EUROPEAN COMMISSION Brussels, 15.3.2022 COM(2022) 123 final REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL pursuant to Article 16(2) of Regulation (EU) 2021/953 of the European Parliament and of the Council on a framework for the issuance, verification and acceptance of interoperable COVID-19 vaccination, test and recovery certificates (EU Digital COVID Certificate) to facilitate free movement during the COVID-19 pandemic



1.Introduction On 14 June 2021, the European Parliament and the Council adopted Regulation (EU) 2021/953 establishing the EU Digital COVID Certificate (the ‘EU Digital COVID Certificate Regulation’). The Regulation, based on a proposal by the Commission, sets out a common framework for the issuance, verification and acceptance of interoperable certificates for COVID-19 vaccination, test or recovery certificates to facilitate free movement of EU citizens and their family members during the COVID-19 pandemic. The Regulation is accompanied by Regulation (EU) 2021/954, which extends the EU Digital COVID Certificate framework to third-country nationals who are legally staying or residing in a Member State’s territory and who are entitled to travel to other Member States in accordance with EU law. The EU Digital COVID Certificate is a simple and secure way to demonstrate a person’s COVID-19 vaccination, test or recovery status during travel. It is free of charge and can be used both in a digital and paper-based format. The EU Digital COVID Certificate has been a crucial element in Europe’s response to the COVID-19 pandemic and has rapidly become a standard in Europe and beyond. Since the Regulation started to apply, more than 1.7 billion EU Digital COVID Certificates have been issued. The EU Digital COVID Certificate Regulation has an important international dimension. It empowers the Commission to connect COVID-19 certificate systems in third countries once it has established that their certificates comply with the relevant requirements so as to be considered as equivalent to EU Digital COVID Certificates for the purpose of facilitating their holders’ exercise of their right of free movement. The EU Digital COVID Certificate system has been developed into a global standard, with 35 third countries and territories across five continents having joined the system so far, in addition to the 27 Member States. The success of the EU Digital COVID Certificate has contributed to the resumption of safe international travel. In line with the EU Digital COVID Certificate Regulation, the Commission submitted a report to the European Parliament and to the Council in October 2021. That report provided an overview of the implementation of the Regulation since its adoption on 14 June 2021. It contained information on the technical implementation of the Regulation, the connection of third countries to the system, the use of certificates by the air transport sector, and the use of certificates by Member States for non-travel related purposes. It also contained an analysis of the possible issuance of certificates of recovery on the basis of rapid antigen and antibody test results, and on the validity period of certificates of recovery and vaccination certificates. It provided an overview of the information received by Member States on the implementation of the Regulation, including the notifications on additional restrictions to free movement for holders of the EU Digital COVID Certificate. Lastly, the report indicated that the Commission would put forward a proposal to extend the period of application of the Regulation, taking into account the evolution of the epidemiological situation with regard to the COVID-19 pandemic. The EU Digital COVID Certificate Regulation provides that the Commission submits another report to the European Parliament and to the Council by 31 March 2022. This second report is to contain, in particular, an assessment of the impact of the Regulation on the facilitation of free movement, including on travel and tourism, and the acceptance of the different types of vaccines, fundamental rights and non-discrimination, as well as on the protection of personal data during the COVID-19 pandemic. Apart from the topics referred to explicitly in the Regulation, this report also contains updated information on the number of EU Digital COVID Certificates issued, the latest technical developments related to the EU Digital COVID Certificate system, and the connection of additional third countries to the system. As a follow-up to the first report, it also contains information on the issuance of certificates of recovery on the basis of rapid antigen and antibody test results, the issuance of test certificates on the basis of laboratory-based antigen tests, and on the acceptance period of recovery and vaccination certificates. Lastly, the Report explains why the Commission has indeed adopted, on 3 February 2022, a proposal for an extension of the EU Digital COVID Certificate Regulation until 30 June 2023. 2.Application of the EU Digital COVID Certificate Regulation and its impact on fundamental rights and non-discrimination 2.1.Facilitation of free movement and non-discrimination 2.1.1.The COVID-19 pandemic and free movement within the EU The right to move and reside freely within the territory of the EU Member States is one of the rights most cherished by EU citizens. In a 2020 Eurobarometer survey, more than 8 in 10 respondents (84%) thought that the free movement of EU citizens within the EU brings overall benefits to the economy of their country. The fundamental right of free movement is enshrined in Article 21(1) of the Treaty on the Functioning of the European Union and Article 45 of the Charter of Fundamental Rights. The right to move and reside freely within the territory of the Member States is not absolute. Its exercise may be subject to limitations, as long as these are applied in compliance with the general principles of EU law and, in particular, the principles of non-discrimination and proportionality. For example, an EU citizen’s right to move and reside freely may be restricted on grounds of public security. During the COVID-19 pandemic, Member States took measures that limited the exercise of the right to move and reside freely within the EU in order to protect public health. These measures were aimed at limiting the spread of SARS-CoV-2 and at protecting healthcare systems from exceeding their capacities. The protection of public health can serve as a legitimate reason to restrict free movement. However, such limitations based on public health must respect EU law principles such as proportionality and non-discrimination. Any measures taken should not extend beyond what is strictly necessary to safeguard public health. The Commission continued to underline this point, which is also set out in Article 11(1) of the EU Digital COVID Certificate Regulation, in its different proposals adopted on the issue of free movement during the COVID-19 pandemic. The restrictions adopted by the Member States in response to the COVID-19 outbreak took different forms. During the early stage of the pandemic, Member States went as far as prohibiting entry into or exit from their territory, some also by reintroducing internal border controls within the Schengen Area. Other measures included the need for travellers to undergo tests for infection with SARS-CoV-2 or to undergo self-isolation/quarantine. Some Member States also required travellers to submit passenger locator forms or fulfil other registration requirements, prior to or upon entry into their territory. As long as certain travel restrictions are necessary from the point of view of public health and comply with the principles of non-discrimination and proportionality, they are not in violation of the right to move and reside freely within the territory of the EU. This is the context in which the EU Digital COVID Certificate Regulation was adopted. It is important to underline that the Regulation, which established interoperable COVID-19 vaccination, test and recovery certificates, does not require Member States to introduce limitations on the right to free movement. If a Member State decides not to require proof of vaccination, test or recovery status in the context of the exercise of free movement, the EU Digital COVID Certificate Regulation does not oblige it to do so. As a result, the Regulation cannot negatively impact free movement within the EU. On the contrary, the Commission considers that the EU Digital COVID Certificate system has had – and continues to have – a positive impact on free movement at a time where Member States are limiting its exercise on grounds of public health. It does so by ensuring that citizens have a right to receive interoperable and mutually accepted certificates on COVID-19 vaccination, testing and recovery that they can use when exercising their right to free movement. Where Member States waive certain restrictions on free movement for persons in possession of proof of vaccination, test or recovery, the EU Digital COVID Certificate Regulations ensures that citizens can benefit, in a non-discriminatory manner, from these exemptions on the basis of certificates issued in line with the Regulation. Without the EU Digital COVID Certificate Regulation, neither of these rights – to receive a certificate and to be exempted from restrictions in the same way as citizens of a Member State on the basis of that certificate – would exist. In addition, there would be no single standard ensuring cross-border interoperability of COVID-19 certificates. In a survey carried out by the Commission in the beginning of February 2022, two thirds of responding Member States indicated that, in the absence of the EU Digital COVID Certificate being adopted, they would have considered to establish a national COVID-19 certificate. While citizens might have been issued certificates by healthcare providers, there would have been no guarantee that they would be accepted – or, in the absence of an encoding standard, understood – in other Member States. In addition, many different types of certificates would inevitably increase the risk of fraud and forgery.

In accordance with the principle of proportionality, any restrictions to the free movement of persons within the EU put in place in response to the COVID-19 pandemic, including possible requirements by Member States to present EU Digital COVID Certificates, should be lifted as soon as the epidemiological situation allows. As a result, the period of applicability of the EU Digital COVID Certificate Regulation is time-limited, meaning that it should cease to apply when the pandemic has been overcome and the certificates are no longer needed to facilitate travel. Recently, the EU has dealt with a wave of COVID-19 cases caused by the Omicron variant of concern. After a peak in Omicron cases, a high proportion of the population is expected to enjoy, at least for a certain period, protection from COVID-19 either due to vaccination or prior infection, or both. However, a renewed increase in infections in the second half of 2022, including due to the emergence of new SARS-CoV-2 variants of concern, is a real possibility as long as the virus continues to circulate widely in a context of large differences in vaccination rates across the world. As also noted by the European Centre for Disease Prevention and Control (ECDC), significant uncertainties remain at this stage of the COVID-19 pandemic. Finally, the World Health Organization has not yet declared an end to the public health emergency of international concern caused by SARS-CoV-2. As a result, Member States might find it necessary to maintain or reintroduce a requirement for EU citizens exercising their right to free movement to present proof of COVID-19 vaccination, test or recovery, for a certain period after 30 June 2022, the date when the EU Digital COVID Certificate Regulation is currently set to expire. In the survey mentioned previously, essentially all responding Member States indicated a possible need, in the context of travel, for proofs of vaccination, test or recovery during the second half of 2022 and the first half of 2023. On 3 February 2022, the Commission therefore proposed to extend the application of the EU Digital COVID Certificate Regulation by 12 months, so that, in the event that certain restrictions to free movement based on public health would still be in place after 30 June 2022, EU citizens will not be deprived of the EU Digital COVID Certificates as an effective, secure and privacy-preserving way of proving their COVID-19 vaccination, test and recovery status. This would be ensured by the Commission’s proposal. As underlined in the proposal, the extension should not be understood as requiring Member States, in particular those that lift domestic public health measures, to maintain or impose free movement restrictions. It is perfectly possible for Member States to lift all such measures while the Regulation is in force, as any restriction, including the obligation to present evidence of any of the three medical events covered by the EU Digital COVID Certificate, should only remain in place as long as it is necessary and proportionate. The extension of the EU Digital COVID Certificate Regulation by 12 months thus serves to ensure that the EU Digital COVID Certificate remains available in case it is needed after June 2022. By contrast, not extending the Regulation, would oblige the Commission to discontinue the EU Digital COVID Certificate trust framework at the end of June 2022. Should a renewed need for the certificate arise at a later point in time, as a result of Member States re-imposing restrictions during the second half of 2022 or first half of 2023, it would then be extremely difficult – if not impossible – to re-establish the system both in legal and technical terms at short notice. EU citizens would be deprived of the possibility to make use of the EU Digital COVID Certificates as a well-established means of proving one’s COVID-19 status, and would potentially be confronted with a lack of cross-border interoperability of COVID-19 certificates. 2.1.2.Coordination of free movement restrictions linked to the COVID-19 pandemic Member States may establish restrictions on free movement on grounds of public policy, public security or public health, provided that they comply with the rules and limits set by EU law. Such restrictions are normally adopted at the individual level – for example the expulsion of an EU citizen no longer fulfilling the conditions for residence – and do not require coordination among multiple or all Member States. However, the pandemic has shown that in the absence of coordination, unilateral limitations on free movement adopted by essentially all Member States can result in uncertainty for EU citizens even if the measures are, assessed individually, in line with EU law. To ensure coordination across the EU, the Commission has, since the beginning of the pandemic, worked closely with Member States to foster cooperation and exchange of information on this issue. The Commission considers that a well-coordinated, predictable and transparent approach to the adoption of travel restrictions imposed in order to prevent the spread of the virus and safeguard the health of citizens is necessary in order to maintain free movement within the EU, under safe conditions. On 13 October 2020, on the basis of a Commission proposal, the Council adopted Recommendation (EU) 2020/1475 on a coordinated approach to the restriction of free movement in response to the COVID-19 pandemic . The Council Recommendation established a common approach on the following key points: the application of common criteria when deciding whether to introduce restrictions to free movement; a mapping of the risk of COVID-19 transmission, published by ECDC, based on an agreed colour code; and a coordinated approach as to the measures, if any, which could be applied to persons moving between different areas. In response to the developments of the pandemic, the Council Recommendation on a coordinated approach to the restriction of free movement has been updated multiple times since October 2020 . The adoption of the EU Digital COVID Certificate Regulation by the European Parliament and the Council on 14 June 2021 was another important achievement in this regard. The Regulation has as one of its objectives to contribute to facilitating the gradual lifting of restrictions to free movement put in place by the Member States, in accordance with EU law, to limit the spread of SARS-CoV-2, in a coordinated manner. To make best use of this EU Digital COVID Certificate framework, the Council adapted, on the same day, the coordinated approach set out in Recommendation (EU) 2020/1475. The Council noted that certificates issued in line with the EU Digital COVID Certificate Regulation should be the primary tool to be used in the context of travel within the EU. In addition, the Council Recommendation established a common understanding of the conditions under which vaccinated persons should be exempted from travel restrictions, as well as standard validity periods for tests for SARS-CoV-2 infection. The EU Digital COVID Certificate Regulation, together with the coordinated approach set out in the Council Recommendation, helped EU citizens to exercise their right to free movement with relative ease during the summer of 2021. Since then, vaccine uptake has increased significantly across the EU, and the rollout of the EU Digital COVID Certificate has progressed at a rapid pace. At the same time, waves of COVID-19 infections caused by the variants of concern Delta and Omicron during the winter of 2021/2022 led Member States to adopt additional public health measures, some of which were related to travel between Member States, seeking to protect individuals’ health as well as the capacity of healthcare systems. On 25 January 2022, the Council adopted Recommendation (EU) 2022/107 on a coordinated approach to facilitate safe free movement during the COVID-19 pandemic, replacing Recommendation (EU) 2020/1475, moving from a ‘region-based’ approach to a ‘person-based’ approach. The Recommendation provides that a person who has a valid EU Digital COVID Certificate should in principle not be subject to additional restrictions, such as tests or quarantine, regardless of their place of departure in the EU. Persons who are not in possession of a valid EU Digital COVID Certificate could be required to undergo a test prior to or no later than 24 hours after arrival. Travellers with an essential function or need, cross-border commuters and children under 12 should not be required to be in the possession of a valid EU Digital COVID Certificate. This person-based approach further strengthens free movement for all travellers in a non-discriminatory manner, as travellers can move freely based on either a vaccination, test or recovery certificate. Since the adoption of Council Recommendation (EU) 2022/107, Member States have increasingly been aligning their travel requirements with this person-based approach. By 4 March 2022, 21 Member States either do not put any additional travel restrictions on holders of an EU Digital COVID Certificate in any circumstances, or do not have any travel restrictions in place at all. Neither Council Recommendation (EU) 2022/107 nor, as mentioned above, the EU Digital COVID Certificate Regulation oblige Member States to require travellers to be in possession of an EU Digital COVID Certificate. On the contrary, the Commission has been encouraging Member States, in particular those that lift domestic public health measures, to lift such measures. Five Member States have already lifted the requirement to hold an EU Digital COVID Certificate to enter their respective territories. The EU Digital COVID Certificate and Council Recommendation 2022/107 (as well as its predecessor, Council Recommendation 2020/1475), have thus been important tools to facilitate free movement within the EU during the COVID-19 pandemic. They have sought to ensure a well-coordinated approach to the adoption of restrictions on freedom of movement, and will continue to be important for the lifting of these restrictions as the epidemiological situation improves. 2.1.3.Ensuring a non-discriminatory approach The EU Digital COVID Certificate framework ensures non-discrimination by including interoperable vaccination, test and recovery certificates. All Member States are obliged to issue the three different types of certificates, and Council Recommendation (EU) 2022/107 sets out a coordinated approach as to their acceptance. As a result, as many persons as possible are able to benefit from an EU Digital COVID Certificate when exercising their right to free movement. As underlined in its Recital 36, the EU Digital COVID Certificate Regulation cannot be interpreted as establishing an obligation to be vaccinated, and it is not a “vaccination passport”. At the same time, vaccination, test or recovery cannot be considered as equal from a public health point of view, given that unvaccinated and partially vaccinated people remain at much higher risk of severe outcomes. This is also reflected in the inherently different rules regarding the validity of the certificates.

The EU Digital COVID Certificate Regulation does not oblige Member States to accept all three types of certificates. This remains a policy decision of the Member States in the field of public health, and some Member States have indeed decided not to accept certain certificates, in particular certificates of recovery. However, where a Member State accepts proof of either vaccination, test or recovery from SARS-CoV-2 infection in order to waive restrictions to free movement, it must accept, under the same conditions, EU Digital COVID Certificates issued for the same medical event. An EU Digital COVID Certificate has the same value regardless of the Member State in which the vaccine was administered, or the test carried out. Finally, as underlined in point 5 of Council Recommendation (EU) 2022/107, travel restrictions cannot be based on the nationality of the person concerned. 2.1.4.Information received pursuant to Article 11 of the EU Digital COVID Certificate Regulation The Commission continues to monitor Member States’ implementation of the EU Digital COVID Certificate Regulation and the Council Recommendation on a coordinated approach to facilitate safe free movement during the COVID-19 pandemic. Information from Member States on the EU Digital COVID Certificate is collected by means of overview tables submitted by the Member States to the Commission and the Council, and is also made available on the Re-open EU platform, which is an interactive tool available online and as a mobile application . The EU Digital COVID Certificate Regulation provides that additional restrictions on EU Digital COVID Certificate holders are only possible where these are necessary and proportionate to safeguard public health in response to the COVID-19 pandemic. Member States have an obligation to inform the Commission and other Member States 48 hours in advance whenever they decide to impose additional restrictions . Between 13 October 2021 and 4 March 2022, the following Member States submitted information pursuant to this provision: Austria, Bulgaria, Cyprus, Denmark, Finland, Greece, Italy, Ireland, Latvia, Portugal and Sweden. This rise in notifications compared to the previous report can be explained by the emergency measures taken in response to the Omicron variant. The additional requirements notified by these Member States included, for example, pre-departure tests, or tests after arrival, including for vaccinated and/or recovered travellers. In a very small minority of cases, quarantine requirements were implemented. In the early phase of the emergence of the Omicron variant, the Commission considered that, in line with the precautionary principle, additional pre-departure testing requirements were a suitable means for Member States to consider as part of an emergency measure to delay the spread of that new variant. However, in the meantime, given the large-scale community transmission of Omicron across the EU, the Commission has called on Member States to lift any intra-EU travel-related testing requirements imposed on vaccinated and recovered persons in response to the emergence of Omicron. By 4 March 2022, no Member States maintained additional restrictions put in place specifically in response to the Omicron variant. The Commission will continue to monitor compliance of all Member States’ public health measures currently still in place, affecting citizens’ right to free movement with EU law, in particular the principles of non-discrimination and proportionality. 2.1.5.Other information on the implementation of the EU Digital COVID Certificate Regulation The EU Digital COVID Certificate Regulation provides that vaccination certificates are to be issued by the Member State where the vaccine has been administered. If citizens are vaccinated in two different Member States, the first Member State should issue an EU Digital COVID Certificate indicating the first dose and the second Member State should issue, upon presentation of proof that the first dose was administered in another Member State, an EU Digital COVID Certificate indicating the second dose (the certificate will indicate “2/2” as the number of doses administered). The same rules apply for boosters; the Member State where the booster dose is administered should issue, upon proof that the primary vaccination series was administered in another Member State, an EU Digital COVID Certificate indicating the last dose (the certificate will indicate “3/3” or “2/1” depending on the type of vaccine). These rules are also clarified in the Commission’s proposal to extend the application of the EU Digital COVID Certificate Regulation (see Section 2.9). In accordance with Article 5(2)(b) of the EU Digital COVID Certificate Regulation, vaccination certificates issued by a Member State following the administration of a dose of a COVID-19 vaccine are indeed to contain “the number of doses administered to the holder”, that is, not just the number of doses administered in the Member State issuing the certificates. Given that a certificate is to be issued after the administration of each dose, the citizen concerned should typically be in the possession of an EU Digital COVID Certificate, which constitutes reliable proof of the administration of previous doses. The issuance of correct vaccination certificates in the EU Digital COVID Certificate format should not be subject to additional administrative requirements not provided for in the EU Digital COVID Certificate Regulation. In particular, the EU Digital COVID Certificate Regulation does not require the person concerned to be registered in the healthcare system of the Member State administering the vaccine, or to provide the batch number of previous doses, before being issued an EU Digital COVID Certificate. However, in certain cases citizens have reported difficulties to obtain correct EU Digital COVID Certificates, in particular vaccination certificates. For example, citizens have reported problems to get an EU Digital COVID Certificate from the Member State where they were vaccinated because they were not in possession of a national registration or social security number. Other issues occurred when citizens received COVID-19 vaccine doses in different Member States. Typically, citizens reported that when they received their second dose or booster dose in a Member State, the EU Digital COVID Certificate that they were issued afterwards omitted previous doses administered in another Member State. In these cases, the number of doses indicating in the latest certificate did not reflect the correct number of doses administered to the person concerned. As underlined in its first report to the European Parliament and to the Council on the application of the EU Digital COVID Certificate Regulation, the Commission continued its regular contacts with the Member States to help resolve these issues at technical level as quickly as possible. Many issues have already been resolved in this way. To get an overview of any persisting issues, the Commission conducted a survey among Member States on this topic at the end of 2021 and asked Member States’ authorities to address the issues identified. The Commission is currently analysing Member States’ replies and will follow up as appropriate to solve any remaining issues. Some of these issues are linked to the intentionally de-centralised nature of the EU Digital COVID Certificate framework, which neither establishes an EU-level database for COVID-19 vaccination, test or recovery nor connects any such databases existing at Member State level. As a result, there is no automatic exchange of data that would allow Member States to easily issue certificates taking into account information stored in another Member State, such as information on a previous COVID-19 vaccine dose administered. Member States thus depend on citizens providing proof of the administration of previous doses in other Member States, in particular in the form of EU Digital COVID Certificates. To provide citizens with additional information, the Commission has published answers to the most frequently asked questions on the EU Digital COVID Certificate, vaccinations and travel restrictions, which have been updated on 11 March 2022. 2.2.Protection of personal data The EU Digital COVID Certificate Regulation and its implementation are in full compliance with EU data protection rules, ensuring, for example, that the amount of data collected is limited to what is necessary to achieve their purpose. In particular, it provides that personal data accessed in the context of the verification process is not to be retained. The EU Digital COVID Certificate is stored and verified offline, and as a result, the issuing Member State is not informed of a certificate having been verified. The Commission also ensures compliance with the principle of data minimisation in the context of implementing and delegated acts adopted pursuant to the provisions of the Regulation. The security of the EU Digital COVID Certificates themselves has proven to be solid. Ensuring compliance with data protection, including information security, in the issuance systems is a responsibility incumbent on the Member States. While fraudulently issued certificates have been reported, there is no reason to believe that any cryptographic keys used to sign and authenticate EU Digital COVID Certificates have been compromised (see also Section 2.6.2). Where Member States decide to use the EU Digital COVID Certificate for domestic purposes, this must be provided for in national law, which must comply with data protection requirements (see also Section 2.5). Compliance with those national rules is for the national authorities to enforce.

2.3.Travel and tourism The COVID-19 pandemic has had a severe impact on several sectors, with transport and tourism being particularly affected. In this challenging context, the EU Digital COVID Certificate and efforts to establish a coordinated approach to travel at EU level have been broadly welcomed by travel and tourism associations as important developments to allow and encourage citizens to travel by providing for the necessary predictability. In addition, the positive impact of the EU Digital COVID Certificate system extends beyond the EU. Since the outbreak of the COVID-19 pandemic, transport has been one of the most severely affected sectors. Following the various waves of infections, and the different measures taken to contain them, several aspects have been identified as driving the impact of the pandemic on this sector. In the short term, impacts are driven by lockdown measures, other restrictions, as well as voluntary efforts of individuals seeking to avoid becoming infected. In addition, changes to transport activities can be due to several factors: the evolution of the pandemic, including vaccination uptake, behavioural changes (vaccination acceptance, need/wish to travel, choice of travel mode), as well as of the economic recovery of the transport services sector. An analysis of the number of commercial flights shows that the lowest level was registered in the months of May and June 2020, corresponding to the lockdown period and strict travel restrictions in the majority of Member States. With the exception of the first three months, at EU level, the number of flights was higher in 2021 than in 2020 in all months, and followed the same seasonal pattern as for the previous years: at EU level, the highest numbers were reached in July and August, with a peak in August, followed by a gradual decrease in the subsequent months. An analysis of the available data on the number of passenger travelling by air seems to confirm this pattern, with the highest level of passengers travelling by air reached in July and August 2021, coinciding with the rollout of the EU Digital COVID Certificate. However, the level of 2019 was not reached in any of the countries with available data. Travel and tourism associations have welcomed the EU Digital COVID Certificate as an important contribution to the restart of the EU tourism ecosystem during the 2021 summer season and beyond. The European Tourism Manifesto Alliance, a group of 70 public and private travel and tourism organisations, stated that “the implementation of the EU Digital COVID Certificate has been a huge success” . Although intended to facilitate free movement within the EU, the EU Digital COVID Certificate has also increasingly contributed to restoring international travel to the EU and beyond. In this context, the Council adopted, on 22 February 2022, an amendment to Recommendation 2020/912 on the temporary restriction on non-essential travel into the EU and the possible lifting of such restriction. It provides that Member States should lift the temporary restriction on non-essential travel to the EU for persons vaccinated with an EU- or WHO-approved vaccine and for persons who have recovered from COVID-19 prior to travelling to the EU (see also Section 2.4 below). The EU Digital COVID Certificate and COVID-19 certificates issued by third countries deemed equivalent in accordance with the procedure established in the EU Digital COVID Certificate Regulation should be used as the primary means of proving testing and vaccination, and as the only mean to prove recovery, given that they can be securely verified. Finally, while not covered by the EU Digital COVID Certificate Regulation, the EU Digital COVID Certificate can facilitate travel of EU citizens to third countries, in particular those connected to the EU system by means of an ‘equivalence decision’ (see Section 2.7.1). As a result, international organisations dealing with topics related to tourism have expressed support for the EU Digital COVID Certificate and/or recognised that it has become an international standard for the facilitation of travel during the COVID-19 pandemic. They include the Organisation for Economic Co-operation and Development , the World Tourism Organization and the Group of Twenty . The EU Digital COVID Certificate not only facilitated EU citizens’ travel, but also provided them with a reliable and accepted document that they could use in case their Member State of destination was using COVID-19 certificates for domestic purposes, such as for access to restaurants, bars or hotels (for more information on the domestic use of the EU Digital COVID Certificate see Section 2.5). 2.4.Acceptance of different types of COVID-19 vaccines and tests As provided in the EU Digital COVID Certificate Regulation, Member States are obliged to accept vaccination certificates for vaccines that have received EU marketing authorisation when it comes to waiving free movement restrictions. In addition, Member States may also decide to, but are not obliged to, waive restrictions for travellers who have received a vaccine that has completed the World Health Organization (WHO) emergency use listing procedure or that has been authorised at national level in another Member State. There has been increasing acceptance by Member States of vaccines having completed the WHO emergency use listing procedure, and the Commission has consulted Member States in the Health Security Committee, established by Article 17 of Decision No 1082/2013/EU , to gather information about the COVID-19 vaccines not authorised at EU level that they accept in order to waive travel-related measures such as additional testing or quarantine. As mentioned above, the latest amendment to Council Recommendation 2020/912 on the temporary restriction on non-essential travel into the EU and the possible lifting of such restriction provides that Member States should lift the temporary restriction on non-essential travel to the EU also for persons vaccinated with a WHO-approved vaccine. However, such travellers may be subject to additional requirements such as tests, quarantine or the administration of an EU-authorised vaccine. As far as tests for SARS-CoV-2 infection are concerned, about two thirds of the Member States accept, in the context of travel, certificates issued based on high-quality rapid antigen tests. Those Member States not accepting rapid antigen tests cite, in particular, higher rates of false negatives as reasons for not accepting such certificates. The EU Digital COVID Certificate Regulation does not oblige them to do so, provided it is done in a non-discriminatory manner. 2.5.Use of the EU Digital COVID Certificate for domestic purposes The EU Digital COVID Certificate Regulation covers the use of certificates for travel within the EU during the COVID-19 pandemic. It neither prescribes nor prohibits the use of COVID-19 certificates for domestic purposes, such as to regulate the access to events, restaurants, sport venues, public transport or the workplace. If Member States decide to use the EU Digital COVID Certificate for other purposes, this must be provided for in national law, which must comply in particular with data protection requirements. At the same time, where a Member State establishes a system of COVID-19 certificates for domestic purposes, it should ensure that the EU Digital COVID Certificates can also be used. This ensures that travellers from other Member States can use their certificates during their stay. In the time since the last report on the application of the EU Digital COVID Certificate Regulation, the use of COVID-19 certificates for domestic purposes has seen changes. Reacting to rising case numbers in autumn 2021, some Member States required the use of COVID-19 certificates for additional purposes, for example in the context of domestic public transport or to access the workplace. However, in early 2022, some Member States began to limit or completely stopped requiring COVID-19 certificates for domestic purposes. In the survey carried out by the Health Security Committee, five countries indicated that the domestic use of the EU Digital COVID Certificate had already been suspended, and five indicated that discussions were ongoing to suspend it. As the domestic use of COVID-19 certificates is not covered by the EU Digital COVID Certificate Regulation, Member States can also set their own rules and conditions of acceptance. The Commission continues to encourage Member States to align their rules for domestic use with the acceptance rules applicable in the context of travel, but divergences remain. For example, while eight Member States indicated in the survey that vaccination certificates showing the completion of the primary vaccination series are accepted for domestic use for 270 days, in line with the rules applicable in the context of travel, the other Member States indicated different acceptance periods. Twelve Member States indicated that certificates showing a booster dose are accepted for domestic use for an indefinite period of time, as is the case in the travel context. Researchers have sought to estimate the impact of COVID-19 certificate requirements. A pre-print article by researchers from the Simon Fraser University in British Columbia estimates a sizable increase in vaccinations and lasting cumulative gains after the announcement of a domestic COVID-19 certificate requirement, relative to the pre-announcement trend. An article published in The Lancet finds that the introduction of COVID-19 certificates led to increased vaccinations 20 days before implementation in anticipation, with a lasting effect up to 40 days after. A working paper published by researchers at Bruegel, a think tank, estimates that the announcement of COVID certificates during summer 2021 led to increased vaccine uptake in France of 13 percentage points of the total population up to the end of the year, in Germany 6.2 percentage points, and in Italy 9.7 percentage points. Further, the authors estimate that this averted an additional 3,979 deaths in France, 1,133 in Germany, and 1,331 in Italy; and prevented gross domestic product losses of EUR 6.0 billion in France, EUR 1.4 billion in Germany, and EUR 2.1 billion in Italy. Notably, the authors claim that the application of COVID certificates substantially reduced the pressure on intensive care units and, in France, prevented occupancy levels being exceeded where prior lockdowns were instated. 2.6.Technical implementation 2.6.1.Number of EU Digital COVID Certificates issued

By 1 March 2022, Member States issued more than 1.72 billion EU Digital COVID Certificates, made up of 1.15 billion vaccination certificates, 511 million test certificates, and 55 million certificates of recovery. A detailed breakdown per Member State is included in Annex I. 2.6.2.EU Gateway and work at technical level The technical specifications, standards and guidelines for the common issuance, verification and acceptance of the EU Digital COVID Certificate were jointly developed by the Commission and the Member States within the framework of the eHealth Network. All of the specifications developed by the eHealth Network are based on open standards and are published as open source on the eHealth Network website and GitHub. This has facilitated interoperability with systems developed by third countries (see Section 2.7.1 below). Since October 2021, work at technical level to further improve the EU Digital COVID Certificate system has included refining the encoding of boosters (see Section 2.8.1 below) and, in particular, developing a mechanism to exchange lists of revoked EU Digital COVID Certificates. The EU Digital COVID Certificate Regulation provides that its trust framework may support the exchange of certificate revocation lists containing the unique certificate identifiers of revoked certificates. Revoking certificates may help safeguarding public health when certificates have been issued erroneously, as a result of fraud or following the suspension of a COVID-19 vaccine batch found to be defective. Since the rollout of the EU Digital COVID Certificate, there have been reports of a small number of fraudulently issued EU Digital COVID Certificates. As the Commission has verified with Member States, these limited cases have typically been due to individual staff of authorised certificate issuers issuing valid certificates in a fraudulent or irregular manner. It remains important that national authorities continue to follow up on those cases. In this context, several Member States have already implemented revocation solutions at the domestic level, that is, regarding the certificates they issue themselves. The Commission, together with experts from Member States, has been working to develop a mechanism allowing a fast and secure exchange of certificate revocation lists between Member States via the EU Digital COVID Certificate Gateway, which is the central part of the trust framework. It has done so because, while the EU Digital COVID Certificate system is capable of immediately revealing forged certificates, authentic certificates that are unlawfully issued on the basis of false documentation, unauthorised access or with fraudulent intent cannot be detected in other Member States unless the lists of revoked certificates generated at national level are exchanged between Member States. The solution developed should be operational over the next weeks. 2.7.International aspects of the EU Digital COVID Certificate system 2.7.1.Connecting Europe and third countries The EU Digital COVID Certificate Regulation stipulates that the Commission can issue a decision establishing that the certificates of a third country are to be considered as equivalent to EU Digital COVID Certificates (‘equivalence decisions’) for the purpose of facilitating their holders’ exercise of their right of free movement. This results in the third country concerned being connected to the EU Gateway. Detailed information on this process can be found in the first report from the Commission to the European Parliament and the Council on the implementation of the EU Digital COVID Certificate. As explained in that first report, the Commission had already adopted equivalence decisions regarding COVID-19 certificates issued by Albania, Andorra, Faroe Islands, Israel, Monaco, Morocco, North Macedonia, Panama, San Marino, Turkey, Ukraine and Vatican City. Moreover, Switzerland is connected to the EU Digital COVID Certificate system based on an equivalence decision adopted pursuant to Article 3(10) of the EU Digital COVID Certificate Regulation, given the Agreement between the European Community and its Member States, of the one part, and the Swiss Confederation, of the other, on the free movement of persons. In addition to the third countries and territories connected on the basis of an equivalence decision, Iceland, Liechtenstein and Norway are connected based on the incorporation of the Regulation into the Agreement on the European Economic Area. Since then, and by the end of February 2022, the Commission adopted additional equivalence decisions regarding Armenia, Benin, Cabo Verde, El Salvador, Georgia, Jordan, Lebanon, Moldova, Montenegro, New Zealand, Serbia, Singapore, Taiwan, Thailand, Tunisia, Togo, the United Arab Emirates, the United Kingdom and Uruguay. As a result, 35 non-EU countries and territories have joined the EU Digital COVID Certificate system in addition to the 27 Member States. This brings the total number of countries connected to the EU Digital COVID Certificate system to 62. 22 of the 32 equivalence decisions recognise all three types of certificate established by the EU Digital COVID Certificate Regulation. In addition, more third countries continue to apply for an equivalence decision. By 16 February 2022, there had been preliminary contacts with 35 interested third countries or territories, 25 of which had formally submitted the results of the self-assessment of their readiness to join the EU system. The Regulation as such does not explicitly require that third countries seeking an equivalence decision reciprocally accept the EU Digital COVID Certificate for travelling to their respective countries. However, before adopting an equivalence decision, the Commission has systematically asked all third countries concerned to accept the EU Digital COVID Certificate. The Commission will continue its efforts to support third countries interested in developing interoperable COVID-19 certificate systems. This may include sharing with third countries technical specifications and open source reference solutions that may support the conversion of third-country certificates into a format that is interoperable with the EU Digital COVID Certificate. Conversion mechanisms have been used by some third countries to support their requests for equivalence decisions. In addition to the system of equivalence decisions, the EU Digital COVID Regulation also provides that Member States may issue an EU Digital COVID Certificate to people vaccinated in a third country with a vaccine used in the EU, where they have been provided with all the necessary information, including reliable proof of that vaccination. A number of Member States have developed online platforms to help travellers from third countries not covered by an equivalence decision to request the conversion of their COVID-19 certificate into an EU Digital COVID Certificate. 2.7.2.Interoperability with systems developed at international level In accordance with Article 4(3) of the Regulation, the EU Digital COVID Certificate trust framework should ensure interoperability with technological systems established at international level. The Commission continues to cooperate with international institutions to provide guidance on the principles underpinning a safe and trusted digital covid certificate system, notably contributing to the WHO’s Digital Documentation of COVID-19 Certificates specifications and guidelines. The Commission has maintained an ongoing dialogue with the International Civil Aviation Organization (ICAO) to identify potential options for interoperability between the EU Digital COVID Certificate and the ICAO VDS-NC certificate.

2.8.Developments regarding EU Digital COVID Certificates 2.8.1.Validity period of vaccination certificates When the Regulation on the EU Digital COVID Certificate was adopted, insufficient data was available as to the duration of protection resulting from the completion of the primary series of a COVID-19 vaccine. Therefore, no validity period was set for vaccination certificates. In the last report to the European Parliament and to the Council, the Commission concluded that it was not, at that point in time, considering an amendment to the EU Digital COVID Certificate Regulation in order to specify the validity of vaccination certificates at that time. However, the Commission noted that it would continue to monitor the scientific evidence on that topic very closely. On 4 October 2021, the European Medicines Agency’s Committee for Medicinal Products for Human Use concluded that booster doses for Comirnaty may be considered at least six months after the second dose for people aged 18 years and older. On 25 October 2021, the Committee concluded that a booster dose of Spikevax may be considered

in people aged 18 years and above at least six months after the second dose. On 15 December 2021, the Committee concluded that a booster dose of COVID-19 Vaccine Janssen may be considered at least two months after the first dose in people aged 18 years and above and that COVID-19 Vaccine Janssen may also be given after two doses of Comirnaty or Spikevax. In this context, on 24 November 2021, the ECDC published a Rapid Risk Assessment of the current SARS-CoV-2 epidemiological situation, projections for the end-of-year festive season and strategies for response in the EU, in which it noted that emerging evidence showed a significant increase in protection against infection and severe disease following a booster dose in all age groups in the short term. According to the ECDC, Member States should urgently consider a booster dose for those 40 years and over, targeting the most vulnerable and the elderly, and that countries could also consider a booster dose for all adults 18 years and older at least six months after completing their primary series to increase protection against infection due to waning immunity, which could potentially reduce the transmission of the virus in the population and prevent additional hospitalisations and deaths. In connection to these scientific developments, more and more Member States adopted rules as to how long vaccination certificates indicating the completion of primary vaccination series should be accepted. These unilateral measures had the potential to cause significant disruption for EU citizens exercising their free movement rights. In response to this, on 21 December 2021, the Commission adopted a Delegated Regulation establishing a binding acceptance period of 270 days for vaccination certificates covering the primary vaccination series, for the purposes of intra-EU travel. Such certificates are therefore not to be accepted if more than 270 days have passed since the last dose. This validity period takes into account the guidance of ECDC, according to which booster doses are recommended at the latest six months after the completion of the first vaccination cycle, as explained above. It also provides for a grace period of an additional three months beyond those six months to ensure that citizens can have access to booster doses. Certificates issued for booster doses do not have a maximum acceptance period, and therefore currently remain valid with no expiry date, as far as travel in the EU is concerned, although this could be reconsidered at a later stage in case scientific evidence would indicate the need for the introduction of an acceptance period also for such certificates. The rules on the acceptance period of vaccination certificates apply for the purposes of travel. As explained above, when introducing different rules to use the certificates at national level, Member States are encouraged to align them to these new rules to provide certainty for travellers and reduce disruptions. In addition, the Commission adopted an implementing act clarifying the rules for the encoding of vaccination certificates. This became necessary to ensure that vaccination certificates showing completion of the primary series can always be distinguished from vaccination certificates issued following a booster dose, irrespectively of the number of doses administered in the primary series. 2.8.2.Laboratory-based antigen tests As of July 2021, the technical working group on COVID-19 diagnostic tests of the Health Security Committee has been reviewing proposals put forward by EU countries and manufacturers for COVID-19 laboratory-based antigenic tests. These proposals are assessed against the same criteria as the rapid antigen tests, which were agreed on 21 September 2021. If the technical working group considers that the proposals are successful and the Health Security Committee agrees as well, the laboratory-based antigenic tests meeting the criteria are included in a separate list (Annex III of the EU common list document). For the reasons set out in its proposal to extend the EU Digital COVID Certificate Regulation, the Commission proposed to include such high-quality laboratory-based antigen tests among the types of tests for which an EU Digital COVID Certificate can be issued. This aims to widen the scope of the types of diagnostic tests at a time where COVID-19 tests are in high demand. 2.8.3.Issuance of certificates of recovery based on antigen test results When the EU Digital COVID Certificate Regulation was adopted, certificates of recovery could only be issued following a positive result of a molecular nucleic acid amplification test (NAAT). The Regulation did not allow for the issuance of certificates of recovery on the basis of other tests, such as rapid antigen tests. In May 2021, the Health Security Committee set up a technical working group on COVID-19 diagnostic tests . The aim of this technical working group is to review proposals put forward by Member States and manufacturers for COVID-19 rapid antigen tests to be included in the EU common list of rapid antigen tests agreed by the Health Security Committee . On 11 January 2022, this technical working group discussed the use of rapid antigen tests for certificates of recovery, taking into account the worsened epidemiological situation, with record high numbers of COVID-19 cases due to the ‘Omicron’ variant of concern, as well as shortages of NAAT capacities in various Member States as a result of a high testing demand. Given these circumstances, the technical working group agreed that rapid antigen tests included in the EU common list could be used to issue certificates of recovery. The technical work group stressed that only the results of rapid antigen tests conducted by medical professionals or other trained personnel should be used to issue such certificates. ECDC considers that appropriately validated rapid antigen tests that meet high specificity criteria of more than 98% could be used to certify that a person has recovered from a past COVID-19 infection . The higher the specificity, the higher the test validity to be used for certifying a recovered individual. In view of the above, and based on further consultations with the Health Security Committee, the Commission adopted, on 22 February 2022, a Delegated Regulation amending the EU Digital COVID Certificate Regulation to provide that certificates of recovery can also be issued following a positive result of a rapid antigen test listed in the EU common list and carried out by health professionals or by skilled testing personnel by the Member State where the test was carried out.

2.8.4.Possible issuance of certificates of recovery based on antibody test results In its first report to the European Parliament and to the Council on the application of the EU Digital COVID Certificate Regulation, the Commission also addressed the possible issuance of certificates of recovery based on antibody test results. The Commission concluded that, based on scientific guidance, it was not considering an amendment to the EU Digital COVID Certificate Regulation to allow for the issuance of certificates of recovery on the basis of antibody tests. As also noted in the first report, ECDC considers that antibody test results are not suitable for the assessment of the time of infection and immunity status of an individual. ECDC has not changed this position, as can be seen in a new report published on 10 February 2022. The key conclusions of the first update of the report are that antibody tests cannot be used to issue or prolong digital COVID-19 certificates. The main reasons for this is that, firstly, while a positive antibody test result can indicate a previous infection or vaccination, it cannot be used to determine whether an individual is currently infectious or protected against infection, nor can it determine the time of infection (in the absence of a positive diagnostic test). Secondly, the range of antibody levels that correlate with protection from infection or severe diseases are currently unknown. Moreover, the level and rate of decline of antibodies vary greatly among individuals and antibody targets and depend on factors such as age, genetic and immune status, viral load and disease severity of the previous SARS-CoV-2 infection. A standard predictable rate can therefore not be calculated. Thirdly, there are a variety of antibody tests available and it is extremely difficult to compare their results due to the diversity and lack of standardisation (both globally and within Member States). And finally, there is a risk that the antibodies detected by the commercial tests currently in use will not prevent infection with newly emerging SARS-CoV-2 variants. In view of the above, the Commission maintains its position not to amend the EU Digital COVID Certificate Regulation on this point. 2.8.5.Validity period of certificates of recovery In the last report, the Commission also concluded that, based on scientific guidance, it was not considering extending the validity period of certificates of recovery beyond 180 days after the date of first positive test result. As had been noted by the ECDC, there was insufficient evidence to support an increase of the validity period. Beyond the period of 180 days, there is limited knowledge regarding the duration of immunity of persons infected with SARS-CoV-2. The assessment of the validity of certificates of recovery is a dynamic process dependant on the emerging scientific evidence, which is affected by changes in the dominant strains of SARS-CoV-2 circulating at any given point. ECDC continues to assess regularly the period of validity of recovery certificates, by monitoring the latest scientific evidence available. Robust evidence on the magnitude and duration of immunity against the Omicron variant is still very limited. ECDC considers that there is currently no justification to revise the current duration of the recovery certificate validity of 180 days. In view of the above, the Commission is currently not considering an amendment to the EU Digital COVID Certificate Regulation extending the validity period of certificates of recovery. 2.9.Extension of the Regulation As explained under Section 2.1.1, the Commission considers that there is a need to extend the EU Digital COVID Certificate system by 12 months. A renewed increase in infections in the second half of 2022, including due to the emergence of new SARS-CoV-2 variants of concern, is a real possibility. As a result, Member States might find it necessary to maintain or reintroduce a requirement for EU citizens exercising their right to free movement to present proof of COVID-19 vaccination, test or recovery for a certain period after 30 June 2022. In such a case, it should be avoided that EU citizens are deprived of the possibility to make use of their EU Digital COVID Certificates as an effective, secure and privacy-preserving way of proving one’s COVID-19 status. Therefore, the Commission proposed, on 3 February 2022, to extend the EU Digital COVID Certificate Regulation by a year, until 30 June 2023. In parallel, the Commission also proposed to extend Regulation (EU) 2021/954, which extends the rules laid down in the EU Digital COVID Certificate Regulation to third-country nationals who do not fall within the scope of that Regulation, but who are legally staying or residing in their territory and who are entitled to travel to other Member States in accordance with EU law. In addition, the Commission’s proposal also contains a small number of additional amendments to the Regulation: First, as already mentioned above, the Commission proposed to include high-quality laboratory-based antigen tests among the types of tests for which a test certificate can be issued. This aims to widen the scope of the types of diagnostic tests at a time where COVID-19 tests are in high demand (see also Section 2.8.2). Second, the proposal clarifies that vaccination certificates contain the correct overall number of doses administered in any Member State and not just in the Member State issuing the certificate. This is to address practical concerns raised by citizens about certificates indicating an incorrect number of doses when they receive vaccine doses in different Member States (see also Section 2.1.5). Lastly, the proposal provides that certificates may be issued to persons participating in clinical trials, that is, studies performed to investigate the safety or efficacy of a medicine, regardless whether the participants have received the COVID-19 vaccine candidate or, to avoid undermining the studies, the dose administered to the control group. The EU Digital COVID Certificate issued to trial participants may then be accepted by other Member States. In particular in light of the emergence of new SARS-CoV-2 variants of concern, the continued development and study of COVID-19 vaccines remains crucial. As a result, it is important to facilitate the participation of volunteers in clinical trials. Depriving volunteers from access to EU Digital COVID Certificates could constitute a major disincentive to participate, delaying the conclusion of clinical trials and negatively impacting public health. 3.Conclusion and next steps The EU Digital COVID Certificate system has had – and continues to have – a very positive impact on free movement at a time where Member States continue to restrict travel on grounds of public health. It ensures that citizens enjoy a right to receive interoperable and mutually accepted certificates on COVID-19 vaccination, testing and recovery that they can use when exercising their right to free movement. Where Member States waive certain restrictions on free movement for persons holding proof of vaccination, test or recovery, the EU Digital COVID Certificate Regulations ensures that citizens can benefit from these exemptions. With the EU Digital COVID Certificate, a fragmented system of multiple national certificates has been avoided. In the event that certain restrictions to free movement based on public health are still in place after 30 June 2022, for example in case of a renewed increase in infections in the second half of 2022, it should be avoided that EU citizens are deprived of the possibility to make use of their EU Digital COVID Certificates as an effective, secure and privacy-preserving way of proving one’s COVID-19 status. For this reason, the Commission proposed to extend the EU Digital COVID Certificate Regulation by a year, until 30 June 2023.