Regulation (EU) 2025/13 of the European Parliament and of the Council of 19 December 2024 on the collection and transfer of advance passenger information for the prevention, detection, investigation and prosecution of terrorist offences and serious crime, and amending Regulation (EU) 2019/818

Type Regulation

Publication 2025-01-08

State In force

Department Council of the European Union, European Parliament

Source EUR-Lex

articles 45

For the purposes of the reporting referred to in Article 44 and for generating statistics in accordance with this Article, eu-LISA shall store the data referred to in paragraphs 5 and 6 of this Article in the CRRS. It shall store such data for a period of five years in accordance with paragraph 2, while ensuring that the data do not allow for the identification of the passengers concerned. The CRRS shall provide the duly authorised staff of the PIUs and other relevant authorities of the Member States with customisable reports and statistics on API data as referred to in paragraph 5 of this Article and other PNR data as referred to in paragraph 6 of this Article for the implementation and monitoring of the application of this Regulation.

The use of the data referred to in paragraphs 5 and 6 of this Article shall not result in the profiling of individuals as referred to in Article 11(3) of Directive (EU) 2016/680 or discrimination against persons on the grounds listed in Article 21 of the Charter. The data referred to in paragraph 5 and paragraph 6 of this Article shall not be used to compare or match them with personal data or to combine them with personal data.

The procedures put in place by eu-LISA to monitor the development and the functioning of the router referred to in Article 39(2) of Regulation (EU) 2019/818 shall include the possibility to produce regular statistics to ensure that monitoring.

Article 40

Practical handbook

The Commission shall, in close cooperation with the PIUs, other relevant authorities of the Member States, air carriers and relevant Union bodies and agencies, prepare and make publicly available a practical handbook, containing guidelines, recommendations and best practices for the implementation of this Regulation, including on fundamental rights compliance as well as on penalties in accordance with Article 38.

The practical handbook shall take into account other relevant handbooks.

The Commission shall adopt the practical handbook in the form of a recommendation.

CHAPTER 8 RELATIONSHIP TO OTHER EXISTING INSTRUMENTS

Article 41

Amendment to Regulation (EU) 2019/818

In Article 39 of Regulation (EU) 2019/818, paragraphs 1 and 2 are replaced by the following:

‘1. A central repository for reporting and statistics (CRRS) is established for the purpose of supporting the objectives of the SIS, Eurodac and ECRIS-TCN, in accordance with the respective legal instruments governing those systems, and to provide cross-system statistical data and analytical reporting for policy, operational and data quality purposes. The CRRS shall also support the objectives of Regulation (EU) 2025/13 of the European Parliament and of the Council ([^E0003]).

eu-LISA shall establish, implement and host in its technical sites the CRRS containing the data and statistics referred to in Article 74 of Regulation (EU) 2018/1862 and Article 32 of Regulation (EU) 2019/816 logically separated by EU information system. eu-LISA shall also collect the data and statistics from the router referred to in Article 39(1) of Regulation (EU) 2025/13. Access to the CRRS shall be granted by means of controlled, secured access and specific user profiles, solely for the purposes of reporting and statistics, to the authorities referred to in Article 74 of Regulation (EU) 2018/1862, Article 32 of Regulation (EU) 2019/816 and Article 13(1) of Regulation(EU) 2025/13.

CHAPTER 9 FINAL PROVISIONS

Article 42

Committee procedure

The Commission shall be assisted by a committee. That committee shall be a committee within the meaning of Regulation (EU) No 182/2011.

Where reference is made to this paragraph, Article 5 of Regulation (EU) No 182/2011 shall apply. Where the committee delivers no opinion, the Commission shall not adopt the draft implementing act and Article 5(4), third subparagraph, of Regulation (EU) No 182/2011 shall apply.

Article 43

Exercise of delegation

The power to adopt delegated acts is conferred on the Commission subject to the conditions laid down in this Article.

The power to adopt delegated acts referred to in Article 4(11) and (12), Article 5(4), and Article 7(5) shall be conferred on the Commission for a period of five years from 28 January 2025. The Commission shall draw up a report in respect of the delegation of power not later than nine months before the end of the five-year period. The delegation of power shall be tacitly extended for periods of an identical duration, unless the European Parliament or the Council opposes such extension not later than three months before the end of each period.

As regards a delegated act adopted pursuant to Article 4(11), if an objection under paragraph 6 of this Article has been expressed either by the European Parliament or by the Council, the European Parliament or the Council shall not oppose the tacit extension referred to in the first subparagraph of this paragraph.

The delegation of power referred to in Article 4(12), Article 5(4) and Article 7(5) may be revoked at any time by the European Parliament or by the Council. A decision to revoke shall put an end to the delegation of the power specified in that decision. It shall take effect the day following the publication of the decision in the Official Journal of the European Union or at a later date specified therein. It shall not affect the validity of any delegated acts already in force.

Before adopting a delegated act, the Commission shall consult experts designated by each Member State in accordance with the principles laid down in the Interinstitutional Agreement of 13 April 2016 on Better Law-Making.

As soon as it adopts a delegated act, the Commission shall notify it simultaneously to the European Parliament and to the Council.

A delegated act adopted pursuant to Article 4(11) or (12), Article 5(4) or Article 7(5) shall enter into force only if no objection has been expressed either by the European Parliament or by the Council within a period of two months of notification of that act to the European Parliament and the Council or if, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object. That period shall be extended by two months at the initiative of the European Parliament or of the Council.

Article 44

Monitoring and evaluation

eu-LISA shall ensure that procedures are in place to monitor the development of the router in light of objectives relating to planning and costs, and to monitor the functioning of the router in light of objectives relating to the technical output, cost-effectiveness, security and quality of service.

By 29 January 2026 and every year thereafter during the development phase of the router, eu-LISA shall produce a report on the state of play of the development of the router, and submit that report to the European Parliament and to the Council. The report shall contain detailed information about the costs incurred and about any risks which may impact the overall costs to be borne by the general budget of the Union in accordance with Article 32.

Once the router starts operations, eu-LISA shall produce a report and submit it to the European Parliament and to the Council explaining in detail how the objectives, in particular relating to planning and costs, were achieved and giving reasons for any divergences.

By 29 January 2029, and every four years thereafter, the Commission shall produce a report containing an overall evaluation of this Regulation, including on the necessity and added value of the collection of API data, including an assessment of:

(a) the application of this Regulation;

(b) the extent to which this Regulation achieved its objectives;

(d) the impact of this Regulation on the travel experience of legitimate passengers;

(e) the impact of this Regulation on the competitiveness of the aviation sector and the burden incurred by businesses;

(f) the quality of the data transmitted by the router to the PIUs;

(g) the performance of the router in respect of the PIUs.

For the purposes of point (e) of the first subparagraph, the Commission’s report shall also address this Regulation’s interaction with other relevant Union legislative acts, in particular Regulations (EC) No 767/2008, (EU) 2017/2226 and (EU) 2018/1240 and, in order to assess the overall impact of related reporting obligations on air carriers, identify provisions that could be updated and simplified, where appropriate, to mitigate the burden on air carriers, and consider actions and measures that could be taken to reduce the total cost pressure on air carriers.

The evaluation referred to in paragraph 4 shall also include an assessment of the necessity, proportionality and effectiveness of including the mandatory collection and transfer of API data relating to intra-EU flights within the scope of this Regulation.

The Commission shall submit the evaluation report to the European Parliament, the Council, the European Data Protection Supervisor and the European Agency for Fundamental Rights. If appropriate, in light of the evaluation conducted, the Commission shall make a legislative proposal to the European Parliament and to the Council with a view to amending this Regulation.

The Member States and air carriers shall, upon request, provide eu-LISA and the Commission with the information necessary to draft the reports referred to in paragraphs 2, 3 and 4. In particular, Member States shall provide quantitative and qualitative information on the collection of API data from an operational perspective. The information provided shall not include personal data. Member States may refrain from providing such information if, and to the extent, necessary not to disclose confidential working methods or jeopardise ongoing investigations of their PIUs or other competent authorities. The Commission shall ensure that any confidential information provided is appropriately protected.

Article 45

Entry into force and application

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

It shall apply:

(a) in relation to API data, from the date two years from the date on which the router starts operations, as determined by the Commission in accordance with Article 34; and

(b) in relation to other PNR data, from the date four years from the date on which the router starts operations, as determined by the Commission in accordance with Article 35.

However:

(a) Article 4(12), Article 5(4), Article 7(5), Article 11(5), Article 12(6), Article 18(4), Article 23(2), Article 24(2), Article 25, Article 28, Article 29, Article 32(1), Article 34, Article 35, Article 42 and Article 43 shall apply from 28 January 2025;

(b) Article 6, Article 17(1), (2) and (3), Article 18(1), (2) and (3), Article 19, Article 20, Article 26, Article 27, Article 33 and Article 36 shall apply from the date on which the router starts operations, as determined by the Commission in accordance with Article 34 and Article 35.

This Regulation shall be binding in its entirety and directly applicable in the Member States in accordance with the Treaties.

[^E0001]: () Directive (EU) 2017/541 of the European Parliament and of the Council of 15 March 2017 on combating terrorism and replacing Council Framework Decision 2002/475/JHA and amending Council Decision 2005/671/JHA (OJ L 88, 31.3.2017, p. 6).

OJ L 56, 4.3.1968, p. 1.

[^E0003]: Regulation (EU) 2025/13 of the European Parliament and of the Council of 19 December 2024 on the collection and transfer of advance passenger information for the prevention, detection, investigation and prosecution of terrorist offences and serious crime, and amending Regulation (EU) 2019/818 (OJ L, 2025/13, 8.1.2025, ELI: http://data.europa.eu/eli/reg/2025/13/oj).’.

Reading this document does not replace reading the official text published in the Official Journal of the European Union. We assume no responsibility for any inaccuracies arising from the conversion of the original to this format.

This text is published under EUR-Lex's own terms of reuse, not a Legalize or public-domain licence. EUR-Lex
Creative Commons Attribution 4.0 International (CC BY 4.0)
© European Union, https://eur-lex.europa.eu — Source: EUR-Lex (Publications Office of the European Union). Reused under the Creative Commons Attribution 4.0 International (CC BY 4.0) licence. Only EU legislation published in the printed Official Journal of the European Union is deemed authentic; consolidated texts are reproduced here for documentation purposes and have been reformatted to Markdown.