Runs an essential service, in the European Union

Regulation (EU) No 910/2014, Article 19a(1)(a) · Read the law's page

• This duty reaches you if you declare that you are an essential or important entity under Directive (EU) 2022/2555 and you are a non-qualified trust service provider, that is, you provide a trust service within the meaning of Article 3, point (16), of Regulation (EU) No 910/2014 (for example issuing certificates for electronic signatures, seals or website authentication, creating electronic timestamps, or providing electronic registered delivery) without being a qualified trust service provider. A qualified trust service provider carries the parallel duty in Article 24(2), point fa.
• Maintain appropriate policies and take corresponding measures to manage the legal, business, operational and other direct or indirect risks to the provision of each non-qualified trust service (Article 19a(1), point (a)).
• Make those measures cover at least registration and onboarding procedures for a trust service, the procedural or administrative checks needed to provide trust services, and the management and implementation of trust services, notwithstanding Article 21 of Directive (EU) 2022/2555 (Article 19a(1), point (a)(i) to (iii)).

Regulation (EU) No 910/2014, Article 19a(1)(b) · Read the law's page

• This duty reaches you if you declare that you are an essential or important entity under Directive (EU) 2022/2555 and you are a non-qualified trust service provider, that is, you provide a trust service within the meaning of Article 3, point (16), of Regulation (EU) No 910/2014 (for example issuing certificates for electronic signatures, seals or website authentication, creating electronic timestamps, or providing electronic registered delivery) without being a qualified trust service provider. A qualified trust service provider carries the parallel duty in Article 24(2), point fb.
• Notify the supervisory body, the identifiable affected individuals, the public if it is of public interest and, where applicable, other relevant competent authorities of any security breach or disruption in the provision of the service, or in the implementation of the Article 19a(1), point (a), measures, that has a significant impact on the trust service provided or on the personal data maintained in it (Article 19a(1), point (b)).
• Make each notification without undue delay and in any case no later than 24 hours after you become aware of the security breach or disruption (Article 19a(1), point (b)).

Commission Delegated Regulation (EU) 2024/1366, Art. 38 · Read the law's page

• This duty reaches you if you declare that you operate an essential service, as an essential or important entity under Directive (EU) 2022/2555 or as an entity a competent authority has identified under Article 24 of Commission Delegated Regulation (EU) 2024/1366 as a high-impact or critical-impact entity for cross-border electricity flows. Article 2(1) lists the entities that can be identified: electricity undertakings, nominated electricity market operators, organized market places that arrange transactions on products relevant to cross-border electricity flows, critical ICT service providers, the ENTSO for Electricity, the EU DSO entity, balancing responsible parties, operators of recharging points, regional coordination centers and managed security service providers. Each competent authority notifies the entities on its list no later than 13 June 2028 (Article 24(6)).
• Establish, for all assets within your cybersecurity perimeter, at least the capabilities of a cybersecurity operation center (CSOC): security logs from your systems and applications, security monitoring including intrusion detection and vulnerability assessment, analysis and the actions needed to protect the entity, and participation in the information collection and sharing Article 38 describes (Article 38(1), point (a)); you may procure these through managed security service providers but remain responsible for them and supervise their efforts (Article 38(1), point (b)).
• Designate a single point of contact at entity level for information sharing (Article 38(1), point (c)).
• Share relevant information related to a reportable cyber-attack with your CSIRTs and your competent authority without undue delay and no later than four hours of becoming aware that the incident is reportable; a cyber-attack is reportable when you assess its criticality as ranging from high to critical on the classification scale methodology under Article 37(8) (Article 38(3) and (4)).
• Provide your CSIRTs without undue delay with any information related to a reportable cyber threat that may have a cross-border effect (Article 38(6)).
• When you share information under Article 38, specify that it is submitted pursuant to the Regulation, which kind of information it is, and, for a reportable cyber-attack, its level on the classification scale with the information leading to that classification (Article 38(7)).
• Where your report of a significant incident under Article 23(1) of Directive (EU) 2022/2555 contains the information Article 38(3) requires, that report counts as your Article 38(3) report (Article 38(8)).

Commission Delegated Regulation (EU) 2024/1366, Arts. 2 and 24 to 32 · Read the law's page

• This duty reaches you if you declare that you operate an essential service, as an essential or important entity under Directive (EU) 2022/2555 or as an entity a competent authority has identified under Article 24 of Commission Delegated Regulation (EU) 2024/1366 as a high-impact or critical-impact entity for cross-border electricity flows. Article 2(1) lists the entities that can be identified: electricity undertakings, nominated electricity market operators, organized market places that arrange transactions on products relevant to cross-border electricity flows, critical ICT service providers, the ENTSO for Electricity, the EU DSO entity, balancing responsible parties, operators of recharging points, regional coordination centers and managed security service providers. Each competent authority notifies the entities on its list no later than 13 June 2028 (Article 24(6)). The periods in the lines below run from that notification unless a line says otherwise.
• Perform cybersecurity risk management for all assets in your high-impact and critical-impact perimeters every three years, in four phases: context establishment, cybersecurity risk assessment at entity level, cybersecurity risk treatment and cybersecurity risk acceptance (Article 26(1) and (2)).
• Register the assets in your high-impact and critical-impact perimeters in an asset inventory that is kept apart from the risk assessment report (Article 26(7)).
• Within 12 months after your Article 24(6) notification, and every three years thereafter, give your competent authority a report listing the controls selected for your entity-level risk mitigation plan with the implementation status of each, an estimate of the risk to each Union-wide high-impact or critical-impact process, and your critical ICT service providers for critical-impact processes (Article 27).
• If you are a high-impact entity, apply the minimum cybersecurity controls within your high-impact perimeter, and if you are a critical-impact entity, apply the advanced cybersecurity controls within your critical-impact perimeter, within 12 months after the controls are approved or updated (Articles 28(2) and (3) and 29(6)).
• Within 24 months after your Article 24(6) notification, establish a cybersecurity management system that covers the assets in your high-impact and critical-impact perimeters, with a documented cybersecurity policy, assigned cybersecurity roles and responsibilities, entity-level risk management and internal audits at planned intervals, and review it every three years (Article 32).
• If you are a critical-impact entity, be able to demonstrate compliance with the cybersecurity management system and the controls at your competent authority's request, no later than 24 months after the controls are adopted and the management system is established, by independent third-party security audits or a national verification scheme, and repeat the verification at the latest 36 months after the first and every 3 years thereafter (Article 31).

Directive (EU) 2022/2555, Art. 21 · Read the law's page

• Take technical, operational and organisational measures appropriate to the risk your network and information systems face, covering at minimum a risk analysis and information-system-security policy, incident handling, business continuity and crisis management, supply chain security, and security in the acquisition, development and maintenance of your systems.
• Maintain basic cyber hygiene practices and cybersecurity training, policies on cryptography and encryption where appropriate, human resources security and access control, and multi-factor authentication or continuous authentication solutions where appropriate.
• Have your management body approve these measures, oversee their implementation, and complete cybersecurity training.
• If you operate an online marketplace, online search engine or social networking services platform, are not established in the Union, and offer it within the Union, designate a representative in the Union, established in one of the Member States where you offer the service; you then fall under the jurisdiction of the Member State where the representative is established.
• This duty reaches your service where you operate an online marketplace, online search engine or social networking services platform under Annex II and you qualify as a medium-sized enterprise or larger under the EU size-cap rule (Commission Recommendation 2003/361/EC), or regardless of size where Article 2(2), points (b) to (e), applies, for example where you are the sole provider in a Member State of a service essential for the maintenance of critical societal or economic activities. It also reaches you where you are a public administration entity of central government, or a regional one that, following a risk-based assessment by the Member State, provides services whose disruption could have a significant impact on critical societal or economic activities (Annex I and Article 2(2), point (f)), unless your activities are in the areas of national security, public security, defence or law enforcement (Article 2(7)).

Directive (EU) 2022/2555, Art. 23 · Read the law's page

• Notify your CSIRT, or the competent authority where applicable, of any incident with a significant impact on the provision of your services: an early warning within 24 hours of becoming aware, an incident notification within 72 hours of becoming aware (24 hours if you are a trust service provider), an intermediate report on relevant status updates if your CSIRT or competent authority asks for one, and a final report no later than one month after the incident notification, or, for an incident still ongoing at that point, a progress report then and a final report within one month of its handling.
• Where appropriate, notify, without undue delay, the recipients of your services who a significant incident is likely to adversely affect, and communicate to recipients potentially affected by a significant cyber threat any measures or remedies they can take.
• Treat an incident as significant where it has caused or is capable of causing severe operational disruption or financial loss to your own operations, or considerable material or non-material damage to another person.
• Where you are one of the providers Commission Implementing Regulation (EU) 2024/2690 names, apply the significance criteria of its Articles 3 to 14 to decide which incidents to notify, which its recital 30 treats as exhaustive.
• This duty reaches your service where you operate an online marketplace, online search engine or social networking services platform under Annex II and you qualify as a medium-sized enterprise or larger under the EU size-cap rule, or regardless of size where Article 2(2), points (b) to (e), applies, for example where you are the sole provider in a Member State of a service essential for the maintenance of critical societal or economic activities. It also reaches you where you are a public administration entity of central government, or a regional one that, following a risk-based assessment by the Member State, provides services whose disruption could have a significant impact on critical societal or economic activities (Annex I and Article 2(2), point (f)), unless your activities are in the areas of national security, public security, defence or law enforcement (Article 2(7)).

Regulation (EU) 2024/2690, Art. 2 and Annex · Read the law's page

• This duty reaches you if you declare that you are an essential or important entity under Article 3 of Directive (EU) 2022/2555 and provide a service Article 1 names: a DNS service provider, TLD name registry, cloud computing service provider, data centre service provider, content delivery network provider, managed service provider, managed security service provider, provider of an online marketplace, online search engine or social networking services platform, or trust service provider. Under Article 2 of that Directive you are in scope if you are a medium-sized enterprise or larger, or, whatever your size, if you are a trust service provider, a TLD name registry or a DNS service provider, or if Article 2(2), points (b) to (e), applies to you.
• Ensure a level of security of your network and information systems appropriate to the risks posed when you implement the requirements, taking due account of your exposure to risks, your size, the likelihood of occurrence of incidents and their severity, including their societal and economic impact (Article 2(2)).
• Where the Annex applies a requirement where appropriate, where applicable or to the extent feasible and you consider it not appropriate, not applicable or not feasible for you to apply it, document your reasoning in a comprehensible manner (Article 2(2)).
• Maintain a policy on the security of network and information systems that your management bodies approve and review at least annually and when significant incidents or significant changes to operations or risks occur, and have at least one person report directly to your management bodies on network and information system security (Annex points 1.1.1(k), 1.1.2 and 1.2.3).
• Establish a risk management framework, perform and document risk assessments, and establish, implement and monitor a risk treatment plan, reviewing the assessment results and the plan at planned intervals and at least annually (points 2.1.1 and 2.1.4).
• Establish and implement an incident handling policy, monitor and log activity on your network and information systems to detect events that could be incidents, assess suspicious events to determine whether they are incidents, and assess the existence of recurring incidents under Article 4 on a quarterly basis (points 3.1.1, 3.2.1, 3.4.1 and 3.4.2(b)).
• Lay down procedures and use tools to monitor and log activities on your network and information systems, maintain, document and review the logs, and establish a list of the assets to be subject to logging based on your risk assessment. Where appropriate, include in the logs network traffic, changes to users and permissions, access to systems and applications, authentication events, privileged and administrator activity, access to or changes of critical configuration and backup files, security tool logs, use of system resources, physical access, use of network equipment, and the activation, stopping and pausing of logs, and environmental events. Review the logs regularly for unusual or unwanted trends and start a qualified response in a timely manner when an alarm is triggered. Maintain and back up the logs for a predefined period, protect them from unauthorized access or changes, and, to the extent feasible, synchronize the time sources of all systems and make your monitoring and logging systems redundant (points 3.2.1 and 3.2.3 to 3.2.6).
• Establish communication plans and procedures with your CSIRT or, where applicable, your competent authority for incident notification (point 3.5.3(a)).
• Lay down and maintain a business continuity and disaster recovery plan, carry out a business impact analysis, and maintain backup copies of data (points 4.1.1, 4.1.3 and 4.2.1).
• Establish a supply chain security policy that governs your relations with your direct suppliers and service providers, and ensure, where appropriate, that your contracts with them specify an obligation to notify you without undue delay of incidents that present a risk to the security of your network and information systems (points 5.1.1 and 5.1.4(d)).
• Before you develop a network and information system, including software, lay down rules for secure development and apply them to in-house and outsourced development (point 6.2.1).
• Apply security patches within a reasonable time after they become available and test them before applying them in production systems, unless you document and substantiate a decision that the disadvantages of applying a patch outweigh the cybersecurity benefits (points 6.6.1 and 6.6.2).
• Address without undue delay the vulnerabilities you identify as critical to your operations, and lay down a procedure for disclosing vulnerabilities in accordance with the applicable national coordinated vulnerability disclosure policy (points 6.10.2(c) and (e)).
• Ensure, where appropriate and in accordance with the classification of the asset to be accessed, that users are authenticated by multiple authentication factors or continuous authentication mechanisms (point 11.7.1).
• Establish a policy and procedures to assess whether your cybersecurity risk-management measures are effectively implemented and maintained (point 7.1), offer your employees an awareness raising programme and give those whose roles require security skills regular training (points 8.1.2 and 8.2.1), and apply the Annex's requirements on cryptography, human resources security, access control, asset management, and environmental and physical security (points 9 to 13).

Regulation (EU) 2024/2690, Arts. 3 to 14 · Read the law's page

• This duty reaches you if you declare that you are an essential or important entity under Article 3 of Directive (EU) 2022/2555 and provide a service Article 1 names: a DNS service provider, TLD name registry, cloud computing service provider, data centre service provider, content delivery network provider, managed service provider, managed security service provider, provider of an online marketplace, online search engine or social networking services platform, or trust service provider. Under Article 2 of that Directive you are in scope if you are a medium-sized enterprise or larger, or, whatever your size, if you are a trust service provider, a TLD name registry or a DNS service provider, or if Article 2(2), points (b) to (e), applies to you.
• Treat an incident as significant, and notify it under Article 23 of Directive (EU) 2022/2555, where it fulfils one or more of the criteria of Article 3(1): direct financial loss, caused or capable of being caused, that exceeds EUR 500,000 or 5 percent of your total annual turnover in the preceding financial year, whichever is lower; the exfiltration of your trade secrets; the death of a natural person or considerable damage to a natural person's health; a successful, suspectedly malicious and unauthorised access to your network and information systems that is capable of causing severe operational disruption; or the recurring-incident rule or a criterion for your class of entity.
• Apply the criteria that Articles 5 to 14 set for your class of entity: Article 5 for DNS service providers, Article 6 for TLD name registries, Article 7 for cloud computing service providers, Article 8 for data centre service providers, Article 9 for content delivery network providers, Article 10 for managed service providers and managed security service providers, Articles 11 to 13 for providers of online marketplaces, online search engines and social networking services platforms, and Article 14 for trust service providers.
• Treat incidents that are individually not significant as one significant incident where they occurred at least twice within 6 months, have the same apparent root cause, and collectively meet the financial loss criterion of Article 3(1), point (a) (Article 4).
• Treat yourself as aware of a significant incident, for the clock Article 23(4) of Directive (EU) 2022/2555 sets, when after your initial assessment you have a reasonable degree of certainty that a significant incident has occurred (recital 31).
• Do not treat scheduled interruptions of service or the planned consequences of scheduled maintenance operations carried out by or on your behalf as significant incidents (Article 3(2)).
• When you calculate the number of users impacted by an incident under Articles 7 and 9 to 14, consider the number of customers that have a contract with you granting access to your network and information systems or services, and the number of natural and legal persons associated with business customers that use them (Article 3(3)).

Commission Delegated Regulation (EU) 2022/1645, Art. 2 and Annex · Read the law's page

• This duty binds the organizations named in Article 2(1) of Commission Delegated Regulation (EU) 2022/1645: a production organization or design organization under Part 21, or an aerodrome operator or apron management service provider under Part-ADR.OR, subject to the exception Article 2(1) lists for organizations solely involved in ELA 2 aircraft. It reaches you if you declare that you are an essential or important entity under Directive (EU) 2022/2555 and you are one of them. The Regulation applies from 16 October 2025 (Article 8).
• Set up, implement and maintain an information security management system that sets a policy on information security, identifies and reviews information security risks, defines and implements risk treatment measures, implements internal and external reporting schemes, detects information security events, responds to and recovers from incidents, applies the measures the competent authority notifies, addresses its findings, and monitors your compliance (point IS.D.OR.200(a)).
• Run a continuous improvement process and document your key processes, procedures, roles and responsibilities (points IS.D.OR.200(b) and (c)).
• Identify the elements of your organization exposed to information security risks and your interfaces with other organizations, assign each information security risk with a potential impact on aviation safety a level under a predefined classification, and review and update the assessment when the elements, the interfaces, the information used or the lessons from incidents change (points IS.D.OR.205(a) to (d)).
• Develop measures to address unacceptable risks, implement them in a timely manner, check their continued effectiveness, inform the persons referred to in point IS.D.OR.240(a) and (b) and the other affected personnel of the outcome of the risk assessment, the corresponding threat scenarios and the measures to be implemented, and inform the organizations you share an interface with of any risk you share with them (points IS.D.OR.210(a) and (b)).
• Establish an internal reporting scheme to collect and evaluate information security events, implement measures to detect incidents and vulnerabilities and to respond to events that may develop into an information security incident, and implement measures to recover from incidents (points IS.D.OR.215 and IS.D.OR.220).
• After the competent authority notifies findings, identify the root cause or causes, define a corrective action plan and demonstrate the correction to the authority's satisfaction within the period agreed with it (point IS.D.OR.225).
• When you contract out any part of these activities, ensure that the contracted activities comply with the Regulation, that the contracted organization works under your oversight, and that the risks of the contracted activities are managed (point IS.D.OR.235(a)).
• Have the accountable manager or, for a design organization, the head of the design organization ensure that the resources needed to comply are available, establish and promote the information security policy, and appoint a person or group of persons to ensure compliance and to manage the compliance monitoring function (points IS.D.OR.240(a) to (c)).
• Keep archived and traceable records of approvals, contracts, key processes, risks and risk treatment measures, reported incidents and vulnerabilities, and events that may need reassessment, and keep the records of key processes, risks and risk treatment measures, and reported incidents and vulnerabilities for at least 5 years (point IS.D.OR.245).

Commission Delegated Regulation (EU) 2022/1645, IS.D.OR.230 · Read the law's page

• This duty binds the organizations named in Article 2(1) of Commission Delegated Regulation (EU) 2022/1645: a production organization or design organization under Part 21, or an aerodrome operator or apron management service provider under Part-ADR.OR, subject to the exception Article 2(1) lists for organizations solely involved in ELA 2 aircraft. It reaches you if you declare that you are an essential or important entity under Directive (EU) 2022/2555 and you are one of them. The Regulation applies from 16 October 2025 (Article 8).
• Report to your competent authority any information security incident or vulnerability that may represent a significant risk to aviation safety; where it affects an aircraft or associated system or component, also report it to the design approval holder, and where it affects a system or constituent you use, to the organization responsible for its design (point IS.D.OR.230(b)).
• Submit a notification as soon as you know of the condition, and a report as soon as possible and not exceeding 72 hours from the time you know of it unless exceptional circumstances prevent this, in the form your competent authority defines (point IS.D.OR.230(c), points (1) and (2)).
• Submit a follow-up report on the actions you have taken or intend to take to recover and to prevent similar incidents as soon as those actions are identified (point IS.D.OR.230(c), point (3)).
• Operate an information security reporting system that complies with Regulation (EU) No 376/2014 and its delegated and implementing acts where that Regulation is applicable to you (point IS.D.OR.230(a)).

Commission Implementing Regulation (EU) 2023/203, Annex II · Read the law's page

• This duty binds the organizations named in Article 2(1) of Commission Implementing Regulation (EU) 2023/203: a Part-145 maintenance organization, a Part-CAMO continuing airworthiness management organization, a Part-ORO air operator, an approved training organization, an aircrew aero-medical center, a flight simulation training device operator, an air traffic controller training organization or aero-medical center, an organization subject to Part-ATM/ANS.OR, or a U-space service provider or single common information service provider, subject to the exceptions Article 2(1) lists. It reaches you if you declare that you are an essential or important entity under Directive (EU) 2022/2555 and you are one of them. The Regulation applies from 22 February 2026, and from 1 January 2026 to the air navigation service provider of the European Geostationary Navigation Overlay Service (Article 16).
• Set up, implement and maintain an information security management system that sets a policy on information security, identifies and reviews information security risks, defines and implements risk treatment measures, implements internal and external reporting schemes, detects information security events, responds to and recovers from incidents, applies the measures the competent authority notifies, addresses its findings, and monitors your compliance (point IS.I.OR.200(a)).
• Run a continuous improvement process and document your key processes, procedures, roles and responsibilities (points IS.I.OR.200(b) and (c)).
• Identify the elements of your organization exposed to information security risks and your interfaces with other organizations, assign each information security risk with a potential impact on aviation safety a level under a predefined classification, and review and update the assessment when the elements, the interfaces, the information used or the lessons from incidents change (points IS.I.OR.205(a) to (d)).
• Develop measures to address unacceptable risks, implement them in a timely manner, check their continued effectiveness, inform the persons referred to in point IS.I.OR.240(a) and (b) and the other affected personnel of the outcome of the risk assessment, the corresponding threat scenarios and the measures to be implemented, and inform the organizations you share an interface with of any risk you share with them (points IS.I.OR.210(a) and (b)).
• Establish an internal reporting scheme to collect and evaluate information security events, implement measures to detect incidents and vulnerabilities and to respond to events that may develop into an information security incident, and implement measures to recover from incidents (points IS.I.OR.215 and IS.I.OR.220).
• After the competent authority notifies findings, identify the root cause or causes, define a corrective action plan and demonstrate the correction to the authority's satisfaction within the period agreed with it (point IS.I.OR.225).
• When you contract out any part of these activities, ensure that the contracted activities comply with the Regulation, that the contracted organization works under your oversight, and that the risks of the contracted activities are managed (point IS.I.OR.235(a)).
• Have the accountable manager ensure that the resources needed to comply are available, establish and promote the information security policy, and appoint a person or group of persons to ensure compliance and to manage the compliance monitoring function (points IS.I.OR.240(a) to (c)).
• Keep archived and traceable records of approvals, contracts, key processes, risks and risk treatment measures, reported incidents and vulnerabilities, and events that may need reassessment, and keep the records of key processes, risks and risk treatment measures, and reported incidents and vulnerabilities for at least 5 years (point IS.I.OR.245).

Commission Implementing Regulation (EU) 2023/203, IS.I.OR.230 · Read the law's page

• This duty binds the organizations named in Article 2(1) of Commission Implementing Regulation (EU) 2023/203: a Part-145 maintenance organization, a Part-CAMO continuing airworthiness management organization, a Part-ORO air operator, an approved training organization, an aircrew aero-medical center, a flight simulation training device operator, an air traffic controller training organization or aero-medical center, an organization subject to Part-ATM/ANS.OR, or a U-space service provider or single common information service provider, subject to the exceptions Article 2(1) lists. It reaches you if you declare that you are an essential or important entity under Directive (EU) 2022/2555 and you are one of them. The Regulation applies from 22 February 2026, and from 1 January 2026 to the air navigation service provider of the European Geostationary Navigation Overlay Service (Article 16).
• Report to your competent authority any information security incident or vulnerability that may represent a significant risk to aviation safety; where it affects an aircraft or associated system or component, also report it to the design approval holder, and where it affects a system or constituent you use, to the organization responsible for its design (point IS.I.OR.230(b)).
• Submit a notification as soon as you know of the condition, and a report as soon as possible and not exceeding 72 hours from the time you know of it unless exceptional circumstances prevent this, in the form your competent authority defines (point IS.I.OR.230(c), points (1) and (2)).
• Submit a follow-up report on the actions you have taken or intend to take to recover and to prevent similar incidents as soon as those actions are identified (point IS.I.OR.230(c), point (3)).
• Operate an information security reporting system that complies with Regulation (EU) No 376/2014 and its delegated and implementing acts where that Regulation is applicable to you (point IS.I.OR.230(a)).

Regulation (EU) No 910/2014, Article 5f(2) · Read the law's page

• This duty reaches you if you provide services as a private relying party other than a microenterprise or small enterprise, and Union or national law, or a contractual obligation, requires you to use strong user authentication for online identification, in any area (Art. 5f(2) names transport, energy, banking, financial services, social security, health, drinking water, postal services, digital infrastructure, education and telecommunications as examples and the list is open); it applies no later than 24 December 2027, 36 months after the implementing acts under Article 5a(23) and Article 5c(6) entered into force on 24 December 2024.
• Accept European Digital Identity Wallets that are provided in accordance with the Regulation, only upon the voluntary request of the user (Art. 5f(2)).