Article 2 - Scope

• Regulation (EU) 2022/1645 found in: Information Security (2023/203 and 2022/1645) Part-IS (Jun 2024)
• Regulation (EU) 2025/22 found in: Information Security (2023/203 and 2022/1645) Part-IS (Dec 2025)

Article 2 – Scope Regulation (EU) 2022/1645 1.       This Regulation applies to the following organisations: (a)      production organisations and design organisations subject to Subparts G and J of Section A of Annex I (Part 21) to Regulation (EU) No 748/2012, except design and production organisations that are solely involved in the design and/or production of ELA2 aircraft as defined in Article 1(2), point (j) of Regulation (EU) No 748/2012; (b)     aerodrome operators and apron management service providers subject to Annex III ‘Part Organisation Requirements (Part-ADR.OR)’ to Regulation (EU) No 139/2014[[35]](#_ftn35). 2.       This Regulation is without prejudice to information security and cybersecurity requirements laid down in Point 1.7 of the Annex toCommission Implementing Regulation (EU) 2015/1998([[36]](#_ftn36)) and in Article 14 of Directive (EU) 2016/1148 of the European Parliament and of the Council([[37]](#_ftn37)). --- [[35]](#_ftnref35) Commission Regulation (EU) No 139/2014 of 12 February 2014 laying down requirements and administrative procedures related to aerodromes pursuant to Regulation (EC) No 216/2008 of the European Parliament and of the Council ([OJ L 44, 14.2.2014, p. 1](https://eur-lex.europa.eu/legal-content/EN/AUTO/?uri=OJ:L:2014:044:TOC)). [[36]](#_ftnref36) Commission Implementing Regulation (EU) 2015/1998 of 5 November 2015 laying down detailed measures for the implementation of the common basic standards on aviation security ([OJ L 299, 14.11.2015, p. 1](https://eur-lex.europa.eu/legal-content/EN/AUTO/?uri=OJ:L:2015:299:TOC)). [[37]](#_ftnref37) Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union ([OJ L 194, 19.7.2016, p. 1](https://eur-lex.europa.eu/legal-content/EN/AUTO/?uri=OJ:L:2016:194:TOC)). ## Article 2 – Scope *Regulation (EU) 2025/22* 1. This Regulation applies to the following organisations: (a) production organisations and design organisations subject to Subparts G and J of Section A of Annex I (Part 21) to [Regulation (EU) No 748/2012](https://eur-lex.europa.eu/eli/reg/2012/748/oj), except design and production organisations that are solely involved in the design and/or production of ELA2 aircraft as defined in Article 1(2), point (j) of Regulation (EU) No 748/2012; (b) aerodrome operators and apron management service providers subject to Annex III ‘Part Organisation Requirements (Part-ADR.OR)’ to [Regulation (EU) No 139/2014](https://eur-lex.europa.eu/eli/reg/2014/139/oj). (c) ground handling organisations subject to [Commission Delegated Regulation (EU) 2025/20](https://eur-lex.europa.eu/eli/reg_del/2025/20/oj)[[36]](#_ftn36) that: (i) in order to provide the respective services, have to collect, store, analyse or otherwise process data provided by third parties; or (ii) provide directly to aircraft operators data that will be used for operational purposes. *[point (c) applicable from 27 March 2031 — Regulation (EU)* *2025/22]* 2. This Regulation is without prejudice to information security and cybersecurity requirements laid down in point 1.7 of the Annex to [Commission Implementing Regulation (EU) 2015/1998](https://eur-lex.europa.eu/eli/reg_impl/2015/1998/oj) and in Article 14 of [Directive (EU) 2016/1148](https://eur-lex.europa.eu/eli/dir/2016/1148/oj) of the European Parliament and of the Council. --- [[36]](#_ftnref36) Commission Delegated Regulation (EU) 2025/20 of 19 December 2024 supplementing Regulation (EU) 2018/1139 of the European Parliament and of the Council by laying down requirements for the safe provision of ground handling services and for organisations providing them ([OJ L, 2025/20, 7.3.2025, ELI: http://data.europa.eu/eli/reg\_del/2025/20/oj](https://data.europa.eu/eli/reg_del/2025/20/oj)).