COMMISSION IMPLEMENTING REGULATION (EU) 2022/1409

of 18 August 2022

concerning the detailed rules on the conditions for the operation of the web service and data protection and security rules applicable to the web service, as well as measures for the development and technical implementation of the web service and repealing Implementing Regulation (EU) 2021/1224

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2017/2226 of the European Parliament and of the Council of 30 November 2017 establishing an Entry/Exit System (EES) to register entry and exit data and refusal of entry data of third-country nationals crossing the external borders of the Member States and determining the conditions for access to the EES for law enforcement purposes, and amending the Convention implementing the Schengen Agreement and Regulations (EC) No 767/2008 and (EU) No 1077/2011 (1), and in particular Article 13(7), Article 13a and Article 36, first paragraph, point (h), thereof,

Having regard to Regulation (EC) No 767/2008 of the European Parliament and of the Council of 9 July 2008 concerning the Visa Information System (VIS) and the exchange of information between Member States on short-stay visas, long-stay visas and residence permits (VIS Regulation) (2), and in particular Article 45c(3), fourth subparagraph, Article 45c(5), second paragraph and Article 45d(3), thereof,

Whereas:

(1) Regulation (EU) 2017/2226 establishes the Entry/Exit System, for the electronic recording and storage of the date, time and place of entry and exit of third-country nationals admitted or refused for a short stay in the territory of the Member States and calculates the duration of their authorised stay.

(2) Regulation (EC) No 767/2008 establishes the Visa Information System for the exchange of data between Member States on applications for short-stay visas, long-stay visas and residence permits, and on the decision taken to annul, revoke or extend the visa.

(3) The European Agency for the operational management of large-scale IT systems in the area of freedom, security and justice, established by Regulation (EU) No 1077/2011 of the European Parliament and of the Council (3) (eu-LISA) is responsible for the development of the Entry/Exit System, and the operational management of the Entry/Exit System and the Visa Information System.

(4) Commission Implementing Regulation (EU) 2021/1224 (4) laid down specifications and conditions for the operation of the web service provided for in Article 13 of Regulation (EU) 2017/2226, including specific provisions for data protection and security. Those specifications and conditions also take into account visa-exempt travellers within the meaning of Article 45(2) of Regulation (EU) 2018/1240 of the European Parliament and of the Council (5). Those specifications and conditions should be adapted by taking into account third-country nationals that require a short-stay visa, a long-stay visa or a residence permit within the meaning of Article 45c of Regulation (EC) No 767/2008. In the interests of clarity, that Regulation shall be replaced.

(5) Article 13(3) of Regulation (EU) 2017/2226 requires carriers to use the web service to verify whether third-country nationals holding a short-stay visa issued for one or two entries have already used the number of entries authorised by their visa.

(6) Article 45c(1) and (2) of Regulation (EC) No 767/2008 requires air carriers, sea carriers and international carriers transporting groups overland by coach to use the carrier gateway to verify whether third-country nationals subject to a short-stay visa, airport transit visa or who are required to hold a long-stay visa or a residence permit are in possession of a valid short-stay visa, an airport transit visa, a long-stay visa or a residence permit.

(7) In order to enable carriers to verify whether the third-country national subject to a visa requirement or who is required to hold an airport transit visa, a long-stay visa or a residence permit, is in possession of a valid visa or residence permit, they should have access to the web service. Carriers should access the web service through an authentication scheme and be able to dispatch and receive messages in a format to be determined by eu-LISA.

(8) Technical rules on the message format and authentication scheme should be laid down in order to enable carriers to connect and use the web service to be specified in the technical guidelines, which are part of the technical specifications referred to in Article 37(1) of Regulation (EU) 2017/2226, to be adopted by eu-LISA.

(9) Carriers should be able to indicate that the passengers fall outside the scope of the Regulation (EU) 2017/2226 and Regulation (EC) No 767/2008 and in such case carriers should receive an automatic ‘Not applicable’ reply from the web service, without querying the read-only database and without logging.

(10) The Commission, eu-LISA and the Member States should endeavour to inform all known carriers of how and when they can register. Upon successful completion of the registration procedure as well as, where relevant, the successful completion of testing, eu-LISA should connect the carrier to the carrier interface.

(11) Authenticated carriers should only give access to the web service to duly authorised staff.

(12) This Regulation should provide for data protection and security rules applicable to the authentication scheme.

(13) In order to ensure that the verification query is based on information, which is as up-to-date as possible, queries should be introduced at the earliest 48 hours prior to the scheduled time of departure.

(14) This Regulation should apply to air carriers, sea carriers and international carriers transporting groups overland by coach, coming into the territory of the Member States. Border checks for entry into the territory of the Member States may precede boarding. In such cases, carriers should be relieved of the obligation to verify the travel authorisation status of travellers.

(15) Carriers should have access to a web form on a public website allowing them to request assistance. When requesting assistance carriers should receive an acknowledgement of receipt containing a ticket number. eu-LISA or the ETIAS Central Unit may contact carriers that have received a ticket by any means necessary, including by phone, in order to provide an adequate response. It is necessary to adopt further detailed rules for this assistance to be provided by the ETIAS Central Unit as provided for in Article 13a of Regulation (EU) 2017/2226.

(16) Given that Regulation (EU) 2017/2226 and Regulation (EU) 2021/1134 of the European Parliament and of the Council (6) build upon the Schengen

acquis

, Denmark, in accordance with Article 4 of Protocol No 22 on the Position of Denmark, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, Denmark notified the implementation of Regulation (EU) 2021/1134 in its national law. It is therefore, bound by this Regulation.

(17) This Regulation constitutes a development of the provisions of the Schengen

acquis

in which Ireland does not take part (7). Ireland is therefore not taking part in the adoption of this Regulation and is not bound by it or subject to its application.

(18) As regards Iceland and Norway, this Regulation constitutes a development of the provisions of the Schengen

acquis

within the meaning of the Agreement concluded by the Council of the European Union and the Republic of Iceland and the Kingdom of Norway concerning the association of those two States with the implementation, application and development of the Schengen

acquis

(8), which fall within the area referred to in Article 1, points A and B of Council Decision 1999/437/EC (9).

(19) As regards Switzerland, this Regulation constitutes a development of the provisions of the Schengen

acquis

within the meaning of the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation’s association with the implementation, application and development of the Schengen

acquis

(10), which fall within the area referred to in Article 1, points A and B of Decision 1999/437/EC, read in conjunction with Article 3 of Council Decision 2008/146/EC (11).

(20) As regards Liechtenstein, this Regulation constitutes a development of the provisions of the Schengen

acquis

within the meaning of the Protocol between the European Union, the European Community, the Swiss Confederation and the Principality of Liechtenstein on the accession of the Principality of Liechtenstein to the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation’s association with the implementation, application and development of the Schengen

acquis

(12) which fall within the area referred to in Article 1, points A and B of Decision 1999/437/EC read in conjunction with Article 3 of Council Decision 2011/350/EU (13).

(21) As regards Bulgaria and Romania, in relation to the provisions under this act concerning Regulation (EU) 2017/2226, the provisions of the Schengen

acquis

relating to the Schengen Information System have been put into effect by Council Decision (EU) 2018/934 (14); the provisions of the Schengen

acquis

relating to the Visa Information System have been put into effect by Council Decision (EU) 2017/1908 (15), all the conditions for the operation of the Entry/Exit System set out in Article 66(2), point (b), of Regulation (EU) 2017/2226 are met and those Member States should therefore operate the Entry/Exit System from the start of operations as decided in accordance with Article 66(1) of Regulation (EU) 2017/2226. The provisions under this act concerning Regulation (EC) No 767/2008, constitute an act building upon, or otherwise relating to, the Schengen

acquis

within the meaning of Article 4(2) of the 2005 Act of Accession.

(22) As regards Cyprus and Croatia, in relation to the provisions under this act concerning Regulation (EU) 2017/2226, the operation of the Entry/Exit System requires the granting of passive access to the Visa Information System and the putting into effect of all the provisions of the Schengen

acquis

relating to the Schengen Information System in accordance with the relevant Council Decisions. Those conditions can only be met once the verification in accordance with the applicable Schengen evaluation procedure has been successfully completed. Therefore, the Entry/Exit System should be operated only by those Member States which fulfil those conditions at the start of the operation of the Entry/Exit System. Member States not operating the Entry/Exit System from the start of operations should be connected to the Entry/Exit System, in accordance with the procedure set out in Regulation (EU) 2017/2226, as soon as all of those conditions are met.

(23) As regards Cyprus, the provisions under this Regulation concerning Regulation (EC) No 767/2008, constitutes an act building upon, or otherwise relating to, the Schengen

acquis

, within the meaning of Article 3(2) of the 2003 Act of Accession.

(24) As regards Croatia, the provisions under this Regulation concerning Regulation (EC) No 767/2008, constitutes an act building upon, or otherwise relating to, the Schengen

acquis

within the meaning of Article 4(2) of the 2011 Act of Accession.

(25) The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 of the European Parliament and of the Council (16) and delivered an opinion on 22 March 2022.

(26) The measures provided for in this Regulation are in accordance with the opinion of the Smart Borders Committee,

HAS ADOPTED THIS REGULATION:

Article 1

Subject matter

This Regulation establishes:

(a) the detailed rules and conditions for the operation of the web service and the data protection and security rules applicable to the web service provided for in Article 13(1) and (3) and Article 36, first paragraph, point (h), of Regulation (EU) 2017/2226 and in Article 45c(3), fourth subparagraph of Regulation (EC) No 767/2008;

(b) an authentication scheme for carriers to enable them to fulfil their obligations pursuant to Article 13(3) of Regulation (EU) 2017/2226 and Article 45c(5), second paragraph of Regulation (EC) No 767/2008 as well as detailed rules and conditions on registration of carriers with the authentication scheme;

(c) details of the procedures to be followed where it is technically impossible for carriers to access the web service pursuant to Article 45d(3) of Regulation (EC) No 767/2008.

Article 2

Definitions

For the purposes of this Regulation the following definitions apply:

(1) ‘carrier interface’ means the web service to be developed by eu-LISA in accordance with Article 37(1) of Regulation (EU) 2017/2226 where used for the purposes of Article 13(3) of that Regulation and the carrier gateway referred in Article 45c(2) and (3) of Regulation (EC) No 767/2008 and consisting of an IT interface connected to a read-only database;

(2) ‘technical guidelines’ means the part of the technical specifications, referred to in Article 37(1) of Regulation (EU) 2017/2226 that is relevant for carriers for the implementation of the authentication scheme and the development of the message format of the Application Programming Interface referred to in Article 4(2), point (a) of this Regulation;

(3) ‘duly authorised staff’ means employees of or contractually engaged by the carrier or by other legal or natural persons acting under that carrier’s direction or supervision, assigned with the tasks of verifying whether the number of entries authorised by a visa has already been used on behalf of the carrier, in accordance with Article 13(3) of Regulation (EU) 2017/2226 and as from the start of operations of the Visa Information System, to verify whether third-country nationals who are subject to a short-stay visa or who are required to hold a long-stay visa, the airport transit visa or a residence permit are in possession of a valid short-stay visa, long-stay visa, airport transit visa or a residence permit, as applicable, in accordance with Article 45c(1) of Regulation (EC) No 767/2008.

Article 3

Obligations of carriers

1. From the start of operations of the Entry/Exit System until the start of operations of the Visa Information System, carriers shall send a query to verify whether in the case of a single-entry visa or a double-entry visa the number of entries authorised by a visa has already been used as referred to in Article 13 of Regulation (EU) 2017/2226 (‘verification query’) through the carrier interface.

2. From the start of operations of the Visa Information System, carriers shall launch a query through the carrier interface, to verify whether:

(a) in the case of a short-stay visa, the number of entries authorised by the visa has already been used or whether the holder of the visa has reached the maximum authorised stay, as referred to in Article 13 of Regulation (EU) 2017/2226;

(b) in the case of a long-stay visa, an airport transit visa or a residence permit, the visa or the permit are valid as referred to in Article 45c(1) of Regulation (EC) No 767/2008.

3. From the start of operations of the Visa Information System, carriers shall launch the verification query for the long-stay visa or the residence permit for those long-stay visas and residence permits issued after the start of operations of the Visa Information System. Carriers shall manually check long-stay visas and residence permits issued prior to the start of operations of the Visa Information System.

4. The verification query shall be sent at the earliest 48 hours prior to the scheduled time of departure.

5. Carriers shall ensure that only duly authorised staff have access to the carrier interface. The carriers shall put in place at least the following mechanisms:

(a) physical and logical access control mechanisms to prevent unauthorised access to the infrastructure or the systems used by the carriers;

(b) authentication;

(c) logging to ensure access traceability;

(d) regular review of the access rights.

Article 4

Connection and access to the carrier interface

1. Carriers shall connect to the carrier interface through one of the following:

(a) a dedicated network connection;

(b) an internet connection.

2. Carriers shall access the carrier interface through one of the following:

(a) a system-to-system interface (Application Programming Interface);

(b) a web interface (browser);

(c) an application for mobile devices.

Article 5

Queries

1. In order to send a verification query, the carrier shall provide the following traveller data:

(a) surname (family name); first name or names (given names);

(b) date of birth; sex; nationality;

(c) the type and number of the travel document and the three letter code of the issuing country of the travel document;

(d) the date of expiry of the validity of the travel document;

(e) the scheduled date of arrival at the border of a Member State which applies the Schengen

acquis

in full or a Member State which does not apply the Schengen

acquis

in full but operates the Entry/Exit system;

(f) one of the following:

(1) the scheduled Member State of entry which applies the Schengen

acquis

in full;

(2) where possible to identify the scheduled Member State of entry, an airport in the Member State of entry which applies the Schengen

acquis

in full;

(3) the scheduled Member State of entry which does not apply the Schengen

acquis

in full but operates the Entry/Exit System;

(4) where possible to identify the scheduled Member State of entry, an airport in the Member State of entry which does not apply the Schengen

acquis

in full but operates the Entry/Exit System;

(5) from the start of operations of the Visa Information System, in the case of airport transit, the Member State of transit for third-country nationals who require an airport transit visa in accordance with Article 3 of Regulation (EC) No 810/2009 of the European Parliament and of the Council (17), where applicable;

(g) the details (local date and time of scheduled departure, identification number, where available, or other means to identify the transport) of the means of transportation used to access the territory of a Member State which applies the Schengen

acquis

in full or the Member State which does not apply the Schengen

acquis

in full but operates the Entry/Exit System.

The carrier may also provide the number of the short-stay visa, the long-stay visa or the residence permit.

2. From the start of operations of the Entry/Exit System, where the destination cannot be reached with a single-entry visa, the carrier shall provide information that the itinerary includes two entries into the Member States when submitting the verification query.

From the start of operations of the Visa Information System, where the destination cannot be reached with a single-entry visa, the carrier shall provide information that the itinerary includes two or more entries into the Member States when submitting the verification query.

3. For the purposes of providing the information referred to in paragraph 1, points (a) to (d), carriers shall be allowed to scan the machine-readable zone of the travel document.

4. From the start of operations of the Entry/Exit System until the start of operations of the Visa Information System, where the passenger is exempt from the scope of Regulation (EU) 2017/2226 in accordance with Article 2 of that Regulation or is in airport transit, the carrier shall be able to specify it in the verification query.

From the start of operations of the Visa Information System, the carrier shall be able to specify in the verification query, where:

(a) the passenger is exempt from the scope of Regulation (EU) 2017/2226 in accordance with Article 2 of that Regulation, except for holders of a residence permit pursuant to Article 2(3), point (c) and holders of long-stay visas pursuant to Article 2(3), point (e); or

(b) in the case of airport transit, where the passenger is not required to hold an airport transit visa pursuant to Article 3 of Regulation (EC) No 810/2009.

5. Carriers shall be able to send a verification query for one or more passengers. The carrier interface shall include the reply referred to in Article 6 for each passenger included in the query.

Article 6

Reply

1. From the start of operations of the Entry/Exit System until the start of operations of the Visa Information System, where the passenger is exempt from the scope of Regulation (EU) 2017/2226 in accordance with Article 2 of that Regulation, is in airport transit or is a holder of a national short-stay visa in the meaning of Article 3(1), point 10 of that Regulation, the reply shall be ‘Not applicable’. In all other cases, the reply shall be ‘OK’ or ‘Not OK’.

2. From the start of operations of the Visa Information System:

(a) where the passenger is exempt from the scope of Regulation (EU) 2017/2226 in accordance with Article 2 of that Regulation, except for holders of a residence permit pursuant to Article 2(3), point (c), and holders of long-stay visas pursuant to Article 2(3), point (e), of that Regulation, the reply shall be ‘Not applicable’;

(b) in the case of airport transit, where the passenger is not required to hold an airport transit visa pursuant to Article 3 of Regulation (EC) No 810/2009, the reply shall be ‘Not applicable’;

(c) in all other cases, where the passenger is a holder of a short-stay visa, a long-stay visa, a residence permit or an airport transit visa, the reply shall be ‘OK’ or ‘Not OK’.

Where a verification query returns a ‘Not OK’ reply, the carrier interface shall specify that the reply is coming from the Entry/Exit System or the Visa Information System.

3. From the start of operations of the Entry/Exit System until the start of operations of the Visa Information System, replies to verification queries shall be determined in accordance with the following rules:

(a) where the traveller is the holder of a uniform short-stay visa:

(1) where the authorised number of entries (one or two) on the visa has not yet been reached: OK;

(2) where the authorised number of entries (one or two) on the visa has already been reached: Not OK;

(3) where the visa has expired, or has been revoked or annulled: Not OK;

(b) where the traveller is subject to a visa obligation and no visa information is available: Not OK;

(c) where the carrier specifies that the itinerary requires a double entry visa:

(1) where the traveller is in possession of a double entry visa, valid for the date of arrival and neither entry has been used: OK;

(2) where the traveller is not in possession of a double entry visa: Not OK;

(3) where the traveller is in possession of a double entry visa but at least one entry has been used: Not OK;

(4) where the traveller is in possession of a double entry visa but at least one entry is not valid for the date of arrival: Not OK.

4. From the start of operations of the Visa Information System, replies to verification queries in the case that the carrier indicates the Member State of transit in accordance with Article 5(1)(f), point (5), shall be determined in accordance with the following rules:

(a) where the traveller is the holder of an airport transit visa:

(1) where the airport transit visa corresponds to the transit area of the Member State’s airport: OK;

(2) where the visa has expired, or has been revoked or annulled: Not OK;

(3) where the visa is a single airport transit visa and the visa has not been used: OK;

(4) where the visa is a double airport transit visa and the visa has been used only once: OK; or

(b) where the traveller is the holder of a short-stay visa:

(1) where the authorised number of entries on the visa has not yet been reached and there is at least 1 remaining day of authorised stay: OK;

(2) where the authorised number of entries on the visa has already been reached or there are 0 remaining days of authorised stay: Not OK;

(3) where the visa has expired, or has been revoked or annulled: Not OK; or

(c) where the traveller is the holder of a short-stay visa with limited territorial validity:

(1) where the authorised number of entries on the visa has not yet been reached and there is at least 1 remaining day of authorised stay, and where the Member State of transit corresponds to one of the Member States for which the limited territorial validity visa is valid: OK;

(2) where the authorised number of entries on the visa has not yet been reached and there is at least 1 remaining day of authorised stay, and where the Member State of transit does not correspond to one of the Member States for which the limited territorial validity visa is valid: Not OK;

(3) where the authorised number of entries on the visa has already been reached or there are 0 remaining days of authorised stay, and where the Member State of transit corresponds to one of the Member States for which the limited territorial validity visa is valid: Not OK;

(4) where the authorised number of entries on the visa has already been reached or there are 0 remaining days of authorised stay, and where the Member State of transit; does not correspond to one of the Member States for which the limited territorial validity visa is valid: NOT OK;

(5) has expired, or has been revoked or annulled: Not OK; or

(d) where the traveller is the holder of a long-stay visa:

(1) where the visa has expired, or has been revoked or annulled: Not OK;

(2) otherwise: OK; or

(e) where the traveller is the holder of a residence permit:

(1) where the residence permit has expired, or has been revoked or annulled: Not OK;

(2) otherwise: OK.

5. From the start of operations of the Visa Information System, replies to verification queries in the case that the carrier indicates the Member State of destination in accordance with Article 5(1)(f)(1)-(4), shall be determined in accordance with the following rules:

(a) where the traveller is the holder of a short-stay visa:

(1) where the authorised number of entries on the visa has not yet been reached and there is at least 1 remaining day of authorised stay: OK;

(2) where the authorised number of entries on the visa has already been reached or there are 0 remaining days of authorised stay: Not OK;

(3) where the visa has expired, or has been revoked or annulled: Not OK; or

(b) where the traveller is the holder of a short-stay visa with limited territorial validity:

(1) where the authorised number of entries on the visa has not yet been reached and there is at least 1 remaining day of authorised stay, and where the Member State of entry corresponds to one of the Member States for which the limited territorial validity visa is valid: OK;

(2) where the authorised number of entries on the visa has not yet been reached and there is at least 1 remaining day of authorised stay, and where the Member State of entry does not correspond to one of the Member States for which the limited territorial validity visa is valid: Not OK;

(3) where the authorised number of entries on the visa has already been reached or there are 0 remaining days of authorised stay, and where the Member State of entry corresponds to one of the Member States for which the limited territorial validity visa is valid: Not OK;

(4) where the authorised number of entries on the visa has already been reached or there are 0 remaining days of authorised stay, and where the Member State of entry does not correspond to one of the Member States for which the limited territorial validity visa is valid: NOT OK;

(5) has expired, or has been revoked or annulled: Not OK;

(c) where the traveller is the holder of a long-stay visa:

(1) where the visa has expired, or has been revoked or annulled: Not OK;

(2) otherwise: OK;

(d) where the traveller is the holder of a residence permit:

(1) where the residence permit has expired, or has been revoked or annulled: Not OK;

(2) otherwise: OK;

(e) where the traveller is subject to a visa obligation and no visa information is available: Not OK;

(f) where the carrier specifies that the itinerary cannot be reached with a single-entry visa:

(1) where the traveller is in possession of a double entry visa, valid for the date of arrival and neither entry has been used: OK;

(2) where the traveller is in possession of a single-entry visa: Not OK;

(3) where the traveller is in possession of a double entry visa but at least one entry has been used: Not OK;

(4) where the traveller is in possession of a double entry visa but at least one entry is not valid for the date of arrival: Not OK;

(5) where the traveller is in possession of a multiple entry visa: OK.

6. Where the traveller is visa exempt or the traveller falls within the scope of Regulation (EU) 2018/1240, the provisions defined in the Commission Implementing Regulation C(2022) 4550 (18) applies.

Article 7

Message format

eu-LISA shall specify the data formats and structure of messages to be used for transmitting verification queries and replies to those queries through the carrier interface in the technical guidelines. eu-LISA shall provide for the use of at least the following data formats:

(a) UN/EDIFACT;

(b) PAXLST/CUSRES;

(c) XML;

(d) JSON.

Article 8

Data extraction requirements for the carrier interface and the web service for third-country nationals and data quality

1. Data on issued, annulled and revoked short stay visas, long-stay visas, airport transit visas, residence permits, and travel authorisations shall be automatically extracted from the Visa Information System, the European Travel Information and Authorisation System and the Entry/Exit System at least daily and transmitted to the read-only database.

2. All extractions of data into the read-only database pursuant to paragraph 1 shall be logged.

3. eu-LISA shall be responsible for the security of the web service and of the personal data it contains, and for the process of extracting and transmitting the data referred to in paragraph 1 to the read-only database. The technical implementation details shall be derived from the security plan, following the risk assessment process.

4. It shall not be possible to transmit data from the read-only database to the Entry/Exit System or the Visa Information System.

Article 9

Authentication scheme

1. eu-LISA shall develop an authentication scheme, taking into account information on security risk management and the principles of data protection by design and default and access control principles, including accountability, and allowing to trace the initiator of the verification query.

2. The details of the authentication scheme shall be set out in the technical guidelines.

3. The authentication scheme shall be tested in accordance with Article 12.

4. Where carriers access the carrier interface using the Application Programming Interface referred to in Article 4(2), point (a), the authentication scheme shall be implemented by means of mutual authentication.

Article 10

Registration with the authentication scheme

1. Carriers referred to in Article 13(3) of Regulation (EU) 2017/2226 and Article 45c(1) of Regulation (EC) No 767/2008 operating and transporting passengers into the territory of the Member States shall be required to register prior to gaining access to the authentication scheme.

2. eu-LISA shall make available a registration form on a public website to be completed on-line. Submission of the registration form shall only be possible where all the fields have been correctly completed.

3. The registration form shall include fields requiring carriers to provide the following information:

(a) the legal name of the carrier as well as its contact details (email address, telephone number and postal address);

(b) the contact details of the legal representative of the company requesting the registration and of back-up points of contact (names, telephone numbers, email and postal addresses) as well as the functional email address and other means of communication that the carrier intends to use for the purposes of Articles 13 and 14;

(c) the Member State or third country that issued the official company registration referred to in paragraph 6 and any available registration number;

(d) where the carrier has attached, in accordance with paragraph 6, an official company registration issued by a third country, the Member States in which the carrier operates or intends to operate within the next year.

4. The registration form shall inform the carriers of the minimum security requirements. The carriers shall ensure compliance with the following objectives:

(a) identifying and managing security risks related to the connection to the carrier interface;

(b) protecting the environments and the devices connected to the carrier interface;

(c) detecting, analysing, responding to and recovering from cyber security incidents.

5. The registration form shall require carriers to declare:

(a) that they operate and transport passengers into the territory of the Member States or intend to do so within the next six months;

(b) that they will access and make use of the carrier interface in accordance with the minimum security requirements set out in the registration form, in accordance with paragraph 4;

(c) that only duly authorised staff will have access to the carrier interface.

6. The registration form shall require carriers to attach an electronic copy of their instruments of constitution, including, where applicable statutes, as well as an electronic copy of an extract of their official company registration from either at least one Member State, where applicable, or from a third country in, or officially translated into, one of the official Union or Icelandic or Norwegian. An electronic copy of an authorisation to operate in one or more Member States, such as an Air Operator Certificate, can substitute the official company registration.

7. The registration form shall notify carriers:

(a) that they are required to inform eu-LISA of any changes regarding the information referred to in paragraphs 3, 4 and 5 of this Article or in case of technical changes affecting their ‘system-to-system’ connection to the carrier interface that may require additional testing in accordance with Article 12 through specified contact details of eu-LISA to be used for this purpose;

(b) that they will be automatically deregistered from the authentication scheme if the logs show that the carrier has not used the carrier interface during a period of one year;

(c) that they may be deregistered from the authentication scheme in case of a breach of the provisions of this Regulation, the security requirements referred to in paragraph 4 or the technical guidelines, including in case of abuse of the carrier interface;

(d) that they are obliged to inform eu-LISA of any personal data breach that may occur and regularly review the access rights of their dedicated staff.

8. Where the registration form has been submitted correctly, eu-LISA shall register the carrier and notify the carrier that it has been registered. Where the registration form has not been submitted correctly, eu-LISA shall refuse registration and notify the carrier of the reasons.

eu-LISA shall maintain an up-to-date register of registered carriers. Personal data contained in the registration of carriers shall be deleted at the latest one year after the carrier has been deregistered.

Article 11

Deregistration from the authentication scheme

1. Where a carrier informs eu-LISA that it no longer operates or transports passengers into the territory of the Member States, eu-LISA shall deregister the carrier.

2. Where the logs show that the carrier has not used the carrier interface during a period of one year, it shall be automatically deregistered.

3. Where a carrier no longer fulfils the conditions referred to in Article 10(5), or has otherwise breached the provisions of this Regulation, the security requirements referred to in Article 10(4) or the technical guidelines, including in case of abuse of the carrier interface, eu-LISA may deregister the carrier.

4. eu-LISA shall inform the carrier of its intention to deregister the carrier pursuant to paragraphs 1, 2 or 3, together with the reason for the deregistration, one month before deregistration. Before deregistration, eu-LISA shall give the carrier the opportunity to provide written comments.

5. In case of urgent IT security concerns, including where the carrier is not complying with the security requirements referred to in Article 10(4) or with the technical guidelines, eu-LISA may immediately disconnect a carrier. eu-LISA shall inform the carrier of the disconnection, together with the reason for the disconnection.

6. To the extent appropriate, eu-LISA shall assist carriers that have received a notice of deregistration or disconnection to remedy the deficiencies that gave rise to the notice and, where possible, for a limited time and under strict conditions, provide the opportunity for disconnected carriers to send verification queries by other means than those referred to in Article 4.

7. Disconnected carriers may again be connected to the carrier interface following successful removal of the security concerns that gave rise to the disconnection. Deregistered carriers may submit a new request for registration.

8. At any time following the registration of carriers pursuant to Article 10, eu-LISA may, in particular where there is reasoned suspicion that one or more carriers are abusing the carrier interface or do not fulfil the conditions referred to in Article 10(4), make inquiries with Member States or third countries.

9. Where the registration form referred to in Article 10(2) is not available for a prolonged period of time, eu-LISA shall ensure that registration in accordance with that Article is possible via other means.

Article 12

Development, testing and connection of the carrier interface

1. eu-LISA shall make the technical guidelines available to carriers in order to enable them to develop and test the carrier interface.

2. Where carriers choose to connect through the Application Programming Interface referred to in Article 4(2), point (a), the implementation of the message format referred to in Article 7 and of the authentication scheme referred to in Article 9 shall be tested.

3. Where carriers choose to connect through the web interface (browser) or application for mobile devices referred to in Article 4(2), points (b) and (c) respectively, they shall notify eu-LISA that they have successfully tested their connection to the carrier interface and that their duly authorised staff has been successfully trained in using the carrier interface.

4. For the purpose of paragraph 2, eu-LISA shall develop and make available a testing plan, a test environment and a simulator allowing eu-LISA and carriers to test the carriers’ connection to the carrier interface. For the purpose of paragraph 3, eu-LISA shall develop and make available a test environment allowing carriers to train their staff.

5. Upon successful completion of the registration procedure referred to in Article 10 as well as the successful completion of the testing referred to in paragraph 2 or reception of the notification referred to in paragraph 3, eu-LISA shall connect the carrier to the carrier interface.

Article 13

Technical impossibility

1. Where it is technically impossible to send a verification query because a component of the Entry/Exit System or a component of the Visa Information System failed, the following shall apply:

(a) where the failure is detected by a carrier, as soon as it becomes aware of it, it shall notify the ETIAS Central Unit through the means referred to in Article 14;

(b) where the failure is detected or confirmed by eu-LISA, the ETIAS Central Unit shall inform the concerned carriers and Member States of such failure by email or other means of communication, as soon as they become aware of it, and of the end of the failure when the issue has been solved.

2. Where it is technically impossible to send a verification query for other reasons than a failure of any component of the Entry/Exit System or the Visa Information System, the carrier shall notify the ETIAS Central Unit through the means referred to in Article 14.

3. The carrier shall inform the ETIAS Central Unit, through the means referred to in Article 14, as soon as the issue has been solved.

The ETIAS Central Unit shall inform the Member States of the impossibility of this carrier to send the verification query.

4. For the purpose of this Article and Article 14, eu-LISA shall make available to the ETIAS Central Unit a ticketing tool. That tool shall offer access to the register of carriers.

5. The ETIAS Central Unit shall acknowledge receipt of the notifications referred to in paragraphs 1 and 2.

Article 14

Assistance to carriers

1. A web form as part of the ticketing tool shall be made available to carriers on a public website in order to allow carriers to request assistance.

The web form shall enable the carriers to provide at least the following information:

(a) the identification details of the carrier;

(b) a summary of the request;

(c) whether the request is of a technical nature and, in such case, the date and time of the start of the technical issue.

2. Carriers shall receive an acknowledgement of receipt of the request by the ETIAS Central Unit. That receipt shall contain a ticket number.

3. Where the request for assistance is of a technical nature, the ETIAS Central Unit shall send the request to eu-LISA. eu-LISA shall be responsible for providing technical assistance to carriers.

4. Where the request for assistance is not of a technical nature, the ETIAS Central Unit shall assist carriers by directing them to relevant information.

5. Where it is technically impossible to request assistance in accordance with paragraph 1 using the web form, the carrier shall be able to use an emergency phone line connected to the ETIAS Central Unit or eu-LISA.

6. The assistance provided by the ETIAS Central Unit and eu-LISA shall be available 24/7 and provided in English.

7. The ETIAS Central Unit shall make available online a list of frequent questions and answers relevant for carriers. That list shall be available in all official languages of the Union. It shall be separate from the questions and answers relevant for travellers.

Article 15

Access to the web service by third-country nationals

1. When verifying the remaining days of authorised stay via a secure internet access to the web service, third-country nationals shall indicate the Member State of destination.

2. The third-country national shall insert the following data in the web service:

(a) type and number of the travel document or documents and three-letter code of the issuing country of the travel document or documents;

(b) optionally, intended date of entry or exit or both, set as Central European Time by default, editable by the user;

(c) Member State of destination.

3. The web service shall provide one of the following replies:

(a) ‘OK’ and the remaining days of authorised stay;

(b) ‘NOT OK’ and 0 remaining days of authorised stay;

(c) ‘Not available’.

4. Where the number of remaining days of authorised stay is provided, the web service shall indicate that the number of days was calculated on the basis of the intended date of entry provided by the third-country national and that the actual number of days remaining may vary depending on the actual date of entry.

5. Where no intended date of entry has been provided by the third-country national, the remaining authorised stay shall be calculated on the basis of the calendar date of the query. In this case, the web service shall indicate that the number of days remaining for authorised stay was calculated on the basis of the calendar date of the query.

6. During the transitional period provided for in Article 22 of Regulation (EU) 2017/2226, where no data exist in the Entry/Exit System for the third-country national, replies to the verification queries shall be determined in accordance with the following rules:

(a) authorised stay: OK;

(b) remaining days: information not available, including a note stating that the stays that occurred before the Entry/Exit System started operations have not been taken into account.

7. After the transitional period provided for in Article 22 of Regulation (EU) 2017/2226, replies to the verification queries shall be determined in accordance with the following rules:

(a) where the third-country national has sufficient remaining days of authorised stay, the reply shall be:

(i) authorised stay: OK;

(ii) remaining days: remaining days of authorised stay calculated by the Entry/Exit System;

(b) where the third-country national has consumed part of the authorised stay and intends to stay longer than the authorised stay, the reply shall be:

(i) authorised stay: NOT OK;

(ii) remaining days: 0;

(c) where the third-country national has consumed all the days of the authorised stay, the reply shall be:

(i) authorised stay: NOT OK;

(ii) remaining days: 0;

(d) where the third-country national is subject to a visa obligation and has no valid visa or the visa has expired, or has been revoked or annulled, or has a limited territorial validity visa which does not match the inserted Member State of destination, the reply shall be:

(i) authorised stay: NOT OK;

(ii) remaining days: 0;

(e) where the third-country national is not subject to a visa obligation and has no valid travel authorisation or has a travel authorisation that has expired, or has been revoked or annulled, the reply shall be:

(i) authorised stay: NOT OK;

(ii) remaining days: 0;

(f) where there are no entries in the Entry/Exit System for a third-country national who is a holder of a short stay visa, the number of remaining days shall be capped according to the expiration date of the short stay visa. In the case of visa exempt third-country nationals, after start of operations of the European Travel Information and Authorisation System, the number of remaining days shall be capped according to the expiration date of the travel authorisation, taking into account the transitional period and grace period referred to in Article 83 of Regulation (EU) 2018/1240.

8. The web service shall provide additional information to the third-country national as follows:

(a) in a prominent place, the Member States for which the calculation of the stay is applicable;

(b) close to the field to enter the travel document number, that the travel document to be used for the purposes of the web service shall be one of the travel documents used for previous stays;

(c) the list of Member States;

(d) all possible reasons for receiving the reply: ‘Information not available’;

(e) a general disclaimer stating clearly that the answer ‘OK/NOT OK’ cannot be interpreted as a decision to grant or refuse entry to the Schengen area;

(f) the regime applicable to third-country nationals who are members of the family of a Union citizen to whom Directive 2004/38/EC of the European Parliament and of the Council (19) applies or of a national of a third country enjoying the right of free movement equivalent to that of Union citizens under an agreement between the Union and its Member States, on the one hand, and a third country, on the other and do not hold a residence card pursuant to Directive 2004/38/EC or a residence permit pursuant to Council Regulation (EC) No 1030/2002 (20).

Article 16

Keeping of logs for data processing operations

For the purposes of Article 13(4) of Regulation (EU) 2017/2226 and Article 45c(8) of Regulation (EC) No 767/2008, the ETIAS National Unit shall have access to logs necessary for the dispute resolution that are kept by eu-LISA.

Article 17

Repeal of Implementing Regulation (EU) 2021/1224

Implementing Regulation (EU) 2021/1224 is repealed.

Article 18

Entry into force and applicability

This Regulation shall enter into force on the twentieth day following that of its publication in the

Official Journal of the European Union,

with the exception of the following provisions which shall apply from the date of the start of operations of the VIS pursuant to Article 11 of Regulation (EU) 2021/1134:

(a) Article 1in so far as it relates to Regulation (EC) No 767/2008;

(b) Article 2 in so far as it relates to Regulation (EC) No 767/2008;

(c) Article 3(2), (3);

(d) Article 5(1)(f)(5);

(e) Article 5(1) second subparagraph; (2) second subparagraph; (4) second subparagraph;

(f) Article 6(2), (4), (5);

(g) Article 8(1), (4) in so far as it relates to Regulation (EC) No 767/2008;

(h) Article 10(1) in so far as it relates to Regulation (EC) No 767/2008;

(i) Article 13(1) in so far as it relates to Regulation (EC) No 767/2008;

(j) Article 16 in so far as it relates to Regulation (EC) No 767/2008.

This Regulation shall be binding in its entirety and directly applicable in the Member States in accordance with the Treaties.

Done at Brussels, 18 August 2022.

For the Commission

The President

Ursula VON DER LEYEN

(1)

OJ L 327, 9.12.2017, p. 20

.

(2)

OJ L 218, 13.8.2008, p. 60

.

(3) Regulation (EU) No 1077/2011 of the European Parliament and of the Council of 25 October 2011 establishing a European Agency for the operational management of large-scale IT systems in the area of freedom, security and justice (

OJ L 286, 1.11.2011, p. 1

).

(4) Commission Implementing Regulation (EU) 2021/1224 of 27 July 2021 concerning the detailed rules on the conditions for the operation of the web service and data protection and security rules applicable to the web service, as well as, measures for the development and technical implementation of the web service provided for by Regulation (EU) 2017/2226 of the European Parliament and of the Council and repealing Commission Implementing Decision C(2019)1230 (

OJ L 269, 28.7.2021, p. 46

).

(5) Regulation (EU) 2018/1240 of the European Parliament and of the Council of 12 September 2018 establishing a European Travel Information and Authorisation System (ETIAS) (

OJ L 236, 19.9.2018, p. 1

).

(6) Regulation (EU) 2021/1134 of the European Parliament and of the Council of 7 July 2021 amending Regulations (EC) No 767/2008, (EC) No 810/2009, (EU) 2016/399, (EU) 2017/2226, (EU) 2018/1240, (EU) 2018/1860, (EU) 2018/1861, (EU) 2019/817 and (EU) 2019/1896 of the European Parliament and of the Council and repealing Council Decisions 2004/512/EC and 2008/633/JHA, for the purpose of reforming the Visa Information System (

OJ L 248, 13.7.2021, p. 11

)

(7) This Regulation falls outside the scope of the measures provided for in Council Decision 2002/192/EC of 28 February 2002 concerning Ireland’s request to take part in some of the provisions of the Schengen

acquis

(

OJ L 64, 7.3.2002, p. 20

).

(8)

OJ L 176, 10.7.1999, p. 36

.

(9) Council Decision 1999/437/EC of 17 May 1999 on certain arrangements for the application of the Agreement concluded by the Council of the European Union and the Republic of Iceland and the Kingdom of Norway concerning the association of those two States with the implementation, application and development of the Schengen

acquis

(

OJ L 176, 10.7.1999, p. 31

).

(10)

OJ L 53, 27.2.2008, p. 52

.

(11) Council Decision 2008/146/EC of 28 January 2008 on the conclusion, on behalf of the European Community, of the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation’s association with the implementation, application and development of the Schengen

acquis

(

OJ L 53, 27.2.2008, p. 1

).

(12)

OJ L 160, 18.6.2011, p. 21

.

(13) Council Decision 2011/350/EU of 7 March 2011 on the conclusion, on behalf of the European Union, of the Protocol between the European Union, the European Community, the Swiss Confederation and the Principality of Liechtenstein on the accession of the Principality of Liechtenstein to the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation’s association with the implementation, application and development of the Schengen

acquis

, relating to the abolition of checks at internal borders and movement of persons (

OJ L 160, 18.6.2011, p. 19

).

(14) Council Decision (EU) 2018/934 of 25 June 2018 on the putting into effect of the remaining provisions of the Schengen

acquis

relating to the Schengen Information System in the Republic of Bulgaria and Romania (

OJ L 165, 2.7.2018, p. 37

).

(15) Council Decision (EU) 2017/1908 of 12 October 2017 on the putting into effect of certain provisions of the Schengen

acquis

relating to the Visa Information System in the Republic of Bulgaria and Romania (

OJ L 269, 19.10.2017, p. 39

).

(16) Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (

OJ L 295, 21.11.2018, p. 39

).

(17) Regulation (EC) No 810/2009 of the European Parliament and of the Council of 13 July 2009 establishing a Community Code on Visas (Visa Code) (

OJ L 243, 15.9.2009, p. 1

).

(18) Commission Implementing Regulation C(2022) 4550 laying down the rules and conditions for verification queries by carriers, provisions for data protection and security for the carriers’ authentication scheme as well as fall back procedures in case of technical impossibility.

(19) Directive 2004/38/EC of the European Parliament and of the Council of 29 April 2004 on the right of citizens of the Union and their family members to move and reside freely within the territory of the Member States amending Regulation (EEC) No 1612/68 and repealing Directives 64/221/EEC, 68/360/EEC, 72/194/EEC, 73/148/EEC, 75/34/EEC, 75/35/EEC, 90/364/EEC, 90/365/EEC and 93/96/EEC (

OJ L 158, 30.4.2004, p. 77

).

(20) Council Regulation (EC) No 1030/2002 of 13 June 2002 laying down a uniform format for residence permits for third-country nationals (

OJ L 157, 15.6.2002, p. 1

).