2018.574 EU Implementing
2018.574 EU Implementing
2018.574 EU Implementing
Having regard to Directive 2014/40/EU of the European Parliament and of the Council of 3 April 2014 on the approxi
mation of the laws, regulations and administrative provisions of the Member States concerning the manufacture,
presentation and sale of tobacco and related products and repealing Directive 2001/37/EC (1), and in particular
Article 15(11) thereof,
Whereas:
(1) In order to address the issue of illicit trade in tobacco products, Directive 2014/40/EU provides that all unit
packets of tobacco products are to be marked with a unique identifier in order for their movements to be
recorded. This will enable such products to be tracked and traced throughout the Union. Technical specifications
regarding the system's establishment and operation, as well as its compatibility throughout the Union, should be
laid down.
(2) Rules concerning the marking of packages with a unique identifier, the recording and transmission of data, the
processing, storing and accessing of data and the compatibility of components of the traceability system should
be set.
(3) Legislative action at Union level is also necessary in order to implement Article 8 of the Protocol to Eliminate
Illicit Trade in Tobacco Products to the World Health Organisation's Framework Convention on Tobacco
Control (2) (‘WHO FCTC Protocol’), which has been ratified by the European Union (3) and provides for a global
tracking and tracing regime for tobacco products, to be established by the Parties to the WHO FCTC Protocol
within five years of its entry into force.
(4) In order to combat multiple existing types of fraudulent activities that result in illicit products being made
available to consumers, including practices that entail the false declaration of exports, the traceability system
provided for under this Regulation is to apply, in accordance with Article 15 of Directive 2014/40/EU, to all
tobacco products manufactured in the Union, as well as to those manufactured outside the Union insofar as they
are destined for or placed on the Union market.
(5) In order to provide for the independence of the traceability system and guarantee that it is controlled by the
Member States, as provided for under Article 8 of the WHO FCTC Protocol, a proper assignment of roles in
relation to the marking of packages with a unique identifier is essential. The key task of generation of the unique
identifiers at unit packet level should be attributed to an independent third party appointed by each Member
State (‘ID issuer’).To avoid the risk that two or more ID issuers, independently of each other, generate the same
unique identifier, each ID issuer should be identified by a unique identification code, which should also form part
of the unique identifiers issued by them.
(6) In order to guarantee the uniqueness of the identifier, a serial number generated by the ID issuer should form
part of each unique identifier that has a negligible probability of being guessed by falsifiers.
(7) When requesting unit packet unique identifiers from an ID issuer, manufacturers and importers should be
required to provide all information necessary for the issuer to be able to generate that identifier, in accordance
with Article 15(2), points (a) to (h) of Directive 2014/40/EU, with the exception of date and time of manufacture,
which may not be possible to determine in advance and which should be added by economic operators at the
moment of production.
(8) The length of the unit level unique identifier may impact the speed at which it can be applied to unit packets by
tobacco product manufacturers or importers. In order to avoid an excessive impact on this process whilst
ensuring sufficient space for all information required at unit packet level, the maximum permitted number of
alphanumeric characters for the unit level unique identifier should be laid down.
(9) In order to ensure that unit level unique identifiers are capable of meeting the requirements relating to the
maximum permitted number of alphanumeric characters, information required under Article 15(2) points (a)
to (h) of Directive 2014/40/EU should be translated into code.
(10) For the purpose of enabling the competent authorities of the Member States to decode the unique identifiers
without accessing the information stored in the repositories system, flat-files should be established and
maintained by the ID issuers. Such flat-files should enable all information codified in the unique identifier codes
to be identified. The size of such flat-files should be defined, in order to ensure that they can be downloaded to
the devices used by Member States when reading the unique identifiers in offline mode (offline flat-files).
(11) Directive 2014/40/EU provides that the recording obligations established pursuant to Article 15 may be
complied with by the marking and recording of aggregated packaging, such as cartons, mastercases or pallets,
provided that the tracking and tracing of all unit packets remains possible. Where economic operators opt to
make use of that possibility, they should be required to ensure that such packaging is marked with an aggregated
level identifier which is also unique and therefore capable of unequivocally identifying any lower aggregated
levels and ultimately the unit packets that it contains.
(12) In order to ensure that all movements of the unit packets can be recorded and transmitted, manufacturers and
importers should verify the unique identifiers so as to ensure their correct application and readability. To control
this critical process for the unit level unique identifiers, anti-tampering devices, which are to be supplied by an
independent third party, should be installed on the devices used for verification purposes. In laying down rules
on the installation of such devices, it is appropriate to take into account differences between undertakings,
particularly as regards their size, production output and nature of the production process, so as to ensure that
compliance with this requirement does not entail an excessive burden, particularly, on smaller operators,
including small and medium-sized enterprises (SMEs). As anti-tampering devices are of particular relevance to the
automated production of tobacco products, for the purpose of ensuring that the integrity of unit level unique
identifiers is adequately protected, it is appropriate to limit the obligation to install such devices to operators
other than those that use fully manual production processes.
(13) In order to minimise the impact of the traceability system on production and distribution schemes, economic
operators should be permitted to order batches of the unique identifiers in advance. However, to avoid
overstocking of the unique identifiers by economic operators and to control the size of individual orders, a time
limit for the application of unique identifiers issued at both unit packet and aggregated levels should be set. These
measures should also alleviate potential excessive impacts on the generation and issuing activities performed by
the ID issuers.
(14) In order to ensure the proper functioning of the traceability system, economic operators and operators of first
retail outlets should apply in advance to the relevant ID issuers for an economic operator identifier code and for
a facility identifier code for each facility. The assignment of economic operator identifier codes and facility
identifier codes permits the efficient identification of all purchasers and of the actual shipment route from manu
facturing to the first retail outlet as provided for in Article 15(2) points (i) and (j) of Directive 2014/40/EU.
16.4.2018 EN Official Journal of the European Union L 96/9
(15) Manufacturers or importers should in addition apply for an identifier code for machines used to manufacture
tobacco products. The obligation to apply for machine identifier codes permits the efficient identification of the
machine used to manufacture the tobacco products in accordance with Article 15(2) point (c) of Directive
2014/40/EU.
(16) In order to ensure that the information contained in the unique identifier is capable of being recorded and
transmitted by all relevant economic operators, as well as to guarantee the compatibility of the unique identifier
with external components such as scanning devices, the types of permitted data carriers should be specified.
(17) In order for the traceability system to be able to achieve its objective, it is necessary for it to be capable of
enabling easy transmission of all relevant data, providing secure storage of data and ensuring full access to this
data for the Commission, the competent authorities of the Member States and the external auditor. The storage
architecture should further allow manufacturers and importers to select independent third party data storage
providers with which to conclude data storage contracts for the purpose of hosting data related exclusively to
their tobacco products (‘primary repositories’), as provided for by Article 15(8) of Directive 2014/40/EU, whilst
ensuring authorities are provided with full access to all stored data for the purpose of carrying out their
monitoring and enforcement activities. The effectiveness of such monitoring and enforcement activities requires
the presence of a single second-level repository system (‘secondary repository’), containing a copy of all the data
stored in the primary repositories and providing authorities with a global overview of the functioning of the
traceability system. A routing system, operated by the provider of the secondary repository, should be established
in order to provide economic operators other than manufacturers and importers with a single entry point to
submit the data recorded by them to the traceability system and thereby ease the data transmission. At the same
time, the routing service should ensure that data are transmitted to the correct primary repository.
(18) In order to guarantee full access for relevant authorities and to contribute to the efficient functioning of the
traceability system, the provider of the secondary repository should develop user interfaces enabling the stored
data to be viewed and queried. In accessing the repositories system the relevant authorities should be able to rely
on the eIDAS (1) based reusable solutions provided as building blocks under the telecommunication part of the
Connecting Europe Facility. In addition, to facilitate effective surveillance and enforcement, the user interface
should allow for the possibility to define individual automatic alerts based on specific reporting events.
(19) To ensure interoperability of the components of the repositories system, technical specifications, based on non-
proprietary open standards, should be established for the exchange of data between the primary repositories, the
secondary repository and the routing system.
(20) In order to ensure that the required information is recorded and transmitted in a timely and uniform manner by
all economic operators, the precise list of supply chain and transactional events that are required to be recorded
under Article 15(2), points (i), (j) and (k) of Directive 2014/40/EU, as well as the content of the information
messages to be transmitted, should be laid down.
(21) Given that the aim of a traceability system is to provide Member States and the Commission with an effective
tool to fight illicit trade of tobacco products, timely availability of supply chain and transactional event data is
necessary for investigation and enforcement purposes. The maximum time that may elapse between the
occurrence of a relevant supply chain or transactional event and the transmission of the related information to
the relevant data storage repository should therefore be established. In laying down such time-limits, it is
appropriate to take into account differences between undertakings, particularly as regards their size and
production output, so as to ensure that compliance with reporting obligations does not entail an excessive
burden, particularly on smaller operators, including small and medium-sized enterprises (SMEs).
(22) For investigation and enforcement purposes, it is necessary that competent authorities of Member States and the
Commission have access to a record of all economic operators and operators of first retail outlets involved in the
trade of tobacco products, as well as the facilities and machines that are used by them to manufacture, store and
process their products. Therefore, each ID issuer should establish and maintain a registry that contains the
(1) Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust
services for electronic transactions in the internal market and repealing Directive 1999/93/EC (OJ L 257, 28.8.2014, p. 73).
L 96/10 EN Official Journal of the European Union 16.4.2018
identifier codes for economic operators, operators of first retail outlets, machines and facilities referred to above.
An up-to-date copy of these registries, along with the corresponding information, should be transferred electron
ically via the router to the secondary repository and compiled into an EU-wide register.
(23) Given the requirement for the traceability system to be independent of manufacturers and importers of tobacco
products and to be under the control of the Member States, as provided for under Article 8 of the WHO FCTC
Protocol, common criteria for the assessment of independence of all third parties involved in the traceability
system (ID issuers, providers of repository services and anti-tampering devices) should be laid down. In order to
ensure the continuing respect of the requirement for independence that is critical for ensuring and maintaining
the integrity of the traceability system, the procedures governing the appointment of the ID issuers and other
independent providers and the monitoring of their compliance with the independence criteria set out in this
Regulation should undergo periodic review by the Commission. Conclusions of the review should be published
by the Commission and form part of the report on the application of Directive 2014/40/EU provided for under
Article 28 of that Directive.
(24) The protection of personal data processed in the context of a traceability system should be ensured in accordance
with Directive 95/46/EC of the European Parliament and of the Council (1).
(25) Recourse to international standards should be possible for the purposes of demonstrating fulfilment of certain
technical requirements laid down in this Regulation. Where it is not possible to prove compliance with internat
ional standards, it should be the responsibility of the persons to whom the obligations are imposed to prove, by
verifiable means, that they comply with those requirements.
(26) The measures provided for in this Regulation are in accordance with the opinion of the Committee referred to in
Article 25 of Directive 2014/40/EU,
CHAPTER I
Article 1
Subject matter
This Regulation lays down the technical standards for the establishment and operation of the traceability system
provided for in Article 15 of Directive 2014/40/EU.
Article 2
Definitions
For the purposes of this Regulation, in addition to the definitions laid down in Article 2 of Directive 2014/40/EU, the
following definitions shall apply:
(1) ‘unique identifier’ means the alphanumeric code enabling the identification of a unit pack or an aggregated
packaging of tobacco products;
(2) ‘economic operator’ means any natural or legal person who is involved in the trade of tobacco products, including
for export, from the manufacturer to the last economic operator before the first retail outlet;
(3) ‘first retail outlet’ means the facility where tobacco products are placed on the market for the first time, including
vending machines used for the sale of tobacco products;
(1) Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to
the processing of personal data and on the free movement of such data (OJ L 281, 23.11.1995, p. 31).
16.4.2018 EN Official Journal of the European Union L 96/11
(5) ‘aggregated packaging’ means any packaging containing more than one unit packet of tobacco products;
(6) ‘facility’ means any location, building or vending machine where tobacco products are manufactured, stored or
placed on the market;
(7) ‘anti-tampering device’ means the device allowing for the recording of the verification process following the
application of each unit level unique identifier by means of a video or a log file, which once recorded cannot be
further altered by an economic operator;
(8) ‘offline flat-files’ means the electronic files established and maintained by each ID issuer that contain data in a plain
text format allowing for the extraction of information encoded in the unique identifiers (excluding the time stamp)
used at the unit packet and aggregated packaging levels without accessing the repositories system;
(9) ‘registry’ means the record established and maintained by each ID issuer of all the identifier codes generated for
economic operators, operators of first retail outlets, facilities and machines along with the corresponding
information;
(10) ‘data carrier’ means a carrier representing data in a form readable with the aid of a device;
(11) ‘machine’ means the equipment used for the manufacture of tobacco products which is integral to the manufactur
ing process;
(12) ‘time stamp’ means the date and time of occurrence of a particular event recorded in UTC (Coordinated Universal
Time) time in a prescribed format;
(13) ‘primary repository’ means a repository storing traceability data relating exclusively to the products of a given
manufacturer or importer;
(14) ‘secondary repository’ means a repository containing a copy of all traceability data stored in the primary
repositories;
(15) ‘router’ means a device established within the secondary repository that transfers data between different
components of the repositories system;
(16) ‘repositories system’ means the system consisting of the primary repositories, the secondary repository and the
router;
(17) ‘common data dictionary’ means a set of information describing the contents, format, and structure of a database
and the relationship between its elements, used to control access to and manipulation of the databases common
for all primary and secondary repositories;
(18) ‘working day’ means every day of work in the Member State for which the ID issuer is competent;
(19) ‘trans-loading’ means any transfer of tobacco products from one vehicle to another during which tobacco products
do not enter and exit a facility;
(20) ‘vending van’ means a vehicle used for the delivery of tobacco products to multiple retail outlets in quantities that
have not been predetermined in advance of the delivery.
CHAPTER II
SECTION 1
Common provisions
Article 3
ID issuer
1. Each Member State shall appoint an entity (the ‘ID issuer’) responsible for generating and issuing unique identifiers,
in accordance with Articles 8, 9, 11 and 13, within a maximum period of one year from the date of entry into force of
this Implementing Regulation.
L 96/12 EN Official Journal of the European Union 16.4.2018
2. Member States shall ensure that an ID issuer that intends to have recourse to subcontractors for the performance
of its functions shall only be considered for appointment if the identity of any subcontractors proposed has been
communicated to them.
3. The ID issuer shall be independent and comply with the criteria set out in Article 35.
4. Each ID issuer shall be equipped with a unique identification code. The code shall be composed of alphanumeric
characters and comply with the International Organization for Standardisation/International Electrotechnical
Commission standard (‘ISO/IEC’) 15459-2:2015.
5. Where the same ID issuer is appointed in more than one Member State, it shall be identifiable by the same code.
6. Member States shall notify the Commission of the appointment of the ID issuer and of its identification code
within one month of its appointment.
7. Member States shall ensure that information related to the identity of the ID issuer appointed and its identification
code is made publicly available and accessible online.
(a) that the ID issuer it has appointed continues to comply with the requirement of independence in accordance with
Article 35; and
(b) the continuous operation of the services provided by successive ID issuers, in case a new ID issuer is appointed to
take over the services from the previous ID issuer. For this purpose Member States shall require the ID issuer to
develop an exit plan laying down the procedure to be followed to guarantee the continuity of the operations until
the new ID issuer is appointed.
9. The ID issuer may establish and charge fees to economic operators solely for generating and issuing unique
identifiers. Fees are to be non-discriminatory and proportionate to the number of unique identifiers generated and issued
to economic operators taking into account the mode of delivery.
Article 4
1. For tobacco products manufactured in the Union, the competent ID issuer shall be the entity appointed for the
Member State in which the products are manufactured.
By derogation to the first subparagraph, the competent ID issuer shall be the entity appointed for the Member State on
whose market the products are placed, where such a requirement is imposed by that Member State.
2. For tobacco products imported into the Union, the competent ID issuer shall be the entity appointed for the
Member State on whose market the products are placed.
3. For tobacco products aggregated in the Union, the competent ID issuer shall be the entity appointed for the
Member State in which the products are aggregated.
4. For tobacco products destined for export, the competent ID issuer shall be the entity appointed for the Member
State in which the products are manufactured.
5. In the event of the temporary absence of the competent ID issuer, the Commission may authorise economic
operators to use the services of another ID issuer that has been appointed in accordance with Article 3.
16.4.2018 EN Official Journal of the European Union L 96/13
Article 5
1. Unique identifiers generated by ID issuers may be used to mark unit packets or aggregated packaging, as provided
for by Articles 6 and 10, within a maximum period of six months from the date of receipt of the unique identifiers by
the economic operator. After this time period unique identifiers shall become invalid and economic operators shall
ensure that they are not used to mark unit packets or aggregated packaging.
2. The repositories system shall ensure that the unique identifiers that have not been used within the six months
period referred to in paragraph 1 shall be automatically deactivated.
3. At any time, manufacturers and importers may obtain the deactivation of unique identifiers by transmitting
a deactivation request to the relevant primary repository. Other economic operators may obtain the deactivation of the
unique identifiers by transmitting a deactivation request via the router. The deactivation request shall be introduced elec
tronically, in accordance with Article 36, and shall contain the information listed in point 2.3 of Section 2 of Chapter II
of Annex II, in the format indicated therein. The deactivation shall not interfere with the integrity of the information
already stored related to the unique identifier.
SECTION 2
Article 6
1. Manufacturers and importers shall mark each unit packet manufactured or imported in the Union with a unique
identifier (‘unit level UI’) compliant with Article 8.
2. In the case of tobacco products that are manufactured outside the Union, the unit level UI shall be applied on the
unit packet before the tobacco product is imported in the Union.
Article 7
1. Manufacturers and importers shall ensure that the application of unit level UIs is directly followed by the
verification of those unit level UIs in terms of correct application and readability.
2. The process referred to in paragraph 1 shall be protected with an anti-tampering device supplied and installed by
an independent third party who shall provide a declaration to the relevant Member States and the Commission that the
installed device meets the requirements of this Regulation.
3. Where the process referred to in paragraph 1 fails to confirm the correct application and full readability of the
unit level UI, manufacturers and importers shall re-apply the unit level UI.
4. Manufacturers and importers shall ensure that the information recorded by the anti-tampering device remains
available for a period of nine months from the time of recording.
5. Manufacturers and importers shall, upon request from Member States, provide full access to the record of the
verification process created by the anti-tampering device.
6. By way of derogation from paragraphs 2, 4 and 5, the obligation to install an anti-tampering device shall not
apply:
(a) until 20 May 2020 to production processes operated by economic operators, or where applicable, the group of
undertakings to which they belong, that handled less than 120 million unit level UIs at Union level during the
calendar year 2019;
L 96/14 EN Official Journal of the European Union 16.4.2018
(b) until 20 May 2021 to production processes operated by economic operators falling under the definition of small
and medium enterprises set out in Commission Recommendation 2003/361/EC (1);
Article 8
1. Each unit packet of tobacco products shall be marked with a unit level UI. It shall consist of as short a sequence of
alphanumeric characters as possible, not exceeding 50 characters. The sequence shall be unique to a given unit packet
and shall be composed of the following data elements:
(a) in the first position, the alphanumeric characters that constitute the ID issuer identification code assigned pursuant
to Article 3(4);
(b) an alphanumeric sequence, whose probability to be guessed shall be negligible and in any case lower than one in ten
thousand (‘serial number’);
(c) a code (‘product code’) allowing for the determination of the following:
iii. the machine used to manufacture the tobacco products referred to in Article 18;
(d) in the last position, the time stamp in the form of a numeric sequence of eight characters, in the format
YYMMDDhh, indicating the date and time of manufacture.
2. ID issuers shall be responsible for the generation of a code consisting of the elements listed in paragraph 1,
points (a), (b), and (c).
3. Manufacturers or importers shall add the time stamp referred to in paragraph 1, point (d), to the code generated
by the ID issuer pursuant to paragraph 2.
4. Unit level UIs shall not include any data elements other than those listed in paragraph 1.
Where ID issuers use encryption or compression for the generation of unit level UIs, they shall inform the competent
authorities of the Member States and the Commission of algorithms used for such encryption and compression. Unit
level UIs shall not be reused.
Article 9
1. Manufacturers and importers shall send a request to the competent ID issuer for unit level UIs referred to in
Article 8. Requests shall be introduced electronically, in accordance with Article 36.
2. Manufacturers and importers introducing such a request shall supply the information listed in point 2.1. of
Section 2 of Chapter II of Annex II, in the format indicated therein.
(1) Commission Recommendation of 6 May 2003 concerning the definition of micro, small and medium-sized enterprises (OJ L 124,
20.5.2003, p. 36).
16.4.2018 EN Official Journal of the European Union L 96/15
3. The ID issuer shall, within two working days from the receipt of the request and in the order indicated:
(b) transmit the codes along with the information referred to in paragraph 2 of this Article via the router to the
primary repository of the requesting manufacturer or importer, as established under Article 26; and
4. However, a Member State may require ID issuers to offer physical delivery of unit level UIs as an alternative to
electronic delivery. In cases where physical delivery of unit level UIs is offered, manufacturers and importers shall specify
whether physical delivery is requested. In that case, the ID issuer shall within 10 working days from the receipt of the
request, and in the following order:
(b) transmit the codes along with the information referred to in paragraph 2 via the router to the primary repository of
the requesting manufacturer or importer, as established under Article 26;
(c) deliver the codes to the requesting manufacturer or importer in the form of optical barcodes, compliant with
Article 21, placed on physical carriers, such as adhesive labels.
5. Within one working day, manufacturers and importers may cancel a request which was sent pursuant to
paragraph 1 by means of a recall message as further defined in Point 5 of Section 5 of Chapter II of Annex II.
SECTION 3
Article 10
1. Where economic operators choose to comply with the recording obligations provided for under Article 15(5) of
Directive 2014/40/EU by means of the recording of aggregated packaging, they shall mark aggregated packages
containing tobacco products with a unique identifier (‘aggregated level UI’).
2. Aggregated level UIs shall be generated and issued on the basis of a request to the competent ID issuer or directly
by the economic operator.
3. Where the aggregated level UI is generated on the basis of a request to the competent ID issuer, it shall comply
with the structure set out in Article 11(1).
4. Where the aggregated level UI is generated directly by the economic operator, it shall consist of an individual unit
code generated in accordance with ISO/IEC 15459-1:2014 or ISO/IEC 15459-4:2014 or their latest equivalents.
Article 11
1. For aggregated level UI generated on the basis of a request to the competent ID issuer, the structure of the
aggregated level UI shall consist of a sequence of a maximum of 100 alphanumeric characters that is unique to a given
aggregated package and shall be composed of the following data elements:
(a) in the first position, the alphanumeric characters that constitute the ID issuer identification code assigned under
Article 3(4);
L 96/16 EN Official Journal of the European Union 16.4.2018
(b) an alphanumeric sequence, whose probability to be guessed shall be negligible and in any case lower than one in ten
thousand (‘serial number’);
(c) the identifier code of the facility (as set out in Article 16) in which the aggregation process took place;
(d) in the last position, the time stamp in the form of a numeric sequence of eight characters, in the format
YYMMDDhh, indicating the date and time of aggregation.
2. ID issuers shall be responsible for the generation of a code consisting of the elements listed in paragraph 1,
points (a), (b), and (c).
3. Economic operators shall add the time stamp, referred to in paragraph 1, point (d), to the code generated by the
ID issuer pursuant to paragraph 2.
4. The aggregated level UI may be completed by the economic operator with additional information, provided that
the maximum character limit set out in paragraph 1 is not exceeded. Any such information may only appear after the
data referred to in paragraph 1.
Article 12
1. The aggregated level UI shall be capable of identifying the list of all unique identifiers contained within the
aggregated packaging by means of an electronically accessible link to the repositories system.
2. In order to establish the link referred to in paragraph 1, manufacturers and importers shall transmit to their
primary repository the information listed in point 3.2 of Section 2 of Chapter II of Annex II, in the format indicated
therein.
3. In order to establish the link referred to in paragraph 1, economic operators other than manufacturers and
importers shall transmit via the router to the secondary repository the information listed in point 3.2 of Section 2 of
Chapter II of Annex II, in the format indicated therein.
Article 13
1. Economic operators requesting aggregated level UIs on the basis of a request to the competent ID issuer shall
introduce such requests electronically, in accordance with Article 36.
2. Economic operators introducing such requests shall supply the information listed in point 2.2. of Section 2 of
Chapter II of Annex II, in the format indicated therein.
3. For manufacturers and importers, the ID issuer shall, within two working days from the receipt of the request and
in the order indicated:
(b) transmit the codes along with the information referred to in paragraph 2 via the router to the primary repository of
the requesting manufacturer or importer, as established under Article 26; and
4. For economic operators other than manufacturers and importers, the ID issuer shall, within two working days
from the receipt of the request and in the order indicated:
(b) transmit the codes along with the information referred to in paragraph 2 via the router to the secondary repository,
as established under Article 26; and
5. Within one working day, economic operators may cancel a request which was sent pursuant to paragraph 1 by
means of a recall message as further defined in point 5 of Section 5 of Chapter II of Annex II, in the format indicated
therein.
CHAPTER III
Article 14
1. Economic operators and operators of first retail outlets shall apply for an economic operator identifier code from
the ID issuer competent for each Member State in which they operate at least one facility. Importers shall apply for an
identifier code from the ID issuer competent for each Member State on whose market they place their products.
2. Economic operators and operators of first retail outlets introducing a request pursuant to paragraph 1 shall
provide the information listed in point 1.1 of Section 1 of Chapter II of Annex II, in the format indicated therein.
3. For operators of first retail outlets the obligation to apply for an economic operator identifier code may also be
discharged by any other registered economic operator. Such registration by the third party shall be subject to the
consent of the operator of the first retail outlet. The third party shall inform the operator of the first retail outlet of the
full details of the registration, including the allocated economic operator identifier code.
4. Economic operators and operators of first retail outlets shall inform the ID issuer of any economic operator
identifier codes allocated to them by other ID issuers. If not available at the time of registration, economic operators
shall provide that information at the latest within two working days from the receipt of the economic operator identifier
codes allocated by another ID issuer.
5. Any modification of the information submitted in the initial application form and any cessation of the operator
activities shall be notified by the relevant operator to the ID issuer without delay, in the formats indicated in points 1.2.
and 1.3. of Section 1 of Chapter II of Annex II.
Article 15
1. Upon receipt of a request pursuant to Article 14, the ID issuer shall generate an economic operator identifier code,
which consists of the following data elements, to be placed in the following order:
(a) in the first position, the alphanumeric characters that constitute the ID issuer identification code assigned under
Article 3(4); and
(b) in the second position, an alphanumeric sequence which is unique within the code pool of the ID issuer.
2. Within two working days, the ID issuer shall transmit the code to the requesting operator.
3. All the information submitted to the ID issuer in accordance with Article 14(2), and the corresponding identifier
codes, shall form part of a registry to be established, managed and kept up to date by the competent ID issuer.
4. In duly justified cases, Member States may, in accordance with their national laws, require the ID issuer to
deactivate an economic operator identifier code. In such cases the Member State shall inform the economic operator or
the operator of a first retail outlet of the deactivation, together with the grounds for such deactivation. The deactivation
of an economic operator identifier code shall lead to the automatic deactivation of related facility identifier codes and
machine identifier codes.
L 96/18 EN Official Journal of the European Union 16.4.2018
5. Economic operators and operators of first retail outlets shall exchange information on their respective economic
operator identifier codes in order to allow economic operators to record and transmit the transactional information, as
provided under Article 33.
Article 16
1. All facilities from manufacturing to the first retail outlet shall be identified by a code (‘facility identifier code’)
generated by the ID issuer competent for the territory in which the facility is located.
2. Economic operators and operators of first retail outlets shall apply for a facility identifier code providing to the ID
issuer the information listed in point 1.4. of Section 1 of Chapter II of Annex II, in the format indicated therein.
3. For first retail outlets, the obligation to apply for a facility identifier code shall lie with the operator of the first
retail outlet. This obligation may also be discharged by any other registered economic operator, who may act on behalf
of the operator of the first retail outlet. The registration by the third party shall be subject to the consent of the operator
of the first retail outlet. The third party shall inform the operator of the first retail outlet about the full details of the
registration, including the allocated facility identifier code.
4. The obligation to apply for a facility identifier code related to manufacturing facilities located outside the Union
shall lie with the importer established inside the Union. The importer shall apply to any ID issuer appointed by
a Member State on whose market they place their products. The registration by the importer shall be subject to the
consent of the entity responsible for the third country manufacturing facility. The importer shall inform the economic
operator responsible for the third country manufacturing facility about the full details of registration, including the
allocated facility identifier code.
5. Any modification of the information submitted in the initial application form and any facility closure shall be
notified by the economic operator to the ID issuer without delay, in the formats indicated in points 1.5 and 1.6 of
Section 1 of Chapter II of Annex II.
Article 17
1. Upon receipt of a request pursuant to Article 16, the ID issuer shall generate a facility identifier code, which
consists of the following data elements, to be placed in the following order:
(a) in the first position, the alphanumeric characters that constitute the ID issuer identification code assigned under
Article 3(4); and
(b) in the second position, an alphanumeric sequence which is unique within the code pool of the ID issuer.
2. Within two working days from the receipt of the request, the ID issuer shall transmit the code to the requesting
operator.
3. All the information submitted to the ID issuer in accordance with Article 16(2), and the corresponding identifier
codes shall form part of a registry to be established, managed and kept up to date by the competent ID issuer.
4. In duly justified cases, Member States may require the ID issuer to deactivate a facility identifier code. In such cases
the Member State shall inform the economic operator or the operator of a first retail outlet of the deactivation, together
with the grounds for such deactivation. The deactivation of a facility identifier code shall lead to the automatic
deactivation of related machine identifier codes.
16.4.2018 EN Official Journal of the European Union L 96/19
5. Economic operators and operators of first retail outlets shall exchange the information on their respective
economic operator identifier codes in order to allow economic operators to record and transmit the information on
product movements, as provided under Article 32.
Article 18
1. Each machine shall be identified by a code (‘machine identifier code’) generated by the ID issuer competent for the
territory in which the machine is located.
2. Manufacturers and importers shall apply for a machine identifier code by providing to the ID issuer the
information listed in point 1.7. of Section 1 of Chapter II of Annex II, in the format indicated therein.
3. The obligation to apply for a machine identifier code related to machines located in manufacturing facilities
outside the Union shall lie with the importer established inside the Union. The importer shall apply to any ID issuer
appointed by a Member State on whose market they place their products. The registration by the importer shall be
subject to the consent of the entity responsible for the third country manufacturing facility. The importer shall inform
the economic operator responsible for the third country manufacturing facility as to the full details of the registration,
including the allocated machine identifier code.
4. Any modification of the information submitted in the initial application form and any decommissioning of the
registered machines shall be notified by the manufacturer or the importer to the ID issuer without delay, in the formats
indicated in points 1.8 and 1.9 of Section 1 of Chapter II of Annex II.
Article 19
1. Upon receipt of a request pursuant to Article 18, the ID issuer shall generate a machine identifier code, which
consists of the following data elements, to be placed in the indicated position:
(a) in the first position, the alphanumeric characters that constitute the ID issuer identification code assigned under
Article 3(4); and
(b) in the second position, an alphanumeric sequence which is unique within the code pool of the ID issuer.
2. Within two working days, the ID issuer shall transmit the code to the requesting operator.
3. All the information submitted to the ID issuer in accordance with Article 18(2), and the corresponding identifier
codes shall form part of a registry to be established, managed and kept up to date by the relevant ID issuer.
4. In duly justified cases, Member States may require the ID issuer to deactivate a machine identifier code. In such
cases the Member State shall inform the manufacturers and importers of the deactivation, together with the grounds for
such deactivation.
Article 20
1. ID issuers shall establish offline flat-files, as well as registries relating to the information referred to in
Articles 14(2), 16(2) and 18(2), along with explanatory notes on the structures thereof.
2. Offline flat-files shall be no larger than two gigabytes per ID issuer. Each line of the flat-file shall hold one record
with fields separated by delimiters such as commas or tabs.
L 96/20 EN Official Journal of the European Union 16.4.2018
3. ID issuers shall ensure that an up-to-date copy of all offline flat-files, registries and related explanatory notes are
electronically provided via the router to the secondary repository.
4. Member States may adapt the size limit for offline flat-files referred to in paragraph 2, taking into account both
the average size of available memory installed on the verification devices used for offline checks of unique identifiers
and the total number of ID issuers.
CHAPTER IV
DATA CARRIERS
Article 21
1. Unit level UIs shall be encoded using at least one of the following types of data carriers:
(a) an optical device-readable Data Matrix with error detection and correction equivalent to or higher than those of the
Data Matrix ECC200. Barcodes conforming to ISO/IEC 16022:2006 shall be presumed to fulfil the requirements set
out in this point;
(b) an optical device-readable QR Code with a recovery capacity of approximately 30 %. Barcodes conforming to
ISO/IEC 18004:2015 with the error correction level H shall be presumed to fulfil the requirements set out in this
point;
(c) an optical device-readable DotCode with the error detection and correction equivalent to or higher than those
provided with the Reed-Solomon error correction algorithm with the number of check characters (NC) equal to
three plus the number of data characters (ND) divided by two (NC = 3 + ND/2). Barcodes conforming to the ISS
DotCode Symbology Specification published by the Association for Automatic Identification and Mobility (‘AIM’)
(revision 3.0, August 2014) shall be presumed to fulfil the requirements set out in this point.
2. In the case of unit level UIs delivered electronically, manufacturers and importers are responsible for encoding unit
level UIs in accordance with paragraph 1.
3. In the case of unit level UIs delivered physically, ID issuers are responsible for encoding the codes generated
pursuant to Article 8(2), in accordance with paragraph 1.
4. By way of derogation from paragraph 1, manufacturers and importers may add the time stamp separately from the
data carrier in the format YYMMDDhh as a human readable code.
5. Aggregated level UIs shall be encoded by economic operators using at least one of the following types of data
carriers:
(a) an optical device-readable Data Matrix with error detection and correction equivalent to or higher than those of the
Data Matrix ECC200. Barcodes conforming to ISO/IEC 16022:2006 shall be presumed to fulfil the requirements set
out in this point;
(b) an optical device-readable QR Code with a recovery capacity of approximately 30 %. Barcodes conforming to
ISO/IEC 18004:2015 with the error correction level H shall be presumed to fulfil the requirements set out in this
point;
(c) an optical device-readable Code 128 with the error detection equivalent to or higher than the one provided with the
algorithm based on the even/odd — bar/space character parity and the check character. Barcodes conforming to
ISO/IEC 15417:2007 shall be presumed to fulfil the requirements set out in this point.
6. In order to distinguish the data carriers referred to in paragraphs 1 and 5 from any other data carrier placed on
unit packets or aggregated packaging, economic operators may add the marking ‘TTT’ next to such data carriers.
16.4.2018 EN Official Journal of the European Union L 96/21
Article 22
1. Economic operators shall ensure high readability of the optical data carriers. A quality of the optical data carriers
rated at least 3.5 in accordance with ISO/IEC 15415:2011 for the two-dimensional data carriers, or in accordance with
ISO/IEC 15416:2016 for the linear symbols shall be presumed to fulfil the requirements set out in this Article.
2. Economic operators shall ensure that the optical data carriers are capable of remaining readable for at least five
years after their creation.
Article 23
Human-readable code
1. Economic operators shall ensure that each data carrier includes a human-readable code that enables electronic
access to the information related to the unique identifiers stored in the repositories system.
2. Where the dimensions of the packaging allow, the human-readable code shall be adjacent to the optical data
carrier carrying the unique identifier.
CHAPTER V
REPOSITORIES SYSTEM
Article 24
Article 25
(g) it shall allow for automatic validation of messages received from economic operators, including refusal of incorrect
or incomplete messages, in particular reporting activities related to non-registered or duplicated unique identifiers,
whereby the repositories system shall store the information concerning any refused message;
(h) it shall ensure messaging between all of its components which shall take place instantaneously, in accordance with
the requirements of this Regulation, in particular the overall response time of the repositories system in sending
acknowledgment messages, not considering the speed of the internet connection of the end user, which shall be no
more than 60 seconds;
(i) it shall ensure continuous availability of all components and services with a monthly uptime of at least 99,5 % and
sufficient back-up mechanisms in place;
(j) it shall be guarded by security procedures and systems ensuring that access to the repositories and download of the
data stored therein is only granted to persons authorised according to this Regulation;
(k) it shall be accessible by the competent authorities of Member States and by the Commission. National adminis
trators designated by the Member States and Commission services shall be granted access rights enabling them to
create, manage, and withdraw user access rights for repositories, and related operations stipulated in this Chapter,
via a graphical user management interface. The graphical user management interface shall be compatible with
Regulation (EU) No 910/2014, in particular the relevant reusable solutions provided as building blocks under the
telecommunication part of the Connecting Europe Facility. National administrators designated by the Member States
shall be able to grant subsequent access rights to other users under their responsibility;
(l) it shall enable Member States and the Commission to carry out downloads of full and selected sets of data stored in
a repository;
(m) it shall maintain a complete record (‘audit trail’) of all operations concerning the stored data of the users performing
those operations and of the nature of these operations, including the history of users access. The audit trail shall be
created when the data is uploaded for the first time and, notwithstanding any additional national requirements, be
maintained until at least five years after.
2. Data stored in the repositories system shall be used only for the purposes referred to in Directive 2014/40/EU and
this Regulation.
Article 26
Primary repositories
1. Each manufacturer and importer shall ensure the establishment of a primary repository. To that end each
manufacturer and importer shall contract an independent third party provider, in accordance with the contractual
requirements set out in Commission Delegated Regulation (EU) 2018/573 (1). The selection of the independent third
party shall take place in accordance with the procedural rules laid down in Annex I, Part A.
2. Each primary repository shall exclusively host information which relates to the tobacco products of the
manufacturer or importer who contracted the repository.
3. Whenever data are received by the primary repository on the basis of a reporting activity, or for any other
permitted reason, it shall be forwarded to the secondary repository instantaneously.
4. In forwarding all data received to the secondary repository, the primary repositories shall use the data format and
data exchange modalities defined by the secondary repository.
5. Primary repositories shall store the data in accordance with the common data dictionary provided by the
secondary repository.
6. Member States, the Commission, and external auditors approved by the Commission shall be able to carry out
basic query requests in relation to all data stored in a primary repository.
(1) Commission Delegated Regulation (EU) 2018/573 of 15 December 2017 on key elements of data storage contracts to be concluded as
part of a traceability system for tobacco products (see page 1 of this Official Journal).
16.4.2018 EN Official Journal of the European Union L 96/23
Article 27
Secondary repository
1. A single secondary repository containing a copy of all data stored in primary repositories shall be established. The
operator of the secondary repository shall be appointed from among the providers of primary repositories in
accordance with the procedure laid down in Annex I, Part B.
2. The secondary repository shall provide for graphical and non-graphical user interfaces that enable Member States
and the Commission to access and query the data stored in the repositories system, using all commonly available
database search functions, in particular by remotely carrying out the following operations:
(a) retrieval of any information concerning one or multiple unique identifier(s), including the comparison and cross-
checking of multiple unique identifiers and the related information, in particular their location in the supply chain;
(b) creation of lists and statistics, such as product stocks and inflow/outflow numbers, associated with one or multiple
elements of reporting information listed as Data Fields in Annex II;
(c) identification of all tobacco products that have been reported by an economic operator to the system, including the
products reported as recalled, withdrawn, stolen, missing or intended for destruction.
3. The user interfaces referred to in paragraph 2 shall enable each Member State and the Commission to define
individual rules for:
(a) automatic alerting based on exceptions and specific reporting events, such as abrupt fluctuations or irregularities in
trade, attempts to introduce duplicate unique identifiers into the system, deactivation of the identifiers referred to in
Articles 15(4), 17(4) and 19(4), or where a product is indicated by economic operators as stolen or missing;
(b) the receipt of periodic reports based on any combination of the elements of reporting information listed as Data
Field in Annex II.
4. Automatic alerts and periodic reports referred to in paragraph 3 shall be forwarded to recipient addresses indicated
by Member States and the Commission such as individual email addresses and/or internet Protocol (IP) addresses
belonging to external systems used and managed by national authorities or the Commission.
5. The user interfaces referred to in paragraph 2 shall enable Member States and the Commission to connect
remotely to the data stored in the repositories system with the analytical software of their choice.
6. The user interfaces referred to in paragraph 2 shall be provided in the official languages of the Union.
7. The overall response time of the repository to any given query or alert trigger, not considering the speed of the
internet connection of the end user, shall be no more than 5 seconds for the data stored for less than 2 years and no
more than 10 seconds for the data stored for 2 years or more, in at least 99 % of all queries and automatic alerts
foreseen under paragraphs 2 and 3.
8. The overall time between the arrival of reporting activity data and its accessibility, via the graphical and non-
graphical interfaces, in the primary and secondary repositories shall be no more than 60 seconds in at least 99 % of all
data transfer activities.
9. The repository shall allow for the receipt, storing and making available of offline flat-files for the purpose of
updating verification devices used by Member States for offline decoding of unique identifiers.
10. The provider of the secondary repository shall establish and maintain a register of the information transferred to
it in accordance with Article 20(3). A record of the information stored in the register shall be kept for as long as the
traceability system is operational.
11. Member States and the Commission shall retain the right to enter into additional service level agreements with
the provider of the secondary repository for the purpose of contracting the latter to carry out additional services not
provided for by this Regulation. The provider of the secondary repository may charge proportionate fees for providing
such additional services.
L 96/24 EN Official Journal of the European Union 16.4.2018
12. The repository services provided to Member States and the Commission under this Article shall be compatible
with Regulation (EU) No 910/2014 and in particular allow for the use of reusable solutions provided as building blocks
under the telecommunication part of the Connecting Europe Facility.
Article 28
1. The provider operating the secondary repository shall communicate to providers operating primary repositories,
ID issuers and economic operators, the list of specifications required for the data exchange with the secondary
repository and the router. All specifications shall be based on non-proprietary open standards.
The list referred to in the first subparagraph shall be communicated no later than two months following the date when
the provider operating the secondary repository was selected.
2. On the basis of the information listed in Annex II, the provider operating the secondary repository shall establish
a common data dictionary. The common data dictionary shall refer to labels of data fields in the human readable
format. The common data dictionary shall be communicated to the providers operating primary repositories no later
than two months following the date when the provider operating the secondary repository was selected.
3. Whenever necessary to ensure the effective operation of the repositories system in accordance with the
requirements of this Regulation, the provider operating the secondary repository shall update the list referred to in
paragraph 1 and the common data dictionary referred to in paragraph 2. Any such update shall be communicated to the
providers operating primary repositories at least two months prior to the date of implementing the update into the
system.
Article 29
Router
1. The provider of the secondary repository shall set up and manage a router.
2. Data exchange between the router and the primary and secondary repositories shall take place using the data
format and data exchange modalities defined by the router.
3. Data exchange between the router and an ID issuer shall take place using the data format and data exchange
modalities defined by the router.
4. Economic operators other than manufacturers and importers shall send the information recorded pursuant to
Article 15 of Directive 2014/40/EU and in accordance with this Regulation to the router, which shall transfer it to the
primary repository serving the manufacturer or importer whose tobacco products are concerned. A copy of those data
shall be transferred instantaneously to the secondary repository system.
Article 30
1. All costs related to the repositories system referred to in Article 24(1), including those that arise from its
establishment, operation and maintenance, shall be borne by manufacturers and importers of tobacco products. Those
costs shall be fair, reasonable, and proportionate:
(b) to the amount of unit level UIs requested over a given period of time.
2. The costs, as applicable, of establishing, operating and maintaining the secondary repository and the router shall
be transmitted to manufacturers and importers of tobacco products through the costs charged to them by the providers
of the primary repositories.
16.4.2018 EN Official Journal of the European Union L 96/25
Article 31
The repositories system shall be established and functional for testing purposes by 20 March 2019.
CHAPTER VI
Article 32
1. To allow the determination of the actual shipment route of unit packets manufactured in, or imported into the
Union, economic operators shall record the following events:
(a) application of unit level UIs on unit packets;
(b) application of aggregated level UIs on aggregated packaging;
(c) dispatch of tobacco products from a facility;
(d) arrival of tobacco products at a facility;
(e) trans-loading.
2. Manufacturers and importers shall transmit the information listed in points 3.1 to 3.5 of Section 3 of Chapter II of
Annex II, in the format indicated therein, to the primary repository contracted by them. All other economic operators
shall transmit the information listed in points 3.1 to 3.5 of Section 3 of Chapter II of Annex II, in the format indicated
therein, via the router.
3. For disaggregation of aggregated packaging marked pursuant to Article 10(4), where an economic operator intends
to reuse an aggregated level UI in any future operations, manufacturers and importers shall transmit the information
listed in point 3.6 of Section 3 of Chapter II of Annex II, in the format indicated therein, to the primary repository
contracted by them. All other economic operators shall transmit the information listed in point 3.6 of Section 3 of
Chapter II of Annex II, in the format indicated therein, via the router.
4. For deliveries to multiple first retail outlets by means of a vending van, manufactures and importers shall transmit
the information listed in point 3.7 of Section 3 of Chapter II of Annex II, in the format indicated therein, to the primary
repository contracted by them. All other economic operators shall transmit the information listed in point 3.7 of
Section 3 of Chapter II of Annex II, in the format indicated therein, via the router.
5. For dispatch and trans-loading of unit or aggregated packaging of tobacco products with total weight below 10 kg
destined outside the Union, Member States in which the dispatch facility is located may allow the recording obligation
referred to in paragraph 1 in points (c) to (e) to be discharged by means of providing access to the logistic or postal
operator's own track and trace system records.
6. If following the application of the unique identifier tobacco products are destroyed or stolen, economic operators
shall promptly transmit a deactivation request in accordance with the scope and format specified in point 2.3 of
Section 2 of Chapter II of Annex II.
7. The information concerning the event shall be deemed to have been transmitted correctly upon the positive
acknowledgement by the primary repository or the router. The acknowledgement shall include a message recall code to
be applied by the economic operator if the original message needs to be cancelled.
Article 33
1. To allow the determination of the transactional information referred to in Article 15(2), points (j) and (k) of
Directive 2014/40/EU, economic operators shall record the following events:
(a) issuing of the order number;
(b) issuing of the invoice;
(c) receipt of the payment.
L 96/26 EN Official Journal of the European Union 16.4.2018
2. Manufacturers and importers shall transmit the information listed in Section 4 of Chapter II of Annex II, in the
format indicated therein, to the primary repository contracted by them. All other economic operators shall transmit the
information listed in Section 4 of Chapter II of Annex II, in the format indicated therein, via the router.
3. The responsibility for recording and transmitting the information referred to in paragraph 2 shall lie with the
vendor.
4. The information referred to in paragraph 2 shall be deemed to have been transmitted correctly upon the positive
acknowledgement by the primary repositories or the router. The acknowledgement shall include a message recall code
to be applied by the economic operator if the original message needs to be cancelled.
Article 34
1. Economic operators shall transmit the information referred to in Article 32(1) points (a), (b) and (d), Articles 32(3)
and (4), and Article 33(1), within 3 hours from the occurrence of the event. The information referred to in Article 32
shall be transmitted in the order of the occurrence of the events.
2. For the purposes of paragraph 1, the events referred to in Article 33 shall be deemed to occur at the moment
when they can be associated with the relevant unit packets for the first time.
3. Economic operators shall transmit the information concerning the dispatch of tobacco products from a facility and
trans-loading referred to in Article 32(1) points (c) and (e), within 24 hours prior to the occurrence of the event.
4. By way of derogation from paragraph 1, economic operators may transmit the information referred to in
Article 32(1) points (a), (b) and (d), Articles 32(3) and (4), and Article 33(1), within 24 hours from the occurrence of
the event, if they fulfil any of the following conditions:
(a) they, or where applicable, the group of undertakings to which they belong, handled less than 120 million unit level
UIs at Union level during the previous calendar year;
(b) they are small and medium enterprises within the meaning of Commission Recommendation 2003/361/EC.
5. Paragraph 1 shall apply from 20 May 2028. Until that date all economic operators may transmit the information
referred to in paragraph 1 within 24 hours from the occurrence of the event.
CHAPTER VII
FINAL PROVISIONS
Article 35
Independence
1. ID issuers, providers of repository services and anti-tampering devices as well as, where applicable, their subcon
tractors shall be independent and exercise their functions impartially.
2. For the purposes of paragraph 1, the following criteria shall be used to assess independence:
(a) independence from the tobacco industry in terms of legal form, organisation and decision making. In particular it
shall be assessed whether the undertaking or the group of undertakings is not under the direct or indirect control of
the tobacco industry, including a minority shareholding;
(b) independence from the tobacco industry in financial terms, which will be presumed if, before assuming their
functions the undertaking or the group of undertakings concerned generates less than 10 % of its annual worldwide
turnover, excluding VAT and any other indirect taxes, from goods and services supplied to the tobacco sector over
the past two calendar years, as may be determined on the basis of the most recent approved accounts. For each
subsequent calendar year, the annual worldwide turnover, excluding VAT and any other indirect taxes, from goods
and services supplied to the tobacco sector shall not exceed 20 %;
16.4.2018 EN Official Journal of the European Union L 96/27
(c) absence of conflicts of interests with the tobacco industry of the persons responsible for the management of the
undertaking or the group of undertakings, including members of the board of directors or any other form of
governing body. In particular, they:
(1) shall not have participated in company structures of the tobacco industry for the last five years;
(2) shall act independently from any pecuniary or non-pecuniary interest linked to the tobacco industry, including
possession of stocks, participation in private pension programmes or interest held by their partners, spouses or
direct relatives in the ascending or descending line.
3. Where ID issuers, providers of repository services and providers of anti-tampering devices have recourse to sub-
contractors, they shall remain responsible for ensuring compliance by those subcontractors with the independence
criteria set out in paragraph 2.
4. For the purposes of complying with their obligations under Article 3(8)(a) Member States, as well as the
Commission may require ID issuers, providers of repository services and providers of anti-tampering devices, including
where applicable their sub-contractors to provide them with documents necessary to assess compliance with the criteria
set out in paragraph 2. Such documents may include annual declarations of conformity with the independence criteria
set out in paragraph 2. Member States and the Commission may require that the annual declarations include a full list of
services provided to the tobacco industry during the last calendar year as well as individual declarations of financial
independence from the tobacco industry provided by all management members of the independent provider.
5. Any change in circumstances related to the criteria referred to in paragraph 2, capable of affecting the
independence of ID issuers, providers of repository services and providers of anti-tampering devices (including, where
applicable, their subcontractors), that subsist for two consecutive calendar years, shall be communicated without delay
to the relevant Member States and to the Commission.
6. Where, information obtained in accordance with paragraph 4, or the communication referred to in paragraph 5,
discloses that providers of repository services and providers of anti-tampering devices (including, where applicable, their
subcontractors), no longer meet the requirements laid down in paragraph 2, then within a reasonable time period and at
the latest by the end of the calendar year following the calendar year in which the information or communication was
received, Member States and, in relation to the provider of secondary repository, the Commission shall take all measures
to ensure compliance with the criteria set out in paragraph 2.
7. ID issuers, providers of repository services and providers of anti-tampering devices shall inform without delay the
relevant Member States and the Commission about any occurrences of threats or other attempts at exercising undue
influence that may actually or potentially undermine their independence.
8. Public authorities or undertakings governed by public law along with their subcontractors shall be presumed
independent from the tobacco industry.
9. The procedures governing the appointment of ID issuers, providers of repository services and providers of anti-
tampering devices and the monitoring of their compliance with the independence criteria set out in paragraph 2 shall be
subject to periodic review by the Commission with a view to assessing their conformity with the requirements of
Article 15 of Directive 2014/40/EU and this Regulation. Conclusions of the review shall be published and form part of
the report on the application of Directive 2014/40/EU provided for under Article 28 of that Directive.
Article 36
1. All electronic communication provided for under this Regulation shall be carried out using secure means. Appli
cable security protocols and connectivity rules shall be based on non-proprietary open standards. They shall be
established by:
(a) the ID issuer for communications between the ID issuer and the economic operators registering with the ID issuer
or requesting unique identifiers;
(b) the providers of the primary repositories for communications between the primary repositories and manufactures or
importers;
L 96/28 EN Official Journal of the European Union 16.4.2018
(c) the provider of the secondary repository for communications between the secondary repository and the router and:
i. the ID issuers;
iii. economic operators using the router, i.e. economic operators other than manufacturers and importers.
2. Providers of primary and secondary repositories shall be responsible for the security and integrity of hosted data.
Data portability shall be secured in accordance with the common data dictionary set out in Article 28.
3. For all transfers of data, the sending party is responsible for the completeness of transferred data. In order for the
sending party to discharge this obligation, the receiving party shall acknowledge the receipt of transferred data including
a checksum value of actual transmitted data or any alternative mechanism allowing for validating the integrity of
transmission, in particular its completeness.
Article 37
Transitional provision
1. Cigarettes and roll-your-own tobacco that were manufactured in the Union or imported into the Union before
20 May 2019 and not marked by means of unit level UIs in accordance with Article 6 may remain in free circulation
until 20 May 2020. In relation to these tobacco products which are allowed to remain in free circulation, but not
marked with a unit level UIs, the obligations referred to in Chapter VI shall not apply.
2. Tobacco products other than cigarettes and roll-your-own tobacco that were manufactured in the Union or
imported into the Union before 20 May 2024 and not marked by means of unit level UIs in accordance with Article 6
may remain in free circulation until 20 May 2026. In relation to these tobacco products which are allowed to remain in
free circulation, but not marked with a unit level UIs, the obligations referred to in Chapter VI shall not apply.
Article 38
This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the
European Union.
This Regulation shall be binding in its entirety and directly applicable in all Member States.
ANNEX I
PART A
The following procedures shall apply to the selection of an independent third party provider operating a primary
repository:
1. Each manufacturer and importer of cigarettes and roll-your-own tobacco shall notify to the Commission, no later
than two months following the entry into force of Delegated Regulation (EU) 2018/573:
(a) the identity of the third party that it proposes to appoint to operate a primary repository (the ‘proposed
provider’), and
(b) a draft data storage contract containing the key elements laid down in the Delegated Regulation for approval by
the Commission.
(a) the written declaration of technical and operational expertise, referred to in Article 4 of Delegated Regulation
(EU) 2018/573,
(b) the written declaration of legal and financial independence, referred to in Article 8 of Delegated Regulation (EU)
2018/573, and
(c) a table setting out the correspondence between the contractual clauses and the requirements laid down in
Delegated Regulation (EU) 2018/573.
3. The Commission shall, within three months of the date of receiving the notification, and on the basis of an
examination of the suitability of the proposed provider, in particular, as regards its independence and technical
capacities as referred to in Article 15(8) of Directive 2014/40/EU, approve or reject the proposed provider and the
draft contract. In the absence of a reply by the Commission within that timeframe, the provider and the draft
contract shall be deemed to be approved.
4. Where the Commission does not approve the proposed provider or the draft contract, or where it considers that the
contract does not incorporate the key elements laid down in Delegated Regulation (EU) 2018/573, the manufacturer
or importer concerned shall, within one month of being informed by the Commission, propose an alternative
provider and/or make necessary amendments to the draft contract for further consideration by the Commission.
5. Once the proposed provider and the draft contract have been approved, the manufacturers and importers shall,
within two weeks of such approval, provide in electronic format:
(b) the declarations required to be provided as part of the contract under Articles 4 and 8 of Delegated Regulation
(EU) 2018/573.
6. Manufacturers and importers of tobacco products other than cigarettes and roll-your-own tobacco shall notify to the
Commission, by 31 December 2022, the identity of the proposed provider, a draft data storage contract containing
the key elements laid down in Delegated Regulation (EU) 2018/573 for approval by the Commission, and the
additional documentation referred to in paragraph 2.
7. The provider appointed to operate the primary repository shall only integrate its repository into the traceability
system following the conclusion of the approved contract.
8. A list of notified and approved third parties shall be made publicly available by the Commission on a website.
9. Any amendment to the key elements of the contract, as defined in Delegated Regulation (EU) 2018/573, shall be
subject to approval by the Commission. Any other amendment to the contract shall require prior communication to
the Commission.
L 96/30 EN Official Journal of the European Union 16.4.2018
PART B
The following procedure shall apply to the selection of an independent third party operating the secondary repository
system:
1. The Commission shall appoint, from amongst the providers of the primary repositories who have been approved in
accordance with Part A within six months following the entry into force of Delegated Regulation (EU) 2018/573,
a provider tasked with operating the secondary repository (‘the operator of the secondary repository’) for the purpose
of carrying out the services specified in Chapter V of this Regulation.
2. The appointment of the operator of the secondary repository shall be based on an assessment of objective criteria
and take place no later than eight months following the entry into force of Delegated Regulation (EU) 2018/573.
3. The result of the appointment of the operator of the secondary repository shall be made publicly available by the
Commission on a website.
4. Each primary repository provider appointed in accordance with Part A shall enter into an individual contract with
the provider appointed to operate the secondary repository for the purpose of carrying out the services specified in
Chapter V of this Regulation.
5. The contracts shall be signed and submitted to the Commission within one month from the date of the appointment.
PART C
The following requirements shall apply in addition to the selection procedures outlined in Parts A and B:
1. Where the contractual relationship between a manufacturer and importer and the provider of a primary repository is
terminated, or expected to be terminated, by any of the parties to the contract, for any reason, including the failure
to comply with the criteria for independence laid down in Article 35, the manufacturer or importer shall
immediately inform the Commission of such termination, or expected termination, and as soon as it is known, the
date of the notification of termination and the date at which the termination is to take effect. The manufacturer or
importer shall propose and notify to the Commission a replacement provider as soon as practicable, and at the latest,
three months prior to the termination date of the existing contract. The appointment of the replacement provider
shall take place in accordance with paragraphs 2 to 7 of Part A.
2. In the event that the operator of the secondary repository gives notice of its intention to cease operating that
repository in accordance with the contracts entered into pursuant to paragraph 4 of Part B, it shall immediately
inform the Commission thereof and of the date at which the termination is to take effect.
3. Where the finding referred to in paragraph 1 applies to the provider who has been appointed to operate the
secondary repository, the contracts for the operation of the secondary repository entered into pursuant to
paragraph 4 of Part B shall, in turn, be terminated by the parties.
4. In cases referred to in paragraphs 2 and 3, the Commission shall appoint a replacement operator as soon as
practicable, and at the latest, three months prior to the termination date of the existing contract.
16.4.2018 EN Official Journal of the European Union L 96/31
ANNEX II
The messages required for regulatory purposes shall contain at least the data fields listed in this Annex. Both ID issuers
and providers of data repositories (including the router) may decide to extend the message content for strictly technical
purposes to secure smooth functioning of the tobacco products traceability system.
The messages listed in this Annex do not include the messages to be sent back by ID issuers and providers of data
repositories (including the router) to the economic operators, such as acknowledgments of receipt.
All the messages generated within the tobacco traceability system shall contain the identification of the originator and
a timestamp up to the second (see Data Type: Time(L)). ID issuers and providers of data repositories (including the
router) shall timestamp each received message up to the second.
CHAPTER I
FIELD DESCRIPTIONS
SECTION 1
Data Type
ARC Administrative Reference Code (ARC) or any successive code adopted ‘15GB0123456789ABCDEF0’
under the Excise Movement and Control System (EMCS)
Country Country name coded with ISO-3166-1:2013 alpha-2 (or its latest equi ‘DE’
valent)
Currency Currency name coded with ISO 4217:2015 (or its latest equivalent) ‘EUR’
Date UTC (Coordinated Universal Time) date corresponding to the following ‘2019-05-20’
format: YYYY-MM-DD
SEED Excise number composed of: (a) country name coded with ISO-3166- ‘LU00000987ABC’
1:2013 alpha-2 (or its latest equivalent) (e.g. ‘LU’) and (b) eleven alpha
numeric characters, if needed, padded to the left with zeroes (e.g.
‘00000987ABC’).
ITU Individual transport unit code (e.g. SSCC) generated in accordance with ‘001234560000000018’
ISO15459-1:2014 (or its latest equivalent)
Time(L) UTC (Coordinated Universal Time) in the following format: YYYY-MM- ‘2019-07-16T19:20:30Z’
DDThh:mm:ssZ
TPID Tobacco Product Identifier (TP-ID) – numeric identifier used in the ‘02565-16-00230’
EU-CEG system in the format: NNNNN-NN-NNNNN
upUI(L) Unit packet level unique identifier coded with the invariant set of
ISO646:1991 and composed of three blocks: (a) ID Issuer's prefix in
accordance with ISO15459-2:2015, (b) middle block in the format es
tablished by the ID issuer and (c) timestamp following the Data Type:
Time(s)
16.4.2018 EN Official Journal of the European Union L 96/33
upUI(s) Unit packet level unique identifier coded with the invariant set of
ISO646:1991 and composed of two blocks: (a) ID issuer's prefix in ac
cordance with ISO15459-2:2015 and (b) serialisation element in the
format established by the ID issuer (i.e. UI made visible in the human
readable format on the unit packets)
Year UTC (Coordinated Universal Time) year in the following format: YYYY ‘2024’
SECTION 2
Cardinality Type
Type Description
SECTION 3
Priority Type
Type Description
Mandatory (M) The variable must be completed to successfully submit the message
Optional (O) The variable relates to supplementary fields which remain optional
CHAPTER II
MESSAGES
SECTION 1
Item Cardin
Field Comments Data Type Priority Values
# ality
Item Cardin
Field Comments Data Type Priority Values
# ality
Item Cardin
Field Comments Data Type Priority Values
# ality
Item Cardin
Field Comments Data Type Priority Values
# ality
Item Cardin
Field Comments Data Type Priority Values
# ality
Item Cardin
Field Comments Data Type Priority Values
# ality
Item Cardin
Field Comments Data Type Priority Values
# ality
Item Cardin
Field Comments Data Type Priority Values
# ality
Item Cardin
Field Comments Data Type Priority Values
# ality
Item Cardin
Field Comments Data Type Priority Values
# ality
Item Cardin
Field Comments Data Type Priority Values
# ality
Item Cardin
Field Comments Data Type Priority Values
# ality
Item Cardin
Field Comments Data Type Priority Values
# ality
SECTION 2
Item Cardin
Field Comments Data Type Priority Values
# ality
Item Cardin
Field Comments Data Type Priority Values
# ality
Item Cardin
Field Comments Data Type Priority Values
# ality
Item Cardin
Field Comments Data Type Priority Values
# ality
SECTION 3
Item Cardin
Field Comments Data Type Priority Values
# ality
Item Cardin
Field Comments Data Type Priority Values
# ality
Item Cardin
Field Comments Data Type Priority Values
# ality
Item Cardin
Field Comments Data Type Priority Values
# ality
Item Cardin
Field Comments Data Type Priority Values
# ality
Item Cardin
Field Comments Data Type Priority Values
# ality
Item Cardin
Field Comments Data Type Priority Values
# ality
Item Cardin
Field Comments Data Type Priority Values
# ality
3.5. Trans-loading
Item Cardin
Field Comments Data Type Priority Values
# ality
Item Cardin
Field Comments Data Type Priority Values
# ality
Item Cardin
Field Comments Data Type Priority Values
# ality
Item Cardin
Field Comments Data Type Priority Values
# ality
3.7. Report of delivery carried out with a vending van to retail outlet (required if in message type 3-3, field
Destination_ID1 = 4)
Item Cardin
Field Comments Data Type Priority Values
# ality
SECTION 4
Transactional events
Item Cardin
Field Comments Data Type Priority Values
# ality
Item Cardin
Field Comments Data Type Priority Values
# ality
Item Cardin
Field Comments Data Type Priority Values
# ality
Item Cardin
Field Comments Data Type Priority Values
# ality
Item Cardin
Field Comments Data Type Priority Values
# ality
Item Cardin
Field Comments Data Type Priority Values
# ality
Item Cardin
Field Comments Data Type Priority Values
# ality
SECTION 5
Recalls
5. Recalls of requests, operational and transactional messages (possible for message types 2-1, 2-2, 3-1 to 3-7,
4-1, 4-2 and 4-3)
Item Cardin
Field Comments Data Type Priority Values
# ality
Item Cardin
Field Comments Data Type Priority Values
# ality
Recall_Reason1 Reason for recalling the original Integer S M 1 – reported event did
message not materialise (only
for message types 3-3
and 3-5)
2 – message
contained erroneous
information
3 – other
Notice: A recall with respect to operational and logistic events results in flagging the recalled message as cancelled but
does not lead to the deletion of the existing database record.