Commission Delegated Regulation (EU) 2021/2288 of 21 December 2021 amending the Annex to Regulation (EU) 2021/953 of the European Parliament and of the Council as regards the acceptance period of vaccination certificates issued in the EU Digital COVID Certificate format indicating the completion of the primary vaccination series (Text with EEA relevance)

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2021/953 of the European Parliament and of the Council of 14 June 2021 on a framework for the issuance, verification and acceptance of interoperable COVID-19 vaccination, test and recovery certificates (EU Digital COVID Certificate) to facilitate free movement during the COVID-19 pandemic ¹, and in particular Article 5(2) and (4) thereof,

Whereas:

• (1) Regulation (EU) 2021/953 lays down a framework for the issuance, verification and acceptance of interoperable COVID-19 vaccination, test and recovery certificates (EU Digital COVID Certificate) for the purpose of facilitating the holders’ exercise of their right to free movement during the COVID-19 pandemic. It is also to contribute to facilitating the gradual lifting of restrictions to free movement put in place by the Member States, in accordance with Union law, to limit the spread of SARS-CoV-2, in a coordinated manner.

• (2) The EU Digital COVID Certificate framework established by Regulation (EU) 2021/953 allows for the issuance, cross-border verification and acceptance of three types of COVID-19 certificates. One of these is the vaccination certificate, that is, a certificate confirming that the holder has received a COVID-19 vaccine in the Member State issuing the certificate.

• (3) Pursuant to Regulation (EU) 2021/953, each Member State is to, automatically or upon request by the persons concerned, issue vaccination certificates to persons to whom a COVID-19 vaccine has been administered. In terms of categories of personal data, the vaccination certificate is to contain the identity of the holder, information about the COVID-19 vaccine and the number of doses administered to the holder, and certificate metadata, such as the certificate issuer or a unique certificate identifier. That data is to be included in the vaccination certificate in accordance with the specific data fields set out in point 1 of the Annex to Regulation (EU) 2021/953.

• (4) When Regulation (EU) 2021/953 was adopted, insufficient data was available as to the duration of protection resulting from the completion of the primary series of a COVID-19 vaccine. As a result, the data fields to be included in vaccination certificates in accordance with the Annex to Regulation (EU) 2021/953 do not include data concerning an acceptance period, unlike the data fields to be included in certificates of recovery.

• (5) On 4 October 2021, the European Medicines Agency’s Committee for Medicinal Products for Human Use concluded that booster doses for Comirnaty may be considered at least six months after the second dose for people aged 18 years and older. On 25 October 2021, the Committee concluded that a booster dose of Spikevax may be considered in people aged 18 years and above at least six months after the second dose. On 15 December 2021, the Committee concluded that a booster dose of COVID-19 Vaccine Janssen may be considered at least two months after the first dose in people aged 18 years and above and that COVID-19 Vaccine Janssen may also be given after two doses of Comirnaty or Spikevax.

• (6) In this context, the European Centre for Disease Prevention and Control published, on 24 November 2021, a Rapid Risk Assessment of the current SARS-CoV-2 epidemiological situation, projections for the end-of-year festive season and strategies for response in the EU/EEA ², in which it noted that emerging evidence showed a significant increase in protection against infection and severe disease following a booster dose in all age groups in the short term. According to the European Centre for Disease Prevention and Control, Member States of the Union and EEA countries should urgently consider a booster dose for those 40 years and over, targeting the most vulnerable and the elderly, and that countries could also consider a booster dose for all adults 18 years and older at least six months after completing their primary series to increase protection against infection due to waning immunity, which could potentially reduce the transmission of the virus in the population and prevent additional hospitalisations and deaths.

• (7) In its Rapid Risk Assessment of 15 December 2021 ³, the European Centre for Disease Prevention and Control noted that according to currently available evidence, booster doses will increase protection against severe outcomes caused by the ‘Delta’ variant of concern, and preliminary evaluations also suggest boosters could increase protection against the ‘Omicron’ variant of concern, with an expected higher population impact if the booster dose is given within a short interval of time to most of the adult population. According to the European Centre for Disease Prevention and Control, data currently available support safe and effective administration of a booster dose as early as three months from completion of the primary vaccination series.

• (8) In connection with the administration of booster doses, more and more Member States are adopting rules as to how long vaccination certificates indicating the completion of primary vaccination series should be accepted, taking into account that the resulting protection from infection with COVID-19 appears to be waning over time. These rules either apply to domestic use-cases only, or also apply to the acceptance of vaccination certificates for the purpose of travel.

• (9) Unilateral measures in that area have the potential to cause significant disruption as Union citizens and businesses are confronted with a wide array of diverging measures. In the absence of a uniform approach at Union level, citizens would be obliged to verify each Member State’s rules in order to determine whether their vaccination certificates continue to be accepted. This uncertainty also bears the risk of impairing trust in the EU Digital COVID Certificate and compliance with the necessary public health measures being undermined. Particularly stringent rules in one Member State could make it impossible for citizens travelling from another Member State to benefit from the lifting of restrictions for vaccinated travellers, as they might not yet be in a position to obtain the necessary booster dose before travelling. These risks are particularly harmful in a situation where the economy of the Union has already been significantly affected by the virus.

• (10) To avoid diverging and disruptive measures, it is thus necessary to establish, for the purpose of travel, a standard acceptance period of 270 days for vaccination certificates indicating the completion of the primary vaccination series. This takes into account the guidance of the European Centre for Disease Prevention and Control regarding the administration of booster doses as of six months after completion of the primary vaccination series, and provides for an additional period of three months to ensure that national vaccination campaigns can adjust and citizens can have access to the administration of boosters. To ensure a coordinated approach, Member States should not accept vaccination certificates indicating the completion of the primary vaccination series if more than 270 days have passed since the administration of the dose indicated therein. At the same time, and in order to ensure a coordinated approach, Member States should not, for the purpose of travel, provide for an acceptance period shorter than 270 days. Within this standard acceptance period, vaccination certificates indicating the completion of the primary vaccination series should continue to be accepted by a Member State even if it is already administering booster doses.

• (11) Member States should immediately take all necessary steps to ensure the availability of and access to vaccination for those population groups whose previously issued vaccination certificates approach the limit of the standard acceptance period, with full regard for domestic decisions on prioritisation for different population groups in the vaccination roll-out in light of national policy and the epidemiological situation. Member States should also inform citizens about the standard acceptance period and the need to obtain booster doses.

• (12) The standard acceptance period of 270 days should apply to certificates indicating the completion of the primary vaccination series, be it a single-dose primary course, a two-dose primary series, or, in line with the vaccination strategy of the Member State of vaccination, a single dose primary course of a two-dose vaccine after having previously been infected with SARS-CoV-2. It should apply to all vaccination certificates, that is, regardless of the COVID-19 vaccine indicated therein.

• (13) As reported by the European Centre for Disease Prevention and Control, the follow-up times after administration of the booster dose in the available studies are short, and further monitoring of data is needed to determine the duration of immunity following the booster dose against infection, mild disease and severe disease. As of yet, there are no studies expressly addressing the effectiveness of boosters on transmission of SARS-CoV-2 and therefore it is not possible for now to determine an acceptance period for certificates indicating the administration of booster doses. However, the emerging data on the effectiveness of booster doses on restoring a high protection against infection indicate that they are also likely to have an important impact on limiting onward transmission. It can reasonably be expected that protection from booster vaccinations may last longer than that resulting from the primary series. Therefore, no acceptance period should, at this stage, apply to certificates indicating the administration of a booster dose, regardless whether the booster dose was administered during the 270-day acceptance period applicable to certificates indicating the completion of the primary vaccination series or whether it was administered afterwards.

• (14) In addition, no acceptance period should be established for additional doses administered to better protect individuals who mount inadequate immune responses following the completion of the primary vaccination series. A need to distinguish between such additional doses and booster doses would create a risk that the health status of such vulnerable groups is disclosed inadvertently. References in this Regulation to booster doses should thus be understood as also covering such additional doses.

• (15) It is necessary to monitor and to regularly re-evaluate the approach regarding the acceptance period to assess whether adaptations might be needed on the basis of newly emerging scientific evidence, including in relation to the acceptance period for certificates indicating the administration of a booster dose. As there are currently no recommendations from the European Medicines Agency to administer booster doses to persons below the age of 18, this re-evaluation should also assess whether exemptions from the standard acceptance period might be justified for this age group.

• (16) The standard acceptance period should not be included as a new data field in the vaccination certificate, but should be applied at the level of verification, by adapting the mobile applications used to verify EU Digital COVID Certificates. If a relevant vaccination certificate indicating a date of vaccination exceeding the acceptance period of 270 days is presented to the verifier, the mobile application used for verification should indicate the certificate as expired. Applying the standard acceptance period at the level of verification allows for easier follow-up of further evolution in scientific evidence than if a set expiry date is included in the certificates. For the purpose of applying the standard acceptance period at the level of verification, the data field on the date of vaccination should be modified. Doing so is preferable to adding a new data field specifically on the expiry date of a vaccination certificate. Adding a new data field would imply the need either to re-issue already issued vaccination certificates or to establish technical systems capable of interpreting, at the same time, already issued vaccination certificates without an expiry date and newly issued vaccination certificates featuring an expiry date. To ensure its uniform application, the standard acceptance period of vaccination certificates should be incorporated into the verification applications of all Member States.

• (17) In accordance with Articles 3(10) and 8(2) of Regulation (EU) 2021/953, vaccination certificates covered by an implementing act adopted pursuant to these provisions are to be accepted under the same conditions as EU Digital COVID Certificates. Accordingly, such certificates should not be accepted if they have been indicating the completion of the primary vaccination series and if more than 270 days have passed since the administration of the dose indicated therein.

• (18) Regulation (EU) 2021/953 should therefore be amended accordingly.

• (19) Pursuant to Article 5(4) of Regulation (EU) 2021/953, where, in the case of newly emerging scientific evidence, imperative grounds of urgency so require, the urgency procedure provided for in Article 13 of that Regulation is to apply to delegated acts adopted pursuant to Article 5(2).

• (20) In light of the already evident diverging responses from Member States to the newly emerging scientific evidence on the duration of protection resulting from the completion of the primary series of a COVID-19 vaccine, imperative grounds of urgency require the use of the procedure provided for in Article 13 of Regulation (EU) 2021/953. Delaying immediate action would risk aggravating these divergences and would be detrimental to the trust in the EU Digital COVID Certificate. In addition, citizens would be faced with an extended period of unilateral rules as to the acceptance of their vaccination certificates.

• (21) Given the urgency of the situation related to the COVID-19 pandemic, this Regulation should enter into force on the third day following that of its publication in the Official Journal of the European Union. To allow for sufficient time for the technical implementation of the standard acceptance period, this Regulation should apply from 1 February 2022.

• (22) The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 of the European Parliament and of the Council ⁴ and delivered formal comments on 14 December 2021,

HAS ADOPTED THIS REGULATION:

Article 1

In point 1 of the Annex to Regulation (EU) 2021/953, point (h) is replaced by the following:

• ‘(h) date of vaccination, indicating the date of the latest dose received (certificates indicating the completion of the primary vaccination series shall be accepted only if not more than 270 days have passed since the date of the latest dose in that series);’.

Article 2

This Regulation shall enter into force on the third day following that of its publication in the Official Journal of the European Union.

It shall apply from 1 February 2022.

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at Brussels, 21 December 2021.

For the Commission

The President

Ursula VON DER LEYEN