Commission Implementing Regulation (EU) 2025/512 of 13 March 2025 on technical arrangements for developing, maintaining and employing electronic systems for the exchange and storage of information under Regulation (EU) No 952/2013 of the European Parliament and of the Council

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 952/2013 of the European Parliament and of the Council of 9 October 2013 laying down the Union Customs Code (1), and in particular Article 8(1), point (b), Article 17 and Article 50(1) thereof,

Whereas:

(1) Article 6(1) of Regulation (EU) No 952/2013 (‘the Code’ or ‘UCC’) requires that all exchanges of information, such as declarations, applications, or decisions, between the customs authorities of the Member States and between economic operators and the customs authorities of the Member States, and the storage of that information, as required under the customs legislation of the Union, be made by using electronic data-processing techniques.

(2) Commission Implementing Decision (EU) 2023/2879 (2) establishes the work programme for the implementation of the electronic systems required for the application of the Code, which are to be developed through the projects listed in Section II of the Annex to that Implementing Decision.

(3) Important technical arrangements for the functioning of the electronic systems should be specified, such as arrangements for development, testing and deployment as well as for maintenance and for changes to be introduced in the electronic systems. Further arrangements should be specified concerning data protection, updating of data, limitation of data processing and systems ownership and security.

(4) In order to safeguard the rights and interests of the Union, Member States, and economic operators, it is important to lay down the procedural rules and provide for alternative solutions to be implemented in the event of a temporary failure of the electronic systems.

(5) The European Union Customs Trader Portal (EUCTP), as initially developed through the UCC Authorised Economic Operator (AEO), European Binding Tariff Information (EBTI) and Information Sheets (INF) for Special Procedures (INF SP) projects, aims to provide a unique access point for economic operators and other persons, and to access each of the specific trader portals developed for their related systems.

(6) The Customs Decisions System (CDS), developed through the UCC Customs Decisions project referred to in Implementing Decision (EU) 2023/2879, pursues the objective of harmonising the processes for the application for a customs decision, for the decision-taking and the decision management in the whole of the Union by using electronic data-processing techniques only. It is therefore necessary to lay down the rules governing that electronic system. The scope of the system should be determined by reference to the customs decisions which are to be applied for, taken, and managed using that system. Detailed rules should be set out regarding the system’s common components (EU trader portal, central customs decisions management system and customer reference services) and national components (national trader portal and national customs decisions management system), by specifying their functions and their interconnections.

(7) The Uniform User Management and Digital Signature (UUM&DS) system, developed through the direct trader access to the European Information Systems (Uniform User Management & Digital Signature) project referred to in Implementing Decision (EU) 2023/2879, aims to manage the authentication and access verification process for economic operators and other persons. It is necessary to set out detailed rules regarding the scope and characteristics of the system by specifying the different components (common and national components) of the system, their functions and interconnections.

(8) The EBTI system, as upgraded through the UCC Binding Tariff Information (BTI) project referred to in Implementing Decision (EU) 2023/2879, aims to align the processes for applying for, taking, and managing BTI decisions with the requirements of the Code using electronic data-processing techniques only. It is therefore necessary to lay down rules governing that system. Detailed rules should be laid down for the system’s common components (EU trader portal, central EBTI system and BTI usage monitoring) and national components (national trader portal and national BTI system), by specifying their functions and interconnections. Moreover, the project aims to facilitate the monitoring of compulsory BTI usage and the monitoring and management of BTI extended usage.

(9) The Economic Operator Registration and Identification (EORI) system, as upgraded through the UCC Economic Operator Registration and Identification system (EORI 2) project referred to in Implementing Decision (EU) 2023/2879, enables the registration and identification of economic operators of the Union and of third countries and of other persons for the purposes of applying the customs legislation of the Union. It is therefore necessary to lay down rules governing the system by specifying the components (central EORI system and national EORI systems) and the use of the EORI system. To ensure the uniform application of customs legislation and customs controls, which encompass all legislation governing entry, import, export, transit and exit of the goods, including restrictive measures in line with Articles 46 and 50(1) of the Code, and, in particular, to provide Member States with enriched data and other information relevant for the identification of risks through data processing, and the comparison and analysis of data from different sources at Union level, it is necessary to ensure that the Commission is provided with access to the central component of the EORI system. In addition, as laid down in Article 17 of the Treaty on the European Union, the Commission is to ensure the application of the Treaties and of measures adopted by the institutions pursuant to them, which includes the customs legislation and thus also the provisions on the identification and registration of economic operators in the customs legislation, the present regulation and Implementing Decision (EU) 2023/2879 adopted according to Article 280(2), point (b) of the Code to enhance the efficiency, effectiveness and uniform application of customs procedures including customs controls. As one of the systems laid down in the present regulation and in Implementing Decision (EU) 2023/2879, and as already provided for with respect to the Import Control System 2 (ICS2) and Surveillance system, the EORI system should therefore also be used by the Commission to ensure the uniform, effective and efficient implementation of customs legislation and thus it should be clarified that the Commission should access the central component of the EORI system also for this purpose.

(10) The AEO system, as upgraded through the UCC Authorised Economic Operators (AEO) project referred to in Implementing Decision (EU) 2023/2879, aims to improve the business processes relating to AEO applications and authorisations and the management of such applications and authorisations. The system also aims to implement the electronic form to be used for AEO applications and decisions, and to provide economic operators with an EUCTP through which to submit AEO applications and to receive AEO decisions electronically. It is necessary to lay down detailed rules regarding the system’s common components.

(11) The Import Control System 2 (ICS2), as developed through the ICS2 project referred to in Implementing Decision (EU) 2023/2879 aims to strengthen the safety and security of goods entering the Union. The system supports the collection of entry summary declaration data from different economic operators and other persons acting in the international supply chains for goods. The system also aims to support all exchanges of information related to fulfilment of the entry summary declaration requirements between the customs authorities of the Member States and economic operators and other persons through a harmonised trader interface developed either as a common or as a national application. The system further aims to support, via a common repository and related processes, the real-time collaborative implementation of security and safety risk analysis by the customs offices of first entry and exchange of risk analysis results among the customs authorities of the Member States, prior to goods departure from third countries and/or prior to their arrival in the customs territory of the Union. In addition, the system supports customs measures to address safety and security risks identified following risk analysis, including customs controls and the exchange of results of controls, and, where relevant, notifications to economic operators and other persons regarding certain measures which they need to take to mitigate risks. Finally, the system supports the monitoring and evaluation by the Commission and the customs authorities of the Member States of the implementation of the common safety and security risk criteria and standards and of the control measures and priority control areas referred to in the Code. For the above stated reasons, it is necessary to lay down detailed rules specifying the components and the use of the system.

(12) In accordance with Decision No 6/2020 of the Joint Committee (3) and with Article 12(2) of the Windsor Framework (4), it should be confirmed that the Union Representatives as referred to in Article 12(2) of the Windsor Framework can continue to use the data related to the United Kingdom in respect of Northern Ireland, which are collected via the ICS2.

(13) The Automated Export System, as upgraded through the UCC Automated Export System (AES) project referred to in Implementing Decision (EU) 2023/2879, aims to upgrade the existing Export Control System to be aligned with the new business and data requirements laid down in the Code. The system also aims to offer all the required functionalities and to cover the necessary interfaces with supporting systems, namely the New Computerised Transit System (NCTS) and the Excise Movement Control System. In addition, the AES supports the implementation of the centralised clearance at export functionalities. As the AES is a decentralised system, it is necessary to lay down rules specifying the components and the use of the system.

(14) In the interest of business continuity and in order to prevent serious disruptions of the trade, Member States should have the possibility to keep making use of the transitional measures and supporting mechanisms, including the central convertor for AES, during a prolonged period ending on the date defined in Article 56 of this Regulation, which is beyond the AES deployment window set out in the Annex to Implementing Decision (EU) 2023/2879.

(15) The NCTS, as upgraded through the UCC New Computerised Transit System (NCTS) project referred to in Implementing Decision (EU) 2023/2879, aims to upgrade the existing NCTS Phase 4 to align with the new business and data requirements laid down in the Code. The system also aims to offer new functionalities referred to in the Code and to cover the necessary interfaces with supporting systems and the AES. As the NCTS is a decentralised system, it is necessary to lay down rules specifying the components and the use of the system.

(16) The INF SP system, developed through the UCC Information Sheets (INF) for Special Procedures project referred to in Implementing Decision (EU) 2023/2879, aims to develop a new trans-European system to support and streamline the processes of INF data management and the electronic handling of INF data in the domain of Special Procedures. Detailed rules should be laid down to specify the system’s components and usage.

(17) In line with Article 46(3) and (5) as well as Article 47(2) of the Code, with Article 8 of the Agreement on the European Economic Area (5), Protocol 10 on simplification of inspections and formalities in respect of carriage of goods as amended by the Decision of the EEA Joint Committee No 76/2009 (6) and with Article 12 of the Agreement of 25 June 2009 between the European Community and the Swiss Confederation on the simplification of inspections and formalities in respect of the carriage of goods and on customs security measures as amended by Decision No 1/2021 of the EU-Switzerland Joint Committee (7), the customs risk management system (CRMS) referred to in Article 36 of Commission Implementing Regulation (EU) 2015/2447 (8) aims to support the exchange of risk information between the customs authorities of the Member States, Switzerland and Norway, and between those customs authorities and the Commission to support the implementation of the common risk management framework.

(18) The Centralised Clearance for Import (CCI) system, as developed through the UCC Centralised Clearance for Import (CCI) project referred to in Implementing Decision (EU) 2023/2879 aims to allow goods to be placed under a customs procedure using centralised clearance, thereby enabling economic operators to centralise their business from a customs viewpoint. The processing of the customs declaration and the physical release of the goods should be coordinated between the customs offices involved. As the CCI system is a decentralised system, it is necessary to lay down rules specifying the components and the use of the system.

(19) The Registered Exporter (REX) system, referred to in Articles 68 to 93 of Implementing Regulation (EU) 2015/2447, aims to enable exporters registered in the Union and in some third countries with which the Union has a preferential trade arrangement to self-certify the origin of their goods. Detailed rules should be laid down to specify the system’s components and usage.

(20) The Proof of Union Status (PoUS) system, developed through the UCC PoUS project referred to in Implementing Decision (EU) 2023/2879, aims to create a new trans-European system to store, manage and retrieve the proofs of Union status in the form of T2L/T2LF and customs goods manifest (CGM) documents. It is necessary to lay down rules specifying the components and the use of the system.

(21) The Surveillance system, as upgraded through the UCC Surveillance 3 project referred to in Implementing Decision (EU) 2023/2879, aims to upgrade the Surveillance 2+ system to ensure it is aligned with the UCC requirements such as the standard exchange of information via electronic data processing techniques and the establishment of the functionalities needed for the processing and analysis of the full surveillance dataset obtained from Member States. The Surveillance system, which is available to the Commission and the Member States, further includes data mining capabilities and reporting functionalities. It is necessary to lay down rules specifying the components and the use of the system.

(22) The Guarantee Management (GUM) system, developed through the UCC GUM project referred to in Implementing Decision (EU) 2023/2879, aims to ensure the efficient and effective management of different types of guarantees, except for transit which is handled as part of the NCTS project. Detailed rules should be laid down to specify the system’s components and usage.

(23) Where the Commission shall act as a joint controller together with the Member States, the Member States and the Commission shall establish joint controllership arrangements pursuant to Article 26 of Regulation (EU) 2016/679 of the European Parliament and of the Council (9) and Article 28 of Regulation (EU) 2018/1725 of the European Parliament and of the Council (10).

(24) Data retention periods need to be defined to allow for the full application of the customs legislation and to ensure effective risk management and controls, including ex post controls.

(25) Commission Implementing Regulation (EU) 2023/1070 (11) sets out technical arrangements for developing, maintaining, and employing electronic systems for the exchange of information and for the storage of such information under the Code. Given the number of amendments that need to be made to that Regulation to take account of the fact that GUM has become fully operational, the developments as regards the transition approach for AES and the updated data access for EORI, Implementing Regulation (EU) 2023/1070 should be repealed and replaced by a new Implementing Regulation.

(26) This Regulation respects the fundamental rights and observes the principles recognised by the Charter of Fundamental Rights of the European Union, and notably the right to the protection of personal data. Where for the purposes of the uniform application of the customs legislation of the Union it is necessary to process personal data in the electronic systems, Member States’ authorities should process those data in accordance with Regulation (EU) 2016/679 and the Commission should process those data in accordance with Regulation (EU) 2018/1725. The personal data of economic operators and other persons processed by the electronic systems should be restricted to the datasets as set out in Annex A, Title II, Section 3, Group 33 – Parties; Annex B, Title II, Group 13 – Parties; and Annex 12-01 to Commission Delegated Regulation (EU) 2015/2446 (12).

(27) The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725.

(28) The measures provided for in this Regulation are in accordance with the opinion of the Customs Code Committee,

HAS ADOPTED THIS REGULATION:

CHAPTER I

GENERAL PROVISIONS

Article 1

Scope

(a) the Customs Decisions System (CDS), developed through the Union Customs Code (‘the Code’ or ‘UCC’) Customs Decisions project;

(b) the Uniform User Management and Digital Signature (UUM&DS) system, developed through the direct trader access to the European Information Systems (Uniform User Management & Digital Signature) project;

(c) the European Binding Tariff Information (EBTI) system, upgraded through the UCC Binding Tariff Information (BTI) project;

(d) the Economic Operator Registration and Identification (EORI) system, upgraded through the UCC Economic Operator Registration and Identification system upgrade (EORI 2) project;

(e) the Authorised Economic Operator (AEO) system, upgraded in line with the requirements of the Code through the AEO upgrade project;

(f) the Import Control System 2 (ICS2), developed through the ICS2 project;

(g) the Information Sheets (INF) for Special Procedures (INF SP) system, developed through the UCC Information Sheets (INF) for Special Procedures project;

(h) the Registered Exporter (REX) system, developed through the UCC REX project;

(i) the Proof of Union Status (PoUS) system, developed through the UCC PoUS project;

(j) the Surveillance system, upgraded through the UCC Surveillance 3 project.