EUROPEAN COMMISSION
Brussels, 10.9.2026
COM(2026) 485 final
2026/0280(NLE)
Proposal for a
COUNCIL DECISION
on the conclusion of Framework Agreement between the European Union and the United States of America on the reciprocal exchange of information for identity verification, and screening and vetting, relating to border procedures and applications for travel authorizations and visas
EXPLANATORY MEMORANDUM
(1)CONTEXT OF THE PROPOSAL
•Reasons for and objectives of the proposal
In 2022, the United States of America (US) introduced a new requirement for all countries that have been admitted to or aspire to join the US Visa Waiver Program (VWP). This program enables citizens of participating countries to travel to the US visa-free for a maximum of 90 days for the purposes of tourism or business. The new requirement entails the conclusion of an “Enhanced Border Security Partnership” (EBSP) with the US Department of Homeland Security (DHS) as a condition for admission to, and further participation in, the VWP, as a component of the already existing traveller information exchange requirement.
The VWP partnerships are at the forefront of the US international cooperation on border and immigration security. One of their objectives is to establish robust bilateral exchanges of information to enable authorities to authenticate effectively the identity of travellers from partner countries and determine whether they represent a threat to US security.
As part of its VWP partnerships, the US concluded bilateral agreements with EU Member States, such as the Agreements on Enhancing Cooperation in Preventing and Combating Serious Crime (PCSC Agreements). These agreements established information exchange, including biometric data, on individuals who are suspected or convicted of terrorist offences or serious crime.
Under the EBSP, exchanges concern information, including biometric data, stored in national databases of Member States on individuals travelling or intending to travel to the US. The EBSP agreements are expected to be concluded by 31 December 2026. After this deadline, the DHS will assess each country’s compliance with the EBSP requirement during evaluations for initial and continued participation in the VWP.
The Commission Recommendation for the Council Decision authorising the opening of negotiations on a Framework Agreement between the European Union and the US was adopted on 23 July 2025 1 . The Council adopted the decision to authorise the opening of negotiations on 16 December 2026.
On 16 December 2025, the Council adopted the Decision authorising the opening of negotiations for a framework agreement between the European Union and the United States of America on the reciprocal exchange of information for security screenings and identity verifications relating to border procedures and visa applications 2 . The Commission was appointed as the Union negotiator. The Council Decision also included an addendum with the directives for the negotiation of such agreement (‘negotiation directives’).
The Commission conducted the negotiations in close consultation with the Council’s Working Party on JHA Information Exchange and kept the European Parliament informed of the evolution of the negotiations (LIBE Committee). The negotiations were completed on 23 July 2026.
The Framework Agreement sets the conditions for the reciprocal exchange of information between the competent authorities of the EU Member States and of the US for identity verification, screening and vetting of individuals in the context of border checks and applications for travel authorisations and visas necessary to determine whether the traveller’s entry or stay would pose a serious and genuine risk to public security or public order. The bilateral agreements between Member States and the US will set out the specifics of the information exchange with the US from their national information systems, considering national legal requirements, the set-up of national databases, and other technical requirements or limitations.
One of the key objectives of the Framework Agreement is to ensure reciprocity in the exchange of information with the US, which would help to enhance border protection and security of the Union as a whole. The Framework Agreement establishes rules for a reciprocal exchange of information. It provides for the exchange of information on third country nationals and EU and US citizens. Sharing information on EU citizens is possible under strict reciprocity whereby if the US categorically exempts their nationals, the Member States are entitled to decide on exempting all EU citizens. In line with the principles of necessity and proportionality, the Framework Agreement envisages an automated exchange of information necessary only for the identification of a person. Additional information can be provided upon request, with human oversight, and with the possibility to refuse providing such information.
The Framework Agreement applies to those Member States which enjoy a visa free status with the US or who wish to join the VWP. The Member States are allowed to halt information exchange as provided for in the Framework Agreement in case their status in the VWP changes. As regards bilateral agreements already concluded by Member States with the US prior to the entry into force of this Framework Agreement, the Framework Agreement includes the conditions under which such agreements remain applicable.
The entry into provisional application of the Framework Agreement is a matter of urgency due to the review of the VWP and the deadline set by the US to implement the EBSP requirement by end of 2026. In light of these circumstances, the Commission proposed to apply the Framework Agreement on a provisional basis as soon as possible and until the completion of the Parties’ respective internal procedures for the entry into force of the Framework Agreement.
•Consistency with existing policy provisions in the policy area
The Framework Agreement was negotiated taking into account the negotiating directives adopted by the Council 3 . The present Framework Agreement is also consistent with existing Union policies in the area of the common visa policy and its objective for visa reciprocity, as well as with EU’s data protection framework.
This Framework Agreement contributes to fulfilling the objectives of the Union’s common visa policy. The Union has developed a common visa policy for short stays (up to 90 days in any 180-day period) based on Regulation 2018/1806 4 . The Visa Regulation lists the third countries whose nationals must be in possession of visa when crossing the external borders and those whose nationals are exempt from that requirement. Currently, US nationals enjoy visa-free status in the Schengen area. In parallel, the Union has concluded visa waiver and visa facilitation agreements with several third countries 5 .
The principle of reciprocity is one of the foundations of the Union’s visa policy with third countries. Reciprocity means that where the Union has granted to citizens of a third country visa-free access to visit the Schengen area, it expects the third country to reciprocate by allowing Union citizens to travel to that third country without the need for a visa as well. The Union aims to achieve full visa reciprocity with third countries whose nationals are exempted from the visa requirement to enter the Schengen area. Full reciprocity has indeed been achieved with all visa-free third countries, except the US With the exception of Bulgaria, Cyprus and Romania, all Member States participate in the US VWP. Achieving full reciprocity with the US remains a political objective actively pursued by the Union.
This Framework Agreement thus ensures a consistent approach for all Member States participating in the VWP in relation to the EBSP requirement.
•Consistency with other Union policies
The Framework Agreement is consistent with the requirements under EU data protection laws to provide safeguards for the transfers of personal information to third countries.
In the EU, the processing of personal data by Member States is governed by Regulation (EU) 2016/679 6 (the ‘GDPR’), except for the processing of data by criminal law enforcement authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties which is covered by Directive (EU) 2016/680 7 . For data transfers between criminal law enforcement authorities for the prevention, investigation, detection or prosecution of criminal offenses, including terrorism, the EU-US ‘Umbrella Agreement’ provides for an international agreement ensuring appropriate safeguards 8 .
Given the different scope and purpose of the information exchange intended by the EBSP, the EU-US ‘Umbrella Agreement’ is not applicable to the transfers envisaged by the US under the EBSP, therefore throughout the Framework Agreement, data protection safeguards have been added.
Part III of the Framework Agreement provides for the necessary safeguards, in line with the GDPR and Article 8 of the Charter of the Fundamental Rights, including provisions ensuring a number of data protection principles and obligations that must be respected by both Parties. These provisions ensure enforceable individual rights, independent supervision and effective administrative and judicial redress for violations of the rights and safeguards recognised in the Framework Agreement resulting from the processing of personal data under this Framework Agreement. The Commission ensured that the Framework Agreement sets out rules for the exchange of personal data while providing for adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals.
(2)LEGAL BASIS, SUBSIDIARITY AND PROPORTIONALITY
·Substantive legal basis
Article 16(2) of the Treaty on the Functioning of the European Union (TFEU) provides for Union competence to adopt rules relating to the protection of personal data. Article 77(2) of the TFEU provides for Union competence to adopt rules relating to the common policy on visas and checks on persons at external borders.
The Framework Agreement between the European Union and the United States of America on the reciprocal exchange of information for identity verification, and screening and vetting, relating to border procedures and applications for travel authorizations and visas (hereafter the ‘Framework Agreement’) covers the conditions and safeguards for the exchange of information in the context of border procedures and applications for travel authorisations and visas.
Given that the main objectives and component of this Framework Agreement are to provide the conditions and safeguards for the transfer of personal information in the context of border procedures and applications for travel authorisations and visas, the substantive legal bases are Articles 16(2) and 77(2) TFEU.
Given the subject matter of the envisaged framework agreement, it is appropriate for the Commission to submit the proposal to the Council.
·Procedural legal basis
In accordance with Article 218(6) TFEU, where the agreement relates to matters outside of the common foreign and security policy (CFSP), the Council is to adopt a decision concluding the agreement on a proposal by the Commission as negotiator.
Given that Articles 16(2) and 77(2) of the TFEU are the substantive legal bases, the Council is to adopt the decision concluding the Framework Agreement after obtaining the consent of the European Parliament, in accordance with Article 216(6) point (a) TFEU.
Therefore, the procedural legal basis for the proposed decision on concluding the Framework Agreement is Article 218(6), second subparagraph, point (a).
·Union competence and proportionality
The Union has competence covering all the provisions of this Framework Agreement. In particular, transfers of personal information by Member States subject to appropriate safeguards provided by a legally binding and enforceable instrument are foreseen by Article 46(2)(a) of the GDPR. In addition, the Union can conclude international agreements concerning checks to which persons crossing external borders are subject as well as common policy on visas (Article 77(2) TFEU). The Union has, thus, competence to conclude this Framework Agreement with the US on the exchange of information in relation to the crossing of the external borders between the EU and the US, including on border procedures and applications for visas and travel authorisations.
A Framework Agreement concluded between the EU and the US is required to ensure the common visa policy objective for visa reciprocity and the safeguards of the EU’s data protection framework. In addition, this Framework Agreement is required to set an adequate level of information exchange between the EU and the US, which should not exceed the level of information sharing among the Member States in a bilateral or EU context, subject also to the principles of proportionality and necessity.
·Choice of the instrument
This proposal for a Council decision is submitted in accordance with Article 218(6) TFEU, which envisages the adoption by the Council of a decision concluding the agreement. There exists no other legal instrument that could be used in order to achieve the objective pursued by this proposal.
·Fundamental rights
The exchange of information under this Framework Agreement and its processing by the authorities of a third country constitutes an interference with the fundamental rights to privacy and data protection. However, such interference is justified, also because the Framework Agreement pursues legitimate objectives i.e. enhancing border security. The Framework Agreement includes appropriate data protection safeguards to the personal data transferred and processed, in line with EU law, notably Articles 7, 8, 47 and 52 of the Charter of Fundamental Rights of the EU.
(3)OTHER ELEMENTS
·Detailed explanation of the specific provisions of the proposal
The framework agreement sets forth the framework for the exchange of information as well as appropriate safeguards for the protection of personal information when transferred between the US and the Member States in the context of EBSP cooperation relating to border procedures and applications for travel authorisations and visas.
The framework agreement consists of five Parts, as follows:
Part 1 on Common Provisions contains the provisions setting out the objective and scope of the Framework Agreement, and the key definitions used in the agreement. This Framework Agreement covers information exchange on individuals crossing the external borders of the US and the Member States or applying for travel authorisation or a visa to enter or stay in the territory of the Member States or of the US. The exchange of information is guided by the principle of reciprocity, which includes, in particular, the similarity regarding maximum volume limits of information exchanged taking into account capacity and technical limitations of the competent authorities. This Part further addresses the relationship between this Framework Agreement and existing EBSPs between the US and some Member States that address matters within the scope of the Framework Agreement. This Framework Agreement will supplement, as appropriate, relevant provisions regarding the protection of personal information in existing EBSPs. The US will adapt existing EBSPs to ensure compliance with this Framework Agreement. The other cooperation channels and information exchanges dealt with in other agreements between the US and the EU and the US and the Member States remain unaffected by this Framework Agreement (e.g. EU-US mutual legal assistance treaty, bilateral mutual legal assistance treaties, bilateral PCSC agreements). It clarifies that this Framework Agreement in and of itself shall not be the legal basis for any transfers of personal information.
Part 2 on Principles and Conditions for the Information Exchange contains provisions setting the necessary conditions for the exchange of information. It stipulates that the information exchange under this Framework Agreement may only take place to the extent authorised and further specified in bilateral agreements between the Member States and the US. Such bilateral agreements must comply with the conditions and safeguards set in the Framework Agreement. Member States could suspend bilateral agreements particularly in cases of suspension of visa-free travel. This Part further sets the rules for an automated exchange of limited personal data needed for the identification of the individual during the assessment of an application for a travel authorisation or visa or during a border check. Where, during such assessment, there is reason to believe that the entry or stay could pose a serious and genuine risk to public security or public order, a query can be submitted in relation to such individual. In cases where there is information of potential interest for EBSP cooperation (i.e. showing that the entry or stay of an individual would pose a serious and genuine risk to public security or public order), such confirmation of risk would be communicated without delay, to the requesting authority following an assessment of all relevant factors, in accordance with national law and consistent with the technical capabilities of the requested authority. Additional information on the same individual may be provided after a human assessment of compliance with the conditions set in the Framework Agreement and the bilateral agreements. The exchange of information is to take place between single points of contact. This Part also provides for grounds for refusal to exchange information that can be used at any stage of the information exchange.
Part 3 on Protection of Personal Information sets out the purpose limitation (i.e. verification of identity, and screening and vetting, of individuals needed to determine whether their entry or stay would pose a serious and genuine risk to public security or public order) for the processing of personal information covered by this Framework Agreement. Further processing of personal information may only take place for purposes that are not incompatible with the original purpose. It distinguishes between onward sharing (within the same country, subject to the data protection safeguards of the Framework Agreement) and onward transfers (to third countries or international organisations, only with prior consent of the requested competent authority, after an assessment of the level of data protection that would be ensured). Both onward sharing and transfers are limited to public authorities. Personal data will only be retained for as long as this is necessary and appropriate, taking into account specific factors listed in the Framework Agreement and subject to at least an annual review of the retention period. This Part provides safeguards for the processing of special categories of data, and includes transparency and information obligations, on individuals’ rights to access and correct their own data. Parties are required to have in place effective administrative and judicial remedies to provide redress for individuals, as well as independent oversight mechanisms.
Part 4 on Institutional Framework includes a single provision establishing a Joint Committee: a joint body of the Parties to the Framework Agreement entrusted with the monitoring of the effective implementation of the Framework Agreement, including by carrying out periodic joint reviews of the implementation of this Framework Agreement.
Part 5 on Final Provisions covers a number of final clauses regarding consultations in case of disputes regarding the way the Framework Agreement is interpreted or applied; the possibility to suspend the Framework Agreement in case of material breach of the agreement by the other party; the territorial application of the Framework Agreement considering the specific situation of Ireland and Denmark; the duration and amendment of the agreement; possibility of each party to terminate the agreement, while it is specified that personal information transferred prior to the termination will continue to be processed in accordance with the rules of this Framework Agreement; the entry into force of the agreement and language clause.
·Text of the Agreement and notifications
The text of the Agreement is submitted to the Council together with this proposal.
In accordance with the Treaties, it is for the Commission to proceed to make the notification provided for in Article 31 paragraph 1 of the Framework Agreement, in order to express the consent of the Union to be bound by the Agreement.
2026/0280 (NLE)
Proposal for a
COUNCIL DECISION
on the conclusion of Framework Agreement between the European Union and the United States of America on the reciprocal exchange of information for identity verification, and screening and vetting, relating to border procedures and applications for travel authorizations and visas
THE COUNCIL OF THE EUROPEAN UNION,
Having regard to the Treaty on the Functioning of the European Union, and in particular Articles 77(2) and 16(2), in conjunction with Article 218(6), second subparagraph, point (a), and Article 218(7) thereof,
Having regard to the proposal from the European Commission,
Having regard to the consent of the European Parliament 9 ,
Whereas:
(1)In accordance with Council Decision […] of […] 10 , the Framework Agreement between the European Union and the United States of America on the reciprocal exchange of information for identity verification, and screening and vetting, relating to border procedures and applications for travel authorizations and visas (the ‘Framework Agreement’) was signed on […], subject to its conclusion at a later date, and has been applied on a provisional basis since […], pending its entry into force.
(2)The United States of America have introduced a new requirement for admission to and further participation in the U.S. Visa Waiver Program, which enables citizens of participating countries to travel to the United States visa-free for maximum 90 days for the purpose of tourism or business. The new requirement entails the conclusion of an ‘Enhanced Border Security Partnership’ (EBSP) with the U.S. Department of Homeland Security.
(3)This Framework Agreements sets a common framework for information exchange in the context of the EBSP between the Union and the United States of America.
(4)The Framework Agreement allows for the conclusion of bilateral agreements between the United States of America and the Member States on matters covered by the Framework Agreement. The provisions of such bilateral agreements are to be compatible with those of the Framework Agreement and with Union law.
(5)In addition, in the event that this Framework Agreement is terminated or suspended bilateral agreements between the Member States and the United States of America on matters covered by the Framework Agreement should, in full respect of the principle of sincere cooperation, be terminated or suspended, as the case may be. The Member States should inform the Commission of the termination or suspension of these bilateral agreements.
(6)In accordance with Articles 1 and 2 of Protocol No 22 on the Position of Denmark annexed to the Treaty on European Union and to the TFEU, Denmark is not taking part in the adoption of this Decision and is not bound by it or subject to its application. Given that this Decision builds upon the Schengen acquis, the Kingdom of Denmark to, in accordance with Article 4 of that Protocol, decide within a period of six months after the Council has adopted this Decision whether it will implement it in its national law.
(7)This Decision constitutes a development of the provisions of the Schengen acquis in which Ireland does not take part, in accordance with Council Decision 2002/192/EC; Ireland is therefore not taking part in its adoption and is not bound by it or subject to its application.
(8)A common understanding was reached during the negotiations on the situation of Denmark and Ireland in relation to the Schengen acquis, as well as of the close relationship between the European Union and Norway, Iceland, Switzerland and Liechtenstein, particularly by virtue of the Agreements of 18 May 1999 and 26 October 2004 concerning the association of those countries with the implementation, application and development of the Schengen acquis.
(9)The Framework Agreement should be approved,
HAS ADOPTED THIS DECISION:
Article 1
The Framework Agreement between the European Union and the United States of America on the reciprocal exchange of information for identity verification, and screening and vetting, relating to border procedures and applications for travel authorizations and visas is hereby approved.
Article 2
(2)Any decision of the Union to take measures related to the provision of guidance in accordance with Article 27(4)(c) shall be taken by the European Commission in accordance with the conditions set out in the corresponding provisions of the Framework Agreement.
(3)The Commission shall inform the Council in a timely manner of its intention to adopt the proposed measures set out in paragraph 1 and take into account the possible views expressed. The Commission shall also inform the European Parliament, as appropriate.
Article 3
This Decision shall enter into force on the day of its adoption.
Done at Brussels,
For the Council
The President