Clearances and the Security Aspects Letter in an EDF project

Security clearances in a European Defence Fund project are usually discussed as a box to tick after an award. They are better understood as a schedule: several of them run on national timelines you do not control, and one of them stands between a successful evaluation and a signed agreement.

The rules are not in the Model Grant Agreement, which is where most people look. They are in Commission Decision (EU, Euratom) 2021/259, the implementing rules on industrial security for classified grants, and they reach you through an instrument many applicants never see named.

The document that carries all of it

Under Article 5(1) of Commission Decision (EU, Euratom) 2021/259, grant-specific security requirements take the form of a Security Aspects Letter, with a template annexed to that Decision. Article 27(4) of the EDF Regulation separately requires the security framework to be in place before the agreement is signed.

That is the mechanism. Everything below is not a general obligation floating around the programme; it is something a SAL applies to your specific action, at a specific classification level, with specific consequences. If you are working out what your project will actually be required to do, the SAL is the document to ask about, and asking about it early marks you out as someone who has done this before.

Facility Security Clearances

A Facility Security Clearance is an assurance from a national authority that an organisation's premises and procedures are fit to handle classified information at a given level.

The trigger is not the granting authority's preference. Under Article 3(6) of the Decision, an FSC is required for handling information classified CONFIDENTIEL UE/EU CONFIDENTIAL and SECRET UE/EU SECRET. That is a function of the classification level of the work and of national law, not of what a call happens to ask for.

Two consequences follow, and the second is the one that bites.

Article 3(3) requires the call documentation to include clarifications about the timeline for beneficiaries to obtain the FSCs where they are required. So the timeline is knowable in advance, from the call itself.

Article 5(4) is blunter: the classified grant agreement shall not be signed until the applicant's National Security Authority or Designated Security Authority has confirmed the applicant's FSC.

Read that again if you are planning a project schedule. A clearance you begin after the award is not a piece of administration running alongside the project. It is a gate in front of the signature, operated by a national authority working to its own timetable.

Personnel clearances follow the same rule

This is where a good deal of published advice diverges from the Decision, by treating personnel clearances as a separate regime with separate logic.

Article 3(7) covers both in one sentence: in principle, an FSC or a PSC shall not be required for access to information classified RESTREINT UE/EU RESTRICTED.

So at RESTRICTED level the default is that neither is needed. Above it, both come into play.

The qualifier matters as much as the rule. Member States may impose requirements under national law, and those national exceptions are published - they are listed in Annex IV of the Decision, and in the corresponding annex of the EDF Programme Security Instruction. So the accurate answer to "do we need clearances at RESTRICTED level" is: in principle no, and then check whether the Member State you are established in is one of the exceptions. Not: no.

That is a two-step answer rather than a one-step answer, which is precisely why it gets flattened in summaries.

What to do about it before an award

If classified work is in scope, three questions are worth answering while the proposal is still being written rather than after it succeeds.

At what level will this action actually be classified? That determines whether Article 3(6) is engaged at all, and it should be visible from the call documentation.

Which partners already hold an FSC, at what level, and when does it expire? A clearance held by one consortium member does not cover another, and an expiry mid-project is a scheduling problem of exactly the kind Article 5(4) makes expensive.

Is our Member State one of the Annex IV exceptions? If it is, the RESTRICTED-level default does not apply to you and your personnel planning changes.

None of those questions is difficult. They are simply easier to answer in March than in the week before signature, and the answers are the sort of thing that has to be evidenced later rather than remembered: which clearance, at what level, valid between which dates, confirmed by which authority.

That is a records problem, and it belongs with the rest of your evidence base - under document control, with dates and an approval history, rather than in an inbox.

Checking this yourself

• Commission Decision (EU, Euratom) 2021/259, Articles 3(3), 3(6), 3(7), 5(4) and Annex IV
• Regulation (EU) 2021/697, Article 27(4), for the requirement that the security framework be in place before signature, and Commission Decision (EU, Euratom) 2021/259, Article 5(1), for the Security Aspects Letter itself
• The EDF Programme Security Instruction, which sets out the programme-level security arrangements
• Your call documentation, which is required to state the FSC timeline

The related obligation to hold a contingency plan for EU classified information is a separate requirement in the same Decision, at Article 16, and we cover it in its own article. The wider set of requirements is in what an EDF grant actually obliges you to prove.

Clearances, confirmations and the dates attached to them are evidence with an expiry. See how ComplyTrain tracks them.

This describes what the published rules say as at 8 September 2026. It is not legal advice, and clearance requirements in particular turn on the national law of the Member State in which an entity is established.