Commission Implementing Regulation (EU) 2022/1409 of 18 August 2022 concerning the detailed rules on the conditions for the operation of the web service and data protection and security rules applicable to the web service, as well as measures for the development and technical implementation of the web service and repealing Implementing Regulation (EU) 2021/1224

19.8.2022	EN	Official Journal of the European Union	L 216/3

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2017/2226 of the European Parliament and of the Council of 30 November 2017 establishing an Entry/Exit System (EES) to register entry and exit data and refusal of entry data of third-country nationals crossing the external borders of the Member States and determining the conditions for access to the EES for law enforcement purposes, and amending the Convention implementing the Schengen Agreement and Regulations (EC) No 767/2008 and (EU) No 1077/2011 ¹, and in particular Article 13(7), Article 13a and Article 36, first paragraph, point (h), thereof,

Having regard to Regulation (EC) No 767/2008 of the European Parliament and of the Council of 9 July 2008 concerning the Visa Information System (VIS) and the exchange of information between Member States on short-stay visas, long-stay visas and residence permits (VIS Regulation) ², and in particular Article 45c(3), fourth subparagraph, Article 45c(5), second paragraph and Article 45d(3), thereof,

Whereas:

• (1) Regulation (EU) 2017/2226 establishes the Entry/Exit System, for the electronic recording and storage of the date, time and place of entry and exit of third-country nationals admitted or refused for a short stay in the territory of the Member States and calculates the duration of their authorised stay.

• (2) Regulation (EC) No 767/2008 establishes the Visa Information System for the exchange of data between Member States on applications for short-stay visas, long-stay visas and residence permits, and on the decision taken to annul, revoke or extend the visa.

• (3) The European Agency for the operational management of large-scale IT systems in the area of freedom, security and justice, established by Regulation (EU) No 1077/2011 of the European Parliament and of the Council ³ (eu-LISA) is responsible for the development of the Entry/Exit System, and the operational management of the Entry/Exit System and the Visa Information System.

• (4) Commission Implementing Regulation (EU) 2021/1224 ⁴ laid down specifications and conditions for the operation of the web service provided for in Article 13 of Regulation (EU) 2017/2226, including specific provisions for data protection and security. Those specifications and conditions also take into account visa-exempt travellers within the meaning of Article 45(2) of Regulation (EU) 2018/1240 of the European Parliament and of the Council ⁵. Those specifications and conditions should be adapted by taking into account third-country nationals that require a short-stay visa, a long-stay visa or a residence permit within the meaning of Article 45c of Regulation (EC) No 767/2008. In the interests of clarity, that Regulation shall be replaced.

• (5) Article 13(3) of Regulation (EU) 2017/2226 requires carriers to use the web service to verify whether third-country nationals holding a short-stay visa issued for one or two entries have already used the number of entries authorised by their visa.

• (6) Article 45c(1) and (2) of Regulation (EC) No 767/2008 requires air carriers, sea carriers and international carriers transporting groups overland by coach to use the carrier gateway to verify whether third-country nationals subject to a short-stay visa, airport transit visa or who are required to hold a long-stay visa or a residence permit are in possession of a valid short-stay visa, an airport transit visa, a long-stay visa or a residence permit.

• (7) In order to enable carriers to verify whether the third-country national subject to a visa requirement or who is required to hold an airport transit visa, a long-stay visa or a residence permit, is in possession of a valid visa or residence permit, they should have access to the web service. Carriers should access the web service through an authentication scheme and be able to dispatch and receive messages in a format to be determined by eu-LISA.

• (8) Technical rules on the message format and authentication scheme should be laid down in order to enable carriers to connect and use the web service to be specified in the technical guidelines, which are part of the technical specifications referred to in Article 37(1) of Regulation (EU) 2017/2226, to be adopted by eu-LISA.

• (9) Carriers should be able to indicate that the passengers fall outside the scope of the Regulation (EU) 2017/2226 and Regulation (EC) No 767/2008 and in such case carriers should receive an automatic ‘Not applicable’ reply from the web service, without querying the read-only database and without logging.

• (10) The Commission, eu-LISA and the Member States should endeavour to inform all known carriers of how and when they can register. Upon successful completion of the registration procedure as well as, where relevant, the successful completion of testing, eu-LISA should connect the carrier to the carrier interface.

• (11) Authenticated carriers should only give access to the web service to duly authorised staff.

• (12) This Regulation should provide for data protection and security rules applicable to the authentication scheme.

• (13) In order to ensure that the verification query is based on information, which is as up-to-date as possible, queries should be introduced at the earliest 48 hours prior to the scheduled time of departure.

• (14) This Regulation should apply to air carriers, sea carriers and international carriers transporting groups overland by coach, coming into the territory of the Member States. Border checks for entry into the territory of the Member States may precede boarding. In such cases, carriers should be relieved of the obligation to verify the travel authorisation status of travellers.

• (15) Carriers should have access to a web form on a public website allowing them to request assistance. When requesting assistance carriers should receive an acknowledgement of receipt containing a ticket number. eu-LISA or the ETIAS Central Unit may contact carriers that have received a ticket by any means necessary, including by phone, in order to provide an adequate response. It is necessary to adopt further detailed rules for this assistance to be provided by the ETIAS Central Unit as provided for in Article 13a of Regulation (EU) 2017/2226.

• (16) Given that Regulation (EU) 2017/2226 and Regulation (EU) 2021/1134 of the European Parliament and of the Council ⁶ build upon the Schengen acquis, Denmark, in accordance with Article 4 of Protocol No 22 on the Position of Denmark, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, Denmark notified the implementation of Regulation (EU) 2021/1134 in its national law. It is therefore, bound by this Regulation.

• (17) This Regulation constitutes a development of the provisions of the Schengen acquis in which Ireland does not take part ⁷. Ireland is therefore not taking part in the adoption of this Regulation and is not bound by it or subject to its application.

• (18) As regards Iceland and Norway, this Regulation constitutes a development of the provisions of the Schengen acquis within the meaning of the Agreement concluded by the Council of the European Union and the Republic of Iceland and the Kingdom of Norway concerning the association of those two States with the implementation, application and development of the Schengen acquis ⁸, which fall within the area referred to in Article 1, points A and B of Council Decision 1999/437/EC ⁹.

• (19) As regards Switzerland, this Regulation constitutes a development of the provisions of the Schengen acquis within the meaning of the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation’s association with the implementation, application and development of the Schengen acquis ¹⁰, which fall within the area referred to in Article 1, points A and B of Decision 1999/437/EC, read in conjunction with Article 3 of Council Decision 2008/146/EC ¹¹.

• (20) As regards Liechtenstein, this Regulation constitutes a development of the provisions of the Schengen acquis within the meaning of the Protocol between the European Union, the European Community, the Swiss Confederation and the Principality of Liechtenstein on the accession of the Principality of Liechtenstein to the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation’s association with the implementation, application and development of the Schengen acquis ¹² which fall within the area referred to in Article 1, points A and B of Decision 1999/437/EC read in conjunction with Article 3 of Council Decision 2011/350/EU ¹³.

• (21) As regards Bulgaria and Romania, in relation to the provisions under this act concerning Regulation (EU) 2017/2226, the provisions of the Schengen acquis relating to the Schengen Information System have been put into effect by Council Decision (EU) 2018/934 ¹⁴; the provisions of the Schengen acquis relating to the Visa Information System have been put into effect by Council Decision (EU) 2017/1908 ¹⁵, all the conditions for the operation of the Entry/Exit System set out in Article 66(2), point (b), of Regulation (EU) 2017/2226 are met and those Member States should therefore operate the Entry/Exit System from the start of operations as decided in accordance with Article 66(1) of Regulation (EU) 2017/2226. The provisions under this act concerning Regulation (EC) No 767/2008, constitute an act building upon, or otherwise relating to, the Schengen acquis within the meaning of Article 4(2) of the 2005 Act of Accession.

• (22) As regards Cyprus and Croatia, in relation to the provisions under this act concerning Regulation (EU) 2017/2226, the operation of the Entry/Exit System requires the granting of passive access to the Visa Information System and the putting into effect of all the provisions of the Schengen acquis relating to the Schengen Information System in accordance with the relevant Council Decisions. Those conditions can only be met once the verification in accordance with the applicable Schengen evaluation procedure has been successfully completed. Therefore, the Entry/Exit System should be operated only by those Member States which fulfil those conditions at the start of the operation of the Entry/Exit System. Member States not operating the Entry/Exit System from the start of operations should be connected to the Entry/Exit System, in accordance with the procedure set out in Regulation (EU) 2017/2226, as soon as all of those conditions are met.

• (23) As regards Cyprus, the provisions under this Regulation concerning Regulation (EC) No 767/2008, constitutes an act building upon, or otherwise relating to, the Schengen acquis, within the meaning of Article 3(2) of the 2003 Act of Accession.

• (24) As regards Croatia, the provisions under this Regulation concerning Regulation (EC) No 767/2008, constitutes an act building upon, or otherwise relating to, the Schengen acquis within the meaning of Article 4(2) of the 2011 Act of Accession.

• (25) The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 of the European Parliament and of the Council ¹⁶ and delivered an opinion on 22 March 2022.

• (26) The measures provided for in this Regulation are in accordance with the opinion of the Smart Borders Committee,

HAS ADOPTED THIS REGULATION:

Article 1

Subject matter

This Regulation establishes:

• (a) the detailed rules and conditions for the operation of the web service and the data protection and security rules applicable to the web service provided for in Article 13(1) and (3) and Article 36, first paragraph, point (h), of Regulation (EU) 2017/2226 and in Article 45c(3), fourth subparagraph of Regulation (EC) No 767/2008;

• (b) an authentication scheme for carriers to enable them to fulfil their obligations pursuant to Article 13(3) of Regulation (EU) 2017/2226 and Article 45c(5), second paragraph of Regulation (EC) No 767/2008 as well as detailed rules and conditions on registration of carriers with the authentication scheme;

• (c) details of the procedures to be followed where it is technically impossible for carriers to access the web service pursuant to Article 45d(3) of Regulation (EC) No 767/2008.

Article 2

Definitions

For the purposes of this Regulation the following definitions apply:

• (1) ‘carrier interface’ means the web service to be developed by eu-LISA in accordance with Article 37(1) of Regulation (EU) 2017/2226 where used for the purposes of Article 13(3) of that Regulation and the carrier gateway referred in Article 45c(2) and (3) of Regulation (EC) No 767/2008 and consisting of an IT interface connected to a read-only database;

• (2) ‘technical guidelines’ means the part of the technical specifications, referred to in Article 37(1) of Regulation (EU) 2017/2226 that is relevant for carriers for the implementation of the authentication scheme and the development of the message format of the Application Programming Interface referred to in Article 4(2), point (a) of this Regulation;

• (3) ‘duly authorised staff’ means employees of or contractually engaged by the carrier or by other legal or natural persons acting under that carrier’s direction or supervision, assigned with the tasks of verifying whether the number of entries authorised by a visa has already been used on behalf of the carrier, in accordance with Article 13(3) of Regulation (EU) 2017/2226 and as from the start of operations of the Visa Information System, to verify whether third-country nationals who are subject to a short-stay visa or who are required to hold a long-stay visa, the airport transit visa or a residence permit are in possession of a valid short-stay visa, long-stay visa, airport transit visa or a residence permit, as applicable, in accordance with Article 45c(1) of Regulation (EC) No 767/2008.

Article 3

Obligations of carriers

• (a) in the case of a short-stay visa, the number of entries authorised by the visa has already been used or whether the holder of the visa has reached the maximum authorised stay, as referred to in Article 13 of Regulation (EU) 2017/2226;

• (b) in the case of a long-stay visa, an airport transit visa or a residence permit, the visa or the permit are valid as referred to in Article 45c(1) of Regulation (EC) No 767/2008.

• (a) physical and logical access control mechanisms to prevent unauthorised access to the infrastructure or the systems used by the carriers;

• (b) authentication;

• (c) logging to ensure access traceability;

• (d) regular review of the access rights.

Article 4

Connection and access to the carrier interface

• (a) a dedicated network connection;

• (b) an internet connection.

• (a) a system-to-system interface (Application Programming Interface);

• (b) a web interface (browser);

• (c) an application for mobile devices.

Article 5

Queries

• (a) surname (family name); first name or names (given names);

• (b) date of birth; sex; nationality;

• (c) the type and number of the travel document and the three letter code of the issuing country of the travel document;

• (d) the date of expiry of the validity of the travel document;

• (e) the scheduled date of arrival at the border of a Member State which applies the Schengen acquis in full or a Member State which does not apply the Schengen acquis in full but operates the Entry/Exit system;

• (f) one of the following:

• (1) the scheduled Member State of entry which applies the Schengen acquis in full;

• (2) where possible to identify the scheduled Member State of entry, an airport in the Member State of entry which applies the Schengen acquis in full;

• (3) the scheduled Member State of entry which does not apply the Schengen acquis in full but operates the Entry/Exit System;

• (4) where possible to identify the scheduled Member State of entry, an airport in the Member State of entry which does not apply the Schengen acquis in full but operates the Entry/Exit System;

• (5) from the start of operations of the Visa Information System, in the case of airport transit, the Member State of transit for third-country nationals who require an airport transit visa in accordance with Article 3 of Regulation (EC) No 810/2009 of the European Parliament and of the Council ¹⁷, where applicable;

• (g) the details (local date and time of scheduled departure, identification number, where available, or other means to identify the transport) of the means of transportation used to access the territory of a Member State which applies the Schengen acquis in full or the Member State which does not apply the Schengen acquis in full but operates the Entry/Exit System.

The carrier may also provide the number of the short-stay visa, the long-stay visa or the residence permit.

From the start of operations of the Visa Information System, where the destination cannot be reached with a single-entry visa, the carrier shall provide information that the itinerary includes two or more entries into the Member States when submitting the verification query.

From the start of operations of the Visa Information System, the carrier shall be able to specify in the verification query, where:

• (a) the passenger is exempt from the scope of Regulation (EU) 2017/2226 in accordance with Article 2 of that Regulation, except for holders of a residence permit pursuant to Article 2(3), point (c) and holders of long-stay visas pursuant to Article 2(3), point (e); or

• (b) in the case of airport transit, where the passenger is not required to hold an airport transit visa pursuant to Article 3 of Regulation (EC) No 810/2009.

Article 6

Reply

• (a) where the passenger is exempt from the scope of Regulation (EU) 2017/2226 in accordance with Article 2 of that Regulation, except for holders of a residence permit pursuant to Article 2(3), point (c), and holders of long-stay visas pursuant to Article 2(3), point (e), of that Regulation, the reply shall be ‘Not applicable’;

• (b) in the case of airport transit, where the passenger is not required to hold an airport transit visa pursuant to Article 3 of Regulation (EC) No 810/2009, the reply shall be ‘Not applicable’;

• (c) in all other cases, where the passenger is a holder of a short-stay visa, a long-stay visa, a residence permit or an airport transit visa, the reply shall be ‘OK’ or ‘Not OK’.

Where a verification query returns a ‘Not OK’ reply, the carrier interface shall specify that the reply is coming from the Entry/Exit System or the Visa Information System.

• (a) where the traveller is the holder of a uniform short-stay visa:

• (1) where the authorised number of entries (one or two) on the visa has not yet been reached: OK;

• (2) where the authorised number of entries (one or two) on the visa has already been reached: Not OK;

• (3) where the visa has expired, or has been revoked or annulled: Not OK;

• (b) where the traveller is subject to a visa obligation and no visa information is available: Not OK;

• (c) where the carrier specifies that the itinerary requires a double entry visa:

• (1) where the traveller is in possession of a double entry visa, valid for the date of arrival and neither entry has been used: OK;

• (2) where the traveller is not in possession of a double entry visa: Not OK;

• (3) where the traveller is in possession of a double entry visa but at least one entry has been used: Not OK;

• (4) where the traveller is in possession of a double entry visa but at least one entry is not valid for the date of arrival: Not OK.

• (a) where the traveller is the holder of an airport transit visa:

• (1) where the airport transit visa corresponds to the transit area of the Member State’s airport: OK;

• (2) where the visa has expired, or has been revoked or annulled: Not OK;

• (3) where the visa is a single airport transit visa and the visa has not been used: OK;

• (4) where the visa is a double airport transit visa and the visa has been used only once: OK; or

• (b) where the traveller is the holder of a short-stay visa:

• (1) where the authorised number of entries on the visa has not yet been reached and there is at least 1 remaining day of authorised stay: OK;

• (2) where the authorised number of entries on the visa has already been reached or there are 0 remaining days of authorised stay: Not OK;

• (3) where the visa has expired, or has been revoked or annulled: Not OK; or

• (c) where the traveller is the holder of a short-stay visa with limited territorial validity:

• (1) where the authorised number of entries on the visa has not yet been reached and there is at least 1 remaining day of authorised stay, and where the Member State of transit corresponds to one of the Member States for which the limited territorial validity visa is valid: OK;

• (2) where the authorised number of entries on the visa has not yet been reached and there is at least 1 remaining day of authorised stay, and where the Member State of transit does not correspond to one of the Member States for which the limited territorial validity visa is valid: Not OK;

• (3) where the authorised number of entries on the visa has already been reached or there are 0 remaining days of authorised stay, and where the Member State of transit corresponds to one of the Member States for which the limited territorial validity visa is valid: Not OK;

• (4) where the authorised number of entries on the visa has already been reached or there are 0 remaining days of authorised stay, and where the Member State of transit; does not correspond to one of the Member States for which the limited territorial validity visa is valid: NOT OK;

• (5) has expired, or has been revoked or annulled: Not OK; or

• (d) where the traveller is the holder of a long-stay visa:

• (1) where the visa has expired, or has been revoked or annulled: Not OK;

• (2) otherwise: OK; or

• (e) where the traveller is the holder of a residence permit:

• (1) where the residence permit has expired, or has been revoked or annulled: Not OK;

• (2) otherwise: OK.

• (a) where the traveller is the holder of a short-stay visa:

• (1) where the authorised number of entries on the visa has not yet been reached and there is at least 1 remaining day of authorised stay: OK;

• (2) where the authorised number of entries on the visa has already been reached or there are 0 remaining days of authorised stay: Not OK;

• (3) where the visa has expired, or has been revoked or annulled: Not OK; or

• (b) where the traveller is the holder of a short-stay visa with limited territorial validity:

• (1) where the authorised number of entries on the visa has not yet been reached and there is at least 1 remaining day of authorised stay, and where the Member State of entry corresponds to one of the Member States for which the limited territorial validity visa is valid: OK;

• (2) where the authorised number of entries on the visa has not yet been reached and there is at least 1 remaining day of authorised stay, and where the Member State of entry does not correspond to one of the Member States for which the limited territorial validity visa is valid: Not OK;

• (3) where the authorised number of entries on the visa has already been reached or there are 0 remaining days of authorised stay, and where the Member State of entry corresponds to one of the Member States for which the limited territorial validity visa is valid: Not OK;

• (4) where the authorised number of entries on the visa has already been reached or there are 0 remaining days of authorised stay, and where the Member State of entry does not correspond to one of the Member States for which the limited territorial validity visa is valid: NOT OK;

• (5) has expired, or has been revoked or annulled: Not OK;

• (c) where the traveller is the holder of a long-stay visa:

• (1) where the visa has expired, or has been revoked or annulled: Not OK;

• (2) otherwise: OK;

• (d) where the traveller is the holder of a residence permit:

• (1) where the residence permit has expired, or has been revoked or annulled: Not OK;

• (2) otherwise: OK;

• (e) where the traveller is subject to a visa obligation and no visa information is available: Not OK;

• (f) where the carrier specifies that the itinerary cannot be reached with a single-entry visa:

• (1) where the traveller is in possession of a double entry visa, valid for the date of arrival and neither entry has been used: OK;

• (2) where the traveller is in possession of a single-entry visa: Not OK;

• (3) where the traveller is in possession of a double entry visa but at least one entry has been used: Not OK;

• (4) where the traveller is in possession of a double entry visa but at least one entry is not valid for the date of arrival: Not OK;

• (5) where the traveller is in possession of a multiple entry visa: OK.

Article 7

Message format

eu-LISA shall specify the data formats and structure of messages to be used for transmitting verification queries and replies to those queries through the carrier interface in the technical guidelines. eu-LISA shall provide for the use of at least the following data formats:

• (a) UN/EDIFACT;

• (b) PAXLST/CUSRES;

• (c) XML;

• (d) JSON.

Article 8

Data extraction requirements for the carrier interface and the web service for third-country nationals and data quality

Article 9

Authentication scheme

Article 10

Registration with the authentication scheme

• (a) the legal name of the carrier as well as its contact details (email address, telephone number and postal address);

• (b) the contact details of the legal representative of the company requesting the registration and of back-up points of contact (names, telephone numbers, email and postal addresses) as well as the functional email address and other means of communication that the carrier intends to use for the purposes of Articles 13 and 14;

• (c) the Member State or third country that issued the official company registration referred to in paragraph 6 and any available registration number;

• (d) where the carrier has attached, in accordance with paragraph 6, an official company registration issued by a third country, the Member States in which the carrier operates or intends to operate within the next year.

• (a) identifying and managing security risks related to the connection to the carrier interface;

• (b) protecting the environments and the devices connected to the carrier interface;

• (c) detecting, analysing, responding to and recovering from cyber security incidents.

• (a) that they operate and transport passengers into the territory of the Member States or intend to do so within the next six months;

• (b) that they will access and make use of the carrier interface in accordance with the minimum security requirements set out in the registration form, in accordance with paragraph 4;

• (c) that only duly authorised staff will have access to the carrier interface.

• (a) that they are required to inform eu-LISA of any changes regarding the information referred to in paragraphs 3, 4 and 5 of this Article or in case of technical changes affecting their ‘system-to-system’ connection to the carrier interface that may require additional testing in accordance with Article 12 through specified contact details of eu-LISA to be used for this purpose;

• (b) that they will be automatically deregistered from the authentication scheme if the logs show that the carrier has not used the carrier interface during a period of one year;

• (c) that they may be deregistered from the authentication scheme in case of a breach of the provisions of this Regulation, the security requirements referred to in paragraph 4 or the technical guidelines, including in case of abuse of the carrier interface;

• (d) that they are obliged to inform eu-LISA of any personal data breach that may occur and regularly review the access rights of their dedicated staff.

eu-LISA shall maintain an up-to-date register of registered carriers. Personal data contained in the registration of carriers shall be deleted at the latest one year after the carrier has been deregistered.

Article 11

Deregistration from the authentication scheme

Article 12

Development, testing and connection of the carrier interface

Article 13

Technical impossibility

• (a) where the failure is detected by a carrier, as soon as it becomes aware of it, it shall notify the ETIAS Central Unit through the means referred to in Article 14;

• (b) where the failure is detected or confirmed by eu-LISA, the ETIAS Central Unit shall inform the concerned carriers and Member States of such failure by email or other means of communication, as soon as they become aware of it, and of the end of the failure when the issue has been solved.

The ETIAS Central Unit shall inform the Member States of the impossibility of this carrier to send the verification query.

Article 14

Assistance to carriers

The web form shall enable the carriers to provide at least the following information:

• (a) the identification details of the carrier;

• (b) a summary of the request;

• (c) whether the request is of a technical nature and, in such case, the date and time of the start of the technical issue.

Article 15

Access to the web service by third-country nationals

• (a) type and number of the travel document or documents and three-letter code of the issuing country of the travel document or documents;

• (b) optionally, intended date of entry or exit or both, set as Central European Time by default, editable by the user;

• (c) Member State of destination.

• (a) ‘OK’ and the remaining days of authorised stay;

• (b) ‘NOT OK’ and 0 remaining days of authorised stay;

• (c) ‘Not available’.

• (a) authorised stay: OK;

• (b) remaining days: information not available, including a note stating that the stays that occurred before the Entry/Exit System started operations have not been taken into account.

• (a) where the third-country national has sufficient remaining days of authorised stay, the reply shall be:

• (i) authorised stay: OK;

• (ii) remaining days: remaining days of authorised stay calculated by the Entry/Exit System;

• (b) where the third-country national has consumed part of the authorised stay and intends to stay longer than the authorised stay, the reply shall be:

• (i) authorised stay: NOT OK;

• (ii) remaining days: 0;

• (c) where the third-country national has consumed all the days of the authorised stay, the reply shall be:

• (i) authorised stay: NOT OK;

• (ii) remaining days: 0;

• (d) where the third-country national is subject to a visa obligation and has no valid visa or the visa has expired, or has been revoked or annulled, or has a limited territorial validity visa which does not match the inserted Member State of destination, the reply shall be:

• (i) authorised stay: NOT OK;

• (ii) remaining days: 0;

• (e) where the third-country national is not subject to a visa obligation and has no valid travel authorisation or has a travel authorisation that has expired, or has been revoked or annulled, the reply shall be:

• (i) authorised stay: NOT OK;

• (ii) remaining days: 0;

• (f) where there are no entries in the Entry/Exit System for a third-country national who is a holder of a short stay visa, the number of remaining days shall be capped according to the expiration date of the short stay visa. In the case of visa exempt third-country nationals, after start of operations of the European Travel Information and Authorisation System, the number of remaining days shall be capped according to the expiration date of the travel authorisation, taking into account the transitional period and grace period referred to in Article 83 of Regulation (EU) 2018/1240.

• (a) in a prominent place, the Member States for which the calculation of the stay is applicable;

• (b) close to the field to enter the travel document number, that the travel document to be used for the purposes of the web service shall be one of the travel documents used for previous stays;

• (c) the list of Member States;

• (d) all possible reasons for receiving the reply: ‘Information not available’;

• (e) a general disclaimer stating clearly that the answer ‘OK/NOT OK’ cannot be interpreted as a decision to grant or refuse entry to the Schengen area;

• (f) the regime applicable to third-country nationals who are members of the family of a Union citizen to whom Directive 2004/38/EC of the European Parliament and of the Council ¹⁹ applies or of a national of a third country enjoying the right of free movement equivalent to that of Union citizens under an agreement between the Union and its Member States, on the one hand, and a third country, on the other and do not hold a residence card pursuant to Directive 2004/38/EC or a residence permit pursuant to Council Regulation (EC) No 1030/2002 ²⁰.

Article 16

Keeping of logs for data processing operations

For the purposes of Article 13(4) of Regulation (EU) 2017/2226 and Article 45c(8) of Regulation (EC) No 767/2008, the ETIAS National Unit shall have access to logs necessary for the dispute resolution that are kept by eu-LISA.

Article 17

Repeal of Implementing Regulation (EU) 2021/1224

Implementing Regulation (EU) 2021/1224 is repealed.

Article 18

Entry into force and applicability

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union, with the exception of the following provisions which shall apply from the date of the start of operations of the VIS pursuant to Article 11 of Regulation (EU) 2021/1134:

• (a) Article 1in so far as it relates to Regulation (EC) No 767/2008;

• (b) Article 2 in so far as it relates to Regulation (EC) No 767/2008;

• (c) Article 3(2), (3);

• (d) Article 5(1)(f)(5);

• (e) Article 5(1) second subparagraph; (2) second subparagraph; (4) second subparagraph;

• (f) Article 6(2), (4), (5);

• (g) Article 8(1), (4) in so far as it relates to Regulation (EC) No 767/2008;

• (h) Article 10(1) in so far as it relates to Regulation (EC) No 767/2008;

• (i) Article 13(1) in so far as it relates to Regulation (EC) No 767/2008;

• (j) Article 16 in so far as it relates to Regulation (EC) No 767/2008.

This Regulation shall be binding in its entirety and directly applicable in the Member States in accordance with the Treaties.

Done at Brussels, 18 August 2022.

For the Commission

The President

Ursula VON DER LEYEN