EU-LISA Sued IBM, Atos and Leonardo Over the Border System That Made Travellers Miss Flights

The European Union's border technology agency has been suing the companies that built its flagship biometric border system since December 2025, and the case became public only this week, through a line in the agency's annual accounts.

EU-LISA filed a claim on 22 December 2025 with a court in Estonia, where the agency is headquartered, against IBM, the French IT company Atos and the Italian defence contractor Leonardo. The three form the consortium contracted to implement and maintain the Entry/Exit System, which replaced passport stamping for non-EU travellers when it launched in October 2025.

The annual accounts state that, "following the various delays in the delivery of the EES by a contracting consortium the agency activated the available contractual and legal remedies to protect its financial interest". The Financial Times first reported the lawsuit; the Guardian confirmed the details.

What the system is, and what went wrong

EES records the entry and exit of third-country nationals crossing into the Schengen area, which covers 25 of the 27 EU member states plus Iceland, Liechtenstein, Norway and Switzerland. Travellers have their faces photographed and fingerprints scanned before being admitted. The checks apply to anyone who is not a citizen of one of the 29 Schengen countries, Ireland or Cyprus.

The rollout since October 2025 has been characterised by malfunctioning kiosks, regular system outages and waiting times of up to three hours at peak periods. Some passengers have missed flights. Airports have complained publicly and repeatedly, and the complaints have been specific: not that the checks take time, but that the equipment performing them fails.

The agency's carefully worded defence

EU-LISA declined to discuss the substance of the case but drew a distinction that will matter to anyone trying to work out liability. The proceedings concern "the system's development phase and have no impact on its current operation", the agency said, adding that "EES is fully operational".

The Commission made the same distinction, saying it is not a party to the case and noting that the claim relates to "delays in the delivery of the EES at the time of system development" and is "not related to the operation of the EES".

Read together, those statements describe a project that was delivered late and is now working. That is a defensible position in a procurement dispute. It is a less complete answer to an airport operator whose kiosks were down during the summer peak, because a system can be operational in the contractual sense and still be producing the queues that generated the political pressure.

The procurement question underneath

The consortium structure is the part of this story that generalises. Large EU IT systems are typically built by a small number of integrators working under multi-year framework contracts, with the agency as client and the Commission as political owner. When delivery slips, the agency's remedies are contractual: liquidated damages, milestone withholdings, and in the last resort litigation. None of those recover the operational cost of a delayed launch, which falls on member states, airports and travellers.

The decision to file in an Estonian court rather than announce a dispute is also consistent with how these contracts are managed: quietly, because the agency and the contractor usually have to keep working together through the maintenance phase. EU-LISA and the consortium are still in a relationship. The system is still running on their software.

What is not being said

None of the three companies has given a substantive response. Atos declined to comment. The Guardian contacted IBM and Leonardo. Neither the size of the claim nor the specific breaches alleged have been disclosed.

The Commission's position that the case is a development-phase matter and not an operational one is the line to test in the coming months. If the litigation ends in a settlement, the amount will tell us how the delay was valued. If it goes to judgment, the court record will contain the delivery milestones, the acceptance criteria and the correspondence about them, which is the closest thing to an audit of the project that is likely to become public.

In the meantime, the practical position for a traveller is unchanged. The kiosks are there, the fingerprints are required, and the queue at a large airport in peak season is the number that matters.