Systems for tobacco traceability and security features
Fighting illicit trade in tobacco products
Articles 15 and 16 of the Tobacco Products Directive 2014/40/EU (TPD) provide for EU-wide systems of traceability and security features for tobacco products to address the issue of illicit trade. The systems became operational on 20 May 2019.
The traceability system aims to:
- Contribute to reducing the circulation of non-compliant tobacco products
- Reduce artificially cheap supplies of illegal tobacco products
- Protect public health, State budgets, and legal economic operators.
Under the traceability system:
- All unit packets of tobacco products will be required to be marked with a unique identifier
- Relevant economic operators involved in tobacco trade will be required to record the movements of these packets throughout the supply chain and transmit the related information to an independent provider (data storage contracts to be approved by the Commission)
- The data will then be made accessible to the authorities of EU countries and to the Commission for enforcement purposes.
In this way, it will be possible to track and trace the movement of legal tobacco products to allow public authorities to determine when a product was diverted into the illicit market.
Security features system
Under the security features system, all unit packets of tobacco products placed on the EU market will be required to:
- Carry a tamper-proof security feature composed of visible and invisible elements, enabling authorities and consumers to verify their authenticity.
The systems of traceability and security features must be in place by:
- 20 May 2019 for cigarettes and roll-your-own tobacco
- 20 May 2024 for all other tobacco products.
This will provide manufacturers of other tobacco products (which are often small and medium enterprises (SMEs)) with a longer period to adapt to and benefit from the experience gained before the systems become applicable to them.
Relevant legislative acts
Articles 15 and 16 of the TPD require the Commission to adopt implementing and delegated acts to lay down the technical details necessary for the systems of traceability and security features for tobacco products to become fully operational. These acts were adopted on 15 December 2017 and published in the Official Journal of the EU of 16 April 2018.
The acts are published on the following pages:
- Commission Implementing Regulation (EU) 2018/574 on technical standards for the establishment and operation of a traceability system for tobacco products (incl. Annex I and II): 7
- Commission Delegated Regulation (EU) 2018/573 on key elements of data storage contracts to be concluded as part of a traceability system for tobacco products: 1
- Commission Implementing Decision (EU) 2018/576 on technical standards for security features applied to tobacco products: 57
In addition, as a temporary measure, on 2 May 2019, the Commission adopted Commission Decision (EU) 2019/691 authorising, in accordance with Article 4(5) of Commission Implementing Regulation (EU) 2018/574, economic operators to use the services of another ID issuer. The Decision was published on 3 May 2019 in the Official Journal of the European Union (p. 80).
- Timeline of actions required before 20 May 2019 under Commission Implementing Regulation (EU) 2018/574 and Commission Delegated Regulation (EU) 2018/573.
- Impact Assessment accompanying Commission Implementing Regulation (EU) 2018/574 on technical standards for the establishment and operation of a traceability system for tobacco products and Commission Implementing Decision (EU) 2018/576 on technical standards for security features applied to tobacco products.
- Executive summary of Impact Assessment
- Annexes accompanying Impact Assessment
- Q&A: EU systems for traceability and security features of tobacco products
- Stakeholder manual
The following document serves as the Final Report to the European Commission´s Consumers, Health, Food and Agriculture Executive Agency (Chafea) in response to the request for service Chafea/2015/health/40 for the implementation of Framework Contract FWC DIGIT/R2/PO/2013/004 ABC III Lot 2, concerning the implementation analysis regarding the technical specifications and other key elements for a future EU system for traceability and security features in the field of tobacco products.
The present document is the main report of the study carried out, and is complemented by:
- Annex I – Evaluation of Policy Options
- Annex II – Technical Specifications of the Tracking and Tracing System and the Security Features
- Annex III – Model Contract
- Résumé exécutif
The content of the implementation analysis represents the views of the contractor and is its sole responsibility; it can in no way be taken to reflect the views of the European Commission and/or Chafea or any other body of the European Union. The European Commission and/or Chafea do not guarantee the accuracy of the data included in this report, nor do they accept responsibility for any use made by third parties thereof.
The implementation analysis is an external document and insofar it may assist the interested parties in familiarising themselves with concepts and potential solutions relating to the systems of traceability and security features, this analysis cannot and does not supersede any applicable provisions set out in Articles 15 and 16 of the TPD and the relevant supporting acts: Commission Implementing Regulation (EU) 2018/574, Commission Delegated Regulation (EU) 2018/573 and Commission Implementing Decision (EU) 2018/576.
Competent ID issuers
Pursuant to Article 3(1) of Commission Implementing Regulation (EU) 2018/574, each Member State shall appoint an entity (the ID issuer) responsible for generating and issuing unique identifiers.
See the overview of the national competent authorities and the ID issuers
Commission Implementing Regulation (EU) 2018/574 provides for a set of rules that jointly have an effect on the encoding structures of unique identifiers adopted by individual ID issuers. See the overview of the applicable rules and the resulting encoding structures.
Article 4 of Commission Implementing Regulation (EU) 2018/574 stipulates the competence rules for generating and issuing unique identifiers (required for subsequent product marking).
See the information on the Member States' application of the second subparagraph of Article 4(1) of Commission Implementing Regulation (EU) 2018/574.
Articles 14, 16 and 18 of Commission Implementing Regulation (EU) 2018/574 further specify to which ID issuer(s) the economic operators (and where relevant the operators of first retail outlets) shall apply to obtain an economic operator identifier code, a facility identifier code and a machine identifier code, respectively.
Notification of proposed primary data storage providers and draft data storage contracts
Pursuant to Article 15(8) of the TPD, manufacturers and importers of tobacco products must conclude data storage contracts with an independent third party.
According to Part A of Annex I (paragraph 1) to Commission Implementing Regulation (EU) 2018/574 on technical standards for the establishment and operation of a traceability system for tobacco products, each manufacturer and importer is required to submit, no later than two months following the entry into force of Commission Delegated Regulation (EU) 2018/573 on key elements of data storage contracts to be concluded as part of a traceability system for tobacco products:
- the identity of the third party that it proposes to appoint to operate a primary repository ("the proposed provider");
- a draft data storage contract containing the key elements laid down in Delegated Regulation (EU) 2018/573
for approval by the Commission.
As set out in Part A of Annex I (paragraph 2) of Implementing Regulation (EU) 2018/574, this notification must be accompanied by:
- a written declaration of technical and operational expertise, referred to in Article 4 of Delegated Regulation (EU) 2018/573;
- a written declaration of legal and financial independence, referred to in Article 8 of Delegated Regulation (EU) 2018/573;
- a table setting out correspondence between the contractual clauses and the requirements laid down in Delegated Regulation (EU) 2018/573.
Procedure for notification
Submitting parties are requested to send the required documentation to the following email address: SANTE-TT-SW@ec.europa.eu
You should expect to receive an email acknowledging the receipt of your documents. Should you fail to receive such an email within 5 working days, please contact the secretariat of SANTE B2 Tobacco Control at the following numbers: +32 229-96269, or +32 229-92406.
Submitting parties are asked:
- To use the following templates for the purpose of their submissions:
- written declaration of technical and operational expertise
- written declaration(s) of legal and financial independence (including of potential subcontractors)
- table setting out correspondence between the contractual clauses and the requirements laid down in Delegated Regulation (EU) 2018/573.
- To submit the data storage contract in the MS Word format.
- To include, in the body of the cover email, an email address and telephone number of one contact person for the submitting party.
NOTE: See the list of all notified and approved providers of primary repositories.
Guidelines on annual audit reports
Pursuant to Article 15(8) of the TPD, the third party’s data storage activities shall be monitored by an external auditor, who is proposed and paid by the tobacco manufacturer and approved by the Commission. The external auditor shall submit an annual report to the competent authorities and to the Commission, assessing in particular any irregularities in relation to access. An audit year is a one-year period starting on 20 May and ending on 19 May.
To support manufacturers in selecting the most suitable auditor, and the approved auditors in fulfilling their annual reporting obligations in a consistent manner, the European Commission published Guidelines on annual audit reports to be submitted in accordance with Article 15(8) of Directive 2014/40/EU in the context of the EU traceability system for tobacco products.
The Guidelines provide the approved auditors with practical guidance on how to carry out the audits and report their findings to the national competent authorities and to the Commission.
In line with the Guidelines, the auditors are invited to submit their annual reports by the end of October of each calendar year.
The auditors are requested to include in the conclusions of their audit report an explicit assurance as to the compliance of the audited repository with all the audit domains, in particular as regards the following two aspects:
- absence of any irregularities in access;
- full retention of all relevant data.
The auditors are reminded that the verification for potential traces of irregular access, i.e. access by any external party other than the Commission, the competent authorities of the Member States, and the external auditor is of utmost importance. Articles 15(8) and 15(9) of the TPD restrict the economic operators, in particular the manufacturers and importers of tobacco products who contracted the repositories, from having access to, modifying or deleting the stored data.
Each repository must contain a complete audit trail of all operations concerning the stored data and users performing related operations, including the nature of these operations and the history of user access (please see: Article 25(1)(m) of Implementing Regulation (EU) 2018/574). The audit trail constitutes an element of the evidence that needs to be verified before it is possible to provide assurance in relation to the two aspects above.
Procedure for notification
Each manufacturer or importer is invited to notify the Commission of the auditor it proposes to audit its primary repository within 30 calendar days from the end of the audit year, i.e. by 19 June by completing and submitting signed copies of:
- Annex A – Notification of proposed audit firm,
- Annex B - Declaration form: independence of audit firm and auditors,
- Annex C - Declaration form: professional suitability of audit firm and auditors
to the following email address: SANTE-TT-SW@ec.europa.eu.
Two or more manufacturers may decide to submit a joint notification proposing one audit firm. For manufactures and importers whose auditors were approved for the purpose of the previous audit year(s), it is assumed that, in the absence of a new notification, the already approved auditor will continue its task.
You should expect to receive an email acknowledging the receipt of your submission. Should you fail to receive such an email within 5 working days, please contact the secretariat of SANTE B2 Tobacco Control at the following numbers: +32 229-96269, or +32 229-92406.
The Commission will carry out the assessment of the proposed auditor and will seek to issue a decision within three months of the date of receiving the notification from the manufacturers.
Secondary data storage provider
Commission Implementing Regulation (EU) 2018/574 requires the Commission to appoint, from amongst the approved providers of primary repositories, a provider tasked with operating the secondary repository. The appointment of the operator of the secondary repository shall be based on an assessment of objective criteria and take place no later than eight months following the entry into force of Delegated Regulation (EU) 2018/573.
On 21 December 2018, the Commission appointed 'Dentsu Aegis Network Switzerland AG' as provider to operate the secondary repository.
The provider operating the secondary repository shall establish a list of specifications required for the data exchange with the secondary repository and the router, and a common data dictionary which shall be based on the information listed in Annex II to Implementing Regulation (EU) 2018/574. The list of specifications necessary for economic operators to exchange data with the router, and the common data dictionary are available for download.
The repositories system, including the secondary repository and the router, shall ensure continuous availability of all components and services with a monthly uptime of at least 99.5%. The current status of the secondary repository and the router can be consulted here.
Commission Implementing Regulation (EU) 2018/574 requires that
- the verification of unit level unique identifiers is protected with an anti-tampering device supplied and installed by an independent third party
- the installed anti-tampering device meets the requirements of this Regulation
The independence of the third party and the compliance of the installed anti-tampering device with the requirements of Commission Implementing Regulation (EU) 2018/574 must be attested by a declaration.
This declaration form needs to be submitted to the relevant EU Member States and to the European Commission, as set out in the Regulation.
Please send a copy of the signed and completed declaration form to SANTE-TT-SW@ec.europa.eu.
Subgroup on Traceability and Security Features
Discussions on the systems of traceability and security features for tobacco products take place on a regular basis in the dedicated Subgroup. Summaries of past Subgroup meetings can be found in the Events section. For ease of navigation, it is also possible to consult a single, searchable document compiling Q&As and past Subgroup discussions.
Pre-launch technical briefing
On 6 May 2019, DG SANTE organised a technical briefing to inform the stakeholders about the state of play with regard to the preparations to the system’s launch on 20 May 2019. A summary record of that briefing can be found in the Events section.
Regional workshops and webinars
From January to April 2018, the European Commission organised a series of regional workshops and webinars to support the technical roll-out of the systems for tobacco traceability and security features.
Webinar series (16, 17, and 23 April)
- Summary record
- Presentation (webinar for economic operators)
- Presentation (webinar for solution providers)
- List of questions (16 April, 1st webinar)
- List of questions (16 April, 2nd webinar)
- List of questions (17 April, 3rd webinar)
- List of questions (23 April, 4th webinar)
- List of questions (23 April, 5th webinar)
Workshop No 4 (Bulgaria, Greece, Cyprus, Malta, Croatia, Slovenia, Italy, Finland) – 19 April 2018, Rome
Workshop No 3 (Spain, Belgium, Portugal, Germany, France and Luxembourg) – 15 March 2018, Madrid
Workshop No 2 (Austria, Czechia, Slovakia, Poland, Hungary, Lithuania, Romania) – 15 February 2018, Bucharest
Workshop No 1 (Denmark, Estonia, Ireland, Latvia, Sweden and UK) – 25 January 2018, Stockholm
Note: This webpage is being updated on a regular basis in order to provide you with more detailed information on the establishment and implementation of systems of traceability and security features for tobacco products.