Changes from report parliamentary committee draft to plenary report

50. Remarks that the Court considers the risk to the legality and regularity of payments underlying the agencies’ accounts overall to be medium, varying from low to high for specific budget titles; notes that the Court considers the risk for Title I (Staff Expenditure) to be generally low, for Title II (Administrative Expenditure) to be medium and for Title III (Operational Expenditure) to be low to high, depending on the agency in question and the nature of its operational expenditure; points out that the Court considers the risk as regards Title III to be similar to the risk of Title II, but since there are far higher amounts at stake under Title III, the impact is considered to be higher;

51. Notes that, as in previous years, the Court considers the risk to sound financial management to be medium and primarily associated with public procurement procedures;

Change 85

Changed44.52. Notes that the Court considers the risk to budget management to be low, with the Court’s audit reporting weaknesses relating mainly to automatic carry-overs of non-differentiated appropriations and late payments; highlights that weaknesses in management and control systems concern issues such as the absence of adequate ex-post/ex-ante checks, operational procurements launched without proper financing decisions, expenditure implemented without the proper delegation of power by an authorising officer, weaknesses in the management of grants and delays in an agency’s evaluation by the Commission; stresses that these weaknesses listed by the Court, undermine sound financial management and expose agencies to financial and reputational risks; calls on the agencies concerned to ensure full compliance with the Financial Regulation and to take the necessary corrective measures, and invites the Commission to closely monitor their implementation;

53. Takes note that in 2024 the Court made a total of 72 observations, referring to different issues in the areas of procurement (34 observations), management and control systems (11 observations) (other than procurement and HR issues), and budget management (27 observations);

54. Notes that the Court issued an unqualified audit opinion on the reliability of the accounts of all agencies; notes that the Court issued an unqualified opinion on the legality and regularity of the revenue underlying the accounts for all agencies;

55. Observes that an unqualified opinion on the legality and regularity of the payments underlying the accounts was issued for all agencies with the exception of the European Labour Authority (ELA);

Change 86

Changed48.56. Notes that, concerning the ELA, the qualification relates to payments amounting to EUR 2,6 million in 2024, representing 5,7 % of the total payment appropriations available; notes that this amount includes EUR 2,2 million related to a contract deemed irregular in the 2022 audit report due to the awarded value exceeding the established maximum contract limit contravening point 12.3(a) of Annex I to the Financial Regulation and EUR 0,4 million associated with deficiencies in ex ante checks on contract implementation; takes note of the ELA reply’s during the hearing held on 1 December 2025 that, notwithstanding the irregular award, actual payments made under the contract remained within the EUR 6 million ceiling established in the tender specifications, and that the contract was essential to ensuring the Authority’s continuity of operations during its initial establishment phase; further notes that the irregular contract ended in February 2024 and was not renewed; welcomes the Authority’s assurances that corrective measures have been implemented, including revised tender documentation, strengthened procurement procedures and updated internal checklists to prevent similar irregularities; urges the ELA to strengthen planning and prioritisation mechanisms to ensure efficient use of appropriations and timely implementation of operational activities in the future;

57. Highlights that the Court issued ‘emphasis of matter’ paragraphs to underline a matter presented or disclosed in the accounts which is of such importance that it is fundamental to the understanding of the accounts or the underlying revenue or payments; further notes that, for the 2024 financial year, the Court used ‘emphasis of matter’ paragraphs for the following agencies that are part of this resolution: CdT, CEPOL, EBA, EIT, EMA and ESMA;

Change 87

Changed50.58. Notes that “observations” in the agencies’ specific annual reports are in fact “not timed recommendations” by the Court; notes that the Court annually follows-up on those observations by assessing their status as “open” or “closed”; considers, however, that long-standing open observations should call for timely and concrete corrective measures, accompanied by reinforced oversight by the respective management boards in order to prevent recurrent weaknesses;

▸10 unchanged paragraphs

59. Notes that out of a total of 109 observations made by the Court corresponding to previous years of the agencies that are part of this resolution, a total of 66 were closed during 2024, with a total of 39 still open and two partially closed; observes that the number of ongoing observations varies among the agencies, with some having no open observations, as is the case for the BEREC Office, CdT, CEPOL, EASA, EBA, ECHA, EFSA, EMA, EMSA, ERA, ESA and ESMA, and the highest number of open observations remains in ACER (four), ELA (five), eu-LISA (five) and Frontex (four), compared to ACER (three), ELA (five), euLISA (eight) and Frontex (seven) in 2023; recognises the improvements and encourages the agencies to continue working to resolve the open issues;

60. Takes note that seven out of the 39 open observations (53 in 2023) refer to a high level of carry-overs (ACER, ECDC, EFCA, EIGE, Eurofound, FRA and Frontex); recognises that the ELA and euLISA have reduced the carry-over rate to 15 % which is the Court’s reporting threshold;

Agencies in the area of Economic and Financial Affairs

61. Takes note of the Court’s observations on ESMA’s contract management, particularly six incidents in 2024 where services were provided before contract signing, contravening Article 172(1) of the Financial Regulation; acknowledges that EUR 30 556 in prior payments were irregular, though ESMA highlights low materiality (0,04 % of total payments) and notes internal detection of the cases; notes that all payments (EUR 30 606) were made under existing Framework Contracts, mitigating legal risk;

62. Draws attention to the significant impact of the Digital Operational Resilience Act (DORA), and the Markets in Crypto-Assets Regulation (MiCAR), on the European Banking Authority's (EBA) operational mandates and tasks; notes with concern that initial provisions did not adequately address the funding required for establishing these roles or for the preparatory and implementation phases of related policies; fully supports the view of the Authority that future Legislative Financial Statements must anticipate and provide adequate resources for the timely and effective setup of such complex mandates; urges adequate funding be provided to address this expansion of this mandate;

63. Notes that the procurement procedure led by ESMA, in which the EBA participated as a contracting authority, resulted in the award of a framework contract with a ceiling of EUR 40,2 million in December 2022; notes that a legal application concerning the outcome of the procedure was lodged in January 2023, seeking annulment of the award decision and compensation; welcomes that the judgment of the Court of Justice of the European Union of 29 October 2025 rejected in its entirety the applicant’s requests for annulment and for compensation for damages;

Recommendations

64. Calls on the agencies, in particular to:

– ESMA, to strengthen ex ante controls, enhance monitoring tools, and provide training to prevent future recurrences;

Agencies in the area of Justice and Home affairs

Change 88

Changed57.65. Notes that in June 2024, CEPOL experienced a significant cyber-attack that impacted all business areas, leading to the cancellation of 10 onsite training activities and the suspension of all online training for the remainder of the year; notes furthermore that the event not only disrupted CEPOL’s operational activities but it also resulted in additional unplanned expenditures related to incident response, system recovery, and enhanced cybersecurity measures; isnotes awarethat the security breach was the direct result of a sophisticated cyberattack that targeted CEPOL’s digital infrastructure, and that unauthorised actors gained access to a substantial volume of personal data, compromising its confidentiality, integrity, and availability; emphasises that due to the attack,cyber incident, approximately 99 000 individuals had to be notified directly about the breach of their personal data and that the attack prompted a criminal investigation supported by CERT-EU and Europol; is concerned that despite some circumstantial evidence the threat actor has not been conclusively identified; draws attention to CERT-EU’s advice to rebuild the infrastructure, leading to the implementation of a zero-trustzero-trust, approachfull-cloud infrastructureIT environment with new equipment by DG DIGIT within three weeks; notes that CEPOL is currently implementing 42 cybersecurity tasks and projects as part of its Cybersecurity Plan; highlights that ICT security awareness and training sessions have been rolled out to all staff, complemented by regular intranet notifications and updates, as part of standard practice; stresses that cybersecurity failures pose not only operational but also reputational, financial and legal risks for agencies; calls for binding minimum cybersecurity standards and adequate, stable funding to ensure their effective implementation;

Change 89

Removed58. Recalls that Regulation (EU, Euratom) 2023/284 establishes a binding and ambitious cybersecurity framework for all decentralised agencies, including the adoption of a comprehensive cybersecurity risk-management system, the implementation of robust technical and organisational measures across all ICT environments, the progressive transition towards zero-trust architecture, strengthened cooperation with CERT-EU, and strict incident-reporting obligations; notes that several of these core requirements remain challenging given the current uneven levels of preparedness across agencies; stresses that all agencies must treat CEPOL’s cyber-attack as a clear lesson learnt and accelerate implementation of the Regulation’s cybersecurity provisions;

Added66. Stresses that when agencies operate outside the territory of the Union or cooperate with third-country authorities, they remain fully bound by Union law; calls on the Commission to ensure that cooperation agreements, operational arrangements and data-sharing frameworks include enforceable safeguards, monitoring mechanisms and clear reporting obligations to the discharge authority;

Added67. Recalls that Regulation (EU, Euratom) 2023/284 establishes a binding and ambitious cybersecurity framework for all decentralised agencies covering financial mechanisms, operational platforms and sensitive data, as well as the implementation of robust technical and organisational measures across all ICT environments, the progressive transition towards zero-trust architecture, strengthened cooperation with CERT-EU, DG DIGIT and other relevant inter-institutional bodies as well as strict incident-reporting obligations; notes that several of these core requirements remain challenging given the current uneven levels of preparedness across agencies; stresses that the cybersecurity incident affecting CEPOL demonstrates the daily cyber threats to which the agencies are exposed and their vulnerability when handling sensitive data; calls for accelerated implementation in all agencies of Cyber security provisions of the Regulation (EU, Euratom) 2023/284, and regular stress-testing of agencies’ IT; urges agencies to enhance real-time threat monitoring, response capabilities, and staff cybersecurity training;

Added68. Notes the underrepresentation of men in the staff of EIGE at just 29 % and 21 % (8 men) in the management board, encourages EIGE to achieve a more balanced gender representation in the future hiring of staff;

▸20 unchanged paragraphs

69. Takes note of the Court’s observations on EIGE’s management and control systems, including:

– procurement irregularities: points out that in 2024, EIGE applied excessive financial capacity requirements and restrictive selection criteria in a tender procedure for cleaning services that, according to the Court, might have dissuaded or even prevented potential bidders from participating; acknowledges that EIGE highlights that the restrictive criteria was requested by co-contracting authorities (Commission and Parliament) and no potential bidders complained about the selection criteria;

– inadequate tender evaluation: notes that in two procurements (EUR 220 000 and EUR 193 175), EIGE’s evaluation committees failed to properly assess the ability of tenderers to manage expert teams because, in the tender specifications, EIGE had not required tenderers to provide appropriate evidence in this regard risking poor service delivery;

– weak contract oversight: acknowledges that EIGE paid invoices implemented under three "time and means" contracts without verifying the actual days worked, violating Article 45(5) of its financial regulation and exposing it to overpayment risks; notes that EIGE will strengthen ex ante checks accordingly;

70. Notes the Court’s findings concerning eu-LISA, most of which, relate to procurement irregularities initiated in previous years, resulting in irregular payments in 2024 that include:

– irregularities in a negotiated procedure initiated in 2019 and completed in 2020 for the rental of premises in Strasbourg, where the premises' surface area and number of workplaces were below the needs defined in the tender specifications, and the quality of the offer was assessed as very low but not rejected; notes furthermore that the award criteria were also subsequently negotiated with the tenderer, contravening Article 167(3) and point 6.5 of Annex I to the Financial Regulation; highlights that the negotiated procedure and the resulting rental contract are irregular as well as the associated payments that amounted EUR 850 000 in 2024;

– modifications to the financial offers of tenderers during a procurement procedure for electrical and civil works in Strasbourg, affecting the outcome of the procedure and resulting in an irregular contract and related payments amounting EUR 150 000 in 2024;

– changes in pricing elements of financial offers beyond the corrections allowed under Article 151 of the Financial Regulation, decisively affecting the outcome of a tender and resulting in irregular contracts and related payments totalling EUR 1,4 million in 2024;

– reopening of the competition for monitoring and maintenance services in relation to the Visa information system; is concerned by the fact that the winning tenderer (EUR 47,8 million) was five times lower than the second-cheapest (EUR 243,4 million) and 50 times lower than the highest (EUR 2,4 billion), raising concerns about its validity; draws attention to the fact that euLISA set up a working group to review this reopening of the competition that confirmed the assessment by financial officers but reported operational and contractual risks linked to the fact that the agency would have to pay the bulk of the contract price upfront; highlights that the Court has considered this risk to be significant;

– recalls that, following delays in the implementation of the Entry/Exit System (EES), a dispute arose in which the contractor refused to cover additional maintenance costs for certain IT products, leading to a lapse in maintenance coverage between November 2022 and April 2023 and exposing eu-LISA to operational risks; recalls that, to address the immediate risk to business continuity, eu-LISA amended the transversal operations framework contract (TOF) in 2023 to include reinstatement fees, penalties applied when maintenance is not renewed on time, and subsequently paid EUR 5,3 million in 2023 and EUR 1,3 million in 2024 for the renewal of software maintenance and related reinstatement costs which, according to the Agency’s interpretation, should have been borne by the EES contractor; further recalls that, despite the magnitude of the disputed amounts and the continued open status of the Court’s observation, eu-LISA had not initiated litigation against the EES contractor by the end of 2024;

71. Is concerned that persistent irregularities identified in euLISA’s procurement processes demonstrate systemic weaknesses in the agency’s procurement framework; notes euLISA’s acknowledgment of these issues and efforts to strengthen its practices, encourages eu-LISA to formulate a strategy on improving their procurement framework to be shared at the discharge hearings next year, encourages eu-LISA to provide clarity and transparency on the conditions under which re-tendering may not be considered appropriate; encourages eu-LISA to seek expert advice when formulating this new strategy and to consult with other agencies on best practices;

72. Acknowledges that eu-LISA is confronted with substantial challenges and emphasises the necessity to increase its staff to effectively address these challenges and ensure the continuity of its operations and that this should be funded accordingly;

73. Notes the Court’s procurement observation that, in 2020, Eurojust entered into a framework contract for vehicle leasing with a single economic operator, which was not appropriate for the nature of the services required acknowledges the specific contract awarded, as well as all related payments (EUR 64 000 in 2024), was therefore irregular; takes note of Eurojust’s reply that the framework contract referred to in the ECA 2020 report expired on 10 May 2024, and a new framework contract for vehicle leasing is in place since 25 November 2024;

74. Is concerned by the Court’s observations that Eurojust has not updated its business continuity plans since 2021, despite significant changes affecting resources and staff for key processes, including the introduction of SUMMA as a new budgetary, accounting, and financial system; highlights that Eurojust has also not followed the frequency of testing established in its last business continuity plan and currently lacks a coordinated and agreed disaster recovery plan for its IT systems;

75. Notes that Eurojust’s mandate is set to expand in the future, including to a third state and that the agency is handling an increasing number of criminal cases annually; acknowledges that, in view of these developments, Eurojust needs to increase its staffing levels in order to ensure comprehensive case coverage and the uninterrupted continuity of its operations and that corresponding funding should be made available;

76. In addition, notes the Court’s observation that Eurojust did not adopt a proper financing decision prior to launching procurement procedures for operational expenditure, undermining effective planning and oversight and contravening Articles 32(1) and 72(3)(b) of Eurojust’s financial rules; welcomes Eurojust’s commitment to publish an approved annual procurement plan of all procedures on its website, covering both operational and administrative expenditure, starting from 2026;

77. Notes that, in October 2025, the General Court of the European Union (‘General Court’) annulled two decisions by Eurojust rejecting a temporary staff member’s request for assistance due to alleged psychological harassment by ten colleagues including his Administrative Director; is aware that the Court ruled that Eurojust violated its duty of diligence under Article 24 of the Staff Regulations by splitting this staff member’s inquiry into two separate administrative processes, thereby failing to conduct a holistic, contextual investigation of interconnected harassment claims; notes that while the Court annulled the decisions to allow a proper reassessment, it dismissed the compensation claims;

78. Highlights that internal mechanisms should be developed within the agencies to ensure both the proper internal handling of complaints and the prevention of incidents, including cases of psychological harassment, particularly when multiple parties are involved;

79. Notes the Court’s observation that Europol irregularly reimbursed value-added tax (VAT) under operational grants paid to national police forces acting as public authorities, contrary to Article 186(4)(c) of the Financial Regulation, which does not allow VAT reimbursement to public entities acting in that capacity; takes note of Europol’s explanation that it followed Commission guidance at the time, which allowed VAT to be considered eligible under operational grants, and welcomes the decision to exclude VAT from all new grant agreements initiated by the end of 2024;

80. Welcomes that Europol’s Operational Task Forces (OTFs) and Joint Investigative Teams (JITs) mechanisms were instrumental in dismantling the encrypted communication platform Matrix, demonstrating their complementary yet distinct roles in combating transnational organised crime; notes that the operation began as an OTF in June 2024 between the Netherlands, France, Lithuania, Italy, and Spain, facilitating intelligence-sharing and monitoring of criminal activity; highlights that the transition to a JIT under Eurojust enabled formal investigative coordination, resulting in arrests, seizures, and the decryption of 2,3 million messages in 33 languages; observes that German authorities provided technical support, while Spanish, French, and Dutch police collaborated throughout the investigation; is of the opinion that this case underscores the effectiveness of cross-border cooperation in disrupting illicit networks and the need for sustained investment in law enforcement capabilities to address evolving criminal tactics;

Change 90

Changed71.81. TakesNotes notethat in May 2025 the discharge of the European Union Agency for Asylum (EUAA) status reportwas ofpostponed 31due Octoberto 2025findings onby the implementation of corrective actions, as agreed between theOLAF Executiveregarding Directorgovernance and the Managementstability; Board,notes asthat a follow-upconfidential toinvestigation Parliament’sby resolution;OLAF notesfound that thesenior Managementmanagement Boardat isthe addressingEUAA Parliament’sagency observationsbypassed instaff lineregulations withand itsthat proceduresOLAF andinvestigators willhave reviewnoted progressthat onsuch outstandinghiring measurespractices atare itsin meetingbreach inof Novemberthe 2025;Union's Staff Regulations;

Change 91

Removed72. Notes that while improvements were made in 2024 to strengthen the Agency’s ethical framework, staff awareness, and internal conflict-of-interest procedures, the structural conflict of interest identified by OLAF regarding complaints against the Executive Director has not yet been addressed, as the Legal Unit responsible for preparing such cases continues to operate under the direct supervision of the Executive Director, undermining the independence of the complaints process; notes that most corrective actions are scheduled for 2025 and 2026, including organisational changes, an optimisation programme, training for staff and managers, improvements to governance documents, enhanced transparency in reporting irregularities, a review of internal guidance on requests and complaints under Article 90 of the Staff Regulations, strengthened cooperation with DG HR for handling complaints and a review of procedures for requests for assistance under Article 24 of the Staff Regulations;

Added82. Takes note of the EUAA status report of 31 October 2025 on the implementation of corrective actions, as agreed between the Executive Director and the Management Board, as a follow-up to Parliament’s resolution; notes that the Management Board is addressing Parliament’s observations in line with its procedures and will review progress on outstanding measures at its meeting in November 2025; urges the Agency to fully clarify all open issues, to implement OLAF recommendations in a credible and transparent manner, and to establish robust internal control, ethical oversight and accountability mechanisms; calls on the Agency to inform the discharge authority of any remedial steps taken without undue delay; stresses that the conclusion of OLAF investigations does not in itself constitute closure of governance failures; reiterates that the discharge authority retains full oversight rights until structural weaknesses in management, transparency and conflict-of-interest handling are fully remedied and verified;

Added83. Notes that while improvements were made in 2024 to strengthen the Agency’s ethical framework, staff awareness, and internal conflict-of-interest procedures, the structural conflict of interest identified by OLAF regarding complaints against the Executive Director had not yet been addressed, as the Legal Unit responsible for preparing such cases continued to operate under the direct supervision of the Executive Director, undermining the independence of the complaints process; notes that most corrective actions are scheduled for 2025 and 2026, including organisational changes, an optimisation programme, training for staff and managers, improvements to governance documents, enhanced transparency in reporting irregularities, a review of internal guidance on requests and complaints under Article 90 of the Staff Regulations, strengthened cooperation with DG HR for handling complaints and a review of procedures for requests for assistance under Article 24 of the Staff Regulations;

84. Further stresses the need for continued vigilance regarding the EUAA’s turnover rates and staff satisfaction, the strict prevention of any nepotism or favouritism, and full transparency and merit-based procedures in recruitment and career progression;

Change 92

Added85. Reserves the right to condition or postpone future discharge decisions where agencies fail to deliver full and verifiable structural reforms following serious findings;

Recommendations

Change 93

Changed74.86. Calls on the EU agencies to act on the Court's observations, in particular to:

(i) EIGE to enhance procurement practices by reviewing overly restrictive tender criteria, strengthening evaluation processes to assess the team management capabilities of tenderers, and implementing strict verification of "time and means" contracts to prevent overpayments;

(ii) eu-LISA to address systemic procurement weaknesses including irregular rental contracts and improper financial offer modifications, while enhancing transparency and risk mitigation in tender evaluations; calls on eu-LISA to provide detailed information on the dispute arising from the delays in the implementation of the Entry/Exit System (EES), in particular on the internal assessment that led the Agency to assume reinstatement and maintenance renewal costs amounting to EUR 6,6 million in 20232024 under the transversal operations framework contract, despite considering these costs contractually attributable to the EES contractor; requests clarification on the reasons why no legal proceedings were initiated by the end of 2024 and on whether alternative dispute-resolution or recovery actions were explored; recommends that eu-LISA strengthen its contract-enforcement and dispute-resolution mechanisms, establish clear escalation procedures, and ensure that similar disputes are addressed promptly and transparently in order to safeguard the Agency’s financial interests and operational continuity; encourages eu-LISA to provide an opinion on the conditions under which re-tendering may not be considered appropriate and in which situations it makes common sense to keep the same provider/s in order to ensure continuity of business;

(iii) Eurojust to urgently update business continuity plans within six months to reflect current operations including SUMMA implementation, conduct regular disaster recovery testing, and establish proper financing decisions prior to procurement procedures; requests Eurojust to present its new business continuity plans in the discharge follow up report;

Change 94

Changed75.87. Furthermore, calls on the following EU agencies:

Change 95

Changed(i) CEPOL and all EU agencies to urgently strengthen their internal cybersecurity governance, allocate adequate and stable resources, enhance detection and response capacities, and take concrete steps toward zero-trust architecture to reduce vulnerabilities and ensure resilience against increasingly sophisticated cyber threats;

(ii) Europol to maintain vigilance in ensuring compliance with eligibility rules in future funding cycles, following its swift corrective action on VAT reimbursements; urges the Commission to issue clear guidance on the implementation of Article 186(4)(c) of the Financial Regulation, given that questions regarding the eligibility of VAT have also arisen in other cases in former years, reflecting some ambiguities;

(iii) the EUAA to ensure rigorous monitoring of milestones, particularly those scheduled for 2026 which constitute the core of reform efforts, and report back to the Discharge Authority on the implementation of corrective actions;

(iv) EU agencies and in particular Eurojust to establish clear guidelines for handling complex harassment cases and ensure consistent application of Article 24 of the Staff Regulations;