Regulation (EU) 2018/1240 of the European Parliament and of the Council of 12 September 2018 establishing a European Travel Information and Authorisation System (ETIAS) and amending Regulations (EU) No 1077/2011, (EU) No 515/2014, (EU) 2016/399, (EU) 2016/1624 and (EU) 2017/2226

Where automated processing under Article 20 has reported a hit corresponding to a refusal of entry and stay alert referred to in Article 24 of Regulation (EC) No 1987/2006 of the European Parliament and of the Council ([^E0017]), the ETIAS National Unit shall verify the basis for the decision following which this alert was entered in SIS. If this basis is related to an illegal immigration risk, the alert shall not be taken into consideration for the assessment of the application. The ETIAS National Unit shall proceed according to Article 25(2) of the Regulation (EC) No 1987/2006.

The following rules shall also apply:

The Member State responsible for the manual processing of applications under Article 26 (the ‘Member State responsible’) shall be identified by the ETIAS Central System as follows:

The ETIAS Central System shall indicate the Member State responsible in the application file. Where the ETIAS Central System is not able to identify the Member State responsible as referred to in paragraph 1, the ETIAS Central Unit shall identify it.

Without prejudice to Article 13(1), the duly authorised staff of the ETIAS National Units shall have direct access to and may consult, in a read-only format, the other EU information systems for the purposes of examining applications for travel authorisation and adopting decisions relating to those applications in accordance with Article 26. The ETIAS National Units may consult:

Insofar as a hit results from the verification pursuant to point (n) of Article 20(2), the duly authorised staff of the ETIAS National Units shall also have access, directly or indirectly, in accordance with national law, to the relevant data from the national criminal records of their own Member State in order to obtain information on third-country nationals, as defined in Regulation (EU) 2019/816, convicted of a terrorist offence or any other criminal offence listed in the Annex to this Regulation, for the purposes referred to in paragraph 1 of this Article.

Where the automated processing laid down in Article 20(2) to (5) has reported one or several hits, the application shall be processed manually by the ETIAS National Unit of the Member State responsible. That ETIAS National Unit shall have access to the application file and any linked application files, as well as to any hits triggered during the automated processing laid down in Article 20(2) to (5). The ETIAS Central Unit shall inform the ETIAS National Unit of the Member State responsible whether one or several other Member States or Europol were identified as having entered or supplied the data that triggered the hit pursuant to Article 20(2) or (4). Where one or several Member States have been identified as having entered or supplied the data that triggered such a hit, the ETIAS Central Unit shall also specify the Member States concerned.

Following the manual processing of the application, the ETIAS National Unit of the Member State responsible shall:

Where the automated processing laid down in Article 20(2) has reported a hit, the ETIAS National Unit of the Member State responsible shall:

Where automated processing under Article 20(3) has reported that the applicant replied affirmatively to one of the questions referred to in Article 17(4), the ETIAS National Unit of the Member State responsible shall assess the security or illegal immigration risk and decide whether to issue or refuse a travel authorisation.

Where automated processing under Article 20(4) has reported a hit, the ETIAS National Unit of the Member State responsible shall assess the security risk and decide whether to issue or refuse a travel authorisation.

Where automated processing under Article 20(5) has reported a hit, the ETIAS National Unit of the Member State responsible shall assess the security, illegal immigration or high epidemic risk and decide whether to issue or refuse a travel authorisation. In no circumstances may the ETIAS National Unit of the Member State responsible take a decision automatically on the basis of a hit based on specific risk indicators. The ETIAS National Unit of the Member State responsible shall individually assess the security, illegal immigration and high epidemic risks in all cases.

The ETIAS Information System shall keep records of all data processing operations carried out for assessments under this Article by the ETIAS National Unit of the Member State responsible or by the ETIAS National Units of the Member States consulted in accordance with Article 28. Those records shall be created and entered automatically in the application file. They shall show the date and time of each operation, the data used for consultation of other EU information systems, the data linked to the hit received and the staff member having performed the risk assessment.

Where the ETIAS National Unit of the Member State responsible deems the information provided by the applicant in the application form to be insufficient to enable it to decide whether to issue or refuse a travel authorisation, it may request additional information or documentation from the applicant. The ETIAS National Unit of the Member State responsible shall request additional information or documentation upon the request of a Member State consulted in accordance with Article 28.

The request for additional information or documentation shall be notified through the email service referred to in point (f) of Article 6(2) to the contact email address recorded in the application file. The request for additional information or documentation shall clearly indicate the information or documentation that the applicant is required to provide, as well as a list of the languages in which the information or documentation may be submitted. That list shall include at least English or French or German unless it includes an official language of the third country of which the applicant has declared to be a national. Where additional documentation is requested, an electronic copy of the original documentation shall also be requested. The applicant shall provide the additional information or documentation directly to the ETIAS National Unit of the Member State responsible through the secure account service referred to in point (g) of Article 6(2) within 10 days of the date of receipt of the request. The applicant shall provide such information or documentation in one of the languages notified in the request. The applicant shall not be required to provide an official translation. Only additional information or documentation necessary for the assessment of the ETIAS application may be requested.

For the purpose of requesting additional information or documentation as referred to in paragraph 1, the ETIAS National Unit of the Member State responsible shall use a predetermined list of options. The Commission shall adopt delegated acts in accordance with Article 89 to lay down the content and format of that predetermined list of options.

In exceptional circumstances and as a last resort after processing the additional information or documentation, when serious doubts remain regarding the information or documentation provided by the applicant, the ETIAS National Unit of the Member State responsible may invite the applicant to an interview in his or her country of residence at its consulate located the nearest to the place of residence of the applicant. Exceptionally and when in the interest of the applicant, the interview may take place in a consulate located in a different country than the country of residence of the applicant.

The Commission shall, by means of implementing acts, define the requirements for the means of audio and video communication referred to in paragraph 4, including as regards data protection, security and confidentiality rules and adopt rules on testing and selecting suitable tools and on their operation.

The invitation to an interview shall be issued to the applicant by the ETIAS National Unit of the Member State responsible through the email service referred to in point (f) of Article 6(2) to the contact email address recorded in the application file. The invitation to the interview shall be issued within 72 hours of the applicant’s submission of additional information or documentation pursuant to paragraph 2 of this Article. The invitation to the interview shall include information on the Member State issuing the invitation, on the options referred to in paragraph 4 of this Article and relevant contact details. The applicant shall contact the ETIAS National Unit of the Member State responsible or the consulate as soon as possible, but no later than five days after the invitation to the interview was issued, to agree on a mutually suitable time and date for the interview and on whether the interview shall take place remotely. The interview shall take place within 10 days of the date of the invitation.

Where the applicant fails to attend the interview in accordance with paragraph 6 of this Article following an invitation to the interview, the application shall be refused in accordance with point (g) of Article 37(1). The ETIAS National Unit of the Member State responsible shall inform the applicant without delay.

For the purpose of the interview referred to in paragraph 4, the ETIAS National Unit of the Member State responsible shall indicate the elements to be addressed by the interviewer. Those elements shall relate to the reasons for which the interview was requested.

Upon the applicant’s submission of additional information or documentation in accordance with paragraph 2, the ETIAS Central System shall record and store that information or documentation in the application file. Additional information or documentation provided during an interview in accordance with paragraph 6 shall be added to the application file by the ETIAS National Unit of the Member State responsible.

The ETIAS National Unit of the Member State responsible shall resume the examination of the application from the moment the applicant provides the additional information or documentation or, where applicable, from the date of the interview.

Where one or several Member States are identified as having entered or supplied the data having triggered a hit in accordance with Article 20(7) following verification under Article 22, the ETIAS Central Unit shall notify the ETIAS National Unit of the Member State(s) involved, thereby launching a consultation process between them and the ETIAS National Unit of the Member State responsible.

The ETIAS National Units of the Member States consulted shall have access to the application file for the purpose of the consultation.

The ETIAS National Unit of the Member States consulted shall:

The ETIAS National Unit of the Member State responsible may also consult the ETIAS National Units of one or several Member States following the reply of an applicant to a request for additional information. Where such additional information was requested on behalf of a Member State consulted pursuant to Article 27(1), the ETIAS National Unit of the Member State responsible shall consult the ETIAS National Unit of the consulted Member State following the reply of the applicant to that request for additional information. In such cases, the ETIAS National Units of the Member States consulted shall also have access to the relevant additional information or documentation provided by the applicant following a request from the ETIAS National Unit of the Member State responsible in relation to the matter for which they are being consulted. Where several Member States are consulted, the ETIAS National Unit of the Member State responsible shall ensure the coordination.

The ETIAS National Unit of the Member States consulted shall reply within 60 hours of the notification of the consultation. A failure to reply within the deadline shall be considered to be a positive opinion on the application.

During the consultation process, the consultation request and the replies thereto shall be transmitted through the software referred to in point (m) of Article 6(2) and shall be made available to the ETIAS National Unit of the Member State responsible.

Where the ETIAS National Unit of at least one Member State consulted provides a negative opinion on the application, the ETIAS National Unit of the Member State responsible shall refuse the travel authorisation pursuant to Article 37. This paragraph is without prejudice to Article 44.

Where necessary in cases of technical problems or unforeseen circumstances, the ETIAS Central Unit shall determine the Member State responsible and Member States to be consulted and shall facilitate the consultations between Member States referred to in this Article.

Where Europol is identified as having supplied the data having triggered a hit in accordance with Article 20(8) of this Regulation, the ETIAS Central Unit shall notify it, thereby launching a consultation process between Europol and the ETIAS National Unit of the Member State responsible. Such consultation shall take place in accordance with Regulation (EU) 2016/794 and in particular its Chapter IV.

Where Europol is consulted, the ETIAS Central Unit shall transmit to Europol the relevant data of the application file and of the hits which are necessary for the purpose of the consultation.

In any case, Europol shall not have access to the personal data concerning the education of the applicant referred to in point (h) of Article 17(2).

Where consulted in accordance with paragraph 1, Europol shall provide a reasoned opinion on the application. Europol’s opinion shall be made available to the ETIAS National Unit of the Member State responsible which shall record it in the application file.

The ETIAS National Unit of the Member State responsible may consult Europol following the reply of an applicant to a request for additional information. In such cases, the ETIAS National Unit shall transmit to Europol the relevant additional information or documentation provided by the applicant relating to the request for a travel authorisation on which Europol is being consulted.

Europol shall reply within 60 hours of the notification of the consultation. The failure by Europol to reply within the deadline shall be considered to be a positive opinion on the application.

During the consultation process, the consultation request and the replies thereto shall be transmitted through the software referred to in point (m) of Article 6(2) and shall be made available to the ETIAS National Unit of the Member State responsible.

Where Europol provides a negative opinion on the application and the ETIAS National Unit of the Member State responsible decides to issue the travel authorisation, it shall justify its decision and shall record the justification in the application file.

Where necessary in cases of technical problems or unforeseen circumstances, the ETIAS Central Unit shall determine the Member State responsible and facilitate the consultations between the Member State responsible and Europol referred to in this Article.

Applications shall be decided on no later than 96 hours after the submission of an application which is admissible in accordance with Article 19.

Exceptionally, when a request for additional information or documentation is notified, and when the applicant is invited to an interview, the period laid down in paragraph 1 of this Article shall be extended. Such applications shall be decided on no later than 96 hours after the submission of the additional information or documentation by the applicant. When the applicant is invited to an interview as referred to in Article 27(4), the application shall be decided on no later than 48 hours after the interview has taken place.

Before expiry of the deadlines referred to in paragraphs 1 and 2 of this Article, a decision shall be taken to:

The ETIAS screening rules shall be an algorithm enabling profiling as defined in point 4 of Article 4 of Regulation (EU) 2016/679 through the comparison in accordance with Article 20 of this Regulation of the data recorded in an application file of the ETIAS Central System with specific risk indicators established by the ETIAS Central Unit under paragraph 4 of this Article pointing to security, illegal immigration or high epidemic risks. The ETIAS Central Unit shall register the ETIAS screening rules in the ETIAS Central System.

The Commission shall adopt a delegated act in accordance with Article 89 to further define the risks related to security or illegal immigration or a high epidemic risk on the basis of:

The Commission shall, by means of an implementing act, specify the risks, as defined in this Regulation and in the delegated act referred to in paragraph 2 of this Article, on which the specific risks indicators referred to in paragraph 4 of this Article shall be based. That implementing act shall be adopted in accordance with the examination procedure referred to in Article 90(2).

Based on the specific risks determined in accordance with paragraph 3, the ETIAS Central Unit shall establish a set of specific risk indicators consisting of a combination of data including one or several of the following:

The specific risk indicators shall be targeted and proportionate. They shall in no circumstances be based solely on a person’s sex or age. They shall in no circumstances be based on information revealing a person’s colour, race, ethnic or social origin, genetic features, language, political or any other opinion, religion or philosophical belief, trade union membership, membership of a national minority, property, birth, disability or sexual orientation.

The specific risk indicators shall be defined, established, assessed ex ante, implemented, evaluated ex post, revised and deleted by the ETIAS Central Unit after consultation of the ETIAS Screening Board.

The ETIAS watchlist shall consist of data related to persons who are suspected of having committed or taken part in a terrorist offence or other serious criminal offence or persons regarding whom there are factual indications or reasonable grounds, based on an overall assessment of the person, to believe that they will commit a terrorist offence or other serious criminal offence. The ETIAS watchlist shall form part of the ETIAS Central System.

The ETIAS watchlist shall be established on the basis of information related to terrorist offences or other serious criminal offences.

The information referred to in paragraph 2 shall be entered into the ETIAS watchlist by Europol without prejudice to Regulation (EU) 2016/794 or by Member States. Each of Europol or the Member State concerned shall be responsible for all the data they enter. The ETIAS watchlist shall indicate, for each item of data, the date and time of entry by Europol or by the Member State that entered it.

On the basis of the information referred to in paragraph 2, the ETIAS watchlist shall be composed of data consisting of one or more of the following items:

Before Europol or a Member State enters data into the ETIAS watchlist, it shall:

eu-LISA shall create a specific tool for the purpose of assessment under point (b) of paragraph 1.

Where verification under point (c) of paragraph 1 reveals that the data correspond to an alert entered in SIS, it shall not be entered into the ETIAS watchlist. Where the conditions for using the data to enter an alert in SIS are fulfilled, priority shall be given to entering an alert in SIS.

Member States and Europol shall be responsible for the accuracy of the data referred to in Article 34(2) that they enter into the ETIAS watchlist and for keeping them up to date.

Europol shall review and verify the continued accuracy of the data it has entered into the ETIAS watchlist regularly, and at least once a year. Member States shall likewise review and verify the continued accuracy of the data they have entered into the ETIAS watchlist regularly and at least once a year. Europol and Member States shall develop and implement a joint procedure to ensure fulfilment of their responsibilities under this paragraph.

Following a review, Member States and Europol shall withdraw data from the ETIAS watchlist if it is proven that the reasons for which they were entered no longer hold, or that the data are obsolete or not up to date.

The ETIAS watchlist and the assessment tool referred to in paragraphs 1 and 2 of this Article shall be developed technically and hosted by eu-LISA. The Commission shall, by means of implementing acts, establish the technical specifications of the ETIAS watchlist and of that assessment tool. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 90(2).

In cases referred to in Article 13(4b), fourth subparagraph, the ETIAS Central System shall send an automated notification to either the ETIAS National Unit or to Europol, depending on which of them entered the data into the ETIAS watchlist. Where the ETIAS National unit or Europol, as appropriate, considers that the third-country national undergoing the screening might pose a threat to internal security, it shall immediately notify the respective screening authorities and provide a reasoned opinion to the Member State performing the screening, within two days of the receipt of the notification, in the following manner:

The automated notification referred to in paragraph 1 of this Article shall contain the data referred to in Article 15(2) of Regulation (EU) 2024/1356 used for the query.

Where the examination of an application pursuant to the procedures laid down in Chapters III, IV and V indicates that there are no factual indications or reasonable grounds based on factual indications to conclude that the presence of the person on the territory of the Member States poses a security, illegal immigration or high epidemic risk, a travel authorisation shall be issued by the ETIAS Central System or the ETIAS National Unit of the Member State responsible.

In cases where there is doubt as to whether sufficient reasons to refuse the travel authorisation exist, the ETIAS National Unit of the Member State responsible shall have the possibility, including after an interview, to issue a travel authorisation with a flag recommending to border authorities to proceed with a second line check.

The ETIAS National Unit of the Member State responsible shall have the possibility to add a flag indicating to border authorities and other authorities with access to the data in the ETIAS Central System that a specific hit triggered during the processing of the application has been assessed and that it has been verified that the hit constituted a false hit or that the manual processing has shown that there were no grounds for the refusal of the travel authorisation.

The Commission shall adopt delegated acts in accordance with Article 89 to establish adequate safeguards by providing rules and procedures to avoid conflicts with alerts in other information systems and to define the conditions, the criteria and the duration of flagging pursuant to this Regulation.

A travel authorisation shall be valid for three years or until the end of validity of the travel document registered during application, whichever comes first, and shall be valid for the territory of the Member States.

A travel authorisation shall not confer an automatic right of entry or stay.

A travel authorisation shall be refused if the applicant:

A travel authorisation shall also be refused if, at the time of the application, there are reasonable and serious doubts as to the authenticity of the data, the reliability of the statements made by the applicant, the supporting documents provided by the applicant or the veracity of their contents.

Applicants who have been refused a travel authorisation shall have the right to appeal. Appeals shall be conducted in the Member State that has taken the decision on the application and in accordance with the national law of that Member State. During the appeal procedure, the appellant shall be given access to the information in the application file in accordance with the data protection rules referred to in Article 56 of this Regulation. The ETIAS National Unit of the Member State responsible shall provide applicants with information regarding the appeal procedure. That information shall be provided in one of the official languages of the countries listed in Annex II to Regulation (EC) No 539/2001 of which the applicant is a national.

A previous refusal of a travel authorisation shall not lead to an automatic refusal of a new application. A new application shall be assessed on the basis of all the available information.

Once a travel authorisation is issued, the applicant shall immediately receive a notification via the email service, including:

Where a travel authorisation has been refused, the applicant shall immediately receive a notification via the email service including:

The Commission shall, by means of implementing acts, adopt a standard form for refusal, annulment or revocation of a travel authorisation. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 90(2).

Where a decision has been taken to issue a travel authorisation, the ETIAS Central System or, where the decision has been taken following manual processing as provided for in Chapter IV, the ETIAS National Unit of the Member State responsible shall add the following data to the application file without delay:

The Commission shall adopt delegated acts in accordance with Article 89 to further define the type of additional information that may be added, its language and formats, as well as the reasons for the flags.

Where a decision has been taken to refuse a travel authorisation, the ETIAS National Unit of the Member State responsible shall add the following data to the application file:

In addition to the data referred to in paragraphs 1 and 3, where a decision has been taken to issue or to refuse a travel authorisation, the ETIAS National Unit of the Member State responsible shall also add the reasons for its final decision, unless that decision is a refusal based on a negative opinion from a consulted Member State.

A travel authorisation shall be annulled where it becomes evident that the conditions for issuing it were not met at the time it was issued. The travel authorisation shall be annulled on the basis of one or more of the grounds for refusal of the travel authorisation laid down in Article 37(1) and (2).

Where a Member State is in possession of evidence that the conditions for issuing a travel authorisation were not met at the time it was issued, the ETIAS National Unit of that Member State shall annul the travel authorisation.

A person whose travel authorisation has been annulled shall have the right to appeal. Appeals shall be conducted in the Member State that has taken the decision on the annulment and in accordance with the national law of that Member State. The ETIAS National Unit of the Member State responsible shall provide applicants with information regarding the appeal procedure. The information shall be provided in one of the official languages of the countries listed in Annex II to Regulation (EC) No 539/2001 of which the applicant is a national.

The justification for the decision to annul a travel authorisation shall be recorded in the application file by the staff member having performed the risk assessment.

A travel authorisation shall be revoked where it becomes evident that the conditions for issuing it are no longer met. The travel authorisation shall be revoked on the basis of one or more of the grounds for refusal of the travel authorisation laid down in Article 37(1).

Where a Member State is in possession of evidence that the conditions for issuing the travel authorisation are no longer met, the ETIAS National Unit of that Member State shall revoke the travel authorisation.

Without prejudice to paragraph 2, where a new alert is entered in SIS concerning a refusal of entry and stay or concerning a travel document reported as lost, stolen, misappropriated or invalidated, SIS shall inform the ETIAS Central System. The ETIAS Central System shall verify whether that new alert corresponds to a valid travel authorisation. Where this is the case, the ETIAS Central System shall transfer the application file to the ETIAS National Unit of the Member State having entered the alert. Where a new alert for refusal of entry and stay has been entered, the ETIAS National Unit shall revoke the travel authorisation. Where the travel authorisation is linked to a travel document reported as lost, stolen, misappropriated or invalidated in SIS or the Interpol SLTD database, the ETIAS National Unit shall manually process the application file.

New data entered into the ETIAS watchlist shall be compared to the data of the application files in the ETIAS Central System. The ETIAS Central System shall verify whether those new data correspond to a valid travel authorisation. Where this is the case, the ETIAS Central System shall transfer the application file to the ETIAS National Unit of the Member State having entered the new data, or where Europol entered the new data, to the ETIAS National Unit of the Member State of first intended stay as declared by the applicant in accordance with point (j) of Article 17(2). That ETIAS National Unit shall assess the security risk and shall revoke the travel authorisation where it concludes that the conditions for granting it are no longer met.

Where a refusal of entry record is entered in the EES concerning the holder of a valid travel authorisation and that record is justified by reason B or I listed in Annex V, Part B, to Regulation (EU) 2016/399, the ETIAS Central System shall transfer the application file to the ETIAS National Unit of the Member State having refused entry. That ETIAS National Unit shall assess whether the conditions for granting the travel authorisation are still met and, if not, shall revoke the travel authorisation.

The justification for the decision to revoke a travel authorisation shall be recorded in the application file by the staff member having performed the risk assessment.

An applicant whose travel authorisation has been revoked shall have the right to appeal. Appeals shall be conducted in the Member State that has taken the decision on the revocation and in accordance with the national law of that Member State. The ETIAS National Unit of the Member State responsible shall provide applicants with information regarding the appeal procedure. The information shall be provided in one of the official languages of the countries listed in Annex II to Regulation (EC) No 539/2001 of which the applicant is a national.

A travel authorisation may be revoked at the request of the applicant. No appeal shall be possible against a revocation on this basis. If the applicant is present on the territory of a Member State when such a request is introduced, the revocation shall become effective once the applicant has exited the territory and from the moment the corresponding entry/exit record has been created in the EES in accordance with Articles 16(3) and 17(2) of Regulation (EU) 2017/2226.

Where a decision has been taken to annul or to revoke a travel authorisation, the ETIAS National Unit of the Member State responsible that annulled or revoked the travel authorisation shall add the following data to the application file without delay:

The ETIAS National Unit of the Member State responsible that annulled or revoked the travel authorisation shall also indicate in the application file either the ground(s) for annulment or revocation that are applicable under Article 37(1) and (2) or that the travel authorisation was revoked at the request of the applicant under Article 41(8).

Where an application has been deemed admissible in accordance with Article 19, the Member State to which the third-country national concerned intends to travel may exceptionally issue a travel authorisation with limited territorial validity when that Member State considers it necessary on humanitarian grounds in accordance with its national law, for reasons of national interest or because of international obligations, notwithstanding the fact that:

For the purposes of paragraph 1, and as referred to in the public website and the app for mobile devices, the applicant may contact the ETIAS Central Unit indicating his or her application number, the Member State to which he or she intends to travel and that the purpose of his or her travel is based on humanitarian grounds or is linked to international obligations. Where such contact has been made, the ETIAS Central Unit shall inform the ETIAS National Unit of the Member State to which the third-country national intends to travel and shall record the information in the application file.

The ETIAS National Unit of the Member State to which the third-country national intends to travel may request additional information or documentation from the applicant and may set the deadline within which such additional information or documentation is to be submitted. Such requests shall be notified through the email service referred to in point (f) of Article 6(2) to the contact email address recorded in the application file, and shall indicate a list of the languages in which the information or documentation may be submitted. That list shall include at least English or French or German unless it includes an official language of the third country of which the applicant has declared to be a national. The applicant shall not be required to provide an official translation into those languages. The applicant shall provide the additional information or documentation directly to the ETIAS National Unit through the secure account service referred to in point (g) of Article 6(2). Upon submission of the additional information or documentation, the ETIAS Central System shall record and store that information or documentation in the application file. The additional information or documentation recorded in the application file shall be consulted only for the purpose of assessing and deciding on the application, for the purpose of managing an appeal procedure or for the purpose of processing a new application by the same applicant.

A travel authorisation with limited territorial validity shall be valid for a maximum of 90 days from the date of first entry on the basis of that authorisation.

Travel authorisations issued under this Article may be the subject of a flag under Article 36(2) or (3).

Where a travel authorisation with limited territorial validity is issued, the following data shall be added to the application file by the ETIAS National Unit which issued that authorisation:

Where a travel authorisation with limited territorial validity has been issued, the applicant shall receive a notification via the email service, including:

Air carriers, sea carriers and international carriers transporting groups overland by coach shall send a query to the ETIAS Information System in order to verify whether or not third-country nationals subject to the travel authorisation requirement are in possession of a valid travel authorisation.

Secure access to the carrier gateway referred to in point (k) of Article 6(2), including the possibility to use mobile technical solutions, shall allow carriers to proceed with the query referred to in paragraph 1 of this Article prior to the boarding of a passenger. The carrier shall provide the data contained in the machine-readable zone of the travel document and indicate the Member State of entry. By way of derogation, in the case of airport transit, the carrier shall not be obliged to verify whether the third-country national is in possession of a valid travel authorisation.

The Commission shall, by means of implementing acts, set up an authentication scheme reserved exclusively for carriers in order to allow access to the carrier gateway for the purposes of paragraph 2 of this Article to the duly authorised members of the carriers’ staff. When setting up the authentication scheme, information security risk management and the principles of data protection by design and by default shall be taken into account. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 90(2).

The carrier gateway shall make use of a separate read-only database updated on a daily basis via a one-way extraction of the minimum necessary subset of data stored in ETIAS. eu-LISA shall be responsible for the security of the carrier gateway, for the security of the personal data it contains and for the process of extracting the personal data into the separate read-only database.

The carriers referred to in paragraph 1 of this Article shall be subject to the penalties provided for in accordance with Article 26(2) of the Convention Implementing the Schengen Agreement of 14 June 1985 between the Governments of the States of the Benelux Economic Union, the Federal Republic of Germany and the French Republic on the gradual abolition of checks at their common borders (‘the Convention implementing the Schengen Agreement’) and Article 4 of Council Directive 2001/51/EC ([^E0018]) when they transport third-country nationals who, although subject to the travel authorisation requirement, are not in possession of a valid travel authorisation.

By way of derogation from paragraph 5 of this Article, where, for the same third-country national, the carriers referred to in paragraph 1 of this Article are already subject to the penalties provided for in accordance with Article 26(2) of the Convention Implementing the Schengen Agreement and Article 4 of Directive 2001/51/EC, the penalties referred to in paragraph 5 of this Article shall not apply.

For the purpose of implementing paragraph 5 or for the purpose of resolving any potential dispute arising from its application, eu-LISA shall keep logs of all data processing operations carried out within the carrier gateway by carriers. Those logs shall show the date and time of each operation, the data used for interrogation, the data transmitted by the carrier gateway and the name of the carrier in question.

If third-country nationals are refused entry, any carrier which brought them to the external borders by air, sea and land shall be obliged to immediately assume responsibility for them again. At the request of the border authorities, the carriers shall be obliged to return the third-country nationals to one of either the third country from which they were transported, the third country which issued the travel document on which they travelled, or any other third country to which they are certain to be admitted.

By way of derogation from paragraph 1, for carriers transporting groups overland by coach, for the first three years following the ETIAS entry into operations, the verification referred to in paragraph 1 shall be optional and the provisions referred to in paragraph 5 shall not apply to them.

Where it is technically impossible to proceed with the query referred to in Article 45(1), because of a failure of any part of the ETIAS Information System, the carriers shall be exempt from the obligation to verify the possession of a valid travel authorisation. Where such a failure is detected by eu-LISA, the ETIAS Central Unit shall notify the carriers and the Member States. It shall also notify the carriers and the Member States when the failure is remedied. Where such a failure is detected by the carriers, they may notify the ETIAS Central Unit. The ETIAS Central Unit shall inform the Member States without delay about the notification of the carrier.

The penalties referred to in Article 45(5) shall not be imposed on carriers in the cases referred to in paragraph 1 of this Article.

Where, for other reasons than a failure of any part of the ETIAS Information System, it is technically impossible for a carrier to proceed with the query referred to in Article 45(1) for a prolonged period of time, the carrier shall notify the ETIAS Central Unit. The ETIAS Central Unit shall inform the Member States without delay about the notification of that carrier.

The Commission shall, by means of an implementing act, lay down details of the fall-back procedures referred to in this Article. That implementing act shall be adopted in accordance with the examination procedure referred to in Article 90(2).

The ETIAS Central Unit shall provide operational support to carriers in relation to paragraphs 1 and 3. The ETIAS Central Unit shall establish standard operational procedures setting out how such support is to be provided. The Commission shall, by means of implementing acts, adopt further detailed rules relating to the support to be provided and to the means to provide such support. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 90(2).

The border authorities competent for carrying out border checks at external border crossing points in accordance with Regulation (EU) 2016/399 shall consult the ETIAS Central System using the data contained in the machine-readable zone of the travel document.

The ETIAS Central System shall respond by indicating: