Skip to main content

AENAON

Open Call Round 1

Date: 11 September 2026
Deadline: 6 13 November 2026

ANNOUNCEMENT / OPEN CALL NOTICE

1. Call at a Glance

Item

Open Call 1 provision

Call title

Open Call 1 - Cybersecurity Technology Enhancement for 

Offshore Wind Energy Operators

Opening date

11 September 2026

Submission deadline

13 November 2026 at 17:00 CET

Submission channel

Official AENAON Open Call submission portal, accessible 

through the Open Call section of the AENAON website.

Language

English

Implementation duration

8 months

Indicative implementation period

January-August 2027

Indicative Open Call 1 budget

EUR 2,100,000

Funding form

Lump-sum sub-grant

Funding rate

50% of the eligible sub-project budget

Maximum support

Up to EUR 60,000 per participating legal entity, cumulatively across both AENAON Open Calls. 

By way of derogation: 

Up to EUR 100,000 for offshore wind farm operators and manufacturers, which are considered large critical infrastructures/ operators of essential services; and 

Up to €150,000 per action -in case of small consortia.

Contact

open-call@aenaon-project.eu

Important

The final documents published on the official AENAON Open Call webpage and submission portal are the source of truth for the exact deadline time, eligible countries, submission requirements, templates and contractual conditions.

Eligible Countries

Eligible applicants must be legally established in an EU Member State, Iceland, Liechtenstein or Norway, or in another third country expressly confirmed as fully associated with the Digital Europe Programme for Specific Objective 3 – Cybersecurity and Trust, subject to the conditions of the AENAON Grant Agreement and the applicable Open Call rules.

Applicants established in countries associated with the Digital Europe Programme only for Specific Objectives 1, 2, 4 or 5 are not eligible under this Open Call.

The definitive list of eligible countries is provided in the document ‘AENAON Open Call 1 – List of Eligible Countries’, published as part of the official Open Call package. Applicants are responsible for verifying their country eligibility before submitting an application.

For consortium applications, every participating legal entity must independently satisfy the applicable country-eligibility requirements. If any consortium member is established in an ineligible country, the entire proposal will be declared ineligible at the eligibility-check stage and will not proceed to quality evaluation.

Eligible countries:
• The 27 Member States of the European Union
• Iceland
• Liechtenstein
• Norway

2. Purpose and Scope

AENAON is launching its first competitive Open Call to support external organisations in enriching, integrating, testing and initially validating cybersecurity preparedness capabilities for offshore wind energy operations.


Funded sub-projects are expected to interact with AENAON’s Federated Digital Twin-based Cyber Range Platform, interactive cyber range training programme and/or cybersecurity preparedness support services. Proposals must demonstrate direct operational relevance to offshore wind farms or closely related critical-energy infrastructure environments.

Open Call 1 objectives

• Enhance AENAON cybersecurity technologies, services and platform capabilities through external innovation and validation
• Develop and test offshore-wind-specific cyber-threat, vulnerability, risk and incident-response scenarios
• Validate integration, interoperability and operational readiness in realistic IT/OT or digital-twin environments
• Generate measurable evidence, lessons learned and reusable outputs that support wider adoption and future scaling

Eligible activity types

• A1.1 – Integration of cybersecurity technologies: offshore-wind requirements, threat detection, predictive analytics and OT-security solutions.
• A1.2 – Testing in real-world or operationally relevant pilots: digital-twin simulations, SCADA/OT assessment and penetration-testing validation.
• A1.3 – Compliance and resilience: strategies, methods and content supporting NIS2/CER-related preparedness and resilience.
• A1.4 – Dissemination and communication: targeted knowledge-sharing activities connected to the funded action.
• A1.5 – Collaboration and impact: risk scenarios, penetration tests, stakeholder engagement, training and validation evidence.

3. Who May Apply

Applications may be submitted by a single eligible legal entity or by a small consortium of complementary partners. All members of a consortium must be legal entities established in countries eligible under the final Open Call conditions. If one consortium member is established in an ineligible country, the consortium proposal will be declared ineligible and will not proceed to quality evaluation. Subject to the final country-eligibility list and ownership-and-control requirements, eligible applicant profiles may include:

  • Offshore wind energy operators and manufacturers
  • Offshore wind supply-chain stakeholders
  • SMEs and other technology providers
  • Cybersecurity service providers
  • Research and innovation organisations
  • National Coordination Centres and other relevant critical-infrastructure stakeholders


Not eligible: AENAON Grant Agreement beneficiaries and their affiliated entities may not receive AENAON FSTP funding

4. Funding Conditions

• The indicative budget available for Open Call 1 is EUR 2.1 million
• Financial support is provided as a lump-sum sub-grant covering 50% of the eligible sub-project budget. Applicants must demonstrate the capacity to provide the remaining co-funding
• The maximum AENAON support is EUR 60,000. By way of derogation from this ceiling, AENAON may provide support of up to EUR 100,000 per participating legal entity in the case of offshore wind farm operators and manufacturers considered as large critical infrastructures/operators of essential services, and up to EUR 150,000 per action in the case of small consortia. The applicable ceiling per participating legal entity applies cumulatively across Open Call 1 and Open Call 2, irrespective of whether the entity participates as a single applicant, coordinator, or consortium member.
• The final amount is established during contracting through a needs-based and auditable right-sizing process.
• No double funding is permitted for the same activities, costs, outputs or deliverables
• Where the support requested by the next-ranked proposal exceeds the remaining Open Call budget, AENAON may offer funding limited to the remaining available amount. The applicant may accept the reduced amount and submit a proportionately revised scope, work plan, budget, milestones and deliverables, subject to AENAON approval, or withdraw from the contracting process.

Indicative payment structure

Stage

Payment

Trigger

Contracting and onboarding

30%

Signature of the Sub-Grant Agreement and completion of 

onboarding requirements

Mid-term review

40%

Acceptance of the mid-term report, deliverables and 

milestone evidence

Final completion

30%

Acceptance of final reports, outputs, KPI evidence and 

validation results

5. Proposal Requirements

The technical proposal must be prepared using the official AENAON template. The main technical narrative is limited to 10 A4 pages, in accordance with the template instructions.

Proposals should provide:
• A clear offshore-wind cybersecurity challenge, use case and measurable objectives
• A technically credible and innovative approach linked to AENAON tools, services or platform assets
• Expected outcomes, KPIs, dissemination/exploitation plans and ecosystem contribution
• An 8-month work plan with tasks, milestones, deliverables and acceptance evidence
• Governance, team capacity, resource justification, co-funding and risk mitigation
• Ethics, security, data-protection, confidentiality, IPR and responsible-disclosure information

Required proposal package

  • Online application form
  • Annex 3 – AENAON Technical Proposal Template
  • Budget and co-funding justification
  • Legal-entity and registration information
  • Annex 5 – Declaration of Honour, completed by each participating legal entity
  • Annex 6 – Consortium and Partner Declaration(s), where applicable
  • Annex 7 – Ownership and Control Declaration, completed by each participating legal entity
  • Annex 8 – No Double Funding Declaration, completed by each participating legal entity
  • Annex 9 – IPRs Background and Declaration
  • Any additional document required by the final Open Call package

6. Evaluation and Selection

Criterion

OC1 weight

Minimum score

Assessment focus

Excellence

30%

3/5

Technical and methodological quality, innovation potential and alignment with AENAON objectives

Impact

30%

3/5

Expected outcomes and benefits, dissemination/exploitation, ecosystem contribution, and inclusive participation

Implementation

40%

3/5

Work plan, governance, resources, risks, team capacity, monitoring and quality assurance

Proposals must achieve at least 3/5 for each criterion and an overall weighted score of at least 3.33/5. Proposals passing the thresholds will be ranked by final weighted score and funded in rank order within the available budget. For Open Call 1, ties are resolved first by the Implementation score, then Excellence, then Impact; any remaining tie is decided by the Open Call Coordination Committee on documented strategic-fit grounds.

7. Indicative Open Call 1 Calendar

Phase

Calendar period

Publication and applicant support

July-August 2026

Submission period

11 September-13 November 2026

Admissibility and eligibility checks

Preliminary administrative checks may take place during the submission period; final admissibility and eligibility checks will begin after the submission deadline

Evaluation and selection

November-December 2026

Contracting and onboarding

Following selection, before implementation start

Implementation and monitoring

January-August 2027 (8 months)

Assessment and lessons learned

September 2027

8. Submission and Applicant Support

Applications must be submitted electronically through the official AENAON Open Call portal. Submissions by email or other channels will not be accepted.

Applicants are strongly encouraged to submit well before the deadline. Late applications will not be accepted except where AENAON officially confirms a portal-wide technical failure affecting multiple applicants.

Clarifications of general relevance will be consolidated and published so that all applicants have equal access to the same information.

Contact information

9. Applicable Documents and Precedence

Applicants must read the complete Open Call package, including the Open Call Overview, Guidelines for Applicants, Technical Proposal Template, declarations and Sub-Grant Agreement template. In the event of inconsistency, the final Open Call Notice and other documents published on the official AENAON Open Call webpage prevail, subject to the AENAON Grant Agreement and applicable EU rules.

Info Day – Open call round 1

Alternative questions for Q&A session

1. General information

Open Call 1 supports external organisations in enriching, integrating, testing and initially validating AENAON cybersecurity preparedness capabilities for offshore wind operations and closely related critical-energy infrastructure. Projects should interact with the Federated Digital Twin-based Cyber Range Platform, cyber range training and/or ex-ante cybersecurity preparedness services.

Open Call 1 supports external organisations in enriching, integrating, testing and initially validating AENAON cybersecurity preparedness capabilities for offshore wind operations and closely related critical-energy infrastructure. Projects should interact with the Federated Digital Twin-based Cyber Range Platform, cyber range training and/or ex-ante cybersecurity preparedness services.

The submission period runs from 1 September to 31 October 2026. Applicants must follow the exact closing time and submission instructions stated in the final Open Call Notice and portal, and are strongly encouraged to submit before the final day.

Clarifications of general relevance will be consolidated through the official AENAON Open Call channels. Applicants will be notified through the official process, and final outcome information is expected to be published through the AENAON website and the EU Funding & Tenders Portal after the relevant selection and contracting steps.

2. Scope and eligible activities

Clarifications of general relevance will be consolidated through the official AENAON Open Call channels. Applicants will be notified through the official process, and final outcome information is expected to be published through the AENAON website and the EU Funding & Tenders Portal after the relevant selection and contracting steps.

No. The targets of more than 20 risk scenarios, more than 10 penetration tests and more than five industry stakeholders are collective targets across the relevant funded Open Call projects. Each selected sub-project will receive proportionate targets during contract preparation, based on its scope, scale and complexity.

Activities outside the closed list are not eligible. Examples include generic marketing unrelated to project outcomes, unrelated research and development, and capital investments not directly necessary for implementation of the approved sub-project.

No. Applicants may propose a use case based on their own technology, expertise or operational context, provided it is clearly aligned with Open Call 1 and explains how it will use, integrate, test, validate or extend relevant AENAON capabilities. Detailed access arrangements will be confirmed during technical preparation and onboarding where applicable.

3. Funding and payments

The indicative Open Call 1 envelope is EUR 2.1 million. Support is provided as a lump-sum sub-grant covering 50% of the eligible sub-project budget. The implementation period is eight months.

The ceiling applies to each participating legal entity cumulatively across both AENAON Open Calls, regardless of whether the entity participates as a single applicant, lead applicant or consortium partner. Previous AENAON FSTP awards reduce the amount that may be awarded later.

The general ceiling for financial support to a third party is EUR 60,000. By way of derogation, the ceiling may be increased to EUR 100,000 per participating legal entity where the applicant is an offshore wind farm operator or manufacturer considered a large critical infrastructure/operator of essential services.The applicable ceiling (€60,000 or €100,000, as relevant) applies cumulatively across Open Call 1 and Open Call 2, irrespective of whether the entity participates as a single applicant, coordinator, or consortium member.

Not necessarily. The EUR 60,000 ceiling applies per participating legal entity, including entities participating as consortium members. By way of derogation, this ceiling may be increased to EUR 100,000 per legal entity for offshore wind farm operators and manufacturers considered as large critical infrastructures/operators of essential services.
In addition, for small consortia, the maximum financial support may reach EUR 150,000 per action, subject to the applicable ceiling for each participating legal entity.

Applicants must provide the share of the eligible sub-project budget not covered by AENAON support. For example, an entity requesting EUR 60,000 in AENAON support would normally need an eligible budget of at least EUR 120,000 and must demonstrate the capacity to provide the remaining share.

Payments follow a 30%-40%-30% model: 30% after signature of the Sub-Grant Agreement and completion of onboarding requirements; 40% after acceptance of the mid-term report, deliverables and milestone evidence; and 30% after acceptance of final reports, outputs, KPI evidence and validation results. Payments depend on accepted results and evidence.

AENAON may offer funding limited to the remaining available amount. The applicant may accept and submit a proportionately revised scope, work plan, budget, milestones and deliverables for AENAON approval, or withdraw from contract preparation.

4. Eligibility and consortium rules

Eligible applicants must be legally established in one of the 27 EU Member States, Iceland, Liechtenstein or Norway. Any additional third country is eligible only where it is expressly confirmed as fully associated with the Digital Europe Programme for Specific Objective 3 – Cybersecurity and Trust and is included in the definitive “AENAON Open Call 1 – List of Eligible Countries”. Countries associated only for Specific Objectives 1, 2, 4 or 5 are not eligible.

Every participating legal entity must independently satisfy the country-eligibility requirements. If one consortium member is established in an ineligible country, the entire proposal will be declared ineligible and will not proceed to quality evaluation.

No. They are separate checks. An entity may be established in an eligible country and still be subject to an ownership-and-control assessment. Each participating legal entity must complete Annex 7 and provide supporting information where requested.

Yes. Part A of Annex 6 is completed and signed by the lead applicant. Part B is completed and signed separately by every consortium member, including the lead applicant. Each participating legal entity must also submit its own Annex 5, Annex 7 and Annex 8.

No. Beneficiaries of AENAON Grant Agreement No. 101249723 and their affiliated entities are not eligible for AENAON FSTP funding.

5. Proposal preparation and submission package

The main technical narrative in Annex 3 is limited to 10 A4 pages covering Sections 0-5. The cover page, instruction page, Section 6, Section 7 and separately submitted mandatory annexes are excluded. Pages beyond the permitted limit may be disregarded during evaluation.

The package includes the online application form, Annex 3 – Technical Proposal Template, budget and co-funding information, legal-entity information, Annex 5 – Declaration of Honour for each participating legal entity, Annex 6 where applicable, Annex 7 for each participating legal entity, Annex 8 for each participating legal entity, Annex 9 – IPR and Background Declaration, and any additional documents required by the final package.

Applicants should not include credentials, detailed vulnerabilities, identifiable infrastructure configurations or other operationally sensitive material unless strictly necessary. Specific sensitive passages should be marked [CONFIDENTIAL] in accordance with the Guidelines. Applicants should identify particular passages or data rather than designating the entire proposal as confidential.

Applicants should complete the official templates and must not remove mandatory declarations, headings or table structures unless the Open Call documentation expressly permits a modification. Names, budgets, roles and requested support must remain consistent across all forms and annexes.

6. Declarations, double funding and IPR

Related, complementary or parallel public funding is not automatically prohibited. Double funding arises where the same activity, cost, personnel effort, milestone, deliverable, result or output is financed or claimed more than once from public sources. Related funding must be fully disclosed and technically, financially and documentarily separated.

Each participating legal entity, including the lead applicant and every consortium partner, must complete and sign Annex 8. The entity must disclose current, pending or planned related public funding and maintain records capable of preventing and detecting duplicate claims.

For a consortium proposal, the lead applicant may submit one consolidated Annex 9 covering all participating legal entities, provided each background item, third-party component and restriction is clearly attributed to the relevant entity. Each entity remains responsible for the accuracy of information relating to its own rights, licences and restrictions.

No. Annex 9 records relevant background, third-party materials, rights and restrictions. It does not transfer ownership or create access rights by itself. Any operational rights required for integration, verification, training or demonstration are governed by the Sub-Grant Agreement.

Applicants and selected recipients must notify AENAON in writing without undue delay of material changes affecting ownership and control, funding overlap, background, licences, third-party rights or other relevant declarations before contract signature or during implementation.

7. Evaluation and selection

Proposals are evaluated under Excellence, Impact and Implementation. For Open Call 1 the weights are 30%, 30% and 40%, respectively. Each criterion must score at least 3 out of 5, and the overall weighted score must be at least 3.33 out of 5.

Ties are resolved first by the Implementation score, then Excellence, then Impact. If a tie remains, the Open Call Coordination Committee decides on documented strategic-fit grounds using only information contained in the submitted proposal and assessed under the published criteria.

No. Proposals passing the thresholds are ranked and funded in order within the available budget. Other passing proposals may be placed on a reserve list.

The redress procedure is limited to procedural deficiencies. It does not reopen the technical judgement of evaluators and does not allow new proposal content to be introduced after submission.

8. Contract preparation, implementation and support

Selected applicants complete legal, financial, ownership-and-control and other compliance checks; agree the final scope, milestones, deliverables and acceptance criteria; sign the Sub-Grant Agreement; and complete onboarding.

Selected applicants complete legal, financial, ownership-and-control and other compliance checks; agree the final scope, milestones, deliverables and acceptance criteria; sign the Sub-Grant Agreement; and complete onboarding.

Yes. Selected projects may receive onboarding, technical guidance, platform or service access support, integration guidance, coordination support and participation in review or capacity-building sessions. Exact support arrangements and access conditions will be confirmed during contract preparation and onboarding.

Applicants may contact open-call@aenaon-project.eu and should monitor the official AENAON Open Call webpage. Clarifications of general relevance will be consolidated and made available to all applicants on an equal basis.

Registration and participation in the AENAON Open Call Info Day are subject to the AENAON Website Privacy & Cookies Policy, available at: https://aenaon-project.eu/privacy-policy/  

Attending this Info Day is a dissemination activity. Registration and participation do not constitute submission of an application to the AENAON Open Call, nor do they create any applicant relationship with the AENAON consortium. If you wish to apply to the Open Call, a separate process and a separate Privacy Notice apply, available at: https://aenaon-project.eu/open-calls/  

For this Info Day, WindEurope may process participants’ personal data, including name, email address, organisation, role or job title, country, registration timestamp, attendance information, online meeting metadata, questions submitted during the session, chat messages, and technical connection data generated by the online event platform. These data are processed for registration, event access, participant communications, online event delivery, Q&A management, technical support, attendance documentation, and follow-up communications relating to the Info Day and the AENAON Open Call launch. 

The data controller for the personal data processed in connection with this Info Day is WindEurope asbl, established in Rue Belliard 40, 1040 Brussels, Belgium, which organises and runs the Info Day as part of the AENAON dissemination activities. 

The online session will be delivered through Microsoft Teams Events and related Microsoft 365 services, and Microsoft Ireland Operations Ltd may process registration, attendance, participation, account-related and technical data as provider of the online event platform, in accordance with the applicable Microsoft data protection terms and privacy documentation. 

The legal bases for processing are Article 6(1)(b) GDPR, for steps necessary to enable registration and participation at the participant’s request; Article 6(1)(f) GDPR, for the legitimate interest of WindEurope in organising, securing and documenting the Info Day and answering participant questions; and, where applicable, Article 6(1)(c) GDPR, for compliance with project reporting, audit and record-keeping obligations under Grant Agreement No. 101249723. 

If the session is recorded, participants will be informed before or at the start of the event. Participants who do not wish to appear in the recording may keep their camera and microphone switched off and may submit questions in writing where this option is available. 

Registration and attendance data will generally be retained for up to 12 months after the event, unless longer retention is required for project reporting, audit, legal claims, security incident handling, or obligations under the AENAON Grant Agreement. Aggregated or anonymised statistics may be retained for project reporting purposes. 

Questions submitted during the Info Day may be used, in anonymised or non-identifiable form, to prepare FAQs or clarifications for the benefit of all potential Open Call applicants. 

For privacy questions or to exercise GDPR rights, participants may contact: dpo@aenaon-project.eu. Participants may also lodge a complaint with the Belgian Data Protection Authority or with the supervisory authority of their country of residence or place of work. 

 

AENAON Open Call Privacy Notice 

1. Who We Are and What This Notice Covers 

This Privacy Notice explains how Circular Economy Foundation (CEF), acting as data controller for the AENAON open call, processes personal data in connection with the AENAON Open Call portal at https://aenaon-project.eu/open-calls/ (the “Portal”) and all Open Call activities (proposal submission, evaluation, contracting of sub-grantees, redress). 

The general AENAON project website (aenaon-project.eu) is covered by a separate Website Privacy & Cookies Policy: https://aenaon-project.eu/privacy-policy/. 

Data Controller Circular Economy Foundation (CEF), Rue Breydel 34-36-40, 1040 Brussels, Belgium. 
Data Protection Officer contact dpo@aenaon-project.eu  
Granting authority European Cybersecurity Competence Centre (ECCC) — processes data under its own Portal Privacy Statement 
Legal framework GDPR; Belgian Data Protection Act of 30 July 2018; Grant Agreement No. 101249723 (Articles 9.4, 13, 15, 20, 25); Regulation (EU, Euratom) 2024/2509 

The internal allocation of responsibilities between consortium partners is set out in the AENAON Consortium Agreement (Section 11) and in dedicated data protection arrangements concluded between the relevant partners, including a data sharing and infrastructure access arrangement between Circular Economy Foundation and Asfalys SRL. Where consortium partners or service providers process personal data on behalf of Circular Economy Foundation, this is governed by Article 28 GDPR data processing agreements. 

2. Personal Data We Process 

Where legitimate interest is used as a legal basis, it has been balanced against the rights and reasonable expectations of data subjects participating in an EU-funded Open Call programme. 

Activity Data Categories Purpose Legal Basis (GDPR Art. 6) Retention 
Open Call portal registration and proposal submission Name, job title, organisation, email, postal address, PIC/ORCID, nationality, professional background, CV/bio Receiving and processing applications; eligibility checks; evaluation; selection; contracting; redress; audit trail Art. 6(1)(b) — steps prior to entering into a possible Sub-Grant Agreement; Art. 6(1)(c) — FSTP, audit, transparency and record-keeping obligations under the GA and applicable EU financial rules; Art. 6(1)(f) — legitimate interest in ensuring a fair, secure and auditable Open Call process.  

Unsuccessful proposals: 5 years after final payment to the consortium under the GA, or until any ongoing audit, investigation or legal proceedings conclude, whichever is later.  

Selected applicants: 5 years after final payment under the GA 

Open Call helpdesk Name, email, organisation, query content Responding to Open Call enquiries Art. 6(1)(f) — legitimate interest 2 years, or retention period of the relevant application/sub-project if linked. 
Evaluator engagement Name, address, nationality, identification number, professional background, CV, bank details, conflict-of-interest declarations, evaluation outputs (IERs, ESRs) Engaging and paying independent expert evaluators; conflict-of-interest records; evaluation audit trail Art. 6(1)(b) — Evaluator Services Agreement; Art. 6(1)(c) — audit and record-keeping under the GA 5 years after final payment under the GA, or until conclusion of any ongoing audit, investigation, litigation, recovery or dispute, whichever is later 
Sub-grantee contracting and monitoring Name, job title and contact details of authorised representatives; bank details of lead entity; signature data Executing and managing Sub-Grant Agreements; payment instalments; monitoring; FSTP audit trail Art. 6(1)(b) — Sub-Grant Agreement; Art. 6(1)(c) — FSTP audit under GA Article 9.4 5 years after final payment under the SGA, or longer where required for audit, investigation, recovery, dispute resolution or legal claims.  
Publication of selected projects Name of entity/lead entity, sub-project title, funded amount; minimum personal data where the recipient is a natural person Visibility and transparency under Article 17 GA and EU FSTP rules Art. 6(1)(c) — visibility obligation under the GA; Art. 6(1)(f) — transparent reporting on publicly funded projects Duration of the AENAON website plus at least 5 years after final payment under the GA 
Redress and complaints Name, contact details, proposal reference, grounds, OCCC review record, correspondence Reviewing redress requests from unsuccessful applicants; documenting outcomes Art. 6(1)(c) — Open Call rules; Art. 6(1)(f) — fair and auditable process 5 years after final payment to the consortium under the GA, or until any ongoing audit, investigation or legal proceedings conclude, whichever is later. 

Records relevant to audit, review, investigation, litigation or recovery may be retained until that procedure is fully closed. 

3. Special Category and Sensitive Personal Data 

We do not intentionally collect special-category data (Article 9 GDPR) through the Portal. However: 

  • Where the Open Call process includes registration for information sessions, webinars, evaluation meetings, pitching sessions or other Open Call-related events, we may process event-registration data. If participants voluntarily provide dietary, accessibility or similar special-category information for an in-person event, such data will be processed only where necessary for event organisation, on the basis of explicit consent under Article 9(2)(a) GDPR, and deleted immediately after the event.  
  • Proposals may inadvertently contain references to health, ethnicity or other special-category data. Applicants should not include such data unless strictly necessary. Where received, it is treated with heightened protection and accessed only by personnel with a legitimate need. 
  • Where exclusion or eligibility checks are required under EU financial rules, personal data may be processed to the extent necessary to comply with those obligations. Processing of personal data relating to criminal convictions or offences is carried out only to the extent required by applicable EU financial rules and Belgian law, in accordance with Article 10 GDPR and Article 27 of the Belgian Data Protection Act of 30 July 2018. 

Applicants must avoid including special-category or criminal-offence data, or unnecessary personal data, in proposals, CVs or annexes unless strictly necessary for evaluation. 

4. Who We Share Data With 

Recipient Data shared and purpose 
OCEP evaluators (independent experts) Proposal content including personal data, for evaluation under signed confidentiality and conflict-of-interest declarations. Evaluators receive a dedicated privacy notice at the time of the Call for Evaluators (when application data is first collected) and again at contracting. The notice explains processing of evaluator application data, CV, conflict-of-interest declarations, payment information and evaluation records. 
AENAON consortium partners (technical monitoring and platform access) Contact details of selected recipients and sub-project teams, only as necessary for monitoring and technical support. Governed by the Sub-Grant Agreement and Platform Access Agreement. 
Selected sub-grantees (FSTP recipients) At Sub-Grant Agreement signature, sub-grantees receive a dedicated privacy notice and, where relevant, a Data Processing Agreement. This implements the pass-through obligations under GA Article 9.4 (Articles 12, 13, 14, 17.2, 18, 19 and 20). 
ASFALYS SRL (Coordinator) Asfalys SRL processes consolidated project and financial data for the purposes of reporting to ECCC under the Grant Agreement, acting as controller for those reporting activities in accordance with the data sharing and infrastructure access arrangement concluded between Circular Economy Foundation and Asfalys SRL. Asfalys SRL receives only the specific information necessary for Grant Agreement reporting, namely Sub-Grant Agreements, FSTP financial and contractual records and consolidated monitoring records.  
ZELUS IKE 

ZELUS IKE provides website operation, content management, WordPress administration, maintenance, troubleshooting and technical support for the AENAON Website, including the Open Call information pages and links to the separate Open Call submission platform. ZELUS IKE does not operate the separate Open Call submission platform unless expressly instructed and documented separately. ZELUS IKE may access Open Call-related data only where such data is processed through the AENAON Website, for example website enquiries, technical logs, page administration records or website-based forms, and only where necessary for website operation or technical support, under documented instructions and subject to an Article 28 GDPR data processing agreement. 

 

ECCC and the EU Funding & Tenders Portal Aggregated project data, financial reports and required disclosures for grant management. ECCC processes under its own Portal Privacy Statement. 
European Commission, OLAF, EPPO, European Court of Auditors Financial, contractual and personal data required for audits and investigations under the GA and applicable EU law. Art. 6(1)(c) GDPR. 

Good Grants 

[Open Call submission and evaluation platform] 

Provides the technical platform for proposal submission, application forms, document upload, evaluation workflow, application records and Open Call audit-trail material. Good Grants acts as processor on documented instructions from CEF under an Article 28 GDPR data processing agreement. The platform is administered by the AENAON consortium on behalf of CEF. Data is hosted in EU. 
Microsoft Ireland Operations Ltd (SharePoint — cloud storage and document management) Provides secure cloud storage and document management for proposal files, declarations, evaluation records, contracts, reports and Open Call audit-trail material, via Microsoft SharePoint under the Microsoft 365 subscription held by Asfalys SRL as AENAON Coordinator. Microsoft acts as processor under the Microsoft Data Processing Agreement incorporated into the Microsoft Product Terms.  
Belgian Data Protection Authority Where required by law or in response to a complaint. 

Service providers act on documented instructions under Data Processing Agreements. Where another consortium partner independently determines the purposes and means of a specific processing activity, that partner acts as an independent controller and provides separate privacy information. 

5. International Transfers 

 

The Portal and Open Call processing take place within the EEA. Where transfers outside the EEA are necessary, one of the following safeguards applies: 

  • Adequacy decision under Article 45 GDPR; 
  • Standard Contractual Clauses under Article 46 GDPR, with a Transfer Impact Assessment where required; 
  • A derogation under Article 49(1)(b) GDPR where no other safeguard is available, and only where strictly necessary for the performance of the relevant agreement with the data subject. 

Where personal data is transferred to ECCC or the EU Funding & Tenders Portal, applicants, evaluators and sub-grantees are provided with the Portal Privacy Statement in accordance with Article 15.2 of the Grant Agreement (https://ec.europa.eu/info/funding-tenders/opportunities/portal/screen/support/legalnotice). 

Where possible, AENAON prioritises service providers established and hosting data within the EEA. 

6. Your Rights Under GDPR 

Rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), objection (Art. 21), withdrawal of consent (Art. 7(3)) and lodging a complaint with a supervisory authority (Art. 77). 

The right to erasure does not apply where processing is necessary to comply with the audit and record-keeping obligations under the Grant Agreement (Article 20 GA, 5-year retention) or for the establishment, exercise or defence of legal claims. The right to object does not apply where processing is based on a legal obligation (Article 6(1)(c) GDPR). 

To exercise any right, contact dpo@aenaon-project.eu. Response within one month, extendable by two months for complex requests. 

Complaints: Belgian Data Protection Authority (APD/GBA), Rue de la Presse 35, 1000 Brussels — www.dataprotectionauthority.be, contact@apd-gba.be. 

7. How We Protect Your Data 

Technical and organisational measures under Article 32 GDPR, Article 13 of the Grant Agreement (Confidentiality and Security) and Section 10 of the Consortium Agreement (five-year confidentiality after final payment). Measures include: 

  • TLS/HTTPS encryption in transit and at rest where technically feasible; 
  • Role-based access controls and, where available, multi-factor authentication for Portal administration; 
  • Signed confidentiality and conflict-of-interest declarations for all evaluators and consortium staff with access to proposal data; 
  • Proposal and evaluation materials accessible only to authorised personnel on a need-to-know basis; 
  • Structured repositories for proposal files and evaluation records as part of the Open Call audit trail; 
  • Documented breach-management procedures; 
  • Regular security reviews. 

Personal data breaches likely to risk data subjects’ rights are notified to the Belgian DPA within 72 hours (Article 33 GDPR) and to affected individuals where the breach is likely to result in a high risk (Article 34). 

8. Automated Decision-Making and Profiling 

AENAON does not make decisions about individuals solely on the basis of automated processing within the meaning of Article 22 GDPR. Eligibility, evaluation, ranking and funding decisions are made by human reviewers: the Open Call Coordination Committee (OCCC) for governance and final selection; the Open Call Evaluation Panel (OCEP) of independent experts for merit-based assessment; and the Open Call Technical Team (OCTT) for technical monitoring. 

The Portal may use automated administrative tools (CAPTCHA, file-format validation, mandatory-field validation, duplicate-submission alerts, deadline controls, security pre-checks). These support submission handling only and do not constitute eligibility, evaluation or funding decisions. Applicants flagged by an automated check may contact the Open Call helpdesk. 

9. Contact 

Data Controller Circular Economy Foundation (CEF), Rue Breydel 34-36-40, 1040 Brussels, Belgium 
Data Protection Officer  Contact  dpo@aenaon-project.eu 
Open Call Helpdesk open-call@aenaon-project.eu  
Supervisory Authority APD/GBA, Rue de la Presse 35, 1000 Brussels 

10. Changes to This Notice 

We may update this Notice to reflect changes in processing, legal requirements or project structure. Material changes are notified to active Portal users by email and shown prominently on the Portal before taking effect. Where a change requires consent, separate consent will be requested. Previous versions are available on request. 

11. Legal References 

  • Regulation (EU) 2016/679 (GDPR) 
  • Belgian Data Protection Act of 30 July 2018 (in particular Articles 10 and 27 for criminal-offence data) 
  • Regulation (EU) 2018/1725 (applicable to ECCC and EU institutions) 
  • Regulation (EU, Euratom) 2024/2509 — Financial Regulation (Article 207 — Financial Support to Third Parties; audit, transparency and record-keeping) 
  • Grant Agreement No. 101249723: Articles 9.4 (FSTP pass-through), 13 (Confidentiality and Security), 15 (Data Protection), 20 (Record-keeping), 25 (Audits and investigations) 
  • AENAON Consortium Agreement, Sections 10 (Confidentiality) and 11 (Privacy and Data Protection) 
  • AENAON Open Call Guidelines, Section 17 (Protection of Confidential Information) 

Info Day: AENAON Project Open Call Round 1

Date: 14 July 2026

Info Day: AENAON Project Open Call Round 1

Date: 14 July 2026

Time: 15.00-16.00 CEST

Online


Discover how the AENAON Open Calls can support your project!

AENAON is an EU-funded project that helps offshore wind operators test and relevant stakeholders and strengthen their cybersecurity in a safe and controlled environment.

Through its Open Calls, the project will fund third-party initiatives that contribute to the validation, uptake and wider deployment of AENAON solutions.

During this webinar, we will introduce the AENAON project and present the first Open Call round, which will be published in early July. This round supports the initial validation, integration and testing of AENAON technologies and services in realistic environments.

We will also provide extra time at the end of the session to answer your questions.

AGENDA

  • 15:00 – 15:05: Welcome & Introduction
  • 15:05 – 15:10: AENAON in a Nutshell
  • 15:10 – 15:40: All About Open Call Round 1
  • 15:40 – 15:55: Q&A
  • 15:55 – 16:00: Closing

Watch Info Day meeting

Info Day – Open call round 1

Alternative questions for Q&A session

1. General information

Open Call 1 supports external organisations in enriching, integrating, testing and initially validating AENAON cybersecurity preparedness capabilities for offshore wind operations and closely related critical-energy infrastructure. Projects should interact with the Federated Digital Twin-based Cyber Range Platform, cyber range training and/or ex-ante cybersecurity preparedness services.

The two rounds are complementary. Open Call 1 focuses on content enrichment, integration, testing and
targeted validation. Open Call 2 will build on the results and lessons learned from the first round and  will focus more strongly on scaling, broader validation and ecosystem-level deployment.

The submission period runs from 1 September to 31 October 2026. Applicants must follow the exact closing time and submission instructions stated in the final Open Call Notice and portal, and are strongly encouraged to submit before the final day

Clarifications of general relevance will be consolidated through the official AENAON Open Call channels.
Applicants will be notified through the official process, and final outcome information is expected to be
published through the AENAON website and the EU Funding & Tenders Portal after the relevant selection
and contracting steps.

2. Scope and eligible activities

Eligible activities must fall within the closed Open Call 1 activity list and be directly relevant to offshore wind cybersecurity. They may include integration of cybersecurity technologies, testing in operationally relevant pilots, digital-twin or SCADA/OT validation, penetration-testing validation, compliance and resilience activities, targeted dissemination connected to the funded action, and collaboration or impact activities.

No. The targets of more than 20 risk scenarios, more than 10 penetration tests and more than five industry stakeholders are collective targets across the relevant funded Open Call projects. Each selected sub-project will receive proportionate targets during contract preparation, based on its scope, scale and complexity

Activities outside the closed list are not eligible. Examples include generic marketing unrelated to project outcomes, unrelated research and development, and capital investments not directly necessary for implementation of the approved sub-project.

No. Applicants may propose a use case based on their own technology, expertise or operational context, provided it is clearly aligned with Open Call 1 and explains how it will use, integrate, test, validate or extend AENAON Open Call FAQ – 3 relevant AENAON capabilities. Detailed access arrangements will be confirmed during technical preparation and onboarding where applicable.

3. Funding and payments

The indicative Open Call 1 envelope is EUR 2.1 million. Support is provided as a lump-sum sub-grant covering
50% of the eligible sub-project budget. The implementation period is eight months.

The ceiling applies to each participating legal entity cumulatively across both AENAON Open Calls, regardless of whether the entity participates as a single applicant, lead applicant or consortium partner. Previous AENAON FSTP awards reduce the amount that may be awarded later.

Applicants must provide the share of the eligible sub-project budget not covered by AENAON support. For
example, an entity requesting EUR 100,000 in AENAON support would normally need an eligible budget of at
least EUR 200,000 and must demonstrate the capacity to provide the remaining share.

Payments follow a 30%-40%-30% model: 30% after signature of the Sub-Grant Agreement and completion of onboarding requirements; 40% after acceptance of the mid-term report, deliverables and milestone evidence; and 30% after acceptance of final reports, outputs, KPI evidence and validation results. Payments depend on accepted results and evidence

AENAON may offer funding limited to the remaining available amount. The applicant may accept and submit a proportionately revised scope, work plan, budget, milestones and deliverables for AENAON approval, or withdraw from contract preparation.

4. Eligibility and consortium rules

Eligible applicants must be legally established in one of the 27 EU Member States, Iceland, Liechtenstein or Norway. Any additional third country is eligible only where it is expressly confirmed as fully associated with the Digital Europe Programme for Specific Objective 3 – Cybersecurity and Trust and is included in the definitive “AENAON Open Call 1 – List of Eligible Countries”. Countries associated only for Specific Objectives 1, 2, 4 or 5 are not eligible.

Every participating legal entity must independently satisfy the country-eligibility requirements. If one consortium member is established in an ineligible country, the entire proposal will be declared ineligible and will not proceed to quality evaluation.

No. They are separate checks. An entity may be established in an eligible country and still be subject to an ownership-and-control assessment. Each participating legal entity must complete Annex 7 and provide supporting information where requested.

Yes. Part A of Annex 6 is completed and signed by the lead applicant. Part B is completed and signed separately by every consortium member, including the lead applicant. Each participating legal entity must also submit its own Annex 5, Annex 7 and Annex 8.

No. Beneficiaries of AENAON Grant Agreement No. 101249723 and their affiliated entities are not eligible for AENAON FSTP funding.

5. Proposal preparation and submission package

The main technical narrative in Annex 3 is limited to 10 A4 pages covering Sections 0-5. The cover page, instruction page, Section 6, Section 7 and separately submitted mandatory annexes are excluded. Pages beyond the permitted limit may be disregarded during evaluation.

The package includes the online application form, Annex 3 – Technical Proposal Template, budget and cofunding information, legal-entity information,  Annex 5 – Declaration of Honour for each participating legal entity, Annex 6 where applicable, Annex 7 for each participating legal entity, Annex 8 for each participating legal entity, Annex 9 – IPR and Background Declaration, and any additional documents required by the final package.

Applicants should not include credentials, detailed vulnerabilities, identifiable infrastructure configurations or other operationally sensitive material unless strictly necessary. Specific sensitive passages should be marked [CONFIDENTIAL] in accordance with the Guidelines. Applicants should identify particular passages or data rather than designating the entire proposal as confidential.

Applicants should complete the official templates and must not remove mandatory declarations, headings or table structures unless the Open Call documentation expressly permits a modification. Names, budgets, roles and requested support must remain consistent across all forms and annexes.

6. Declarations, double funding and IPR

Related, complementary or parallel public funding is not automatically prohibited. Double funding arises where the same activity, cost, personnel effort, milestone, deliverable, result or output is financed or claimed more than once from public sources. Related funding must be fully disclosed and technically, financially and documentarily separated.

Each participating legal entity, including the lead applicant and every consortium partner, must complete and sign Annex 8. The entity must disclose current, pending or planned related public funding and maintain records capable of preventing and detecting duplicate claims.

For a consortium proposal, the lead applicant may submit one consolidated Annex 9 covering all participating legal entities, provided each background item, third-party component and restriction is clearly attributed to the relevant entity. Each entity remains responsible for the accuracy of information relating to its own rights, licences and restrictions.

No. Annex 9 records relevant background, third-party materials, rights and restrictions. It does not transfer ownership or create access rights by itself. Any operational rights required for integration, verification, training or demonstration are governed by the Sub-Grant Agreement.

Applicants and selected recipients must notify AENAON in writing without undue delay of material changes
affecting ownership and control, funding overlap, background, licences, third-party rights or other relevant
declarations before contract signature or during implementation.

7. Evaluation and selection

Proposals are evaluated under Excellence, Impact and Implementation. For Open Call 1 the weights are 30%, 30% and 40%, respectively. Each criterion must score at least 3 out of 5, and the overall weighted score must be at least 3.33 out of 5.

Ties are resolved first by the Implementation score, then Excellence, then Impact. If a tie remains, the Open Call Coordination Committee decides on documented strategic-fit grounds using only information contained in the submitted proposal and assessed under the published criteria.

No. Proposals passing the thresholds are ranked and funded in order within the available budget. Other passing proposals may be placed on a reserve list.

The redress procedure is limited to procedural deficiencies. It does not reopen the technical judgement of evaluators and does not allow new proposal content to be introduced after submission.

8. Contract preparation, implementation and support

Selected applicants complete legal, financial, ownership-and-control and other compliance checks; agree the final scope, milestones, deliverables and acceptance criteria; sign the Sub-Grant Agreement; and complete onboarding.

Selected projects must submit the agreed reports, deliverables, milestones, KPI evidence and supporting
records. Outputs are subject to technical verification and formal acceptance. Corrective action, payment
suspension or reduction, termination and recovery may apply in cases of non-performance or non-compliance.

Yes. Selected projects may receive onboarding, technical guidance, platform or service access support, integration guidance, coordination support and participation in review or capacity-building sessions. Exact support arrangements and access conditions will be confirmed during contract preparation and onboarding.

No. Passing the thresholds means the proposal can be considered in the ranking, but funding is allocated in descending order within the available Open Call 1 budget. Threshold-passing proposals may enter the reserve list if budget is not immediately available.

Registration and participation in the AENAON Open Call Info Day are subject to the AENAON Website Privacy & Cookies Policy, available at: https://aenaon-project.eu/privacy-policy/

Attending this Info Day is a dissemination activity. Registration and participation do not constitute submission of an application to the AENAON Open Call, nor do they create any applicant relationship with the AENAON consortium. If you wish to apply to the Open Call, a separate process and a separate Privacy Notice apply, available at: https://aenaon-project.eu/open-calls/

For this Info Day, ASFALYS SRL may process participants’ personal data, including name, email address, organisation, role or job title, country, registration timestamp, attendance information, online meeting metadata, questions submitted during the session, chat messages, and technical connection data generated by the online event platform. These data are processed for registration, event access, participant communications, online event delivery, Q&A management, technical support, attendance documentation, and follow-up communications relating to the Info Day and the AENAON Open Call.

The data controller for this Info Day is ASFALYS SRL, Esplanade 1, Brussels, 1020, Belgium, acting on behalf of the AENAON Consortium.

ASFALYS SRL relies on WindEurope as processor for the organisation and running of the Info Day, including registration management, participant administration, event communications, online session delivery, Q&A and chat management, technical support, attendance documentation, and follow-up communications relating to the Info Day. WindEurope processes Info Day personal data only for these purposes, strictly under the documented instructions of ASFALYS SRL and subject to an Article 28 GDPR data processing agreement.

The online session will be delivered through Microsoft Teams Events and related Microsoft 365 services, and Microsoft Ireland Operations Ltd may process registration, attendance, participation, account-related and technical data as provider of the online event platform, in accordance with the applicable Microsoft data protection terms and privacy documentation.

The legal bases for processing are Article 6(1)(b) GDPR, for steps necessary to enable registration and participation at the participant’s request; Article 6(1)(f) GDPR, for the legitimate interest of the AENAON consortium in organising, securing and documenting the Info Day and answering participant questions; and, where applicable, Article 6(1)(c) GDPR, for compliance with project reporting, audit and record-keeping obligations under Grant Agreement No. 101249723.

If the session is recorded, participants will be informed before or at the start of the event. Participants who do not wish to appear in the recording may keep their camera and microphone switched off and may submit questions in writing where this option is available.

Registration and attendance data will generally be retained for up to 12 months after the event, unless longer retention is required for project reporting, audit, legal claims, security incident handling, or obligations under the AENAON Grant Agreement. Aggregated or anonymised statistics may be retained for project reporting purposes.

Questions submitted during the Info Day may be used, in anonymised or non-identifiable form, to prepare FAQs or clarifications for the benefit of all potential Open Call applicants.

For privacy questions or to exercise GDPR rights, participants may contact: dpo@aenaon-project.eu. Participants may also lodge a complaint with the Belgian Data Protection Authority (APD/GBA) or with the supervisory authority of their country of residence or place of work.