Air cargo security: the two EU regimes that decide whether your cargo moves

Anyone who ships, forwards or handles air cargo into or within the EU sits under more than one regime, but two are decisive, and they should not be conflated. Aviation security law asks a physical question: may this consignment enter the secure supply chain and be loaded onto an aircraft? Customs law asks a data question: has the required advance information reached the customs authorities so they can assess safety and security risk before the goods arrive? The first is built on Commission Implementing Regulation (EU) 2015/1998, which lays down detailed measures for the implementation of the common basic standards set by framework Regulation (EC) No 300/2008. The second is built on the Union Customs Code and operationalised through the Import Control System 2 (ICS2). The two run on different legal bases and, typically, different competent authorities — the national civil aviation authority for security, customs for ICS2 — so a consignment can clear one gate and still be held at the other.

Under Regulation (EU) 2015/1998, cargo and mail must be screened before being loaded onto an aircraft unless it has already been secured within a controlled chain. Two roles defined in Regulation (EC) No 300/2008 make that chain work. A regulated agent is, in the wording of the Regulation, 'an air carrier, agent, freight forwarder or any other entity who ensures security controls in respect of cargo or mail' — in practice a forwarder or handler approved by the national authority to apply and maintain those controls. A known consignor is 'a consignor who originates cargo or mail for its own account and whose procedures meet common security rules and standards' sufficient for the goods to be carried by air. The practical consequence is a fork: cargo tendered by a known consignor and handled through regulated agents can move as already-secure, while cargo that has not passed through this chain must be screened before loading — which is where lead time and cost concentrate.

For cargo and mail flown into the EU from a third country, Regulation (EU) 2015/1998 adds a further layer: the ACC3, the 'air cargo or mail carrier operating into the Union from a third-country airport'. According to the European Commission, an ACC3 designation is required for each non-EU airport from which an air carrier flies cargo or mail to the EU, and the carrier must ensure that all such cargo and mail is either physically screened to EU standards or comes from an EU aviation security validated secure supply chain. That validation — an on-site EU aviation security validation of the carrier's cargo and mail operations at each departure airport for EU-bound flights — has been mandatory since 1 July 2014. For a shipper or forwarder, this means the security status of an inbound consignment depends not only on your own controls but on the designated status of the carrier and the validated status of the origin operations.

On the customs side, Article 127 of the Union Customs Code (Regulation (EU) No 952/2013) requires that goods brought into the customs territory of the Union be covered by an entry summary declaration (ENS), lodged at the customs office of first entry within a set time-limit before the goods are brought in. ICS2 is the system through which that declaration is filed and through which customs performs pre-arrival — and, for air, pre-loading — safety and security risk analysis. The obligation falls on the economic operators that bring goods to or through the EU: air carriers, freight forwarders, express couriers and postal operators. For air specifically, a minimum data set must be filed before loading. Where risk analysis flags a consignment, the Commission notes that customs may issue risk-mitigating referrals requiring additional information, high-risk cargo and mail screening, or an instruction not to load the cargo. The air phase (ICS2 Release 2) took effect on 1 March 2023; since 1 June 2026, consignments entering the EU by any mode of transport are expected to be covered by a valid ENS.

Because the two regimes turn on your role and your lane rather than on your company as a whole, exposure is situation-specific. If you originate goods and hold a validated status, the known consignor route likely applies; if you consolidate or handle third-party cargo, you are likely acting as — or tendering to — a regulated agent, and inbound lanes from outside the EU likely depend on a carrier's ACC3 designation for that origin. On the customs side, the ENS obligation likely rests on whichever party is bringing the goods into the EU and holds the required data, though it can be split across multiple filings by different actors in the chain. None of this determines your specific legal position: exact validation requirements, filing responsibilities and time-limits vary by role, origin and mode, and should be confirmed against the cited EU texts and your national authorities.

Get an email whenever something changes here. No account needed; confirm by email (double opt-in).