IRIS² Security and EU Space Programme 2026: What Operators and Contractors Must Comply With

Key data

Operators and contractors working with European critical space infrastructures have new security obligations that come into force immediately. The Council Decision (CFSP) 2026/1716, published on 14 July 2026 and in force from the previous day, establishes specific and binding instructions for all systems and services associated with the EU Space Programme and the Secure Connectivity Programme—known as GOVSATCOM/IRIS²—.

This is not a recommendation or a best practices guide: under the Common Foreign and Security Policy (CFSP), these instructions generate direct obligations for Member States and for all actors—public and private—participating in these programmes.

What does this regulation establish?

The Decision regulates three areas of activity on the EU's critical space infrastructures:

• Deployment: technical and operational security conditions in the implementation of space systems and services.
• Operation: continuous requirements during the operation of infrastructures linked to GOVSATCOM and IRIS².
• Use: access and use rules for entities that use these systems in their activities.

The specific compliance mechanisms established by the regulation are:

The binding nature within the CFSP framework is a key differentiating element: unlike other technical or sectoral regulations, this Decision does not allow discretionary transposition by Member States. Its application is direct and immediate.

Economic and operational impact

The regulation does not establish specific economic sanctions or fine amounts in the published text. However, the operational impact for affected entities is significant in several areas:

• Adaptation costs: Organizations will need to review and, where necessary, update their access control systems, internal audit procedures and sensitive information management protocols to align with the instructions.
• Specialized human resources: Compliance with security instructions in the space and government connectivity field requires personnel with security clearance and specific technical knowledge.
• Risk of contractual exclusion: Non-compliance with the instructions may result in loss of contracts or eligibility to participate in the IRIS² and EU Space Programme, with the resulting direct economic impact for contractor companies.
• Supply chain impact: Prime contractors will need to pass these requirements on to their subcontractors and suppliers that have access to the systems or sensitive information related to them.

Who does it affect?

Council Decision (CFSP) 2026/1716 directly affects:

• Space systems operators that deploy or manage infrastructures linked to the EU Space Programme.
• Contractors and subcontractors that provide technical, maintenance or development services within GOVSATCOM or IRIS².
• Entities that use the services of secure government connectivity provided by these programmes.
• EU Member States, which have direct obligations arising from the CFSP framework.
• Public bodies and agencies that access or manage information in the field of these space programmes.

Outside the scope of this Decision are commercial telecommunications or satellite operators that do not specifically participate in the GOVSATCOM or IRIS² programmes of the European Union.

Practical example

A Spanish aerospace engineering company acting as a contractor in the IRIS² programme for the development of satellite constellation components will need to, from 13 July 2026:

1. Undergo security audits in accordance with the instructions established in the Decision, which will verify its technical and operational procedures.
2. Implement or update its access controls to the systems and facilities where information or components of the programme are worked on, restricting access only to authorized personnel.
3. Establish specific protocols for the management of any sensitive information generated or received within the framework of the contract, including its storage and transmission.
4. Pass these requirements on to its suppliers and subcontractors that have access, even if partial, to the systems or information of the programme.

If this company does not adapt its procedures, it is exposed to losing the security clearance necessary to continue participating in the contract, which is equivalent to the effective termination of the same.

What should companies do now?

1. Identify if you participate in the affected programmes: Check if your activity is linked to the EU Space Programme, GOVSATCOM or IRIS². If you have active or pending contracts with the EU Agency for the Space Programme (EUSPA) or with the European Commission in this field, you are affected.
2. Review existing contracts: Check if your contracts include security clauses that already reference or need to be updated in accordance with the new CFSP Decision 2026/1716.
3. Audit current access controls: Assess whether your physical and logical access control systems comply with the security requirements required by the regulation for critical space infrastructures.
4. Update sensitive information management protocols: Review internal procedures for the treatment of classified or sensitive information and adapt them to the instructions of the Decision.
5. Extend obligations to the supply chain: Communicate to your subcontractors and suppliers with access to systems or information of the programme that they are also subject to these security instructions.
6. Consult with a CFSP security specialist advisor: Given the binding nature and the scope of the Common Foreign and Security Policy, it is advisable to have specialized legal advice on European security regulations.

Official source

Consult the complete regulation in the official source

Disclaimer: This article is for informational purposes only and does not constitute legal advice. For specific decisions, consult a qualified professional. Source: https://eur-lex.europa.eu/./legal-content/AUTO/?uri=OJ:L_202601716