AEOS certification (Authorised Economic Operator for Security) does not stop at your company’s boundaries. Every link in the international supply chain can become a point of vulnerability: an IT supplier with obsolete systems, a logistics partner without adequate controls, an unknown subcontractor. The Union Customs Code makes you responsible for the security of the entire chain, even when operations are outsourced.

Shared responsibility: why your partners count

As an Authorised Economic Operator, you are responsible for your segment in the supply chain. But the security of the goods also depends on the standards applied by those who work with you. Article 28, paragraph 1, letter d) of the Implementing Regulation establishes that you must demonstrate how you identify business partners and how you ensure security through appropriate contractual agreements.

It is not mandatory for all your suppliers to be AEO certified, but you must ensure they respect acceptable security standards. This applies especially to those managing critical services: IT suppliers, logistics operators, international carriers. A periodic Risk Assessment helps you identify which partners represent a high risk and require stricter controls.

Contractual clauses: sealing agreements with suppliers

Written agreements are the first level of protection. For IT or logistics service providers, include clauses that foresee:

• Obligation to protect IT systems against unauthorized manipulation
• Prohibition to subcontract services to unknown third parties without security guarantees
• Protection of corporate and customs data contained in contracts
• Commitment to promptly report any security incidents

If your organization must also comply with the NIS2 Directive, consider that supplier management requirements overlap: both regulations require controls on the digital and physical supply chain.

Audits and verifications: from paper to reality

Contractual clauses are not enough. You must verify that partners concretely respect the commitments made. Implement monitoring procedures through:

• Security audits conducted directly or by third-party experts at partner premises
• Regular visits to verify compliance with physical and IT standards
• Request for security declarations or international certifications such as ISO 27001

An IT provider managing your customs systems should demonstrate data protection processes, secure backups, and access management. A logistics operator should guarantee physical controls on warehouses, video surveillance, and controlled access procedures. To evaluate the security of application systems used by partners, consider requesting application security tests that verify the absence of critical vulnerabilities.

Frequently asked questions about business partner security

• Is it mandatory for suppliers to be AEO certified?
• No. You are not required to demand that partners be AEO certified. However, you must ensure they respect adequate security standards to protect the supply chain. You can accept non-certified suppliers if you demonstrate that they apply equivalent controls.
• How is the security of an IT provider verified?
• Verification occurs through the analysis of data protection processes, the request for ISO 27001 certifications, sending self-assessment questionnaires, or carrying out technical audits and on-site inspections. You can also request penetration test or vulnerability assessment reports performed by third parties.
• What contractual clauses are recommended?
• Clauses on IT system protection, notification obligations in case of incidents, the right to perform periodic audits, and restrictions on subcontracting to unidentified third parties are recommended. Also include penalties in case of violation of agreed security standards.
• Does the AEO operator remain responsible in case of an incident at a supplier’s site?
• Yes. You can outsource technical activities, but you cannot outsource the responsibility of compliance with AEO criteria before customs authorities. If a supplier causes a security incident, the consequences also fall on you.
• Must the risk assessment include the digital supply chain?
• Yes. Risk and threat analysis must cover all aspects relevant to customs activities, including IT systems, external service providers, and the security of information exchanged with partners. Also consider risks related to cloud providers, software houses, and system integrators.

The AEOS status requires constant monitoring of business partners. Supply chain security is not a document to be signed, but a continuous process of verification, audit, and improvement. Only in this way can you guarantee that every link in the chain respects the standards required by European legislation. To maintain effective control over the vulnerabilities of the entire chain, implement a continuous vulnerability management system that also covers the systems of critical partners.

Related insights

• AEO certification and cybersecurity: requirements and standards
• Network Penetration Test for AEOS: verification of perimeter security
• AEO audit and Vulnerability Test: preparation and compliance
• AEOS security governance: policies and procedures
• SOC monitoring and Incident Response for AEO operators
• Cyber training for AEO operators: awareness and skills