Management Board, as a follow-up to Parliament’s resolution; notes that the Management Board is addressing Parliament’s observations in line with its procedures and will review progress on outstanding measures at its meeting in November 2025; urges the Agency to fully clarify all open issues, to implement OLAF recommendations in a credible and transparent manner, and to establish robust internal control, ethical oversight and accountability mechanisms; calls on the Agency to inform the discharge authority of any remedial steps taken without undue delay; stresses that the conclusion of OLAF investigations does not in itself constitute closure of governance failures; reiterates that the discharge authority retains full oversight rights until structural weaknesses in management, transparency and conflict-of-interest handling are fully remedied and verified;

84. Notes that while improvements were made in 2024 to strengthen the Agency’s ethical framework, staff awareness, and internal conflict-of-interest procedures, the structural conflict of interest identified by OLAF regarding complaints against the Executive Director had not yet been addressed, as the Legal Unit responsible for preparing such cases continued to operate under the direct supervision of the Executive Director, undermining the independence of the complaints process; notes that most corrective actions are scheduled for 2025 and 2026, including organisational changes, an optimisation programme, training for staff and managers, improvements to governance documents, enhanced transparency in reporting irregularities, a review of internal guidance on requests and complaints under Article 90 of the Staff Regulations, strengthened cooperation with DG HR for handling complaints and a review of procedures for requests for assistance under Article 24 of the Staff Regulations;

85. Further stresses the need for continued vigilance regarding the EUAA’s turnover rates and staff satisfaction, the strict prevention of any nepotism or favouritism, and full transparency and merit-based procedures in recruitment and career progression;

86. Reserves the right to condition or postpone future discharge decisions where agencies fail to deliver full and verifiable structural reforms following serious findings;

Recommendations

87. Calls on the EU agencies to act on the Court's observations, in particular to:

(i) EIGE to enhance procurement practices by reviewing overly restrictive tender criteria, strengthening evaluation processes to assess the team management capabilities of tenderers, and implementing strict verification of "time and means" contracts to prevent overpayments;

(ii) eu-LISA to address systemic procurement weaknesses including irregular rental contracts and improper financial offer modifications, while enhancing transparency and risk mitigation in tender evaluations; calls on eu-LISA to provide detailed information on the dispute arising from the delays in the implementation of the Entry/Exit System (EES), in particular on the internal assessment that led the Agency to assume reinstatement and maintenance renewal costs amounting to EUR 6,6 million in 20232024 under the transversal operations framework contract, despite considering these costs contractually attributable to the EES contractor; requests clarification on the reasons why no legal proceedings were initiated by the end of 2024 and on whether alternative dispute-resolution or recovery actions were explored; recommends that eu-LISA strengthen its contract-enforcement and dispute-resolution mechanisms, establish clear escalation procedures, and ensure that similar disputes are addressed promptly and transparently in order to safeguard the Agency’s financial interests and operational continuity; encourages eu-LISA to provide an opinion on the conditions under which re-tendering may not be considered appropriate and in which situations it makes common sense to keep the same provider/s in order to ensure continuity of business;

(iii) Eurojust to urgently update business continuity plans within six months to reflect current operations including SUMMA implementation, conduct regular disaster recovery testing, and establish proper financing decisions prior to procurement procedures; requests Eurojust to present its new business continuity plans in the discharge follow up report;

88. Furthermore, calls on the following EU agencies:

(i) CEPOL and all EU agencies to urgently strengthen their internal cybersecurity governance, allocate adequate and stable resources, enhance detection and response capacities, and take concrete steps toward zero-trust architecture to reduce vulnerabilities and ensure resilience against increasingly sophisticated cyber threats;

(ii) Europol to maintain vigilance in ensuring compliance with eligibility rules in future funding cycles, following its swift corrective action on VAT reimbursements; urges the Commission to issue clear guidance on the implementation of Article 186(4)(c) of the Financial Regulation, given that questions regarding the eligibility of VAT have also arisen in other cases in former years, reflecting some ambiguities;

(iii) the EUAA to ensure rigorous monitoring of milestones, particularly those scheduled for 2026 which constitute the core of reform efforts, and report back to the Discharge Authority on the implementation of corrective actions;

(iv) EU agencies and in particular Eurojust to establish clear guidelines for handling complex harassment cases and ensure consistent application of Article 24 of the Staff Regulations;

(v) the EUAA to implement an effective complaint mechanism for handling complaints ensuring full impartiality and restoring confidence in its governance;

(vi) Frontex to strengthen the budget planning and execution to ensure compliance with the principle of annuality; stresses that the scale and complexity of the agency's mandate require robust internal mechanisms and invites the agency to reinforce oversight of procurement and contract management procedures; encourages Frontex to strengthen follow-up procedures on audit findings and to report measurable progress to the discharge authority;

(vii) Eurojust to share future budgeting needs with the Commission regarding the future expansion of the mandate and urges adequate funding and staffing be provided to address this expansion of the mandate;

Agencies in the area of Employment, education and social affairs

89. Highlights the ELA’s incorrect classification of an amending budget as external assigned revenue, in breach of Articles 6, 12, 20, 21 and 34 of the Financial Rules; takes note of the ELA’s reply explaining that the funds arrived late and for this reason the ELA temporarily reallocated its own budget to avoid payment delays, then recorded the Union funds as external revenue to ensure they were used only for salaries;

90. Takes note of the conclusions of the Evaluation of the ELA, which highlights the need for the Authority to improve its monitoring system based on SMART objectives and key performance indicators; notes with concern that this absence hindered the assessment of the cost-effectiveness of the ELA's activities and undermined the quality of performance monitoring; acknowledges that the ELA has the potential to strengthen its monitoring system through the implementation of structured approaches;

91. Notes with concern that the ELA continues to rely excessively on temporary workers, SNEs and interim staff, for core operational and financial functions; observes that at the end of 2022, temporary workers represented 58 % of the ELA’s workforce, and despite a slight reduction, the proportion remained very high at 47 % at the end of both 2023 and 2024; further notes that, contrary to Article 41(1) of the ELA’s Financial Rules, the Authority relied on an interim worker and a trainee to perform core financial activities related to budget implementation between November 2022 and March 2023, a practice that continued in 2023 and persisted in 2024 with the continued use of an interim worker for essential financial tasks;

92. Takes note of the explanation provided during the hearing held on 1 December 2025 by the Executive Director of the ELA regarding the structurally high share of temporary workers, in particular SNEs, who currently account for around 42-50 % of the ELA’s operational staff and are legally prevented from performing core functions, thereby creating concentration of responsibilities and a higher risk of errors; supports an adjustment of the establishment plan to replace SNE-based resourcing with additional Temporary Agent posts filled through open and competitive procedures within the existing budgetary ceiling; is of the opinion that the Labour Authority should be a role-model in labour standards and seek to offer longer contracts which would be in the interests of staff, the continuity of business, and knowledge retention; calls on the Authority to further enhance cooperation with national labour authorities in order to avoid duplication and to improve information exchange;

93. Draws attention to the conclusions of the Evaluation of EU agencies: Cedefop, EUOSHA, Eurofound, and the ETF; notes that the evaluation has not found evidence to change the conclusions from the previous 2019 evaluation which concluded that merger options present challenges in balancing benefits and drawbacks while efficiency improvements can be achieved through better cooperation; highlights the need for stronger collaboration with the Commission on high-value joint outputs, such as Eurofound-Cedefop cooperation on the European company survey and Cedefop-ETF alignment on VET policy monitoring; observes that better coordination between Cedefop, the ELA, and Eurofound is needed to avoid duplication in skills forecasting and labour-market analysis;

94. Observes that monitoring systems in all agencies, including SMART objectives and KPIs should be strengthened to improve performance assessment and stakeholder engagement; highlights that data gaps (particularly in the ETF), missing performance targets, and the absence of national-level indicators undermine effectiveness; observes that these challenges require improved data completeness, legally clear target-setting, and enhanced monitoring frameworks to ensure comprehensive performance assessments and alignment with stakeholder needs; stresses the importance of transparent governance structures and conflict-of-interest safeguards to support stakeholder confidence in their work;

95. Takes note that the four agencies (Cedefop, EUOSHA, Eurofound, and the ETF) have the potential to reduce the administrative burden and improve efficiency through shared services20; highlights that the agencies should reduce administrative burdens on staff to maintain sustainable workloads by sharing common services for HR, legal, IT, and technical functions; points out that this would enable agencies to decrease staff engaged in administrative activities and increase focus on core operations; calls on these agencies, in close coordination with the Court, to develop a structured shared-services implementation plan with concrete milestones, to facilitate mutual exchange of best practices and recommendations among the agencies concerned as well as across the broader EUAN, drawing on the Court's audit findings and cross-cutting evaluations; calls on the Commission to report annually to the discharge authority on the progress achieved under this plan;