EU Space Security Standards Correction 2026: What Contractors and Operators Must Do

Key data

If your company operates, deploys or uses systems linked to the European Union Space Programme or the Secure Connectivity Programme, this correction affects you directly. The Council Decision (CFSP) 2026/1716, adopted on 13 July 2026, establishes the security instructions applicable to these systems. The correction published on 29 July 2026 corrects formal or material errors detected after its initial publication, without altering the regulatory substance.

The practical key is this: the version with errors is invalidated. Any procedure, contract or security protocol that cites or applies the original uncorrected version must be updated to reference and apply the corrected version.

What does this regulation establish?

Decision (CFSP) 2026/1716 regulates security instructions for the deployment, operation and use of systems and services linked to two major EU programmes:

• European Union Space Programme: includes critical infrastructure such as Galileo (European satellite navigation system) and Copernicus (Earth observation programme).
• European Union Secure Connectivity Programme: includes the IRIS² constellation, the EU's secure satellite communications network.

The scope of application is activated when the deployment, operation or use of these systems may affect the security of the Union. That is, it does not apply to any generic commercial use, but specifically to those activities with implications for European security.

The correction published on 29 July 2026 does not modify the substantive content of the security instructions. It corrects formal or material errors detected after the original publication. Although the correction does not publicly specify what those specific errors are (standard practice in this type of publication), its legal effect is clear: the corrected version is the only valid and applicable version.

Economic and operational impact

As this is a correction of errors without change to the regulatory substance, the direct economic impact is limited. However, the operational impact may be relevant for affected companies:

• Document review: Contracts, internal procedures, security manuals and protocols that cite Decision (CFSP) 2026/1716 must verify that they reference the corrected version.
• Audits and certifications: In security accreditation or compliance audit processes, working with the uncorrected version may generate observations or non-conformities.
• Regulatory version management: Compliance and legal teams must update their regulatory tracking databases to reflect that the current version is the one published on 29 July 2026.
• No new economic obligations: The correction does not introduce new fees, penalties, investment requirements or adaptation deadlines beyond those already established in the original decision.

Who does it affect?

• Space system operators: Entities that manage or operate infrastructure linked to Galileo, Copernicus or IRIS².
• Contractors and subcontractors: Private companies with development, maintenance or technical support contracts under the EU Space Programme or Secure Connectivity Programme.
• Entities participating in the programmes: Public or private bodies that participate in the deployment, operation or use of these systems when they may affect EU security.
• Security and compliance officers: Security directors, regulatory compliance officers and legal advisers of the above entities.
• CFOs and executives: Insofar as they must ensure that their organisations' contracts and procedures reflect the corrected current regulation.

Practical example

A Spanish aerospace engineering company has a technical support contract for ground systems linked to the IRIS² constellation. In its internal security procedures, approved in July 2026, Decision (CFSP) 2026/1716 is expressly cited as a regulatory compliance reference.

Following the publication of the correction on 29 July 2026, the compliance officer must:

1. Verify whether the corrected errors affect any of the articles or annexes that their procedures apply directly.
2. Update the regulatory reference in all internal documents to point to the corrected version.
3. Communicate the change to the client (the contracting agency or entity) if required by the contract.
4. Archive the corrected version as a reference document for future audits.

The cost of this update is primarily internal time (hours of document review), with no additional direct economic impact.

What should companies do now?

1. Download and archive the corrected version: Access the official publication on EUR-Lex and save the corrected version of Decision (CFSP) 2026/1716 as a current reference document.
2. Review internal documentation: Identify all procedures, security manuals, contracts and protocols that cite the original decision and update the references to the corrected version.
3. Inform security and legal teams: Communicate the change to security, compliance and legal advisory officers so they can act accordingly.
4. Verify contractual obligations: Check whether your contracts with the European Space Agency, the European Commission or other contracting entities require notification or document updates in the event of regulatory corrections.
5. Update the regulatory tracking system: Record the correction in your applicable regulation database, indicating that the current version is the one published on 29 July 2026, with effect from 14 July 2026.

Official source

Consult full regulation at official source

Disclaimer: This article is for informational purposes only and does not constitute legal advice. For specific decisions, consult a qualified professional. Source: https://eur-lex.europa.eu/./legal-content/AUTO/?uri=OJ:L_202690639