EN    EN 
 
 
 EUROPEAN  
COMMISSION   
Brussels, XXX   
[…](2017) XXX  draft  
  
COMMISSION IMPLEMENTING REGULATION (EU) …/...  
of XXX  
on technical standards for the establishment and operation of a traceability system for 
tobacco products  
(Text with EEA relevance)    
EN 2   EN COMMISSION IMPLEMENTING REGULATION (EU) …/...  
of XXX  
on technical standards for the establishment and operation of a traceability system for 
tobacco products  
(Text with EEA relevance)  
THE EUROPEAN COMMISSION,  
Having regard to the Treaty on the Functioning of the European Union , 
Having regard to Directive 2014/40/EU of the European Parliam ent and of the Council of 3 
April 2014 on the approximation of the laws, regulations and administrative provisions of the 
Member States concerning the manufacture, presentation and sale of tobacco and related 
products and repealing Directive 2001/37/EC1, and in particular Article 15(11) thereof,  
Whereas:  
(1) In order to address the issue of illicit trade in tobacco products, Directive 2014/40/EU 
provides that all unit packets of tobacco products are to  be marked with a unique 
identifier and their movements tracked and traced throughout the Union. Technical 
specifications regarding the system's establishment and operation, as well as its 
compatibility throughout the Union, should be laid down.  
(2) Rules conc erning the marking of packages with a unique identifier, the recording and 
transmission of data, the processing, storing and accessing of data and the 
compatibility of components of the traceability system should be set.  
(3) Legislative action at Union level i s also necessary in order to implement Article 8 of 
the Protocol to Eliminate Illicit Trade in Tobacco Products  to the  World Health 
Organisation's Framework Convention on Tobacco Control2 ('WHO FCTC Protocol '), 
which has been ratified  by the European Union3 and provides for a global tracking and 
tracing regime for tobacco products, to be established by the Parties to the WHO 
FCTC Protocol  within five years of its entry into force .  
(4) In order to combat multiple existing types of fraudulent activities that res ult in illicit 
products being made available to consumers, including practices that entail the false 
declaration of exports, the traceability system provided for under this Regulation is to 
apply, in accordance with Article 15 of Directive 2014/40/EU, to all tobacco products 
                                                 
1 OJ L 127, 29.4.2014, p. 1.  
2 Protocol to Eliminate Illicit Trade in Tobacco Products to the World Health Organisation's Framework Convention 
on Tobacco Control  (OJ L 268, 1.10.2016, p.10) . 
3 Council Decision (EU) 2016/1749 of 17 June 2016 on the conclusion, on behalf of the European Union, of the 
Protocol to Eliminate Illicit Trade in Tobacco Products to the World Health Organisation's Framework Convention 
on Tobacco Control, with the exception of its provisions falling within the scope of Tit le V of Part Three of the 
Treaty on the Functioning of the European Union ( OJ L 268, 1.10.2016, p. 1) . Council Decision (EU) 2016/1750 of 
17 June 2016 on the conclusion, on behalf of the European Union, of the Protocol to Eliminate Illicit Trade in 
Tobacco  Products to the World Health Organisation's Framework Convention on Tobacco Control, as regards its 
provisions on obligations related to judicial cooperation in criminal matters and the definition of criminal offences 
(OJ L 268, 1.10.2016, p. 6).   
EN 3   EN manufactured in the Union, as well as to those manufactured outside the Union  insofar 
as they are destined for or placed on the Union market.  
(5) In order to provide for the independence of the traceability system and guarantee that 
it is controlled by the Member States , as provided under Article 8  of th e WHO FCTC  
Protocol , a proper assignment of roles in relation to the marking of packages with a 
unique identifier is essential. The key task of generation of the unique identifiers, at 
both unit packet and aggregated packaging level, should be attributed to an 
independent third party appointed by the Member States ( 'ID issuer '). 
(6) To avoid the risk that two or more ID issuers , independently of each other , generate 
the same unique identifier, each ID issuer should be identified by a  unique  
identification code, which should also form part of the unique identifiers issued by 
them.  
(7) In order to guarantee the uniqueness  of the identifier , a serial number generated by the 
ID issuer having a negligible  probability to be guessed by falsifiers should form part of 
each unique  identifier.  
(8) When requesting unit packet unique identifiers from an ID issuer, manufacturers and 
importers should be required to provide all information necessary  for the issuer to be 
able to generate that  identifier, in accordance with Article 15(2), points (a) to (h) of 
Directive 2014/40/EU, with the exception of date and time of manufacture, which may 
not be possible to determine in advance and which should be added by economic 
opera tors at the moment of production.  
(9) The length of the unit level unique identifier may impact the speed at which it can be 
applied to unit packets by tobacco product manufacturers or importers. In order to 
avoid an excessive impact on this process whilst ens uring sufficient space for all 
information required at unit packet level, the maximum permitted number of 
alphanumeric characters for the unit level unique identifier should be laid down.  
(10) In order to ensure that unit level unique identifiers are capable of  meeting the 
requirements relating to the maximum permitted number of alphanumeric characters, 
information required under Article 15(2) points (a) to (h) of Directive 2014/40/EU 
should be translated into code .  
(11) For the purpose of decoding the unique identi fiers by the competent authorities of the 
Member States  without accessing the information stored in the repository system , flat-
files should be established and maintained by the ID issuers. Such  flat-files should 
enable all information codified in the uniq ue identifier codes to be identified. The size 
of such flat-files should be defined, in order to ensure that they can be downloaded to 
the devices used by Member States when readin g the unique identifiers in off line 
mode  (offline flat-files).   
(12) Directive 2014/40/EU provides that the recording obligations established pursuant to 
Article 15 may be complied with by the marking and recording of aggregated 
packaging, such as cartons, mastercases or pallets, provided that the tracking and 
tracing of al l unit packets remains possible. To allow for this, it is necessary for all 
aggregated packaging to be marked with an aggregated level identifier which is also 
unique and therefore capable of unequivocally identifying the unit pack ets that it 
contains. For  this reason, aggregated level unique identifiers should be generated by  
the ID issuers and contain the ID issuer identification code as well as a serial number.   
EN 4   EN (13) In order to determine the minimum essential information related to aggregation  in 
offline mod e, the aggregated level unique identifier should also include the location 
and time of the aggregation.  
(14) In order to ensure that all movements of the unit packets can be recorded and 
transmitted, manufacturers and importers should verify the unique identif iers so as to 
ensure their readability. To control this critical process for the unit level unique 
identifiers, anti -tampering devices, which are to be supplied by an independent third 
party, should be installed on the devices used for verification purpose s. 
(15) In order  to minimise the impact of the traceability system on  production and 
distribution schemes , economic operators should be permitted to order batches of the 
unique identifiers in advance . However, to avoid overstocking of the  unique identifiers 
by economic operators and to control the size of individual orders, a time limit for the 
application of unique identifiers at both unit packet and aggregated levels  should be 
set. These measures should also alleviate  potential excessive impact s on the generation 
and issuing activities performed by the ID issuers.  
(16) In order to ensure  the proper functioning of the traceability  system, economic 
operators and operators of retail outlets should apply in advance to  the relevant ID 
issuers for an econom ic op erator identification code and  for a facility identifier code  
for each facility . The assignment of  economic operator identification codes and facility 
identifier codes permits the efficient identification of all purchasers and of the actual 
shipment r oute from manufacturing to the first retail outlet  as provided for in  Article 
15(2) points (i) and (j) of Directive 2014/40/EU.  
(17) Manufacturers or importers  should in addition apply for  an identifier code for the 
machine used to manufacture tobacco products.  The obligation to apply for machine 
identification codes permits the efficient identification  of the machine used to 
manufacture the tobacco products in accordance with Article 15(2) point (c) of 
Directive 2014/40/EU.  
(18) To ensure that the information contai ned in the unique identifier is capable of being 
recorded and transmitted by all relevant economic operators, as well as to guarantee 
the compatibility of the unique identifier with external components such as scanning 
devices, a list of permitted data car riers should be established.  
(19) In order for the traceability system  to be able to achieve its objective, it is necessary 
for it to be capable of enabling easy transmission of all relevant data, providing secure 
storage of data and ensuring full access to th is data for the Commission, the competent 
authorities of the Member States and the external auditor . The storage architecture 
should further allow manufacturers and importers to select independent third party 
data storage providers (‘primary repositories’) with which  to conclude  data storage 
contracts, as provided for by Article 15(8) of Directive 2014/40/EU, whilst ensuring 
authorities are provided with full access to all stored data for the purpose of carryin g 
out their monitoring and enforcement activities. The effectiveness of such monito ring 
and enforcement activities  requires  the presence of a single second -level repository 
system (‘secondary repository’), containing a copy of all the data stored in the pr imary 
repositories and providing authorities with a global overview of the functioning of the 
traceability  system . A routing system, operated by the provider of the secondary 
repository, should be established in order to  provide economic operators other th an 
manufacturers and importers with a single entry point to submit the data recorded by 
them to the traceability system and thereby ease the data transmission. At the same  
EN 5   EN time, the routing service should  ensure that data are transmitted to the correct pri mary 
repository . 
(20) In order to guarantee full access for relevant authorities and to contribute to the 
efficient functioning of the traceability system, the provider of the secondary 
repository should develop user interfaces enabling the stored data to be vi ewed and 
queried. In using the traceability system the relevant authorities should be able to rely 
on the eIDAS4 based reusable solutions provided as building blocks under the 
telecommunication part of the Connecting Europe Facility. In addition, to facili tate 
effective surveillance and enforcement, the user interface should include automatic 
alerts based on specific reporting events.  
(21) To ensure interoperability of the components of the repository system, technical 
specifications  should be established  for t he exchange of data between the primary 
repositories, the secondary repository and the routing system.  
(22) In order to ensure that the required information is recorded and transmitted in a timely 
and uniform manner by all economic operators, the precise list o f supply chain and 
transactional events that are required to be recorded under Article 15(2), points (i), (j) 
and (k) of Directive 2014/40/EU, as well as the content of the information messages to 
be transmitted, should be laid down.  
(23) Given that the aim of  a traceability  system is to provide Member States and the 
Commission with an effective tool to fight illicit trade of tobacco products, timely 
availability of supply chain and transactional event data is necessary for investigation 
and enforcement purpose s. The maximum time that may elapse between the 
occurrence of a relevant supply chain or transactional event and the transmission of the 
related information to the relevant data storage repository should therefore be 
established.  
(24) Given the requirement for the traceability system to be independent and controlled by 
the Member States , as provided for under Article 8  of the WHO FCTC Protocol , 
common criteria for the assessment of independence of all third parties involved in the 
traceability system (ID issuers, providers of repository services and anti -tampering 
devices) should be laid down.  
(25) The protection of personal data processed in the co ntext of a traceability system  
should be ensured  in accordance with Directive 95/46/EC of the European Parliament 
and of the Council5. 
(26) Compliance with c ertain international standards can be used as proof that certain 
requirements of this Regulation are ful filled. Where it is not possible to prove 
compliance with international standards, it should be the responsibility of the persons 
to whom the obligations are imposed  to prove, by verifiable means, that they comply 
with those requirements.  
(27) The measures prov ided for in this Regulation are in accordance with the opinion of the 
Committee referred to in Article 25 of Directive 2014/40/EU , 
                                                 
4 Regula tion (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 on electronic 
identification and trust services for electronic transactions in the internal market and repealing Directive 
1999/93/EC (OJ L 257/73, 28.8.2014, p. 73).  
5 Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of 
individuals with regard to the processing of personal data and on the free movement of such data ( OJ L 281, 
23.11.1995, p. 31).   
EN 6   EN HAS ADOPTED THIS REGULATION : 
CHAPTER I  
SUBJECT MATTER AND DEFINITIONS  
Article 1  
Subject matter  
This Regulation lays down the technical standards for the establishment and operation of the 
traceability  system provided for in Article 15 of Directive 2014/40/EU . 
Article 2  
Definitions  
For the purposes of this Regulation, in addition to the definitions laid down in Article 2  of 
Directive 2014/40/EU , the following definitions  shall apply :  
(1) ‘unique identifier ’ means the alphanumeric code enabling the 
identification of a unit pack  or an aggregated  packaging of tobacco 
products;  
(2) ‘economic operator ’ means any natural or legal pers on who is involved in 
the trade of tobacco products, from the manufacturer to the last economic 
operator before the first retail outlet;   
(3) ‘aggregated packaging ’ means any packaging containing  more than one  
unit packet of tobacco products;  
(4) ‘facility ’ means any building where tobacco products are manufactured 
or stored;  
(5) ‘anti-tampering device ’ means the device  allowing for recording of the 
verification process following the application of each unit level unique 
identifier  by means of a video or a log file, wh ich once recorded cannot 
be further altered by an economic operator ; 
(6) ‘offline flat-files’ means the electronic files  that contain data allowing for 
the extraction of information encoded in the unique identifier s (excluding 
the timestamp) used at the unit p acket and aggregated packaging levels 
without accessing the repository system ;  
(7) ‘registry ’ means the record of all the identifier codes  generated for 
economic operators, facilities and machines along with  the corresponding 
information ; 
(8) ‘data carrier ’ means  a carrier representing data in a form readable with 
the aid of a device ; 
(9) ‘machine ’ means  machinery  which is designed, or adapted, to be used for 
the manufacture of tobacco products and is integral to the manufacturing 
process;  
(10) ‘time stamp ’ means  the date and time of occurrence of a particular event 
recorded  in UTC (Coordinated Universal Time) time in a prescribed 
format ;   
EN 7   EN (11) ‘primary repository’ means a repository containing data that originate 
from  one manufacturer or importer;  
(12) ‘secondary repository’ m eans a repository containing a copy of all data 
stored in the primary repositories;  
(13) ‘router’ means a device established within the secondary repository  that  
transfer s data between different components of the repository system ; 
(14) ‘repository system ’ means t he system consisting of the primary 
repositories, the secondary repository and the router ; 
(15) ‘common data dictionary ’ means  a set of information describing the 
contents, format, and structure of a database and the relationship between 
its elements, used to c ontrol access to and manipulation of the databases  
common for all primary and secondary repositories;  
(16) ‘working day’ means any day from Monday to Friday except  legal 
holidays in the Member State for which  the ID issuer is competent . 
 
CHAPTER II  
TECHNICAL SPECIFICATIONS RELATED TO  THE UNIQUE IDENTIFIER  
SECTION 1 
COMMON PROVISIONS  
Article 3  
ID issuer  
1. Each Member State shall appoint  an entity  (the ‘ID issuer’) responsible for 
generating and  issuing unique identifiers , in accordance with Article s 8, 9, 11 and 13 , 
within a maximum period of six months from the date of  entry into force of this 
Implementing Regulation.   
2. The ID issuer shall be  independent  and comply with the criteria set out in Article  35. 
3. Each ID issuer  shall be equipped with  a unique  identification code . The code shall be 
composed of  maximum  three  alphanumeric characters and comply with standard 
ISO/IEC 15459 -2:2015.  
4. Where the same ID issuer is appointed in more than one Member State, it shall be 
identifiable by the same code.  
5. Member States shall notify the  Commission of the appointment of  the ID issuer and 
of its identification code within one month of its appointment.  
6. Member States shall ensure that information related to the identity of the ID issuer 
appointed and its identification  code  is made publicly available and accessible 
online .  
7. Member States shall put in place  adequate measures to ensure:  
(a) that the ID issuer continues to comply with the requirement of 
independence  in accordance with Article 3 5; and   
EN 8   EN (b) the continuous operation of the services provided by successive  ID 
issuers , in case a new ID issuer  is appointed to take over the services 
from the previous ID issuer .  
8. The ID issuer may charge fees to economic operators for generating and issuing 
unique i dentifiers. Fees must be non -discriminatory and proportionate to the number 
of unique identifiers generated and issued to economic operators.  
Article 4 
Competent ID issuer s 
1. For tobacco products manufactured in the Union, the competent ID issuer shall be 
either one of the following:  
(a) the entity a ppointed for the Member State in which the products are 
manufactured , 
(b) the entity appointed for the Member State  on whose market the products 
are placed .  
2. For tobacco products aggregated in the Union, the competent ID issuer shall be the 
entity appointed for the Member State in which the products are aggregated.  
3. For tobacco products imported into the Union, the competent  ID issuer shall be  either 
one of the following:  
(a) the entity appointed for the Member State in whic h the products were 
imported , 
(b) the entity appointed for the Member State on whose market  the products 
are placed . 
Article 5 
Validity of unique identifiers and deactivation  
1. Unique identifiers may be used to mark unit packet s or aggregated packaging, as 
provided for by Articles 6 and 10, within a maximum period of six months from the 
date of receipt of the unique identifiers by the economic operator. After this time 
period unique identifiers shall become invalid and economic o perators shall ensure 
that they are not used to mark unit packet s or aggregated packaging .  
2. The repositories system shall ensure that the unique identifiers that have not been 
used within the six months period referred to in paragraph 1 shall be automatica lly 
deactivated.  
3. At any time, manufacturers and importers may  obtain the deactivation of unique 
identifiers by transmitting  a deactivation request to the relevant primary repository . 
Other economic operators may obtain the deactivation of the unique identi fiers by 
transmitting a deactivation  request to the router. The deactivation request shall be 
introduced electronically, in accordance with Article 3 6, and shall contain the 
information listed in  point 2.3 .of Section 2 of Chapter II of Annex II , in the format 
indicated therein.    
EN 9   EN SECTION 2 
UNIQUE IDENTIFIERS AT  UNIT PACKET LEVEL  
Article 6 
Marking by means of unit level UIs  
1. Manufacture rs and importers shall mark each unit packet  manufactured or imported 
in the Union  with a unit level UI compliant with Article 8. 
2. In the case of tobacco products that are manufactured outside the Union, the unit 
level UI shall be applied on the unit packet before the tobacco product is imported in 
the Union.  
Article 7 
Verification of un it level UIs  
1. Manufacturers and importers shall ensure that the application of unit level UIs  is 
directly followed by the verification of the readability of those unit level UIs .  
2. The device used to verify the readability of unit level UIs shall be protecte d with an 
anti-tampering device supplied and installed by an independent third party.  
3. Where the verification process fails to confirm the readability of the unit level UI, 
manufacturers and importers shall re -apply the unit level UI.  
4. Manufacturers and imp orters shall ensure that the information recorded by the anti -
tampering device shall be made available up to three  months from the recording.  
5. Manufacturers and importers shall, within one week of the receipt of a written 
request from Member States, provide  full access to the record of the verification 
process created by the anti -tampering device.  
Article 8 
Structure of unique identifier at  unit packet level  
1. Each unit packet  of tobacco products shall be marked with a unique identifier  (‘unit 
level UI’). It shall consist  of: a sequence of a maximum of 50 alphanumeric 
characters that is unique to a given unit packet; and shall be composed of the 
following data elements  (to be placed in the position indicated) : 
(a) in  position  1, the alphanumeric characters  that constitute  the ID issuer 
identification c ode assigned pursuant to  Article 3(3); 
(b) in position  2,  an alphanumeric sequence , whose probability to be 
guessed shall be negligible  and in any case lower than one in ten 
thousand  (‘serial number’);  
(c) in position  3, a code  (‘product code’)  allowing for the determination of 
the following : 
(a) the place of manufacturing;  
(b) the  manufacturing facility referred to in Article 16; 
(c) the machine used to manufacture the tobacco products 
referred to in Article  18;  
EN 10   EN (d) the product description;  
(e) the intended market of retail sale;  
(f) the intended shipment route;  
(g) where applicable, the importer into the Union;  
(d) in position  4, the time stamp  in the form of a numeric sequence of eight  
characters , in the form at YYMMDDhh , indicating the date and time of 
manufacture . 
2. ID issuers shall be responsible for the generation of a code consisting  of the elements 
listed in pa ragraph 1, point s (a),  (b), and (c).   
3. Manufacturers or importers shall add the time stamp referred to in paragraph 1, point 
(d), to the code generated by  the ID issuer pursuant to paragraph 2 . 
4. Unit level UIs shall not be reused.  
Article 9 
Request and i ssuing of unit level UIs  
1. Manufacture rs and importers shall send a request  to the competent  ID issuer  for unit 
level UIs referred to in Article 8. Requests shall be introduced electronically, in 
accordance with  Article 36. 
2. Manufacturers and importers i ntroducing such a request shall supply the information 
listed in point 2.1. of Section 2 of Chapter II of Annex II, in the f ormat indicated 
therein . 
3. Each ID issuer shall specify whether unit level UIs shall be delivered electronically 
or physically.  
4. Where unit level UIs are delivered  electronic ally, the ID issuer shall  within two 
working days from the receipt of the request  and in the order indicated:  
(a) generate the codes referred to in Article 8(2); 
(b) transmit the codes  along with the information referred to in paragraph 2  
via the router to the primary repository of the requesting manufacturer or 
importer, as established under Article 26; and 
(c) transmit the codes to the requesting manufacturer or importer .  
5. Where unit level UIs are delivered physical ly, the ID issuer shall within 10 working 
days from the receipt of the request,  and in the following order:  
(a) generate the codes referred to in Article 8(2); 
(b) transmit the codes  along with the information referred to in paragraph 2 
via the router to the primary repository of the requesting manufacturer or 
importer, as established under Article 26; and 
(c) deliver the codes  to the request ing manufacturer or importer in the form 
of optical barcode s, compliant with  Article 21, placed  on physical 
carrier s, such as  adhesive label s.  
6. Within one working day, manufacturers and importers may cancel a request which 
was sent pursuant to paragraph 1 by means of a recall message as further defined in 
Point 5  of Section 5 of Chapter II.   
EN 11   EN SECTION  3 
UNIQUE IDENTIFIERS AT  AGGREGATED PACKAGING  LEVEL  
Article 10 
Marking by means of aggregated level UI s 
For the purpose of discharging their obligation under Article 15(5) of Directive 2014/40/EU 
by means of the recording of aggregated packaging, economic operators shall mark each 
aggregated packaging containing tobacco products with an aggregated level UI c ompliant 
with Article 11.  
Article 11 
Structure of unique identifiers at  aggregated packaging level  
1. Each aggregated packaging containing tobacco products shall be marked with a 
unique identifier (‘aggregated level UI’) . It shall  consist of  a sequence of a maximum 
of 100 alphanumeric characters that is unique to a given aggregated packag e and 
shall be composed of  the following data elements, (to be placed in the position  
indicated ): 
(a) in position 1, the alphanumeric characters that constitute the ID issuer 
identification code assigned under Article 3(3); 
(b) in position 2, an alphanumeric sequence, whose probability to be guessed 
shall be negligible and in any case lower than one in ten thousand  (‘serial 
number’) ; 
(c) in position 3, the identifier code of the facility (as set out in Article 16) in 
which the aggregation process took place ; 
(d) in position 4, the time stamp in the form of a numeric sequence of eight  
characters , in the form at YYMMDDhh , indicating the date and time of 
aggregation . 
2. ID issuers shall be responsibl e for the generation of a code consisting  of the elements 
listed in paragraph 1, point  (a), (b), and (c).   
3. Economic operators  shall add the time stamp , referred to in paragraph 1, point (d), to 
the code generated by the ID issuer pursuant to paragraph 2.  
4. The aggregated level UI may be completed by the economic operator with additional 
information, such as a SSCC -18 container code generated in line with 
ISO6346:1995. Any such information may only appear after the data referred to in 
paragraph 1.  
Article 12 
Link between UI levels  
1. The aggregated level UI shall be capable of identifying the list of all unique 
identifiers  contained within the aggregated packaging by means of a n electronically 
accessible link to the repositories system.  
2. In order to establish the link referred to in paragraph 1, economic operators  shall 
transmit to the relevant data storage the information listed in point 3.2 of Section 2 of 
Chapter II of Annex II, in the format indicated therein.   
EN 12   EN Article 13 
Request and i ssuing of aggregated level UIs  
1. Economic operators shall send a request to the competent ID issuer for the 
aggregated level UIs  referred  to in Article 11. Requests shall be introduced 
electronically, in accordance with  Article 36. 
2. Economic  operators introducing such a request shall supply the information listed in 
point 2.2. of Section 2 of Chapter II of Annex II, in the format indicated therein.  
3. For manufacturers and importers , the ID issuer shall , within two working days from 
the receipt of the req uest and in the order indicated:  
(a) generate the code referred to in Article 11(2); 
(b) transmit the codes  along with the information referred to in paragraph 2  
via the router to the primary repository of the requesting manufacturer or 
importer, as established under Article 26; and  
(c) transmit the codes  electronically to the requesting manufacturer or 
importer.  
4. For economic operators  other than manufacturers and importers , the ID issuer shall, 
within two working days from the receipt of the request  and in the order indicated:  
(a) generate the code referred to in Article 11(2); 
(b) transmit the codes along with the information referred to in paragraph 2  
via the router to the secondary repository, as established under Article 
26; and  
(c) transmit the codes electr onically to the requesting economic operators . 
5. Within one working day, economic operators may cancel a request which was sent 
pursuant to paragraph 1 by means of a recall message as further defined in point 5 of 
Section 5 of Chapter II of Annex II, in the format indicated therein.  
6. Aggregated level UIs shall not be reused.  
CHAPTER II I 
IDENTIFIER CODE S FOR ECONOMIC OPERA TORS, FAC ILITIES AND 
MACHINES  
Article 14 
Request for an e conomic operator identifier  code  
1. Economic operators  and operators of retail outlets  shall apply for an economic 
operator identifier code from  the ID issuer competent for each Member State  in 
which they operate at least one facility . Regardless of the operation of facilities, 
importers shall apply for an identifier code with the  competent ID issuer.  
2. Economic operators  and operators of retail outlets  introducing a request pursuant to 
paragraph 1 shall provide the information  listed in point 1.1 of Section 1 of Chapter 
II of Annex II, in the format indicated therein.  
3. For operators  of retail outlet s the obligation  to apply for an economi c operator 
identifier code may also be discharged by any other registered economic operator.   
EN 13   EN Such registration by the third party shall be subject to the consent of the operator of 
the retail outlet. The third party shall inform the operator of the retail outlet of the 
full details of the registration, including the allocated economic operator identifier 
code.  
4. Economic operators and operators of retail outlets  shall inform the ID issuer of any 
economic operator identifier codes allocated  to them  by other ID issuers. If not 
available at the time of registration, economic operators shall provide that  
information at the latest within two working  days from the receipt of the economic 
operator  identifier codes allocated by another ID issuer.  
5. Any modification of the information submitted in the initial application form and any 
cessation of the operator activities  shall be notified by the relevant  operator to  the 
competent ID issuer without delay , in the format s indicated in  points 1.2. and 1.3.  of 
Section 1 of Chapter II of Annex II. 
6. By way of derogation from paragraph 1, transport operators not involv ed in trans -
loading of products shall not be required to apply for an economic operator identifier 
code.  
Article 15 
Issuing and registration of economic operator identifier code s 
1. Upon receipt of a request  pursuant to Article 14, the ID issuer shall generate an 
economic operator identifier code, which consist of the following data elements, to 
be placed in the following order : 
(a) in position  1, the three alphanumeric characters that constitute the ID 
issuer identification code assigned under Article 3(3); and  
(b) in position  2, an alphanumeric sequence which is unique wi thin the code 
pool of the ID issuer.  
2. Within two working days, the ID issuer shall transmit the code to the requesting 
operator.  
3. All the information submitted to the ID issuer in accordance with Article  14(2), and 
the corresponding identifier codes, shall f orm part of a registr y to be established, 
managed and kept up to date by the competent  ID issuer.  
4. In duly justified cases, Member States may require the ID issuer to withdraw an 
economic operator identifier code.  
5. Economic operators and operators of retail outlets shall exchange the information on 
their respective economic operator identifier code in order to allow economic 
operators to record and transmit the transactional information, as provided under 
Article  33.  
Article 16 
Request for a f acility identifier code  
1. All facilit ies involved in the handling  and movement of tobacco products from 
manufacturing to the first retail outlet  shall be identified by  a code (‘ facility identifier 
code’ ) generated by the competent  ID issuer .  
EN 14   EN 2. Economic operators  and operators of retail outlet  shall apply for a facility identifier 
code  provid ing to the competent ID issuer  the information  listed in  point 1.4. of 
Section 1 of Chapter II of Annex II, in the format indicated therein.  
3. For retail outlets, the obligation to apply for a facility identifier code shall lie with 
the operator of the retail outlet. This obligation may also be discharged by any other 
registered economic operator, who may act on behalf of the operator of the reta il 
outlet. The registration by the third party shall be subject to the consent of the 
operator of the retail outlet. The third party shall inform the operator of the retail 
outlet about the full details of the registration, including the allocated facility  
identifier code.  
4. The obligation to apply for a facility identifier code related to  manufacturing 
facilities located outside the Union  shall  lie with the importer  established inside the 
Union . The importer shall apply to the competent ID issuer.  The regis tration by the 
importer shall be subject to the consent of the entity responsible for the third country  
manufacturing facility . The importer  shall inform the econom ic operator responsible 
for the third country manufacturing facility  about the full details of registration, 
including the allocated facility identifier code.  
5. Any modification of the information submitted in the initial application form and any 
facility closure shall be notified by the economic operator to the competent  ID issuer 
without delay, in the format s indicated in points 1.5 and 1.6.  of Section 1 of Chapter 
II of Annex II. 
Article 17  
Issuing and registration of facility identifier codes  
1. Upon receipt of a request  pursuant to Article 16, the ID issuer shall generate a 
facility identifier code, which consist s of the following data elements, to be placed in 
the following order : 
(a) In position 1, the alphanumeric characters that constitute the ID issuer 
identification code assigned under Article 3(3); and  
(b) In position 2, an alphanumeric sequence which is unique within the code 
pool of the ID issuer.  
2. Within two working days  from the receipt of the request , the ID issuer shall transmit 
the code to the requesting operator.  
3. All the information submitted to the ID issuer in accordance with Article  16(2) , and 
the corresponding identifier codes shall form part of a registr y to be established, 
managed and kept up to date  by the competent  ID issuer.  
4. In duly justified cases, Member States may require the ID issuer to withdraw a 
facility identifier code . 
5. Economic operators and operators of retail outlets shall exchange the information on 
their respective economic operator identifier code in order to allow economic 
operators to record and transmit the information  on products movement s, as provided 
under Article 3 2. 
Article 18 
Request for a machine identifier  code   
EN 15   EN 1. Each machine  shall be identified by a code (‘ machine  identifier  code ’) generated by 
the ID issuer competent for the territory in which the machine  is located.  
2. Manufacturers and importers  shall apply for a machine identifier code  by providing 
to the competent ID issuer the information  listed in point 1.7. of Section 1 of Chapter 
II of Annex II, in the format indicated therein.  
3. The obligation to apply for a machine identifier code related to manufacturing 
facilities located outside the Union shall lie with the importer  established inside the 
Union . The importer shall apply to the competent ID issuer.  The registration by the 
importer shall be subject to the consent of the entity responsible for the third country  
manufacturing facility. The importer shall inform the economic operator responsible 
for the third country  manufacturing facility about the full details of registration, 
including the allocated machine identifier code.  
4. Any modification of the information submitted in the initial application form and any 
decommissioning  of the registered machine s shall be notified by the manufacturer or 
the importer to the competent  ID issuer  without delay, in the format s indicated in 
points 1.8 and 1.9.  of Section 1 of Chapter II of  Annex II.  
Article 19  
Issuing and registration of machine identifier code s 
1. Upon receipt of a request pursuant to Article 18, the ID issuer shall generate a 
facility identifier code, which consist s of the following  data elements, to be placed in 
the indicated position:  
(a) In position 1, the alphanumeric characters that constitute the ID issuer 
identification code assigned under Article 3(3); and  
(b) In position 2, an alphanumeric sequence which is unique within the code 
pool of the ID issuer.  
2. Within two working days, the ID issuer shall transmit the code to the requesting 
operator.  
3. All the information submitted to the ID issuer in accordance with Article  18(2), and 
the corresponding identifier codes shall form part of a r egistr y to be established, 
managed and kept up to date by the relevant ID issuer.  
4. In duly justified cases, Member States may require the ID issuer to withdraw a 
machine identifier code.  
Article 20 
Registry and offline flat-files 
1. ID issuers shall establish offline flat-files. 
2. Offline flat -files shall be no larger than two gigabyte s per ID issuer . 
3. ID issuers shall ensure that a copy of all identifier codes , along with the information 
referred to in Articles 1 4(2), 16(2) and 18(2),  and offline flat-files are electronically 
provided via the router to the secondary repository. The copy shall be kept up -to-date 
by the ID issuers . 
4. Member States may adapt  the size limit for offline flat-files referred to in paragraph  
2, taking in to account both the average size of  available memory installed on the  
EN 16   EN verification devices used for offline checks of unique identifiers and the total number  
of ID issuers.  
CHAPTER I V 
DATA CARRIER  
Article 21 
Data carriers for the Unique Identifier s  
1. Unit level UIs shall be encode d using at least one of the following barcodes:  
(a) an optical device -readable Data Matrix with error detection and 
correction equivalent to or higher than those of the Data Matrix ECC200. 
Barcodes conforming to the International Organization for 
Standardisatio n/International Electrotechnical Commission standard 
(‘ISO/IEC’) 16022:2006 shall be presumed to fulfil the requirements set 
out in this point;  
(b) an optical device -readable QR Code with a recovery capacity of 
approximately 30%. Barcodes conforming to ISO/IEC  18004:2015 with 
the error correction level H shall be presumed to fulfil the requirements 
set out in this point;  
(c) an optical device -readable DotCode with the error detection and 
correction equivalent to or higher than those provided with the Reed -
Solomon e rror correction algorithm with the number of check characters 
(NC) equal to three plus the number of data characters (ND) divided by 
two (NC = 3 + ND / 2). Barcodes conforming to the ISS DotCode 
Symbology Specification published by the Association for Auto matic 
Identification and Mobility (‘AIM’) (revision 3.0, August 2014) shall be 
presumed to fulfil the requirements set out in this point.  
2. In the case of unit level UIs delivered electronically , manufacturers and importers are 
responsible for encoding unit level UIs  in accordance with paragraph 1 . 
3. In the case of unit level UIs delivered physically, ID issuers are responsible for 
encoding the codes generated pursuant to Article 8(2), in accordance with paragraph 
1 of this Article . 
4. By way of derogation from pa ragraph 1 , manufacturers and importers may encode  
the time stamp  separately from unit level UIs in the format YYMMDDhh.  
5. Aggregated level UIs shall be encoded by economic operators using at least one of 
the following barcodes:  
(a) an optical device -readable Data Matrix with error detection and 
correction equivalent to or higher than those of the Data Matrix ECC200. 
Barcodes conforming to the International Organization for 
Standardisation/International Electrotechnical Commission standard 
(‘ISO/IEC’) 16022:200 6 shall be presumed to fulfil the requirements set 
out in this point;  
(b) an optical device -readable QR Code with a recovery capacity of 
approximately 30%. Barcodes conforming to ISO/IEC 18004:2015 with  
EN 17   EN the error correction level H shall be presumed to fulfil the requirements 
set out in this point;  
(c) an optical device -readable Code 128 with the error detection equivalent 
to or higher than the one provided with the algorithm based on the 
even/odd - bar/space character parity and the check character. Barcodes 
confo rming to ISO/IEC 15417:2007 shall be presumed to fulfil the 
requirements set out in this point.  
Article 22 
Quality of the optical barcodes  
1. Economic operators shall ensure that the optical barcodes are highly readable. A 
quality of the optical barcodes rat ed at least 3.5 in accordance with ISO/IEC 
15415:2011 for the two -dimensional barcodes, or in accordance with ISO/IEC 
15416:2016 for the linear symbols shall be presumed to fulfil the requirements set 
out in this Article.  
2. Economic operators shall ensure th at the optical barcodes are capable of remain ing 
readable for at least five years after their creation.  
Article 23 
Human -readable code  
1. Economic operators shall ensure that each data carrier includes  a human -readable 
code that permits electronic access to the information related to the  unique 
identifiers . 
2. Where the dimensions of the packaging allow, the human -readable code shall be 
adjacent to the optical barcode carrying the unique identifier.  
CHAPTER V  
REPOSITORIES SYSTEM   
Article 24  
Components of the repositories system  
1. A repositories system shall be composed of the following sub -systems:  
(a) repositories which are established for the purpose of storing data relating 
to tobacco products of individ ual manufacturers and importers ('primary 
repositories');  
(b) a repository which contains a copy of all data stored in the primary 
repositories system ('secondary repository');  
(c) a routing service  ('router') set up and managed by  the provider of the 
secondary r epository system .  
2. The sub -systems referred to in paragraph 1 shall be fully interoperable with one 
another, irrespective of the service provider used.   
EN 18   EN Article 25  
General characteristics of the repositories system  
1. The repositor ies system  shall satisfy the following conditions:  
(b) It shall allow for  functional integration of the repositories system into the 
traceability system, as well as uninterrupted electronic data exchange between 
the repositories system and other relevant components of t he traceability 
system;  
(c) It shall allow for  electronic identification and authentication of tobacco 
products, at unit pack and aggregation levels, by users authorised to do so 
under this Regulation;  
(d) It shall allow for automatic deactivation of unique iden tifiers in accordance 
with the rules set out in Article  5; 
(e) It shall ensure  electronic receipt and storing of informatio n recorded  and sent to 
the repositories system  by economic operators and ID issuers , in accordance 
with the requirements of this Regulati on; 
(f) It shall ensure storage of data for a period of minimum seven years as of the 
moment the data are uploaded into the repositories system;  
(g) It shall allow for automatic status messaging to economic operators, and to 
Member States and the Commission  as req uested , such as in the event of 
success, error or changes related to reporting activities, in accordance  with the 
requirements of this Regulation;  
(h) It shall allow for automatic validation of messages received from economic 
operators, including refusal of i ncorrect or incomplete messages, in particular 
reporting activiti es related to non -registered or  duplicated unique identifiers, 
whereby the repositories system shall store the information concerning any 
refused message;  
(i) It shall ensure  messaging between al l of its components which shall take place 
instantaneously, in accordance with the requirements of this Regulation;  
(j) It shall ensure continuous availability of all components and services with an 
annual uptime of at least 99. 5% and sufficient back -up mechanisms in place;  
(k) It shall be guarded by security procedures and systems ensuring that access to 
the repositories and download of the data stored therein is only granted to 
persons authorised according to this Regulation;  
(l) It shall be accessible by  the c ompetent authorities of  Member States and by the 
Commission . National administrators and Commission services shall be 
granted access rights enabling them to create,  manage, and withdraw user 
access rights for repositories, and related operations stipulated in this Chapter, 
via a graphical user management interface. The graphical user management 
interface shall be compatible with Regulation (EU) No 910/2014, in particu lar 
the relevant reusable solutions provided as building blocks under the 
telecommunication part of the Connecting Europe Facility.  National 
administrators shall be able to grant subsequent access rights to users under 
their responsibility ;  
EN 19   EN (m) It shall enable  Member States and the Commission to carry out downloads of 
full and selected sets of data  stored in a repository;  
(n) It shall maintain a complete record ('audit trail') of all operations concerning 
the stored data , of the users performing those operations an d of the nature of 
these operations , including the history of users access ; the audit trail shall  be 
created when the data  is uploaded for the first time and, notwithstanding any 
additional national requirements, be maintained u ntil at least seven years af ter. 
2. Data stored in the repositories system shall be used  only for the purposes referred to 
in Directive 2014/40/EU and this Regulation.  
Article 26 
Primary repositor ies  
1. Each manufacturer and importer shall ensure the establishment of a primary 
repository . To that end each manufacturer and importer shall contract an independent 
third party provider, in accordance  with the contractual requirements set out in 
Commission Delegated Regulation  XYZ. The  selection of the independent third 
party shall take place i n accordance with the procedural rules laid down in Annex I, 
Part A .  
2. Each primary repository shall exclusively host information which relate s to the 
tobacco products of the manufacturer or importer who contracted the repository.  
3. Whenever data are received  by the prim ary repository on the basis of a reporting 
activity, or for any other permitted reason, it shall be forwarded  to the secondary 
repository instantaneously.  
4. In forwarding  all data received to the secondary repository, the primary repositories 
shall use the data format and data exchange modalities defined by the secondary 
repository.  
5. Primary repositories shall store the data in accordance with the common data 
dictionary provided by  the secondary repository.  
6. Member States, the Commission, and external auditors approved by the Commission 
shall be able to carry out basic query requests in relation to all data stored in a 
primary repository . 
Article 27  
Secondary repository  
1. Providers of the primary repositories shall ensure the estab lishment of a single 
second ary repository . To that end they shall appoint among themselves a provider of 
such a repository. The selection shall be carried out in accordance with the procedur e 
laid down in Annex I, Part B .  
2. The secondary repository  shall provide for graph ical and non -graphical user 
interfaces that enable Member States and the Commission to access and query the 
data stored in the repositories system, using all commonly available database search 
functions,  in particular by remotely carrying out the following  operations:   
EN 20   EN (a) retrieval of any information concerning one or multiple  unique 
identifier (s), including the comparison and cross -checking of multiple 
unique identifiers and the related information , in particular their location ; 
(b) creation  of lists and  statistics, such as product stocks and inflow/outflow 
numbers, associated with one or multiple of the elem ents of reporting 
information listed as Data Fields in Annex II ; 
(c) identification of all tobacco products that have been reported by an 
economic operato r to the system , including the products reported  as 
recalled, withdrawn, stolen, missing or intended for destruction . 
3. The user interfaces referred to in paragraph 2 shall enable each Member State and the 
Commission to define individual rules for : 
(a) automatic  alerting based on exceptions and specific reporting events, 
such as abrupt fluctuations or irregularities in trad e, attempts to introduce  
duplicate unique identifiers into the system, and where a product is 
indicated by economic operators as stolen or mis sing; 
(b) the receipt of periodic reports based on any combination of the elements 
of reporting information  listed as Data Field in Annex II .  
4. Automatic alerts and periodic reports referred to in paragraph 3 shall be forwarded to 
recipient addresses indicated by Member States and the Commission such as  
individual e -mail addresses and/or Internet Protocol (IP) addresses belonging to 
external systems used and managed by national authorities  or the Commission . 
5. The user interfaces referred to in paragraph 2 shall  enable Member States and the 
Commission to connect remotely to the data stored in the repositories system with 
the analytical software of their choice.  
6. The user interfaces referred to in paragraph 2 shall be provided  at least  in the English 
language.  
7. The overall response time of the repository to any given query or alert trigger, not 
considering the speed of the internet connection of the end user , shall be no more 
than 5 seconds  for the data stored for les s than 2 years and no more than 10 seconds 
for the data stored for 2 years or more , in at least 99% of all queries and automatic 
alerts foreseen under paragraphs 2 and 3 . 
8. The overall time between the arrival of reporting activity data and its accessibility , 
via the graphical and non -graphical interfaces, in the primary and secondary 
repositories shall be no more than 60 seconds in at least 99% of all data transfer 
activities.  
9. The repository shall allow for the receipt, storing and making available  of offlin e 
flat-files for the purpose of updating verification devices used by Member States for 
offline decoding of unique identifiers.  
10. Member States and the Commission shall retain the right to enter into additional 
service level agreements with the provider of the secondary repository for the 
purpose of contracting the latter to carry out additional services not provided for by 
this Regulation.  
11. The repository services provided to M ember States and the Commission under this 
Article shall be compatible with Regulation (EU) No 910/2014 and in particular  
EN 21   EN allow for the use of reusable solutions provided as building blocks under the 
telecommunication part of the Connecting Europe Facility . 
Article 28  
Coordination tasks of the provider of the s econdary repository  
1. The provider operating the secondary repository shall communicate to providers 
operating primary repositories, ID issuers  and economic operators , specifications 
required for the da ta exchange with the secondary repository and the router. The list 
shall be communicated no later than two months following the date when the 
provider operating the secondary repository was selected.  
2. On the basis of the information listed in Annex II, t he provider operating the 
secondary repository shall  establish a common data dictionary . The common data 
dictionary shall refer to labels of data fields in the human readable format. The 
common data dictionary shall be communicated to the providers operating primary 
repositories no later than two months following the date when the provider operating 
the secondary repository was selected.  
3. Whenever necessary for the smooth operation of the repository system, t he provider 
operating the secondary repository shall  update the list referred to in paragraph 11 
and the common data dictionary referred to in paragraph 12  and shall communicate 
the updates to providers operating primary repositories . 
Article 29 
Router  
1. The provider of the seconda ry repository shall set up and manage  a router .  
2. Data exchange between the router and the primary  and secondary repositories shall 
take place using the data format and data exchange modalities defined by the router.  
3. Data exchange between the router and an ID issuer shall take place using the data 
format and data exchange modalities defined by the router.  
4. Economic operators other than manufacturers and importers shall send the 
information recorded pursuant to Article 15 of Directive 2014/40/EU and in 
accordance  with this Regulation to  the router, which shall transfer it to the primary 
repository serving the manufacturer or importer whose tobacco products are 
concerned. A copy of those data shall be transferred instantaneously to the secondary 
repository system.  
Article 30 
Costs of the repositor ies system  
1. All costs related  to the repositories system set out  in Article 24(1)  shall be borne  by 
manufacturers and importers of tobacco products . Those  costs shall be fair, 
reasonable, and  proportionate : 
(a) to the services rendered;  and 
(b) to the amount of unit level UIs reques ted over a given period of time .  
EN 22   EN 2. The costs , as applicable,  of establishing and operating the secondary repository and 
the router shall be transmitted to  manufacture rs and importers of tobacco products 
through  the costs  charged to them by the providers of the primary repositories.  
Article 31 
Deadline for the establishment of the repositor ies system  
The repository system shall be established and functional for testing purposes by 20 March  
2019.   
CHAPTER VI  
RECORDING AND TRANSMITTING  
Article 32 
Recording and transmission of information on product movements  
1. To allow the determination of the actual shipment route of unit packets, economic 
operators shall record the following events:  
(a) application of unit level UI s on unit pack ets, 
(b) application of aggregated level UI s on aggregated packaging,  
(c) dispatch of tobacco products from a facility,  
(d) arrival of tobacco products at a facility , 
(e) trans-loading.   
2. Economic operators shall transmit the information listed in Section 3 of Chapter II  of 
Annex II , in the format indicated therein, to the primary repositories, in the case of 
manufacturers and importers, or to the router, in the case of all other economic 
operators.  
3. For dispatch and t rans-loading of small consignments of tobacco products wi th total 
net product weight below 5kg destined outside the Union , the recording obligation 
may be discharged by means of providing an access to the track and trace record 
generated by the logistic operator approved for this purpose by the Member State of 
the dispatch facility.  
4. If following the application of the unique identifier  tobacco products are destroyed or 
stolen, economic operators shall promptly transmit a deactivation  request  in 
accordance  with the scope and format specified in  point 2.3.of Secti on 2 of Chapter 
II of Annex II.  
5. The information concerning the event shall be deemed to have been transmitted 
successfully upon the acknowledgement by the primary repository or the router. The 
acknowledgement shall include a message recall code to be applied by the economic 
operator if the original message needs to be  annulled . 
Article 33 
Recording and transmission of transactional information   
EN 23   EN 1. To allow the determination of the transactional information referred to in Article 
15(2), points (j) and (k) o f Directive 2014/40/EU, economic operators shall record 
the following events:  
(a) issuing  of the invoice,  
(b) issuing of the order number,  
(c) receipt of the payment.  
2. Economic operators shall transmit the information listed in Section  4 of Chapter II of 
Annex II , in the format indicated  therein , to the primary repositories, in the case of 
manufacturers and importers, or to the router, in the case of all other economic 
operators.  
3. The responsibility for recording and transmitting the information referred to in 
paragraph 2 shall lie with the vendor .  
4. The information referred to in paragraph 2 shall be deemed to have been transmitted 
successfully upon the acknowledgement by the primary repositories or the router. 
The acknowledgement shall include a message recall code to be  applied by the 
economic operator if the original message needs to be annulled.  
Article 34 
Time frame for transmission of required information  
1. Economic operators shall transmit the information referred to  in Article  32(1) points 
(a), (b) and (d)  and Article 33(1), within 3 hours from the occurrence of the event.  
2. For the purposes of paragraph 1, the events referred to in Article 32 shall be deemed 
to occur at the first moment when they can be associated with the relevant set of 
unique identifiers.   
3. Economic operators shall transmit the information concerning the dispatch of 
tobacco products from a facility and trans -loading  referred to in Article 3 2(1) points 
(c) and (e), within the  24 hours prior to  the occurrence  of the event.   
4. By way of derogation from paragraph  1, economic operators falling under the 
definition of small and medium enterprises set out in Commission  Recommendation 
2003/361/EC6 may transmit the information referred to in Article 32 (1) points  (a), (b) 
and (d) and Article 33 (1), within 24 hours from the occurrence of the event.  
5. Paragraph 1 shall apply from 20 May 2026 . Until that date  all economic operators 
may transmit the information referred to in paragraph 1 within 24 hours from the 
occurrence of the event.  
CHAPTER VII I 
FINAL PROVISI ONS  
Article 35 
Independence  
                                                 
6 Commission Recommendation of 6 May 2003 concerning the definition of micro, small and medium -sized 
enterprises  (OJ L 124, 20.5.2003, p.36).   
EN 24   EN 1. Member States shall ensure that ID issuer s, providers of repository services and anti -
tampering devices  are independen t and exercise their functions impartially.  
2. The following criteria  shall be used to assess  independence : 
(d) independen ce from the tobacco industry in terms of legal form, 
organisation and decision making . In particular it shall be assessed 
whether the entity  is not under the direct or indirect control of the 
tobacco industry, including a minority shareholding ; 
(e) independence from the tobacco industry in financial  terms , which will be 
presumed  if the entity generates less than 20% of its annual overall 
turnover with the goods and services supplied to the tobacco sector;  
(f) absence of conflicts of interests with the tob acco industry of  the persons 
responsible for the management  of the entity . In particular, they:  
(1) shall not participate in company structures of the tobacco industry;  
(2) shall act independently from any interest  linked to the tobacco 
industry . 
3. Any change in ci rcumstances related to the above criteria that would influence the 
assessment of the entity's independence, shall be communicated without delay by the 
primary repository p rovider to the Commission.  
Article 36 
Security and integrity of communications and data  
1. All electronic communication provided for under this Regulation shall be c arried out 
using secure means . Applicable security protocols and connectivity rules shall be 
established by:  
(g) the ID i ssuer for com munications between the ID i ssuer and the 
econo mic ope rators registering with the ID i ssuer or requesting unique 
identifiers;  
(h) the provider s of the primary repositories  for communications between the 
primary repositories  and manufactures or  importers;  
(i) the provider  of the secondary reposi tory for commun ications between the  
secondary repository and the router  and: 
(a) the ID issuers;  
(b) the primary repositor ies; and 
(c) economic operators using the router , i.e. economic operators other 
than manufacturers and importers.  
2. Providers of primary and secondary repositorie s shall be  responsible  for the security  
and integrity  of hosted  data.  
3. For all transfers of data, the sending party is responsible for the completeness of 
transferred data. In order for the sending party to discharge this obligation, the 
receiving party shall acknowledge the receipt of transferred data including a 
checksum va lue of actual transmitted data or any alternative mechanism allowing for 
validating the integrity of transmission , in particular its completeness .  
EN 25   EN Article 37 
Transitional provision   
1. Cigarettes and roll -your-own tobacco products that were manufactured in the Union 
or imported into the Union before 20 May 2019 and not marked by means of unit 
level UIs in accordance with Article 8 may remain in free circulation until 20 May 
2020. In rela tion to these tobacco products which are allowed to remain in free 
circulation, but not marked with a unit level UIs, the obligations referred to in 
Chapter VI shall not apply.  
2. Tobacco products other than cigarettes and roll -your-own products that were 
manufactured in the Union or imported into the Union before 20 May 2024 and not 
marked by means of unit level UIs in accordance with Article 8 may remain in free 
circulation until 20 May 2025. In relation to these tobacco products which are 
allowed to remain in free circulation, but not marked with a unit level UIs, the 
obligations referred to in Chapter VI shall not apply.  
Article 38 
Entry into force  
This Regulation shall enter into force on the twentieth  day following that of its publication in 
the Official Journal of the European Union . 
This Regulation shall be binding in its entirety and directly applicable in all Member States.  
Done at Brussels,  
 For the Commission  
 The President