Civil Law And Airport Security Incident Compensation Claims In Europe

1. Introduction

Airport security incidents can generate several different kinds of civil claims, including:

• passenger compensation after security-related delays or cancellations;
• personal-injury claims caused by inadequate airport security;
• claims following evacuation or security incidents;
• claims arising from security-screening failures;
• property damage;
• psychological or non-material damage where recognised by national law;
• airline and airport economic-loss claims;
• claims against security contractors;
• claims arising from negligent security procedures;
• claims involving security technology, surveillance or access-control systems.

There is no single European civil-liability law for airport security incidents. Liability is constructed from several layers:

1. EU Regulation 261/2004 for passenger compensation and assistance;
2. Montreal Convention for certain passenger injury, baggage and delay damages;
3. national tort/delict and contract law;
4. airport-operator and occupier liability;
5. public-authority liability;
6. aviation-security regulations;
7. consumer-protection law;
8. data-protection law where security screening involves personal data or biometrics.

A particularly important recent development is the 2026 General Court judgment in NI and HZ v European Air Charter AG, T-656/24, which specifically concerned shortcomings in airport security checks and their relationship with passenger compensation under Regulation 261/2004.

2. Meaning of an Airport Security Incident

An airport security incident may include:

Physical security incidents

• unauthorised access to restricted areas;
• assault at an airport;
• terrorist or bomb threat;
• dangerous object entering a secure zone;
• failure of perimeter security;
• inadequate security at an airbridge or terminal.

Screening incidents

• failure to detect prohibited objects;
• defective baggage screening;
• inadequate passenger screening;
• excessive security queues;
• malfunctioning security scanners;
• biometric identification failures.

Digital security incidents

• cybersecurity attack;
• manipulation of access-control systems;
• hacking of security databases;
• false security alerts;
• biometric-system error;
• failure of airport security software.

Operational security incidents

• evacuation;
• closure of an airport;
• security lockdown;
• aircraft security inspection;
• restricted airspace;
• passenger diversion.

The legal consequences differ significantly depending on whether the incident causes delay only, physical injury, death, property damage, or economic loss.

3. Main Legal Framework

A. Regulation 261/2004

Regulation 261/2004 provides standardised compensation and assistance for:

• cancellation;
• long delay;
• denied boarding.

Article 5(3) contains the important “extraordinary circumstances” defence.

Security risks are expressly contemplated by Recital 14, but a security event does not automatically release an airline from compensation. The EU case law requires examination of whether the event was outside the carrier's control and not inherent in its normal activity.

4. Montreal Convention

The Montreal Convention remains important where an airport security incident causes actual compensable damage during international carriage.

It can become relevant to:

• passenger death or bodily injury;
• baggage damage;
• baggage delay;
• passenger delay.

Importantly, Regulation 261/2004 and the Montreal Convention are not necessarily mutually exclusive.

In IATA and ELFAA, C-344/04, the CJEU explained that Regulation 261/2004's standardised assistance measures do not prevent passengers from pursuing additional individual damages under the Montreal Convention where its conditions are satisfied.

5. Case 1 — NI and HZ v European Air Charter AG, T-656/24, EU:T:2026:167

This is currently one of the most directly relevant authorities.

Facts

The case concerned shortcomings in airport security checks that delayed passengers.

The airline had chosen to wait for passengers who had not yet passed through security. The delay then affected the aircraft rotation and subsequent flights.

Legal issue

The General Court had to consider:

• whether shortcomings in airport security checks constitute extraordinary circumstances;
• whether the airline's own decision to wait for passengers affected the causal chain;
• how aircraft rotation should be treated;
• whether subsequent delays were sufficiently connected to the original security problem.

Importance

This case demonstrates that airport security failures and airline compensation liability must be analysed separately from ordinary airport disruption.

A security problem may be extraordinary, but the airline's own operational decisions remain relevant.

Principle

Security failure + extraordinary circumstance + airline's independent operational decision + causal connection must be analysed separately.

The case is particularly useful for airport-security compensation litigation because it directly addresses security-check shortcomings rather than merely general operational disruption.

6. Case 2 — McDonagh v Ryanair, C-12/11

Facts

The case concerned passengers affected by the volcanic eruption in Iceland and the resulting closure of European airspace.

Principle

The CJEU distinguished:

• compensation, and
• assistance/care.

Even where extraordinary circumstances release an airline from standard compensation under Article 7, the obligation to provide care under Regulation 261/2004 can continue.

Security-incident relevance

The same distinction can apply after:

• terrorist threats;
• airport security closures;
• bomb threats;
• security lockdowns.

Thus:

No Article 7 compensation does not necessarily mean no assistance.

Passengers may still have rights to:

• food;
• refreshments;
• accommodation;
• communication;
• rerouting or reimbursement,

depending on the applicable circumstances.

7. Case 3 — Eglītis and Ratnieks v Latvijas Republikas Ekonomikas ministrija, C-294/10

Facts

The case concerned airport operational disruption caused by an extraordinary event.

The CJEU considered the extent of an airline's obligation to take reasonable measures to avoid cancellation or substantial delay.

Principle

The extraordinary-circumstances defence is not automatically sufficient.

An airline must demonstrate that it took measures reasonably capable of avoiding the consequences, without requiring sacrifices disproportionate to its operational capacity.

Airport-security application

Suppose:

Security incident occurs → airport security capacity falls → airline knows of the problem several hours in advance → airline makes no reasonable operational adjustment → flight is cancelled.

The airline may face a more complicated Article 5(3) analysis.

The important question becomes:

What could reasonably have been done after the security incident became known?

8. Case 4 — Germanwings GmbH v Pauels, C-501/17

Facts

A screw lying on an airport runway damaged the aircraft's tyre.

The CJEU treated the foreign object as an extraordinary circumstance because the carrier was not responsible for clearing the runway.

Security significance

The case is useful because it distinguishes:

airport-controlled circumstances

from

events outside the airline's actual control.

If a security object or prohibited item enters a runway or secure operational area because of an airport security failure, the legal analysis may depend on:

• who controlled the relevant security function;
• who was responsible for preventing the event;
• whether the carrier could control it;
• whether reasonable measures were taken.

Principle

The identity of the responsible operational actor can materially affect the Article 5(3) analysis.

9. Case 5 — Siewert v Condor Flugdienst GmbH, C-394/14

Facts

An airport's mobile boarding stairs collided with an aircraft during a previous operation.

The resulting damage caused a later flight delay.

The CJEU held that the collision could not be classified as an extraordinary circumstance exempting the airline from compensation.

Importance

The case shows that airport equipment and airport operations are not automatically “external” to air transport.

Security application

Consider:

Security barrier improperly operated → aircraft damaged → flight delayed.

The airline cannot simply argue:

“It happened at the airport, therefore it was extraordinary.”

The court must examine the nature and origin of the event and the carrier's actual control.

Principle

Airport involvement does not automatically establish an extraordinary circumstance.

10. Case 6 — Finnair v Lassooy, C-22/11

This case concerned denied boarding and the scope of passenger protection under Regulation 261/2004.

The CJEU emphasised the protective purpose of the regulation and examined circumstances in which passengers may be denied carriage.

Airport-security relevance

Security authorities may determine that a passenger:

• cannot enter a secure area;
• cannot board;
• must undergo additional screening;
• must be removed from the aircraft.

But passenger rights must still be analysed according to the relevant statutory framework.

The distinction between:

• denied boarding, and
• cancellation/delay

can materially affect the applicable remedy.

11. Case 7 — Transportes Aéreos Portugueses (TAP) v Moens, C-74/19

Facts

An unruly passenger created a serious safety problem, resulting in a flight diversion.

The CJEU considered whether this constituted an extraordinary circumstance. It held that serious unruly passenger behaviour capable of requiring diversion can fall within extraordinary circumstances, provided the relevant conditions are met.

Airport-security significance

This is directly relevant to airport and aviation security because unruly or dangerous passenger behaviour may trigger:

• security intervention;
• police intervention;
• evacuation;
• diversion;
• airport closure;
• boarding restrictions.

The Court nevertheless required consideration of whether the airline itself contributed to the behaviour or failed to take appropriate measures in light of warning signs.

Principle

A security-related incident can be extraordinary, but the carrier's own contribution remains relevant.

12. Case 8 — Germanwings v Ronny Henning / Wallentin-Hermann line of cases

The CJEU's technical-defect jurisprudence establishes an important general test:

An event is extraordinary only when:

1. it is not inherent in the normal exercise of the carrier's activity; and
2. it is beyond the carrier's actual control.

Both conditions are cumulative.

Security application

This test can be applied to determine whether an airport security event genuinely falls outside the airline's control.

For example:

13. Case 9 — IATA and ELFAA, C-344/04

This is a foundational authority for understanding the relationship between Regulation 261/2004 and the Montreal Convention.

The CJEU confirmed that Regulation 261/2004's standardised assistance measures are not the same as individual damages claims governed by the Montreal Convention.

Importance for airport-security claims

Suppose a security incident causes:

• a 6-hour delay;
• hotel expenses;
• missed onward transportation;
• physical injury.

Different legal mechanisms may apply to different losses.

Principle

Passenger compensation, passenger assistance and individual damages are legally distinct concepts.

14. Case 10 — Pešková and Peška v Travel Service, C-315/15

This case concerned a bird strike and subsequent delay.

The CJEU examined:

• whether the event was extraordinary;
• reasonable measures;
• the consequences of the external event.

Airport-security analogy

A security breach can similarly involve multiple stages:

Security threat

→ airport closure

→ aircraft delay

→ airline operational response

→ passenger delay.

The legal analysis must not simply stop at the first event.

The court may examine whether subsequent losses were caused by:

• the security event itself;
• airline decisions;
• lack of reasonable mitigation;
• aircraft rotation;
• another independent event.

15. Types of Airport Security Compensation Claims

A. Passenger delay/cancellation compensation

Potentially governed by Regulation 261/2004.

The key questions include:

• Was the flight cancelled?
• Was there a qualifying long delay?
• Was the security event extraordinary?
• Was it within the airline's control?
• Could reasonable measures have avoided the delay?

B. Personal injury

Examples:

• passenger assaulted because of inadequate security;
• dangerous object enters terminal;
• failure to respond to a known threat;
• injury during security evacuation;
• injury caused by uncontrolled access.

These claims normally depend heavily on national tort/delict law and, where applicable, the Montreal Convention.

C. Death

A fatal airport security incident can generate claims by:

• dependants;
• estate representatives;
• family members,

subject to the applicable national and international liability regime.

Potential damages may include:

• loss of financial support;
• funeral expenses;
• medical expenses;
• other recognised heads of damage.

16. D. Property Damage

Examples:

• luggage destroyed during a security incident;
• vehicle damaged during an airport evacuation;
• aircraft damaged by an unauthorised object;
• cargo damaged during emergency security procedures.

The applicable regime depends upon:

• ownership;
• location of the property;
• contractual relationship;
• international carriage;
• applicable limitation rules.

17. E. Psychological and Non-Material Damage

Security incidents can produce:

• fear;
• trauma;
• emotional distress;
• psychological injury.

Whether such losses are compensable depends on the applicable legal regime.

The distinction between:

ordinary inconvenience

and

legally recognised psychological injury

is important.

Courts generally require appropriate evidence of the claimed injury where national law requires it.

18. Airport Operator Liability

An airport operator may face civil liability where security arrangements are inadequate.

Potential allegations include:

• inadequate access control;
• insufficient security personnel;
• defective CCTV;
• failure to monitor restricted areas;
• inadequate perimeter protection;
• defective security doors;
• failure to respond to known risks;
• inadequate emergency procedures;
• inadequate warning systems.

The claimant normally must establish the elements required by the applicable national law.

19. Security Contractor Liability

Airports frequently use third-party security companies.

This creates an important legal question:

Who is legally responsible for the security contractor's conduct?

Possible defendants may include:

1. security company;
2. airport operator;
3. airline;
4. public authority;
5. equipment manufacturer.

The contractual allocation of responsibility does not necessarily determine liability toward third parties.

A claimant's rights may arise independently under tort/delict or statutory law.

20. Security Technology Liability

Modern airport security increasingly uses:

• facial recognition;
• biometric gates;
• AI screening;
• explosive-detection systems;
• automated baggage scanners;
• access-control software;
• cybersecurity systems.

A failure can therefore be both:

physical security failure

and

technology/product failure.

For example:

Biometric system incorrectly identifies an unauthorised person as authorised → restricted area entered → passenger injury.

Possible claims could involve:

• airport operator negligence;
• software/product liability;
• manufacturer liability;
• data-protection issues;
• contractual liability.

21. AI and Automated Security Screening

AI-based airport security introduces additional questions.

Suppose AI produces:

“Passenger cleared.”

But the passenger is carrying a prohibited object.

The legal investigation may examine:

• accuracy of the AI system;
• training and validation;
• known error rates;
• human supervision;
• warning mechanisms;
• maintenance;
• software updates;
• sensor quality;
• operator training.

The mere fact that AI produced the wrong result does not automatically establish liability.

The claimant must connect the technological failure to the relevant legal duty and damage.

22. Cybersecurity Incidents

A cyberattack may cause:

• airport closure;
• security-system shutdown;
• baggage disruption;
• access-control failure;
• flight cancellation;
• passenger evacuation.

The legal analysis can involve:

Contract law

Whether cybersecurity obligations were contractually promised.

Tort/delict

Whether reasonable security precautions were required.

Product liability

Whether defective software caused physical damage.

Data protection

Whether personal data were unlawfully compromised.

Aviation regulation

Whether statutory security obligations were breached.

23. Causation

Causation is particularly difficult in airport-security litigation.

Example:

Security-screening failure
↓
Passenger enters restricted area
↓
Security lockdown
↓
Flight cancellation
↓
Passenger misses business meeting
↓
Claims €20,000 lost profits

The court must determine whether each claimed loss is legally connected to the original security failure.

Not every consequence of an airport security incident is automatically recoverable.

24. Foreseeability

Foreseeability is often important in national civil-law systems.

The court may ask:

Was this type of damage a reasonably foreseeable consequence of the defendant's conduct?

For example:

Clearly foreseeable

Failure of airport access control → unauthorised access → security lockdown.

More remote

Failure of access control → lockdown → passenger misses meeting → business opportunity lost → future commercial loss.

The further the claimed loss is from the original event, the more difficult causation and recoverability may become.

25. Security Incident and “Extraordinary Circumstances”

This is one of the most important examination points.

Under Article 5(3) Regulation 261/2004:

An airline is not automatically liable for standard compensation merely because a security incident occurred.

But equally:

A security incident is not automatically an extraordinary circumstance merely because it is described as a “security” event.

The CJEU requires a case-specific analysis of:

1. nature;
2. origin;
3. control;
4. foreseeability;
5. reasonable measures;
6. causation.

The Commission's interpretive guidance likewise states that events listed in Recital 14—including security risks—require case-by-case assessment.

26. Compensation vs Assistance

This distinction is essential.

27. Evidence Required

Airport-security litigation is heavily evidence-dependent.

Important evidence includes:

Security records

• CCTV;
• access logs;
• screening records;
• security reports;
• incident reports;
• police records.

Airport records

• staffing levels;
• security procedures;
• risk assessments;
• emergency plans;
• training records.

Technology records

• scanner logs;
• biometric records;
• software logs;
• system alerts;
• cybersecurity records;
• maintenance records.

Passenger evidence

• boarding passes;
• receipts;
• medical records;
• witness statements;
• photographs;
• communications with airline.

28. Potential Defendants

29. Defences

Common defences include:

1. Extraordinary circumstance

The event was outside the carrier's control.

2. No breach

The defendant complied with the required security standard.

3. No causation

The incident did not cause the claimed damage.

4. Contributory negligence

The claimant contributed to the damage.

5. Third-party act

The incident resulted exclusively from an independent third party.

6. Unforeseeability

The event could not reasonably have been anticipated or prevented.

7. Limitation of liability

International aviation conventions may restrict certain claims.

8. Insufficient proof

The claimant cannot establish the required elements of the claim.

30. Special Importance of the 2026 Security-Check Case

NI and HZ v European Air Charter, T-656/24 deserves particular attention because it is directly concerned with airport security-check shortcomings rather than merely an ordinary aircraft malfunction.

The case demonstrates three important points:

First

Airport security problems can affect the application of Article 5(3).

Second

The airline's own operational decision can affect causation.

Third

Aircraft rotation means that a security incident affecting one flight can create subsequent delays, but those subsequent consequences must still be legally connected to the original event.

31. Case-Law Comparison

32. Important Legal Formula

For a passenger compensation claim:

Security incident → cancellation/qualifying delay → Article 5/7 analysis → extraordinary circumstance? → reasonable measures → causation → compensation/assistance.

For a personal-injury claim:

Security failure → breach of duty → causation → bodily/psychological injury → recoverable damage.

For a technology-related claim:

Defective security technology → legally relevant defect/breach → causal connection → physical/economic damage → responsible actor.

33. Exam-Style Conclusion

Airport security incident compensation claims in Europe operate through a multi-layered legal framework rather than a single civil-liability rule. Regulation 261/2004 is particularly important for passenger compensation following security-related cancellations and delays, while the Montreal Convention and national civil law may provide separate routes for actual injury, baggage, property and other recognised losses.

The CJEU's jurisprudence establishes that security risks are not automatically sufficient to remove passenger compensation rights. The nature and origin of the event, the airline's control, reasonable measures and causal connection must be examined. The 2026 NI and HZ v European Air Charter case is particularly significant because it specifically addresses shortcomings in airport security checks and the consequences of an airline's own decision-making and aircraft rotation.

The central principle can therefore be stated as:

Airport security incident + legally relevant breach or extraordinary event + causation + recognised damage = potential compensation, subject to the applicable EU, international and national liability regime.

Most importantly, passenger compensation for delay/cancellation should not be confused with ordinary civil damages for personal injury, property damage or economic loss. Each category may be governed by a different legal regime.