Proposal for a Regulation of the European Parliament and of the Council establishing an application for the electronic submission of travel data (“EU Digital Travel application”) and amending Regulations (EU) 2016/399 and (EU) 2018/1726 of the European Parliament and of the Council and Council Regulation (EC) No 2252/2004, as regards the use of digital travel credentials

Home affairs

Enhance the effectiveness and efficiency of external border management, contributing to a safer area of freedom, security and justice and the well-functioning of the area without internal border controls (Schengen area).

Specific objectives:

1. To increase security in the Schengen area and the efficiency of external border management:

Establish a uniform standard for digital travel credentials (DTCs) for the external borders in a coordinated way by all Member States, fostering the future interoperability and the opportunities for cooperation;

Allow for the submission of a DTC by the traveller in a secure and timely manner ahead of his or her trip, increasing also the reliability of the data submitted to the border control authorities;

Allow border control authorities to carry out advance checks against such data in order to reduce bottlenecks and time spent at the border crossing point;

Reach a minimum level of digital maturity among all Member States in the area of border management;

2. To allow for a smoother and faster border crossing for travellers.

The crossing of external borders by all travellers, regardless of their nationality, is facilitated and sped up by more efficient border checks based on the advance checks based on the digital travel credentials submitted by travellers. The processes, third-country nationals subject to the Entry/Exit System, are also accelerated by allowing them to remotely pre-enrol data using digital travel credentials.

eu-LISA will set up and operate the EU Digital Travel application as soon as possible from the date of adoption of the legislative proposal.

Operators of ports of entry (e.g., airports and seaports) will benefit from shorter border crossing times.

Carriers can indirectly benefit from the fact that travellers may have digital travel credentials, by integrating the possibility to use these credentials in their applications for purchasing tickets, check-in as well as for collecting advance passenger information in an automated and accurate manner.

Border management authorities will benefit from being able to carry out advance border checks on persons based on digital travel credentials, which is currently not possible. Border authorities can verify, ahead of travel, the authenticity and integrity of travel documents and better plan and manage resources by pre-clearing travellers that use digital travel credentials.

The EU as such and its citizens will indirectly and directly benefit from increased security as well as the better functioning of the area without internal border controls.

Specific objective No1 – establish a common technical standard and interface for the use of digital travel credentials

-    Successful adoption of the implementing acts laying down the technical specifications for digital travel credentials, the technical architecture of the EU Digital Travel application, the mobile application, backend services and Traveller Router, collection of statistics, the test of the Travel Europe application before its start of operation and the implementing act to determine the start of operation of the application

-    Start of operation of the EU Digital Travel application (target end of 2030)

Specific objective No2 – allow travellers to create and submit digital travel credentials to border authorities and enable advance checks

-    Share of Member States connected to the Traveller Router by the date of entry into operation of the EU Digital Travel application (target 100%)

-    Number of national border authorities receiving information from the Traveller Router

-    Number of digital travel credentials created with the EU Digital Travel application (target: gradual increase from the entry into operation + 5 years) 

-    Number of errors in the creation and submission of digital travel credentials based on ICAO-compliant 2 travel documents (target 0%, if data has been filled in correctly)

-    Number of digital travel credentials requested by EU citizens in conjunction with the application for physical travel documents (passports and identity cards) (target: to gradually increase from 0 to 25% of applicants from entry into force + 2 years)

-    Number of travellers using the EU Digital Travel application to submit their digital travel credentials ahead of travel

-    Ratio: number of travellers that use digital travel credentials for the purposes of crossing external borders vs number of travellers that use only their physical travel documents (target 30% 5 years after entry into operation of the EU Digital Travel application)

-    Ratio: number of travellers pre-checked vs number of travellers that submitted their digital travel credentials (target 100%)

-    Share of fraudulent documents and hits detected during the advance checks against databases (target 100%)

-    Average time per border check at the physical border crossing point for travellers that have submitted their digital travel credential (target < 10 seconds per person)

Specific objective No3 – facilitation of cross-border travel

-    Average waiting times for EU citizens at border crossing points (target: to gradually decrease from current waiting times after the entry into operation of the EU Digital Travel application – impossible to quantify as major difference in infrastructural setups exist)

-    Average waiting times for third-country nationals at border crossing points (target: to gradually decrease from current waiting times after the entry into operation of the EU Digital Travel application – impossible to quantify as major difference in infrastructural setups exist)

-    Average time it takes third-country nationals that have used digital travel credentials to pre-enrol data for the Entry/Exit System (target: to decrease by at least 20 seconds per person)

-    Average time it takes travellers that have submitted their digital travel credentials to undergo the check at the physical border crossing point (target: < 10 seconds per person).

The initiative requires the development, followed by maintenance and operation of the EU Digital Travel application.

In the design and development phase, eu-LISA will develop the technical components needed to operate the application. The exact timeline will depend on the adoption of the proposed regulation (and its exact content) and the delivery of the technical components, some of which may be linked with other ongoing development projects in eu-LISA. It is envisaged that the finalisation of other development projects within eu-LISA would free human resources that could be reassigned for the development of the EU Digital Travel application.

Assumptions were made that the proposed regulation would be adopted by the end of 2025, allowing the start of preparations, including recruitment for certain profiles within 2026 and early 2027. eu-LISA envisages a three-year implementation period for the project due to the requirements definition process, complex stakeholders’ involvement as well as extensive external testing.

The EU Digital Travel application should start operation by 2030. This is conditional on the successful carrying out of a test of the application. No separate transition period is provided for, and Member States should have developed the necessary technical components at national level to connect to the Traveller Router component of the EU Digital Travel application by the time the EU Digital Travel application starts operation.

However, prior to the development of the EU Digital Travel application, Member States could opt-in and implement digital travel credentials (according to the provisions of the proposed regulation) under national projects.

Reasons for action at European level (ex-ante)

The Treaty on the Functioning of the European Union (TFEU) explicitly empowers the Union to develop a common policy on the checks to which persons crossing external borders are subject to and to adopt measures for the gradual establishment of an integrated management system for external borders. These are clear objectives to be pursued at EU level for ensuring the well-functioning of the external borders and of the area without internal border controls, to promote security in the Union and to combat illegal immigration.

While the current EU legal framework does not allow the use of digital travel credentials for remotely verifying the authenticity and integrity of travel documents in border checks, Member States themselves cannot effectively introduce digital travel credentials in a uniform way for achieving the objectives.

Therefore, this proposal would add considerable value in addressing the challenges related to security and travel facilitation that impact security throughout the Union and the proper functioning of the external borders. Joint action at EU level would put in place harmonised measures to establish digital travel credentials and enable their use in the context of border checks at external borders.

Expected generated Union added value (ex-post)

Border authorities should benefit from the introduction of digital travel credentials by enabling them to verify the authenticity and integrity of travel documents as well as consult the relevant databases before travellers arrive at the border crossing point more efficiently than today. This would allow for better management of resources and better detection of high-risk travellers and fraudulent documents, since several travellers would have been pre-cleared and quickly processed at the border crossing point.

While the proposed regulation focuses on the use of digital travel credentials for crossing external borders, the introduction of a legal definition for digital travel credentials could also serve to benefit authorities responsible for processing visa and European Travel Information and Authorisation System (ETIAS) applications and enable them to verify the authenticity and integrity of travel documents (remotely) used by applicants. This also applies to immigration authorities that process residence permit applications submitted by third-country nationals in a third country.

The proposed regulation would enable individual travellers (both EU citizens and third-country nationals) to use digital travel credentials for external border crossing purposes. This brings benefits in terms of less time spent at border crossing points and less hassle due to misspelled or incorrect manually declared data. Errors in self-declared data can lead to additional waiting time or even refusals of entry or a refusal to board a transport vehicle.

As the initiative would establish a legal standard for digital travel credentials, its uses could be incorporated into national systems, particularly with the rollout of digital identity and the European Digital Identity Wallets. EU citizens could better leverage the chip data in their passport or identity card for secure identification in both online and physical transactions.

The initiative will also benefit individuals, if carriers (e.g., airlines, coaches, trains and ships) integrate the processing of digital travel credentials into their booking and check-in systems. This could allow passengers to undergo certain checks – that are currently done physically at transport hubs, e.g., during check-in, baggage drop or boarding – fully remotely and save additional time with less hassle, too.

Since the use of a digital travel credential would be voluntary and free of charge for individuals, no financial costs are envisaged. The only investment required from individuals would relate to the time it takes to derive a digital travel credential from the traveller’s existing passport or identity card, which could be done remotely.

While this is the first time the EU (or any other entity) introduces digital travel credentials for border check purposes, some lessons have been learned from previous IT development projects and the ongoing pilot projects in three Member States on the use of digital travel credentials (see Annex 5 of the impact assessment for more details).

In the context of developing other centralised EU systems (Visa Information System, Schengen Information System), it was noted that the implementation of the central component (the actual EU Digital Travel application with all its components) may suffer from cost overruns and delays due to changing requirements before the legal instruments setting out its purpose, scope, functions, and technical specifications are in place. Therefore, the preparatory design phase should not start until the respective technical specifications are adopted by the Commission. Furthermore, the best use of synergies and efficiency gains should be sought within staff profiles/areas of expertise, e.g., by building the Traveller Router on top of the Carrier Interface and API Router.

While a clear impact of the proposed regulation on waiting times at the border is difficult to ascertain, the results from the ongoing EU pilot projects demonstrate that the processing time of pre-cleared DTC travellers (EU citizens) decreased significantly from between 30 and 90 seconds to less than 9 seconds per traveller. This impact is multiplied with the eventual uptake of DTCs, resulting in shorter queuing times even for those travellers that will not use the DTC themselves, but whose monetary value is at this point impossible to evaluate.

Important questions also arose in the context of those pilot projects that need to be considered when drafting the implementing acts laying down the technical specifications for the EU Digital Travel application. These questions pertain to the security of storage of digital travel credentials, secure messaging, transmission protocol and the importance of developing the application in a modular way to allow additional functionalities and the transition from one technical standard to the next as global standards evolve in the future.

The investments required at EU level during the current 2021-2027 multiannual financial framework (MFF) are limited to EUR 1.3 million. The bulk of the investments required at EU level (EUR 60.2 million) should therefore be financed from the next MFF.

The appropriations needed to finance the development of the EU Digital Travel application by eu-LISA (EUR 61.5 million) have not been planned under the 2021-2027 MFF allocations for eu-LISA, as this is a new proposal for which amounts were not known at the time when the 2021-2027 MFF was tabled.

Therefore, it is proposed to ensure adequate financing of eu-LISA for the amounts needed in 2027 by reducing the corresponding thematic facilities of the Border Management and Visa Policy Instrument or by reallocating funds from other decentralised agencies.

The design and development phase of the EU Digital Travel application is expected to last between 2026 and 2030. The Travel Europe application should be operational by the end of 2030.

The monitoring and reporting of the proposal will follow the principles outlined in eu-LISA’s Regulation, the EU Financial Regulation and in line with the Common Approach on decentralised agencies. Notably, eu-LISA must each year submit to the Commission, the European Parliament and the Council a Single Programming Document containing multi-annual and annual work programmes and resources programming. This Document sets out the objectives, expected results and performance indicators to monitor the achievement of the objectives and the results. eu-LISA must also submit a Consolidated Annual Activity Report to the management board, which includes information on the achievement of the objectives and results set out in the Single Programming Document. The report is also sent to the Commission, the European Parliament and the Council.

According to Article 39 of eu-LISA’s Regulation, every five years, the Commission shall, after consulting the management board, evaluate the performance of the Agency in relation to its objectives, mandate, locations and tasks. This evaluation also includes an examination of the implementation of this proposed regulation and the way and extent to which the Agency effectively contributes to the operational management of large-scale IT systems and to the establishment of a coordinated, cost-effective and coherent IT environment at Union level in the area of freedom, security and justice. That evaluation assesses the possible need to modify the mandate of the Agency and the financial implications of any such modification. The management board may issue recommendations regarding amendments to this regulation to the Commission.

Finally, the proposed regulation would mandate eu-LISA to ensure it has the procedures in place to monitor the development of the EU Digital Travel application in light of the objectives relating to planning and costs and to monitor the functioning of the application. eu-LISA should, by 1 January 2028 and every twelve months thereafter during the design and development phase, submit a report to the European Parliament and to the Council on the state of play of the development of the application. This report should include detailed information about the costs incurred and information as to any risks which may impact the overall costs of the EU Digital Travel application as well as detailed information about the technical implementation of the project and any technical problems and risks that may impact the overall development and entry into operation of the application.

The development of the EU Digital Travel application will be implemented via eu-LISA budget, through indirect management. Pursuant to the principle of sound financial management, the budget of eu-LISA shall be implemented in compliance with effective and efficient internal control. The Agency is therefore bound to implement an appropriate control strategy coordinated among appropriate actors involved in the control chain.

Regarding ex-post controls, eu-LISA as a decentralised agency, is subject to:

-     Internal audit by the Internal Audit Service of the Commission;

-    Annual reports by the European Court of Auditors, giving a statement of assurance as to the reliability of the annual counts and the legality and regularity of the underlying transactions;

-    Annual discharge granted by the European Parliament;

-    Possible investigations by the European Anti-Fraud Office (OLAF) to ensure that the resources allocated to agencies are put to proper use.

As partner DG to eu-LISA, DG HOME will implement its Control Strategy on decentralised agencies to ensure reliable reporting in the framework of its Annual Activity Report. While decentralised agencies have full responsibility for the implementation of their budget, DG HOME is responsible for regular payment of annual contributions established by the EU Budgetary Authorities.

The European Ombudsman provides a further layer of control and accountability over eu-LISA’s administrative actions.

No risks have been identified at this stage.

For the budget implemented by eu-LISA, a specific Internal Control Framework based on the Internal Control Framework of the European Commission is required.

The Single Programming Document must provide information on the internal control systems, while the Consolidated Annual Activity Report (CAAR) must contain information on the efficiency and effectiveness of the internal control systems, including as regards risk assessment. The CAAR 2021 reports that, the management of the Agency was reasonably confident that, overall, suitable controls are in place and that they are functioning as intended. Additionally, risks were being monitored and mitigated appropriately, and various improvements and reinforcements are implemented as necessary.

Another level of internal supervision is also provided by eu-LISA’s Internal Audit Capability, on the basis of an annual audit plan notably taking into consideration the assessment of risks in eu-LISA. The Internal Audit Capability helps eu-LISA in accomplishing its objectives by bringing a systematic and disciplined approach to evaluate the effectiveness of risk management, control, and governance processes, and by issuing recommendations for their improvement.

Moreover, the European Data Protection Supervisor and eu-LISA’s data protection officer (an independent function attached directly to the Management Board Secretariat) supervise eu-LISA’s processing of personal data.

Finally, as partner DG of eu-LISA, DG HOME runs an annual risk management exercise to identify and assess potential high risks related to agencies’ operations, including eu-LISA. Risks considered as critical are reported annually in DG HOME management plan and are accompanied by an action plan stating the mitigating actions envisaged.

The ratio of “control costs/value of the related funds managed” is reported on by the Commission. The 2021 AAR of DG HOME reports 0.08% for this ratio in relation to indirect management entrusted entities and decentralised agencies, including eu-LISA.

DG HOME will apply its Anti-Fraud Strategy in line with the Commission’s Anti-Fraud Strategy (CAFS) in order to ensure that its internal anti-fraud related controls are fully aligned with the CAFS and that its fraud risk management approach is geared to identify fraud risk areas and adequate responses.

The measures related to combating fraud, corruption and any other illegal activities are outlined in Article 50 of eu-LISA’s Regulation and under Title X of eu-LISA’s Financial Regulation.

The Agency shall notably participate in fraud prevention activities of OLAF and inform the Commission without delay on cases of presumed fraud and other financial irregularities – in line with its internal anti-fraud strategy covering the period 2022-2024.

As partner DG, in October 2021, DG HOME adopted a new Anti-Fraud Strategy, together with an accompanying Action Plan, which further strengthens the DG’s anti-fraud capacities and adapts them to a constantly evolving environment. It takes into account the novelties introduced by the 2019 Commission Anti-Fraud Strategy and the adjustments required by the MFF 2021-2027.

Decentralised agencies, including eu-LISA, fall within the scope of this strategy. DG HOME 2021 AAR concluded that the fraud prevention and detection processes worked satisfactorily and therefore contributed to the assurance on the achievement of the internal control objectives.

The appropriations required for the development of the EU Digital Travel application by eu-LISA and recurring costs as from 2031 have neither been planned under the eu-LISA 2021-2027 MFF allocation, nor for DG HOME supplementary staff. The funding required for the development and maintenance of the EU Digital Travel application during the current MFF (EUR 6 million) may be made available via budgetary offsetting against BMVI (11.02.01 – Border management and visa instrument) or reallocation of other decentralised agencies budgets within DG HOME’s scope.

The budget shall include a contribution from countries associated with the implementation, application and development of the Schengen acquis as laid down in the respective agreements in force. The estimates shall be based on calculations for revenues for the implementation of the Schengen acquis from the States that currently contribute (Iceland, Norway and Switzerland) to the general budget of the European Union (consumed payments) an annual sum for the relevant financial year, calculated in accordance with its gross domestic product as a percentage of the gross domestic product of all the participating States. The calculation shall be based on figures from EUROSTAT which are subject to considerable variation depending on the economic situation of the participating States.