1. The Authority shall adopt its own security rules equivalent to the Commission's security rules for protecting European Union Classified Information (EUCI) and sensitive non-classified information, as set out in Commission Decision (EU, Euratom) 2015/443 [Commission Decision (EU, Euratom) 2015/443 of 13 March 2015 on Security in the Commission (OJ L 72, 17.3.2015, p. 41).] and Decision (EU, Euratom) 2015/444. The security rules of the Authority shall cover, inter alia, provisions for the exchange, processing and storage of such information. The Executive Board shall adopt the Authority's security rules following approval by the Commission.
2. Any administrative arrangement on the exchange of classified information with the relevant authorities of a third country or, in the absence of such arrangement, any exceptional ad hoc release of EUCI to those authorities, shall be subject to the Commission's prior approval.