Regulation (EU) 2021/1134 of the European Parliament and of the Council of 7 July 2021 amending Regulations (EC) No 767/2008, (EC) No 810/2009, (EU) 2016/399, (EU) 2017/2226, (EU) 2018/1240, (EU) 2018/1860, (EU) 2018/1861, (EU) 2019/817 and (EU) 2019/1896 of the European Parliament and of the Council and repealing Council Decisions 2004/512/EC and 2008/633/JHA, for the purpose of reforming the Visa Information System

Three months after the date of the start of operations of the VIS pursuant to Article 11 of Regulation (EU) 2021/1134 of the European Parliament and of the Council (¹⁶) eu-LISA shall publish a consolidated list of the authorities notified pursuant to the first subparagraph of this paragraph in the Official Journal of the European Union. Member States shall notify the Commission and eu-LISA of any changes to the authorities notified without delay. In the event of such changes, eu-LISA shall publish once a year an updated consolidated list in the Official Journal of the European Union. eu-LISA shall maintain a continuously updated public website containing that information.

Article 45c

Access to data for verification by carriers

For this purpose, as regards visas, the carrier shall provide the data referred to in point (4)(a), (b) and (c) of Article 9 and as regards long-stay visas and residence permits, the carrier shall provide the data referred to in points (d), (e) and (f) of Article 22a(1), as contained in the travel document. The carrier shall also indicate the Member State of entry or, in the case of airport transit, the Member State of transit. By way of derogation from the second subparagraph of this paragraph, in the case of airport transit, the carrier shall not be obliged to send a query to the VIS, except where the third-country national is required to hold an airport transit visa in accordance with Article 3 of Regulation (EC) No 810/2009.

If a visa with limited territorial validity has been issued in accordance with Article 25 of Regulation (EC) No 810/2009, the answer provided by the VIS shall take into account the Member States for which the visa is valid as well as the Member State of entry indicated by the carrier. Carriers may store the information sent and the answer received in accordance with the applicable law. The OK/NOT OK answer shall not be regarded as a decision to authorise or refuse entry in accordance with Regulation (EU) 2016/399. The Commission shall adopt implementing acts to lay down detailed rules concerning the conditions for the operation of the carrier gateway and the data protection and security rules applicable. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 49(2).

The Commission shall adopt implementing acts to lay down the authentication scheme for carriers. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 49(2).

eu-LISA shall store the logs for a period of two years. eu-LISA shall ensure that logs are protected by appropriate measures against unauthorised access.

Article 45d

Fall-back procedures in the case of technical impossibility to access data by carriers

Article 45e

Access to VIS data by European Border and Coast Guard teams

Article 45f

Conditions and procedure for access to VIS data by European Border and Coast Guard teams

(a) the host Member State authorises the members of the European Border and Coast Guard team to consult the VIS in order to fulfil the operational aims specified in the operational plan on border checks, border surveillance and return; and (b) consultation of the VIS is necessary for performing the specific tasks entrusted to the team by the host Member State.

(a) when exercising tasks related to border checks pursuant to Regulation (EU) 2016/399, the members of the European Border and Coast Guard teams shall have access to VIS data for verification at external border crossing points in accordance with Article 18 or 22g of this Regulation respectively; (b) when verifying whether the conditions for entry to, stay or residence on the territory of the Member States are fulfilled, the members of the teams shall have access to the VIS data for verification within the territory of third-country nationals in accordance with Article 19 or 22h of this Regulation respectively; (c) when identifying any person that does not or no longer fulfils the conditions for the entry to, stay or residence on the territory of the Member States, the members of the teams shall have access to VIS data for identification in accordance with Articles 20 and 22i of this Regulation.

(45) Articles 46, 47 and 48 are deleted;

(46) the following Article is inserted: “Article 48a Exercise of delegation

(47) Articles 49 and 50 are replaced by the following: “Article 49 Committee procedure

Article 49a

Advisory group An Advisory Group shall be established by eu-LISA and provide it with the expertise related to the VIS in particular in the context of the preparation of its annual work programme and its annual activity report.

Article 50

Monitoring and evaluation

(a) the exact purpose of the consultation including the type of terrorist offence or other serious criminal offence; (b) reasonable grounds given for the substantiated suspicion that the suspect, perpetrator or victim is covered by this Regulation; (c) the number of requests to access the VIS for law enforcement purposes and to access the data on children below 14 years of age; (d) the number and type of cases in which the urgency procedures referred to in Article 22n(2) were used, including those cases where the urgency was not accepted by the ex post verification carried out by the central access point; (e) the number and type of cases, which have ended in successful identifications. Member States’ and Europol’s annual reports shall be transmitted to the Commission by 30 June of the subsequent year. A technical solution shall be made available to Member States in order to facilitate the collection of those data pursuant to Chapter IIIb for the purpose of generating statistics referred to in this paragraph. The Commission shall, by means of implementing acts, adopt the specifications of the technical solution. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 49(2).

Article 2

Amendments to Regulation (EC) No 810/2009

Regulation (EC) No 810/2009 is amended as follows:

(1) Article 10 is amended as follows: (a) paragraph 1 is replaced by the following: “1. When lodging an application, applicants shall, where required in accordance with Article 13, appear in person to provide their fingerprints or facial image. Without prejudice to the first sentence of this paragraph and to Article 45, applicants may lodge their applications electronically, where available.”; (b) paragraph 3 is amended as follows: (i) point (c) is replaced by the following: “(c) allow his or her facial image to be taken live in accordance with Article 13 or, where the exemptions referred to in Article 13(7a) apply, present a photograph in accordance with the standards set out in Regulation (EC) No 1683/95;”; (ii) the following subparagraph is added: “Without prejudice to point (c) of this paragraph, Member States may require the applicant to present a photograph in accordance with the standards set out in Regulation (EC) No 1683/95 at every application.”;

(2) Article 13 is amended as follows: (a) paragraphs 1 to 4 are replaced by the following: “1. Member States shall collect biometric identifiers of the applicant comprising a facial image and 10 fingerprints of the applicant in accordance with the safeguards laid down in the Council of Europe’s Convention for the Protection of Human Rights and Fundamental Freedoms, in the Charter of Fundamental Rights of the European Union and in the United Nations Convention on the Rights of the Child.

(a) a facial image taken live at the time of the application; (b) 10 fingerprints taken flat and collected digitally. 2a. The facial images and fingerprints referred to in paragraph 2 of this Article shall be collected for the sole purpose of recording them in the VIS in accordance with points (5) and (6) of Article 9 of the VIS Regulation and the national systems for visa processing.

However, where there is reasonable doubt regarding the identity of the applicant, the consulate shall collect the fingerprints and facial image of that applicant within the period specified in the first subparagraph. Furthermore, if at the time when the application is lodged, it cannot be immediately confirmed that the fingerprints were collected within the period specified in the first subparagraph, the applicant may request that they be collected.

(b) the following paragraph is inserted: “6a. When collecting biometric identifiers of minors all of the following conditions shall be met: (a) the staff taking the biometric identifiers of a minor have been trained specifically to take a minor’s biometric data in a child-friendly and child-sensitive manner and in full respect of the best interests of the child and the safeguards laid down in the United Nations Convention on the Rights of the Child; (b) every minor is accompanied by an adult family member or legal guardian when the biometric identifiers are taken; (c) no force is used to take the biometric identifiers.”; (c) paragraph 7 is amended as follows: (i) point (a) is replaced by the following: “(a) children below the age of six and persons over the age of 75;”; (ii) the following point is added: “(e) persons who are required to appear as witness before international courts and tribunals in the territory of the Member States and their appearance in person to lodge an application would put them in serious danger.”; (d) the following paragraphs are inserted: “7a. Applicants as referred to in points (c), (d) and (e) of paragraph 7 may also be exempt from having their facial images taken live upon submission of the application. 7b. In exceptional cases where the quality and resolution specifications set for the live enrolment of the facial image cannot be met, the facial image may be extracted electronically from the chip of the electronic Machine Readable Travel Document (eMRTD). Before extracting the data from the chip, the authenticity and integrity of the chip data shall be confirmed using the complete valid certificate chain, unless this is technically impossible or impossible due to the unavailability of valid certificates. In such cases, the facial image shall only be inserted into the application file in the VIS pursuant to Article 9 of the VIS Regulation after electronic verification that the facial image recorded in the chip of the eMRTD corresponds to the live facial image of the third-country national concerned.”; (e) paragraph 8 is deleted;

(3) Article 21 is amended as follows: (a) the following paragraphs are inserted: “3a. For the purpose of assessing the entry conditions provided for in paragraph 3 of this Article, the consulate or the central authorities shall take into account, where applicable, the result of the verifications of hits pursuant to Article 9c of the VIS Regulation or the reasoned opinion provided in accordance with Articles 9e and 9g of that Regulation by the VIS designated authority as defined in point (3b) of Article 4 of the VIS Regulation or the ETIAS National Unit as referred to in Article 8 of Regulation (EU) 2018/1240 of the European Parliament and of the Council (¹⁹). By way of derogation from Article 4(1), in the case of applications where a reasoned opinion was provided by the VIS designated authority or the ETIAS National Unit, the central authorities shall either be empowered to decide on the application themselves or shall, after assessing the reasoned opinion, inform the consulate processing the application that they object to the issuance of the visa. 3b. For the purpose of assessing the entry conditions provided for in paragraph 3 of this Article, the consulate or the central authorities shall, where a red link exists in accordance with Article 32 of Regulation (EU) 2019/817 of the European Parliament and of the Council (²⁰), assess and take into account the differences in the linked identities. 3c. Hits against the specific risk indicators referred to in Article 9j of the VIS Regulation pursuant to Article 9a(13) of that Regulation shall be taken into account in the examination of an application. The consulate and the central authorities shall in no circumstances take a decision automatically on the basis of a hit based on specific risk indicators. The consulate or the central authorities shall individually assess the security, illegal immigration and high epidemic risks in all cases. (b) paragraph 4 is replaced by the following: “4. The consulate or the central authorities shall verify, using the information obtained from the EES, in accordance with Article 24 of Regulation (EU) 2017/2226 of the European Parliament and of the Council (²¹), whether the applicant will not exceed with the intended stay the maximum duration of authorised stay in the territory of the Member States, irrespective of possible stays authorised under a national long-stay visa or a residence permit. (c) the following paragraph is inserted: “8a. Consulates shall pay particular attention to the correct verification of the identity of minors and the link with the person exercising parental authority or legal guardianship in order to prevent child trafficking.”;

(4) in point (a) of Article 25(1), the following point is added: “(iv) to issue a visa for reasons of urgency, although the verifications of hits in accordance with Articles 9a to 9g of the VIS Regulation have not been completed;”;

(5) in Article 35, the following paragraph is inserted: “5a. A third-country national for whom the verifications of hits in accordance with Articles 9a to 9g of the VIS Regulation have not been completed shall, in principle, not be issued a visa at the external border. However, a visa with limited territorial validity for the territory of the issuing Member State may be issued at the external border for such persons in exceptional cases, in accordance with point (a) of Article 25(1).”;

(6) in Article 36, paragraph 3 is replaced by the following: “3. This Article shall apply without prejudice to Article 35(3) to (5a).”;

(7) in Article 39, paragraphs 2 and 3 are replaced by the following: “2. Consular and central authorities’ staff shall, in the performance of their duties, fully respect human dignity and the fundamental rights and principles recognised by the Charter of Fundamental Rights of the European Union. Any measures taken shall be proportionate to the objectives pursued by such measures.

(8) Article 46 is deleted;

(9) Article 57 is amended as follows: (a) paragraph 1 is replaced by the following: “1. Two years after all the provisions of this Regulation have become applicable, the Commission shall produce an overall evaluation of its application. The overall evaluation shall include an examination of the results achieved against the objectives pursued and of the implementation of this Regulation.”; (b) paragraphs 3 and 4 are deleted;

(10) in point C(b) of Annex X, the second indent is replaced by the following: “— respect the human dignity and integrity of applicants, do not discriminate against persons on grounds of sex, racial or ethnic origin, religion or belief, disability, age or sexual orientation, — respect the provisions regarding the taking of biometrics identifiers laid down in Article 13, and”;

(11) Annex XII is deleted.

Article 3

Amendments to Regulation (EU) 2016/399

Regulation (EU) 2016/399 is amended as follows:

(1) in Article 8, paragraph 3 is amended as follows: (a) the following point is inserted: “(bb) if the third-country national holds a long-stay visa or a residence permit, the thorough checks on entry shall comprise verification of the identity of the holder of the long-stay visa or residence permit and the authenticity and validity of the long-stay visa or residence permit by consulting the VIS in accordance with Article 22g of Regulation (EC) No 767/2008. In circumstances where verification of the identity of the holder of the long-stay visa or residence permit or of the authenticity and validity of the long-stay visa or residence permit, fails or where there are doubts as to the identity of the holder, the authenticity of the long-stay visa or residence permit or the travel document, the duly authorised staff of those competent authorities shall proceed to a verification of the document chip;”; (b) points (c) to (f) are deleted;

(2) in Annex VII, point 6, is replaced by the following: “6.Minors 6.1.Border guards shall pay particular attention to minors, whether travelling accompanied or unaccompanied. Minors crossing an external border shall be subject to the same checks on entry and exit as adults, as provided for in this Regulation. 6.2.In the case of accompanied minors, the border guard shall check that the persons accompanying minors have parental care or legal guardianship over them, especially where minors are accompanied by only one adult and there are serious grounds for suspecting that they may have been unlawfully removed from the custody of the persons legally exercising parental care or legal guardianship over them. In the latter case, the border guard shall carry out a further investigation in order to detect any inconsistencies or contradictions in the information given. 6.3.In the case of minors travelling unaccompanied, border guards shall ensure, by means of thorough checks on travel documents and supporting documents, that the minors do not leave the territory against the wishes of the persons having parental care or legal guardianship over them. 6.4.Member States shall nominate national contact points for consultation on minors and inform the Commission thereof. A list of those national contact points shall be made available to the Member States by the Commission. 6.5.Where there is doubt as to any of the circumstances set out in points 6.1, 6.2 and 6.3, border guards shall make use of the list of national contact points for consultation on minors. 6.6.Member States shall ensure that border guards verifying biometrics of children or using them to identify a child are specifically trained to do so in a child-friendly and child-sensitive manner and in full respect of the best interests of the child and the safeguards laid down in the United Nations Convention on the Rights of the Child. When accompanied by a parent or a legal guardian that person shall accompany the child when the biometrics are verified or used for identification. No force shall be used. Member States shall ensure, where necessary, that the infrastructure at border crossing points is adapted for the use of biometrics of children.”.

Article 4

Amendments to Regulation (EU) 2017/2226

Regulation (EU) 2017/2226 is amended as follows:

(1) Article 8 is amended as follows: (a) in paragraph 2, point (e) is replaced by the following: “(e) where the identity of a visa holder is verified using fingerprints or facial image, verify at the borders at which the EES is operated the identity of a visa holder by comparing the fingerprints or facial image of the visa holder with the fingerprints or the facial image taken live that are recorded in the VIS, in accordance with Article 23(2) and (4) of this Regulation and Article 18(6) of Regulation (EC) No 767/2008. Only facial images recorded in the VIS with an indication that the facial image was taken live upon submission of the visa application shall be used for that comparison.”; (b) the following paragraphs are inserted: “3a. Interoperability shall enable the erasure of the facial image referred to in point (d) of Article 16(1) from the individual file where a facial image is recorded in the VIS with an indication that it was taken live upon submission of the visa application. 3b. Interoperability shall enable the EES to automatically notify the VIS in accordance with Article 23(3) of Regulation (EC) No 767/2008 where the exit of a child below the age of 12 is entered in the entry/exit record in accordance with Article 16(3) of this Regulation.”; (c) the following paragraph is added: “5. From the date of the start of operations of the VIS pursuant to Article 11 of Regulation (EU) 2021/1134 of the European Parliament and of the Council (²²) the EES shall be connected to the ESP to enable the automated processing pursuant to Articles 9a and 22b of Regulation (EC) No 767/2008.

(2) in Article 9(2), the following subparagraph is added: “The EES shall provide the functionality for the centralised management of that list. The detailed rules on managing that functionality shall be laid down in implementing acts. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 68(2).”;

(3) in Article 13, paragraph 3 is replaced by the following: “3. In order to fulfil their obligation under point (b) of Article 26(1) of the Convention implementing the Schengen Agreement, carriers shall use the web service to verify whether a third-country national holding a short-stay visa issued for one or two entries has already used the number of authorised entries or whether the holder of a short-stay visa has reached the maximum duration of the authorised stay. Carriers shall provide the data listed under points (a), (b) and (c) of Article 16(1) of this Regulation. On that basis, the web service shall provide carriers with an OK/NOT OK answer. Carriers may store the information sent and the answer received in accordance with the applicable law. Carriers shall establish an authentication scheme to ensure that only authorised staff may access the web service. It shall not be possible to regard the OK/NOT OK answer as a decision to authorise or refuse entry in accordance with Regulation (EU) 2016/399. Where third-country nationals are refused boarding due to the answer of the web service, carriers shall inform them that this refusal is due to information stored in the EES and shall provide them with information on their rights with regard to access to and rectification or erasure of personal data recorded in the EES.”;

(4) Article 15 is amended as follows: (a) paragraph 1 is replaced by the following: “1. Where it is necessary to create an individual file or to update the facial image referred to in point (d) of Article 16(1) and point (b) of Article 17(1), the facial image shall be taken live. This shall not apply to third-country nationals subject to a visa requirement where a facial image is recorded in the VIS with an indication that it was taken live upon submission of the application.”; (b) paragraph 5 is deleted;

(5) Article 16 is amended as follows: (a) in paragraph 1, point (d) is replaced by the following: “(d) the facial image as referred to in Article 15, unless a facial image is recorded in the VIS with an indication that it was taken live upon submission of the application.”; (b) the following paragraph is inserted: “1a. Where, for a third-country national whose individual file contains a facial image as referred to in point (d) of paragraph 1, a facial image is subsequently recorded in the VIS with an indication that it was taken live upon submission of the application, the EES shall erase the facial image from the individual file.”;

(6) in Article 18(2), the following subparagraph is added: “By way of derogation from Article 15(1) and point (d) of Article 16(1) of this Regulation, where the third-country national is refused entry on the basis of a reason corresponding to point (B) or (D) of Part B of Annex V to Regulation (EU) 2016/399 and where there are doubts regarding the authenticity of the facial image recorded in the VIS, the facial image referred to in point (a) of this paragraph shall be taken live and entered in the individual file irrespective of any facial image recorded in the VIS.”;

(7) Article 23 is amended as follows: (a) in paragraph 2, the third subparagraph is replaced by the following: “If the search in the EES with the data set out in the first subparagraph of this paragraph indicates that data on the third-country national are recorded in the EES, the border authorities shall: (a) for third-country nationals who are not subject to a visa requirement, compare the live facial image with the facial image referred to in point (b) of Article 17(1) or proceed to a verification of fingerprints against the EES, and (b) for third-country nationals subject to a visa requirement: (i) compare the live facial image with the facial image recorded in the EES referred to in point (d) of Article 16(1) of this Regulation or with the facial image taken live recorded in the VIS in accordance with point (5) of Article 9 of Regulation (EC) No 767/2008, or (ii) proceed to a verification of fingerprints directly against the VIS in accordance with Article 18 of Regulation (EC) No 767/2008. For the verification of fingerprints or the facial image taken live against the VIS for visa holders, the border authorities may launch the search in the VIS directly from the EES as provided in Article 18(6) of Regulation (EC) No 767/2008.”; (b) in the second subparagraph of paragraph 4, point (a) is replaced by the following: “(a) for third-country nationals who are subject to a visa requirement, if the search in the VIS with the data referred to in Article 18(1) of Regulation (EC) No 767/2008 indicates that data on the third-country national are recorded in the VIS, a verification of fingerprints or the facial image taken live against the VIS shall be carried out in accordance with Article 18(6) of that Regulation. For that purpose, the border authority may launch a search from the EES to the VIS as provided for in Article 18(7) of Regulation (EC) No 767/2008. Where a verification of a third-country national pursuant to paragraph 2 of this Article failed, the border authorities shall access the VIS data for identification in accordance with Article 20 of Regulation (EC) No 767/2008.”;

(8) in Article 24 the following paragraph is added: “5. The competent visa authorities and the authorities competent to decide on an application for a long-stay visa or residence permit shall have access to the relevant data in the EES for the purpose of manually verifying the hits resulting from the queries in the EES in accordance with Articles 9c and 22b of Regulation (EC) No 767/2008 as well as for the purpose of examining and deciding on those applications.”;

(9) in Article 35, paragraph 4 is replaced by the following: “4. Where a Member State has evidence to suggest that visa-related data recorded in the EES are factually inaccurate or incomplete or that such data were processed in the EES in breach of this Regulation, it shall first check the accuracy of those data against the VIS and shall, if necessary, rectify or complete them in, or erase them from, the EES. Where the data recorded in the VIS are the same as those recorded in the EES, it shall inform the Member State responsible for entering those data in the VIS immediately in accordance with Article 24(2) of Regulation (EC) No 767/2008. The Member State responsible for entering the data in the VIS shall check those data and shall, if necessary, immediately rectify or complete them in, or erase them from, the VIS and inform the Member State concerned which shall, if necessary, rectify or complete them in, or erase them from, the EES without delay and, where applicable, the list of identified persons referred to in Article 12(3).”.

Article 5

Amendments to Regulation (EU) 2018/1240

Regulation (EU) 2018/1240 is amended as follows:

(1) in Article 4, the following point is inserted: “(da) support the objectives of the VIS of facilitating the visa application procedure and contribute to the prevention of threats to the internal security of the Member States, by allowing queries in ETIAS, including the ETIAS watchlist referred to in Article 34;”;

(2) Article 7 is amended as follows: (a) paragraph 2 is amended as follows: (i) the following point is inserted: “(ca) defining, establishing, assessing ex ante, implementing, evaluating ex post, revising and deleting the specific risk indicators referred to in Article 9j of Regulation (EC) No 767/2008 after consulting the VIS Screening Board;”; (ii) point (e) is replaced by the following: “(e) carrying out regular audits of the processing of applications and of the implementation of Article 33 of this Regulation and Article 9j of Regulation (EC) No 767/2008, including by regularly assessing their impact on fundamental rights, in particular with regard to privacy and personal data protection;”; (iii) point (h) is replaced by the following: “(h) notifying carriers in cases of a failure of the ETIAS Information System as referred to in Article 46(1) of this Regulation or of the VIS as referred to in Article 45d(1) of Regulation (EC) No 767/2008;”; (b) in paragraph 3, the following point is inserted: “(aa) information on the functioning of the specific risk indicators for the VIS.”;

(3) in Article 8(2) the following point is added: “(h) manually verifying the hits in the ETIAS watchlist referred to in Article 34 of this Regulation triggered by the automated queries carried out by the VIS pursuant to Articles 9a and 22b of Regulation (EC) No 767/2008 and following up those hits, in accordance with Article 9e of that Regulation.”;

(4) the following article is inserted: “Article 11a Interoperability with the VIS From the date of the start of operations of the VIS pursuant to Article 11 of Regulation (EU) 2021/1134 of the European Parliament and of the Council (²³) the ETIAS Central System and the CIR shall be connected to the ESP to enable the automated processing pursuant to Articles 9a and 22b of Regulation (EC) No 767/2008.

(5) in Article 13, the following paragraph is inserted: “4b. Access by visa authorities and the authorities competent to decide on an application for a long-stay visa or residence permit to the ETIAS Central System in accordance with Articles 9a and 22b of Regulation (EC) No 767/2008 shall be limited to verifying whether the applicant for a visa, long-stay visa or residence permit or his or her travel document corresponds to an issued, refused, revoked or annulled travel authorisation in the ETIAS Central System and the reasons for the issuing, refusal, revocation or annulment.”;

(6) the following chapter is inserted: “CHAPTER IXa USE OF ETIAS BY VISA AUTHORITIES AND AUTHORITIES COMPETENT TO DECIDE ON AN APPLICATION FOR A LONG-STAY VISA OR RESIDENCE PERMIT

Article 49a

Access to data by visa authorities and authorities competent to decide on an application for a long-stay visa or residence permit For the purpose of carrying out the verifications laid down in Articles 9c and 22b of Regulation (EC) No 767/2008, the competent visa authorities and authorities competent to decide on an application for a long-stay visa or residence permit shall have the right to access relevant data in the ETIAS Central System and the CIR.”;

(7) in Article 69(1), the following point is added: “(h) the hits triggered by the automated queries carried out by the VIS pursuant to Articles 9a and 22b of Regulation (EC) No 767/2008, the data processed by the competent visa authorities and authorities competent to decide on an application for a long-stay visa or residence permit for the purpose of manually verifying the hits in accordance with Articles 9c and 22b of that Regulation, and the data processed by the ETIAS National Units in accordance with Article 9e of that Regulation.”;

(8) in Article 75(1), the following point is added: “(d) the specific risk indicators referred to in Article 9j of Regulation (EC) No 767/2008.”.

Article 6

Amendments to Regulation (EU) 2018/1860

In Regulation (EU) 2018/1860, Article 19 is replaced by the following:

Insofar as not established in this Regulation, the entry, processing and updating of alerts, the provisions on responsibilities of the Member States and eu-LISA, the conditions concerning access and the review period for alerts, data processing, data protection, liability and monitoring and statistics, as laid down in Articles 6 to 19, Article 20(3) and (4), Articles 21, 23, 32 and 33, Article 34(5), Article 36a and Articles 38 to 60 of Regulation (EU) 2018/1861, shall apply to data entered and processed in SIS in accordance with this Regulation.”.

Article 7

Amendments to Regulation (EU) 2018/1861

Regulation (EU) 2018/1861 is amended as follows:

(1) the following article is inserted: “Article 18a Keeping of logs for the purposes of interoperability with VIS Logs of each data processing operation carried out within SIS and VIS pursuant to Article 36c of this Regulation shall be kept in accordance with Article 18 of this Regulation and Article 34 of Regulation (EC) No 767/2008.”;

(2) the following article is inserted: “Article 36a Interoperability with VIS From the date of the start of operations of the VIS pursuant to Article 11 of Regulation (EU) 2021/1134 of the European Parliament and of the Council (²⁴) the Central SIS shall be connected to the ESP to enable the automated processing pursuant to Articles 9a and 22b of Regulation (EC) No 767/2008.

Article 8

Amendments to Regulation (EU) 2019/817

Regulation (EU) 2019/817 is amended as follows:

(1) in Article 4, point 20 is replaced by the following: “(20) ‘designated authorities’ means the Member State designated authorities as defined in point (26) of Article 3(1) of Regulation (EU) 2017/2226, point (3a) of Article 4 of Regulation (EC) No 767/2008, and point (21) of Article 3(1) of Regulation (EU) 2018/1240;”;

(2) in Article 13(1), point (b) is replaced by the following: “(b) the data referred to in points (5) and (6) of Article 9 and points (k) and (j) of Article 22a(1) of Regulation (EC) No 767/2008, provided, as regards the facial image, that it was recorded in VIS with an indication that it was taken live upon submission of the application;”;

(3) in Article 18(1), point (b) is replaced by the following: “(b) the data referred to in points (4)(a) to (ca) and points (5) and (6) of Article 9 and in points (d) to (g), (j) and (k) of Article 22a(1) of Regulation (EC) No 767/2008;”;

(4) in Article 26(1), point (b) is replaced by the following: “(b) the visa authorities and the authorities competent to decide on an application for a long-stay visa or residence permit as referred to in Article 6(1) of Regulation (EC) No 767/2008 when creating or updating an application file in VIS in accordance with that Regulation; (ba) the VIS designated authorities referred to in Articles 9d and 22b of Regulation (EC) No 767/2008 when manually verifying hits triggered by automated queries from VIS to ECRIS-TCN in accordance with that Regulation;”;

(5) in Article 27(3), point (b) is replaced by the following: “(b) surname (family name); first name(s) (given name(s)); date of birth; place of birth; sex, and nationality or nationalities as referred to in points (4)(a) and (aa) of Article 9 and in point (d) of Article 22a(1) of Regulation (EC) No 767/2008;”;

(6) in Article 29(1), point (b) is replaced by the following: “(b) the visa authorities and the authorities competent to decide on an application for a long-stay visa or residence permit as referred to in Article 6(1) of Regulation (EC) No 767/2008 for matches that occurred when creating or updating an application file in VIS in accordance with that Regulation, with the exception of the cases referred to in point (ba) of this paragraph; (ba) the VIS designated authorities referred to in Articles 9d and 22b of Regulation (EC) No 767/2008 only for yellow links created between data in VIS and ECRIS-TCN when creating or updating an application file in VIS in accordance with that Regulation;”;

(7) in Article 39, paragraph 2 is replaced by the following: “2. eu-LISA shall establish, implement and host in its technical sites the CRRS containing the data and statistics referred to in Article 63 of Regulation (EU) 2017/2226, Article 45a of Regulation (EC) No 767/2008, Article 84 of Regulation (EU) 2018/1240, Article 60 of Regulation (EU) 2018/1861 and Article 16 of Regulation (EU) 2018/1860, logically separated by EU information system. Access to the CRRS shall be granted by means of controlled, secured access and specific user profiles, solely for the purpose of reporting and statistics, to the authorities referred to in Article 63 of Regulation (EU) 2017/2226, Article 45a of Regulation (EC) No 767/2008, Article 84 of Regulation (EU) 2018/1240 and Article 60 of Regulation (EU) 2018/1861.”;

(8) in Article 72, the following paragraph is inserted: “1a. Without prejudice to paragraph 1 of this Article, for the purposes of the automated processing pursuant to Articles 9a and 22b of Regulation (EC) No 767/2008, the ESP shall start operations, limited to those purposes, from the date of the start of operations of the VIS pursuant to Article 11 of Regulation (EU) 2021/1134 of the European Parliament and of the Council (²⁵).

Article 9

Amendments to Regulation (EU) 2019/1896

In Article 10(1) of Regulation (EU) 2019/1896, the following point is inserted:

“(afa) fulfil the tasks and obligations entrusted to the Agency under Regulation (EC) No 767/2008;”.

Article 10

Repeal

Decisions 2004/512/EC and 2008/633/JHA are repealed. References to those Decisions shall be construed as references to Regulation (EC) No 767/2008 and shall be read in accordance with the correlation tables in Annexes I and II to this Regulation, respectively.

Article 11

Start of operations

No later than 31 December 2023, the Commission shall adopt a decision by means of an implementing act setting the date on which VIS operations start pursuant to this Regulation. The Commission shall adopt that decision once the following conditions are met:

(a) the measures referred to in Article 5a(3), Article 6(5), the third paragraph of Article 9, Article 9h(2), Article 9j(2) and (3), Article 22b(18), the second subparagraph of Article 29(2a), the second subparagraph of Article 29a(3), Article 45, the fourth subparagraph of Article 45c(3), the second subparagraph of Article 45c(5), Article 45d(3), and third subparagraph of Article 50(4) of Regulation (EC) No 767/2008 have been adopted;

(b) eu-LISA has notified the Commission of the successful completion of all testing activities;

(c) Member States have notified the Commission that they have made the necessary technical and legal arrangements to process data pursuant to this Regulation and have notified to the Commission and eu-LISA the information referred to in Article 45b of Regulation (EC) No 767/2008;

In the event of delays in the full implementation of this Regulation, the Commission shall inform the European Parliament and the Council as soon as possible about the reasons for the delays and their impact in terms of time and costs.

Article 12

Entry into force and application

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

This Regulation shall apply from the date set by the Commission in accordance with Article 11, with the exception of:

(a) the following provisions which shall apply from 2 August 2021: (i) point (6) of Article 1 of this Regulation as regards Article 5a(3) and Article 6(5) of Regulation (EC) No 767/2008; (ii) point (10)(c) of Article 1 of this Regulation as regards the third paragraph of Article 9 of Regulation (EC) No 767/2008; (iii) point (11) of Article 1 of this Regulation as regards Article 9h(2) and Article 9j(2) and (3) of Regulation (EC) No 767/2008; (iv) point (26) of Article 1 of this Regulation as regards Article 22b(18) of Regulation (EC) No 767/2008; (v) point (34) of Article 1 of this Regulation as regards the second subparagraph of Article 29(2a) and the second subparagraph of Article 29a(3) of Regulation (EC) No 767/2008; (vi) point (44) of Article 1 of this Regulation as regards Article 45, the fourth subparagraph of Article 45c(3), the second subparagraph of Article 45c(5) and Article 45d(3) of Regulation (EC) No 767/2008; (vii) point (46) of Article 1; (viii) point (47) of Article 1 of this Regulation as regards Article 49 and the third subparagraph of Article 50(4) of Regulation (EC) No 767/2008; and (ix) point (2) of Article 4 of this Regulation as regards Article 9(2) of Regulation (EU) 2017/2226;

(b) points (40) to (43) of Article 1, which shall apply from 3 August 2022;

(c) point (44) of Article 1 of this Regulation as regards Articles 45e and 45f of Regulation (EC) No 767/2008, which shall apply from 3 August 2023.

This Regulation shall be binding in its entirety and directly applicable in the Member States in accordance with the Treaties.

ANNEX I

ANNEX II