ISO Compliance Insights & Best Practices

Authorised Economic Operator: A Clear Guide to the 4 Tests

Authorised Economic Operator status is what a customs authority gives a business it has decided to trust. It is the closest thing international trade has to a security certification with real operational value — fewer physical inspections, priority treatment, and recognition at partner borders — and it is assessed against four tests that most applicants underestimate.

This guide covers the two authorisation types, the four criteria, what an audit actually examines, and how AEO sits against ISO 28000.

Authorised Economic Operator: the two authorisation types and four criteria — Four cumulative tests — and the fifth applies only to the security authorisation.

Two types of Authorised Economic Operator authorisation

Under the Union Customs Code, status is granted as an authorisation rather than a certificate, and there are two:

AEOC — customs simplifications. Access to simplified procedures, fewer administrative requirements, easier authorisation for other customs facilitations.
AEOS — security and safety. Facilitations tied to entry and exit summary declarations, lower risk scores, priority treatment, and the benefit of mutual recognition arrangements with partner countries.

They can be held together, and many traders do. The distinction matters commercially: the security-and-safety criterion is not assessed for AEOC, so an AEOC holder does not get the security-related benefits — including the mutual recognition that speeds goods through third-country borders.

What the status is worth

Benefit	What it means in practice
Lower risk score	Fewer documentary and physical controls selected by the risk system
Priority treatment	If a control is selected, it is carried out first, and can be moved elsewhere
Simplifications	Easier access to procedures such as self-assessment and centralised clearance
Mutual recognition	Equivalent treatment under arrangements with partner programmes
Commercial signal	Recognition as a secure and compliant partner, increasingly a tender requirement

The four Authorised Economic Operator criteria

Compliance record. No serious or repeated infringements of customs and tax legislation, and no record of serious criminal offences relating to the economic activity, over the preceding three years. This covers the company, the people running it and the person responsible for customs matters.
Records management. A commercial and transport record system that lets customs audit you: traceability of goods flows, stock accounting, an audit trail from order to declaration, archiving, and internal controls that catch errors.
Financial solvency. A sound financial position over the last three years, sufficient to meet obligations — no insolvency proceedings, no significant arrears.
Practical standards of competence or professional qualifications. Demonstrated experience in customs matters or a recognised qualification, held by the applicant or by the person handling customs. For AEOC this is a formal test in its own right.

For AEOS a fifth applies: appropriate security and safety standards across premises, cargo, business partners, personnel security and security awareness. That is the criterion where a management system pays for itself.

What the audit actually examines

An Authorised Economic Operator audit is a visit. They test the records claim by tracing real consignments end to end, they look at physical security — fencing, access control, CCTV, sealing, loading areas — and they read your procedures for handling incoming goods, checking business partners and vetting staff in sensitive roles. The self-assessment questionnaire you complete first is the map they audit against, which is why an honest one produces a shorter visit than an optimistic one.

Authorised Economic Operator status and ISO 28000

Authorised Economic Operator status and ISO 28000 are not the same thing, and they support each other well. ISO 28000 is a management system standard for security in the supply chain — certifiable, international, and organized around risk assessment, controls and continual improvement. AEO is a customs authorisation granted by an authority against its own criteria, with legal facilitations attached.

An operating ISO 28000 system covers a large part of the AEOS security criterion: security risk assessment, premises and cargo controls, personnel security, partner requirements and incident handling all map across. It does not cover the customs-specific criteria — compliance record, records management, solvency and customs competence — which are where AEOC applicants spend their time. Our guide to ISO 28000:2022 covers the standard, and the two supply chain assurance routes covers where each one applies.

Where applications go wrong

Records that cannot be traced end to end. The single most common failure. If a customs officer cannot follow a consignment from purchase order to declaration to payment in your systems, the criterion is not met.

Business partners unassessed. Security is a chain property. An applicant with excellent premises and no requirements imposed on hauliers or warehouse providers has secured one link.

Customs knowledge in one person’s head. The competence criterion is about the organization, and a single unbacked specialist is a risk the authority will name.

Treating it as a one-off. Status is monitored and can be suspended or revoked. Changes to premises, ownership, systems or the person responsible for customs have to be notified, and re-assessment follows material change.

Frequently asked questions

What is an Authorised Economic Operator?
A trader authorised by its customs authority as reliable and secure, granted either customs simplifications (AEOC), security and safety facilitations (AEOS), or both.

How long does authorisation take?
Months rather than weeks. The authority has defined periods to accept and decide the application, and the preparation — records, procedures, physical security — is usually the longer part.

Is it recognised outside the EU?
Through mutual recognition arrangements with partner programmes, including the US C-TPAT and several Asian schemes. The benefits available depend on the specific arrangement.

Do we need ISO 28000 as well?
No. It is not a prerequisite, and it is a substantial head start on the AEOS security criterion — as well as covering suppliers and sites that fall outside the customs authorisation.

Can status be withdrawn?
Yes. It is monitored continuously, and serious infringements, loss of solvency or unnotified material change can lead to suspension or revocation.

Where this leaves you

Decide first whether you need AEOC, AEOS or both, because the security criterion is the expensive one and it only applies to AEOS. Then prove the records criterion to yourself before applying: pick three real consignments and trace them end to end through your own systems. Extend security requirements to the partners who handle your goods, spread customs competence beyond one person, and treat the authorisation as a standing obligation — Authorised Economic Operator status is monitored, and the notification duty does not lapse once the certificate arrives.

References

European Commission — AEO programme — the authorisation types, criteria and benefits.
WCO SAFE Framework of Standards — the international framework AEO programmes are built on.