EU Marking - RESTREINT UE/EU RESTRICTED (EUCI ladder)

Detects European Union Classified Information (EUCI) protective markings as defined in Article 2(2) of Council Decision 2013/488/EU: the four bilingual French/English classification levels rendered together as a single marking — RESTREINT UE/EU RESTRICTED, CONFIDENTIEL UE/EU CONFIDENTIAL, SECRET UE/EU SECRET and TRÈS SECRET UE/EU TOP SECRET (the slash carries no surrounding spaces and TRÈS carries a grave accent, per the primary source). Named historically for RESTREINT but scopes the full EUCI ladder. The single-language French components (RESTREINT UE, CONFIDENTIEL UE, SECRET UE, TRÈS SECRET UE) are matched at a lower tier. Marking syntax verified directly against the Council Decision text; matched case-sensitively.

Type: regex
Engine: boost_regex
Confidence: high
Confidence justification: High confidence on the dual French/English forms: "RESTREINT UE/EU RESTRICTED" and its ladder are structurally unmistakable — the bilingual "<FR-LEVEL> UE/EU <EN-LEVEL>" construction with the no-space slash appears nowhere in natural language and is verified verbatim against Council Decision 2013/488/EU. The single-language French components (75) carry the distinctive trailing "UE" EU marker and are the exact French halves of the verified markings, so they too have negligible natural-language collision. The English-only halves (EU RESTRICTED, EU CONFIDENTIAL, EU SECRET, EU TOP SECRET) are deliberately not matched as a standalone tier, to avoid the higher false-positive surface of an "EU " prefix on common English classification words — documented below.
Jurisdictions: eu
Regulations: Council Decision 2013/488/EU
Frameworks: EUCI
Data categories: government, security-classification
Scope: narrow
Risk rating: 10
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Unsupported

Pattern

\bRESTREINT[\s-]+UE/EU[\s-]+RESTRICTED\b|\bCONFIDENTIEL[\s-]+UE/EU[\s-]+CONFIDENTIAL\b|\bSECRET[\s-]+UE/EU[\s-]+SECRET\b|\b(?:TRÈS|TRES)[\s-]+SECRET[\s-]+UE/EU[\s-]+TOP[\s-]+SECRET\b

Corroborative evidence keywords

European Union, EUCI, Council of the European Union, Union Européenne, classified information

Proximity: 300 characters

Should match

This document is marked RESTREINT UE/EU RESTRICTED and must be stored in an Administrative Area. — Canonical lowest EUCI level, dual French/English form, verified verbatim against Council Decision 2013/488/EU Article 2(2)
Cover page: SECRET UE/EU SECRET — handling per the Council security rules. — SECRET-level dual marking
The annex is classified TRÈS SECRET UE/EU TOP SECRET (grave accent on TRÈS per the source). — Highest EUCI level, dual marking with the grave-accented TRÈS
Header reads CONFIDENTIEL UE/EU CONFIDENTIAL for the working-party papers. — PDF line-wrap between the French and English halves (the [\s-]+ separator tolerates a wrap-inserted newline)
Le dossier porte la mention CONFIDENTIEL UE dans l'en-tête. — Single-language French component (CONFIDENTIEL UE) — the French half of the verified dual marking

Should not match

the document is restreint ue/eu restricted according to the summary note — lowercase prose (case-sensitive exclusion — the marking regex only matches the ALL-CAPS bilingual token)
THE EUROPEAN UNION (EU) RESTRICTED PUBLIC ACCESS TO THE ARCHIVE DURING THE REVIEW — ALL-CAPS prose with "EU RESTRICTED" but no "UE/EU" bilingual construction — fails at the regex level (the dual marking requires the contiguous UE/EU token)
THIS IS A SECRET AND CONFIDENTIAL BUSINESS PLAN FOR OUR EU EXPANSION — ALL-CAPS prose containing SECRET, CONFIDENTIAL and EU but not the EUCI bilingual marking — fails at the regex level

Known false positives

ALL-CAPS prose (headings, legal boilerplate, or fully-capitalised documents) can defeat the case-sensitivity signal, but only if it reproduces the exact bilingual "<FR-LEVEL> UE/EU <EN-LEVEL>" (or the French "<FR-LEVEL> UE") construction — which is itself the marking, so residual collision is very low. Mitigation: The dual-form tier (85) is structurally near-unique; treat single-language French-component hits (75) as lower confidence in all-caps context. Corroborative EU/EUCI keywords within 300 characters reinforce genuine marking context.
The single-language ENGLISH halves (EU RESTRICTED, EU CONFIDENTIAL, EU SECRET, EU TOP SECRET) are real components of the verified markings but are not shipped as a standalone tier: an "EU " prefix on common English classification words (especially EU RESTRICTED / EU SECRET) carries a materially higher false-positive surface than the French components, whose classification words (RESTREINT, CONFIDENTIEL) do not occur in ordinary English text. Mitigation: Documented as a deliberate scoping decision rather than shipped. The English halves are still detected whenever they appear as part of the canonical dual marking (tier 85).
This SIT's SECRET / CONFIDENTIAL / TOP SECRET vocabulary overlaps with the US/UK/NZ/AU marking families, but the mandatory UE/EU bilingual construction (85) and the trailing UE marker (75) mean a genuine EUCI marking is structurally distinct from those nations' bare-word tiers; a document carrying both an EUCI marking and a national marking is expected to fire both SITs as corroborating signals. Mitigation: No mitigation needed — the bilingual/UE structure makes the EUCI forms distinct from national bare-word markings.