Ü2 security clearance. What shipyards and contractors need to know.

An Ü2 is the extended security clearance under the Sicherheitsüberprüfungsgesetz (Security Clearance Check Act). At shipyards building naval vessels, the client often requires it for everyone working on board or in sensitive areas, including the staff of external contractors. For buyers and project managers, three things matter most: which type of Ü2 is meant, who submits the application and how much time passes before the first deployment.

01What is an Ü2, and which type does the shipyard need?

The Ü2 is the middle of three levels of security clearance. At a shipyard building naval vessels, it is usually about sabotage protection, not access to classified information.

The law provides for three levels¹:

The difference between protection of classified information (Geheimschutz) and sabotage protection (Sabotageschutz) is important. Protection of classified information concerns access to classified information. Sabotage protection concerns work in a security-sensitive position in a defence-critical facility or in a military security area of the Bundeswehr (German Armed Forces)¹. Shipyards building naval vessels are expressly named: parts of companies that directly serve the construction, maintenance or repair of naval vessels count as defence-critical³. Whether a particular business is covered is nevertheless decided case by case¹⁰.

In practice this means: a sabotage protection Ü2 does not entitle the holder to access classified information. Conversely, an Ü2 issued for the protection of classified information is recognised in sabotage protection and in military security areas⁷. So always ask which type of Ü2 an employee holds.

02Who submits the application?

The application is not made by the employee, nor by the company on its own initiative. In sabotage protection, the employer's sabotage protection officer applies for the clearance to the Federal Ministry for Economic Affairs and Energy (BMWE)^1,4.

To do this, an external contractor first registers with the BMWE. It needs an extract from its contract with the shipyard or a confirmation from the shipyard. According to the BMWE, registration usually takes about a week, after which the company receives a five-digit company number⁴. A company number from the protection of classified information is not valid here.

The sabotage protection officer must not be involved in personnel decisions. The managing director, the works council or the data protection officer are therefore usually ruled out⁴.

There is a second option: the shipyard submits the application for the contractor staff. This is only possible with the approval of the BMWE and with an agreement between shipyard and employer that covers, for example, access to personnel records and reporting obligations⁵.

In a military security area, such as a naval arsenal (Marinearsenal), the Bundeswehr carries out the check itself. The point of contact is the security officer of the site⁴. The Marinearsenal's operating rules for contractors require a completed sabotage protection Ü2 for work on board⁹.

03When can you apply for the Ü2?

Only after contract award. According to the BMWE, checks intended only to improve a company's chances in a tender are expressly not permitted⁴. As a rule, tenders may only require a willingness to apply for checks after contract award¹⁰.

For planning, this means: the time between contract award and start of work is the time available for the Ü2. Anyone who only thinks about the check shortly before the start has a scheduling problem.

04What does the employee have to declare?

The employee completes a security declaration. Among other things, it asks for names, nationalities, places of residence, employers and periods of education and training, household members and parents, insolvencies and enforcement proceedings in the last five years, pending criminal proceedings, contacts with intelligence services or extremist groups, ties to states with particular security risks, and previous checks¹.

Since the 2026 amendment, the employee's own websites, social media accounts with user names and a photograph have been added². In addition, the spouse or partner is now included in the sabotage protection Ü2 and must co-sign the declaration⁶.

The checks cover information from registers, the police and intelligence services, plus an internet search. For the Ü2, enquiries to the police at the places of residence of the last five years and an identity check are added¹. For anyone who has lived abroad for more than six months at a stretch, foreign authorities are consulted. If the review period cannot be covered, the procedure is discontinued¹.

In the end, the company only learns whether the employee may be deployed. It is not told the reasons¹. The check itself is free of charge⁷.

05How long does an Ü2 take?

The official guide values are three to six months. With periods abroad, or if security-relevant issues come up, it can take considerably longer⁷.

Several figures were cited at the Bundestag hearing in November 2025⁸:

The 4.7 weeks quoted by the Verfassungsschutz are not the total duration. They only measure this authority's share. For planning, the ministries' three to six months is the better figure.

There is a rule for bridging the gap: persons who have not been checked may work for up to eight weeks if they are constantly accompanied by a person who has been checked. Before 2026, the limit was four weeks. The facility's sabotage protection officer decides on this^1,6.

Since 2026, a further rule applies: staff may only be deployed after clearance. Anyone who still lets unchecked persons work and does not withdraw them risks a fine of up to €10,000^1,2.

06How long is an Ü2 valid?

The law sets no fixed expiry date. The security declaration is usually updated after five years, and a repeat check usually takes place after ten years¹. In sabotage protection, the BMWE has required a full repeat check at every scheduled round since 2026⁶.

When an employee moves to a new project, a new check can be dispensed with if a check of the same or a higher level was completed less than five years ago¹. There is no entitlement to this. If the employee changes employer, the security file does not automatically go with them¹.

07What are the most common mistakes?

Most problems arise from wrong assumptions, not from the procedure itself:

• “An Ü2 is an Ü2.” A sabotage protection Ü2 does not entitle the holder to access classified information.
• “The employee applies for the Ü2 themselves.” That is not possible. The application is made by the employer through its sabotage protection officer or, with approval, by the shipyard.
• “We apply before the tender.” That is not permitted.
• “The Verfassungsschutz only needs five weeks.” That is only one part of the processing, not the total duration.
• The partner is forgotten. Since 2026, the partner has to take part in the sabotage protection Ü2.
• The managing director becomes sabotage protection officer. That is usually ruled out.

08What does this mean for your project?

Plan the checks from contract award and ask your service provider about three things early on: which type of Ü2 its people hold, when it was completed and through whom it was applied for.

At Electronautics, more than 100 employees hold a completed extended security clearance (Ü2). Before the start, we clarify with you which positions in the project require an Ü2 and which employees are suitable for them. We send staff who are cleared for the project, with site managers who run the work on site.

In short: the Ü2 can be planned if you start early. The type of check, the right applicant and three to six months' lead time are the three points where projects otherwise get stuck. If you are planning a naval project, talk to us before the staffing plan is fixed.