Commission Implementing Regulation (EU) 2018/574 of 15 December 2017 on technical standards for the establishment and operation of a traceability system for tobacco products (Text with EEA relevance. )

Each Member State shall appoint an entity (the ‘ID issuer’) responsible for generating and issuing unique identifiers, in accordance with Articles 8, 9, 11 and 13, within a maximum period of one year from the date of entry into force of this Implementing Regulation.

Member States shall ensure that an ID issuer that intends to have recourse to subcontractors for the performance of its functions shall only be considered for appointment if the identity of any subcontractors proposed has been communicated to them.

The ID issuer shall be independent and comply with the criteria set out in Article 35.

Each ID issuer shall be equipped with a unique identification code. The code shall be composed of alphanumeric characters and comply with the International Organization for Standardisation/International Electrotechnical Commission standard (‘ISO/IEC’) 15459-2:2015.

Where the same ID issuer is appointed in more than one Member State, it shall be identifiable by the same code.

Member States shall notify the Commission of the appointment of the ID issuer and of its identification code within one month of its appointment.

Member States shall ensure that information related to the identity of the ID issuer appointed and its identification code is made publicly available and accessible online.

Each Member State shall put in place adequate measures to ensure:

The ID issuer may establish and charge fees to economic operators for generating and issuing unique identifiers. Fees are to be non-discriminatory, cost-based and proportionate to the number of unique identifiers generated and issued to economic operators taking into account the mode of delivery. Fees may reflect all fixed and variable costs incurred by the ID issuer in meeting its requirements under this Regulation.

For tobacco products manufactured in the Union, the competent ID issuer shall be the entity appointed for the Member State in which the products are manufactured.

For tobacco products imported into the Union, the competent ID issuer shall be the entity appointed for the Member State on whose market the products are placed.

For tobacco products aggregated in the Union, the competent ID issuer shall be the entity appointed for the Member State in which the products are aggregated.

For tobacco products destined for export, the competent ID issuer shall be the entity appointed for the Member State in which the products are manufactured.

In the event of the temporary absence of the competent ID issuer, the Commission may authorise economic operators to use the services of another ID issuer that has been appointed in accordance with Article 3.

Unique identifiers generated by ID issuers may be used to mark unit packets or aggregated packaging, as provided for by Articles 6 and 10, within a maximum period of six months from the date of receipt of the unique identifiers by the economic operator. After this time period unique identifiers shall become invalid and economic operators shall ensure that they are not used to mark unit packets or aggregated packaging.

The repositories system shall ensure that the unique identifiers that have not been used within the six months period referred to in paragraph 1 shall be automatically deactivated.

At any time, manufacturers and importers may obtain the deactivation of unique identifiers by transmitting a deactivation request to the relevant primary repository. Other economic operators may obtain the deactivation of the unique identifiers by transmitting a deactivation request via the router. The deactivation request shall be introduced electronically, in accordance with Article 36, and shall contain the information listed in point 2.3 of Section 2 of Chapter II of Annex II, in the format indicated therein. The deactivation shall not interfere with the integrity of the information already stored related to the unique identifier.

Manufacturers and importers shall mark each unit packet manufactured or imported in the Union with a unique identifier (‘unit level UI’) compliant with Article 8.

In the case of tobacco products that are manufactured outside the Union, the unit level UI shall be applied on the unit packet before the tobacco product is imported in the Union.

Manufacturers and importers shall ensure that the application of unit level UIs is directly followed by the verification of those unit level UIs in terms of correct application and readability.

The process referred to in paragraph 1 shall be protected with an anti-tampering device supplied and installed by an independent third party who shall provide a declaration to the relevant Member States and the Commission that the installed device meets the requirements of this Regulation. The record generated by the device shall provide proof of correct application and readability of each unit level unique identifier. The device shall ensure that any omission in the marking process referred to in Article 6 is recorded.

Where the process referred to in paragraph 1 fails to confirm the correct application and full readability of the unit level UI, manufacturers and importers shall re-apply the unit level UI.

Manufacturers and importers shall ensure that the information recorded by the anti-tampering device remains available for a period of nine months from the time of recording.

Manufacturers and importers shall, upon request from Member States, provide full access to the record of the verification process created by the anti-tampering device.

By way of derogation from paragraphs 2, 4 and 5, the obligation to install an anti-tampering device shall not apply:

Each unit packet of tobacco products shall be marked with a unit level UI. It shall consist of as short a sequence of alphanumeric characters as possible, not exceeding 50 characters. The sequence shall be unique to a given unit packet and shall be composed of the following data elements:

ID issuers shall be responsible for the generation of a code consisting of the elements listed in paragraph 1, points (a), (b), and (c).

Manufacturers or importers shall add the time stamp referred to in paragraph 1, point (d), to the code generated by the ID issuer pursuant to paragraph 2.

Unit level UIs shall not include any data elements other than those listed in paragraph 1.

Manufacturers and importers shall send a request to the competent ID issuer for unit level UIs referred to in Article 8 and the corresponding human-readable codes referred to in Article 23. Requests shall be introduced electronically, in accordance with Article 36.

Manufacturers and importers introducing such a request shall supply the information listed in point 2.1. of Section 2 of Chapter II of Annex II, in the format indicated therein.

The ID issuer shall, within two working days from the receipt of the request and in the order indicated:

However, a Member State may require ID issuers to offer physical delivery of unit level UIs as an alternative to electronic delivery. In cases where physical delivery of unit level UIs is offered, manufacturers and importers shall specify whether physical delivery is requested. In that case, the ID issuer shall within 10 working days from the receipt of the request, and in the following order:

Within one working day, manufacturers and importers may cancel a request which was sent pursuant to paragraph 1 by means of a recall message as further defined in Point 5 of Section 5 of Chapter II of Annex II.

Where economic operators choose to comply with the recording obligations provided for under Article 15(5) of Directive 2014/40/EU by means of the recording of aggregated packaging, they shall mark aggregated packages containing tobacco products with a unique identifier (‘aggregated level UI’).

Aggregated level UIs shall be generated and issued on the basis of a request to the competent ID issuer or directly by the economic operator.

Where the aggregated level UI is generated on the basis of a request to the competent ID issuer, it shall comply with the structure set out in Article 11(1).

Where the aggregated level UI is generated directly by the economic operator, it shall consist of an individual unit code generated in accordance with ISO/IEC 15459-1:2014 or ISO/IEC 15459-4:2014 or their latest equivalents.

For aggregated level UI generated on the basis of a request to the competent ID issuer, the structure of the aggregated level UI shall consist of a sequence of a maximum of 100 alphanumeric characters that is unique to a given aggregated package and shall be composed of the following data elements:

ID issuers shall be responsible for the generation of a code consisting of the elements listed in paragraph 1, points (a), (b), and (c).

Economic operators shall add the time stamp, referred to in paragraph 1, point (d), to the code generated by the ID issuer pursuant to paragraph 2.

The aggregated level UI may be completed by the economic operator with additional information, provided that the maximum character limit set out in paragraph 1 is not exceeded. Any such information may only appear after the data referred to in paragraph 1.

The aggregated level UI shall be capable of identifying the list of all unique identifiers contained within the aggregated packaging by means of an electronically accessible link to the repositories system.

In order to establish the link referred to in paragraph 1, manufacturers and importers shall transmit to their primary repository the information listed in point 3.2 of Section 3 of Chapter II of Annex II, in the format indicated therein.

In order to establish the link referred to in paragraph 1, economic operators other than manufacturers and importers shall transmit via the router to the secondary repository the information listed in point 3.2 of Section 3 of Chapter II of Annex II, in the format indicated therein.

Economic operators requesting aggregated level UIs on the basis of a request to the competent ID issuer shall introduce such requests electronically, in accordance with Article 36.

Economic operators introducing such requests shall supply the information listed in point 2.2. of Section 2 of Chapter II of Annex II, in the format indicated therein.

For manufacturers and importers, the ID issuer shall, within two working days from the receipt of the request and in the order indicated:

For economic operators other than manufacturers and importers, the ID issuer shall, within two working days from the receipt of the request and in the order indicated:

Within one working day, economic operators may cancel a request which was sent pursuant to paragraph 1 by means of a recall message as further defined in point 5 of Section 5 of Chapter II of Annex II, in the format indicated therein.

Aggregated level UIs issued by competent ID issuers shall not be reused.

Economic operators and operators of first retail outlets shall apply for a single code (‘economic operator identifier code’) from the ID issuer competent for each Member State in which they operate at least one facility. Importers shall also apply for an identifier code from the ID issuer competent for each Member State on whose market they place their products.

Economic operators and operators of first retail outlets introducing a request pursuant to paragraph 1 shall provide the information listed in point 1.1 of Section 1 of Chapter II of Annex II, in the format indicated therein.

For operators of first retail outlets the obligation to apply for an economic operator identifier code may also be discharged by any other registered economic operator. Such registration by the third party shall be subject to the consent of the operator of the first retail outlet. The third party shall inform the operator of the first retail outlet of the full details of the registration, including the allocated economic operator identifier code.

Economic operators and operators of first retail outlets shall inform the ID issuer of any economic operator identifier codes allocated to them by other ID issuers. If not available at the time of registration, economic operators shall provide that information at the latest within two working days from the receipt of the economic operator identifier codes allocated by another ID issuer.

Any modification of the information submitted in the initial application form and any cessation of the operator activities shall be notified by the relevant operator to the ID issuer without delay, in the formats indicated in points 1.2 and 1.3 of Section 1 of Chapter II of Annex II accordingly. In case the operator ceases to exist, the ID issuer shall de-register the economic operator identifier code.

Upon receipt of a request pursuant to Article 14, the ID issuer shall generate an economic operator identifier code, which consists of the following data elements, to be placed in the following order:

Within two working days, the ID issuer shall transmit the code to the requesting operator.

All the information submitted to the ID issuer in accordance with Article 14(2), and the corresponding identifier codes, shall form part of a registry to be established, managed and kept up to date by the competent ID issuer. The competent ID issuer shall keep a record of the information stored in the register for as long as the traceability system is operational.

In duly justified cases, Member States may, in accordance with their national laws, require the ID issuer to deactivate an economic operator identifier code. In such cases the Member State shall inform the economic operator or the operator of a first retail outlet of the deactivation, together with the grounds for such deactivation. The deactivation of an economic operator identifier code shall lead to the automatic deactivation of related facility identifier codes and machine identifier codes.

Economic operators and operators of first retail outlets shall exchange information on their respective economic operator identifier codes in order to allow economic operators to record and transmit the transactional information, as provided under Article 33.

All facilities from manufacturing to the first retail outlet shall be identified by a single code (‘facility identifier code’) generated by the ID issuer competent for the territory in which the facility is located.

Economic operators and operators of first retail outlets shall apply for a facility identifier code providing to the ID issuer the information listed in point 1.4 of Section 1 of Chapter II of Annex II, in the format indicated therein.

For first retail outlets, the obligation to apply for a facility identifier code shall lie with the operator of the first retail outlet. This obligation may also be discharged by any other registered economic operator, who may act on behalf of the operator of the first retail outlet. The registration by the third party shall be subject to the consent of the operator of the first retail outlet. The third party shall inform the operator of the first retail outlet about the full details of the registration, including the allocated facility identifier code.

The obligation to apply for a facility identifier code related to manufacturing facilities located outside the Union shall lie with the importer established inside the Union. The importer shall apply to any ID issuer appointed by a Member State on whose market they place their products. The registration by the importer shall be subject to the consent of the entity responsible for the third country manufacturing facility. The importer shall inform the economic operator responsible for the third country manufacturing facility about the full details of registration, including the allocated facility identifier code.

Any modification of the information submitted in the initial application form and any facility closure shall be notified by the economic operator to the ID issuer without delay, in the formats indicated in points 1.5 and 1.6 of Section 1 of Chapter II of Annex II.

Upon receipt of a request pursuant to Article 16, the ID issuer shall generate a facility identifier code, which consists of the following data elements, to be placed in the following order:

Within two working days from the receipt of the request, the ID issuer shall transmit the code to the requesting operator.

All the information submitted to the ID issuer in accordance with Article 16(2), and the corresponding identifier codes shall form part of a registry to be established, managed and kept up to date by the competent ID issuer. The competent ID issuer shall keep a record of the information stored in the register for as long as the traceability system is operational.

In duly justified cases, Member States may require the ID issuer to deactivate a facility identifier code. In such cases the Member State shall inform the economic operator or the operator of a first retail outlet of the deactivation, together with the grounds for such deactivation. The deactivation of a facility identifier code shall lead to the automatic deactivation of related machine identifier codes.

Economic operators and operators of first retail outlets shall exchange the information on their respective facility identifier codes in order to allow economic operators to record and transmit the information on product movements, as provided under Article 32.

Each machine and machine part shall be identified by a single code (‘machine identifier code’) generated by the ID issuer competent for the territory in which the machine is located.

Manufacturers and importers shall apply for a machine identifier code by providing to the ID issuer the information listed in point 1.7. of Section 1 of Chapter II of Annex II, in the format indicated therein.

The obligation to apply for a machine identifier code related to machines and machine parts located in manufacturing facilities outside the Union shall lie with the importer established inside the Union. The importer shall apply to any ID issuer appointed by a Member State on whose market it places its products. The registration by the importer shall be subject to the consent of the entity responsible for the third country manufacturing facility. The importer shall inform the economic operator responsible for the third country manufacturing facility as to the full details of the registration, including the allocated machine identifier code.

Any modification of the information submitted in the initial application form and any decommissioning of the registered machines and machine parts shall be notified by the manufacturer or the importer to the ID issuer without delay, in the formats indicated in points 1.8 and 1.9 of Section 1 of Chapter II of Annex II.

Upon receipt of a request pursuant to Article 18, the ID issuer shall generate a machine identifier code, which consists of the following data elements, to be placed in the indicated position:

Within two working days, the ID issuer shall transmit the code to the requesting operator.

All the information submitted to the ID issuer in accordance with Article 18(2), and the corresponding identifier codes shall form part of a registry to be established, managed and kept up to date by the competent ID issuer. The competent ID issuer shall keep a record of the information stored in the register for as long as the traceability system is operational.

In duly justified cases, Member States may require the ID issuer to deactivate a machine identifier code. In such cases the Member State shall inform the manufacturers and importers of the deactivation, together with the grounds for such deactivation.

ID issuers shall establish offline flat-files, as well as registries relating to the information referred to in Articles 14(2), 16(2) and 18(2), along with explanatory notes on the structures thereof.

Offline flat-files shall be no larger than two gigabytes per ID issuer. Each line of the flat-file shall hold one record with fields separated by delimiters such as commas or tabs.

ID issuers shall ensure that an up-to-date copy of all offline flat-files, registries and related explanatory notes are electronically provided via the router to the secondary repository.

Member States may adapt the size limit for offline flat-files referred to in paragraph 2, taking into account both the average size of available memory installed on the verification devices used for offline checks of unique identifiers and the total number of ID issuers.

ID issuers shall provide a secure online service for economic operators and operators of first retail outlets allowing them to consult the registries referred to in paragraph 1 as far as their own economic operator, facility and machine identifier codes are concerned. This service shall include a secure procedure for economic operators and operators of first retail outlets to reclaim their own economic operator identifier codes.

Unit level UIs shall be encoded using at least one of the following types of data carriers:

In the case of unit level UIs delivered electronically, manufacturers and importers are responsible for encoding unit level UIs in accordance with paragraph 1 and with Annex III.

In the case of unit level UIs delivered physically, ID issuers are responsible for encoding the codes generated pursuant to Article 8(2), in accordance with paragraph 1 and with Annex III.

By way of derogation from paragraph 1, manufacturers and importers may add the time stamp separately from the data carrier in the format YYMMDDhh as a human readable code.

Aggregated level UIs shall be encoded by economic operators using at least one of the following types of data carriers:

In order to distinguish the data carriers referred to in paragraph 1 from any other data carrier placed on unit packets, economic operators may add the marking ‘TTT’ or ‘EU TTT’ next to such data carriers.

Economic operators shall ensure high readability of the optical data carriers. A quality of the optical data carriers rated at least 3.5 in accordance with ISO/IEC 15415:2011 for the two-dimensional data carriers, or in accordance with ISO/IEC 15416:2016 for the linear symbols shall be presumed to fulfil the requirements set out in this Article.

Economic operators shall ensure that the optical data carriers are capable of remaining readable for at least five years after their creation.

Economic operators shall ensure that each data carrier includes a human-readable code that enables electronic access to the information related to the unique identifiers stored in the repositories system.

Where the dimensions of the packaging allow, the human-readable code shall be adjacent to the optical data carrier carrying the unique identifier.

The repositories system shall be composed of the following sub-systems:

The sub-systems referred to in paragraph 1 shall be fully interoperable with one another, irrespective of the service provider used.

The repositories system shall satisfy the following conditions:

Data stored in the repositories system shall be used only for the purposes referred to in Directive 2014/40/EU and this Regulation.

Each manufacturer and importer shall ensure the establishment of a primary repository. To that end each manufacturer and importer shall contract an independent third party provider, in accordance with the contractual requirements set out in Commission Delegated Regulation (EU) 2018/573 ([^E0002]). The selection of the independent third party shall take place in accordance with the procedural rules laid down in Annex I, Part A.

Each primary repository shall exclusively host information which relates to the tobacco products of the manufacturer or importer who contracted the repository.

Whenever data are received by the primary repository on the basis of a reporting activity, or for any other permitted reason, it shall be forwarded to the secondary repository instantaneously.

In forwarding all data received to the secondary repository, the primary repositories shall use the data format and data exchange modalities defined by the secondary repository.

Primary repositories shall store the data in accordance with the common data dictionary provided by the secondary repository.

Member States, the Commission, and external auditors approved by the Commission shall be able to carry out basic query requests in relation to all data stored in a primary repository.

A single secondary repository containing a copy of all data stored in primary repositories shall be established. The operator of the secondary repository shall be appointed from among the providers of primary repositories in accordance with the procedure laid down in Annex I, Part B.

The secondary repository shall provide for graphical and non-graphical interfaces, including an application programming interface, stationary and mobile user interfaces containing an inspection application for the leading mobile operating systems, that enable Member States and the Commission to access and query the data stored in the repositories system, using all commonly available database search functions, including Structured Query Language (SQL) or equivalent syntax for building custom queries, in particular by remotely carrying out the following operations:

The user interfaces referred to in paragraph 2 shall enable each Member State and the Commission to configure their own rules for:

Automatic alerts and periodic reports referred to in paragraph 3 shall be forwarded to recipient addresses indicated by Member States and the Commission such as individual email addresses and/or internet Protocol (IP) addresses belonging to external systems used and managed by national authorities or the Commission.

The user interfaces referred to in paragraph 2 shall enable Member States and the Commission to:

The user interfaces referred to in paragraph 2 shall be provided in all official languages of the Union.

The overall response time of the repository to any already established type of query or alert trigger, not considering the speed of the internet connection of the end user, shall be no more than 10 seconds for the data stored for less than 2 years and no more than 15 seconds for the data stored for 2 years or more, in at least 99 % of all types of already established queries and automatic alerts foreseen under paragraphs 2 and 3. The provider of the secondary repository shall prepare datasets necessary for responding, in line with the prescribed timelines, to any new query or alert trigger within 4 weeks from receiving a request from Member States or the Commission. After this period, the newly requested types of queries or alert triggers shall be deemed to be already established for the purpose of the response times stipulated in this paragraph.

As regards individual data points and messages, the overall time between the arrival of reporting activity data and its accessibility, via the graphical and non-graphical interfaces, in the primary and secondary repositories shall be no more than 60 seconds in at least 99 % of all data transfer activities. As regards pre-structured analytical datasets, the overall time between the arrival of reporting activity data and its accessibility, via the graphical interfaces, in the secondary repository shall be no more than 24 hours in at least 99 % of all data transfer activities.

The repository shall allow for the receipt, storing and making available of offline flat-files for the purpose of updating verification devices used by Member States for offline decoding of unique identifiers.

The provider of the secondary repository shall establish and maintain a register of the information transferred to it in accordance with Article 20(3). The provider of the secondary repository shall keep a record of the information stored in the register for as long as the traceability system is operational.

Member States and the Commission shall retain the right to enter into additional service level agreements with the provider of the secondary repository for the purpose of contracting the latter to carry out additional services not provided for by this Regulation. The provider of the secondary repository may charge proportionate fees for providing such additional services.

The repository services provided to Member States and the Commission under this Article shall be compatible with Regulation (EU) No 910/2014 and in particular allow for the use of reusable solutions provided as building blocks under the telecommunication part of the Connecting Europe Facility.

The provider of the secondary repository shall organise at least one full-day technical training session per year for the users from each Member State and from the Commission, on the use of the user interfaces referred to in paragraph 2. The provider of the secondary repository shall also develop and keep updated a full set of technical and user documentation for the competent authorities available in all official languages of the Union.

The provider of the secondary repository shall provide an inspection application for the leading mobile operating systems that enables Member States and the Commission to connect to the secondary repository via the mobile user interfaces referred to paragraph 2.

The provider operating the secondary repository shall communicate to providers operating primary repositories, ID issuers and economic operators, the list of specifications, including common validation rules, required for the data exchange with the secondary repository and the router. All specifications shall be based on non-proprietary open standards.

On the basis of the information listed in Annex II, the provider operating the secondary repository shall establish a common data dictionary. The common data dictionary shall refer to labels of data fields in the human readable format.

Whenever necessary to ensure the effective operation of the repositories system in accordance with the requirements of this Regulation, the provider operating the secondary repository shall update the list referred to in paragraph 1 and the common data dictionary referred to in paragraph 2. Any such update shall be consulted on with providers operating primary repositories and ID issuers, and subsequently communicated to providers operating primary repositories, ID issuers and economic operators at least 2 months before the date of implementing the update into the system.

Upon request from the provider of a primary repository, the provider of the secondary repository may carry out data reprocessing operations as far as they are necessary to eliminate consequences of past IT incidents and failures. Such operations shall be possible only to complete or correct the information stored in the secondary repository and be limited to the re-running of regular operations of the secondary repository. They shall exclude to the maximum extent possible negative consequences for any economic operators unrelated to the requesting primary repository.

The provider of the secondary repository shall establish a helpdesk service for the competent authorities of Member States, the Commission, ID issuers, providers of repository services, economic operators and IT service providers. The helpdesk service shall concern only the activities and functions of the router and the secondary repository and be available across all Member States for at least 8 hours on working days, with the exception of 1 January, 25 December and 26 December, and at least in English, French and German. The response times shall be no more than 2 working days in at least 75 % of all requests. The average monthly response time per request shall be no more than 4 working days. The provider of the secondary repository may regulate access to the helpdesk service for economic operators as a part of its fair use policy set out under the terms and conditions referred to in Article 29(6) and the contracts referred to in paragraph 4 of Part B of Annex I.

The provider of the secondary repository shall set up a test environment allowing ID issuers, providers operating primary repositories and economic operators to perform quality assurance of their technical solutions and routines before connecting to the repositories system. The test environment shall closely simulate the repositories system.

The provider of the secondary repository shall set up and manage a router.

Data exchange between the router and the primary and secondary repositories shall take place using the data format and data exchange modalities defined by the router.

Data exchange between the router and an ID issuer shall take place using the data format and data exchange modalities defined by the router.

Economic operators other than manufacturers and importers shall send the information recorded pursuant to Article 15 of Directive 2014/40/EU and in accordance with this Regulation to the router, which shall transfer it to the primary repository serving the manufacturer or importer whose tobacco products are concerned. A copy of those data shall be transferred instantaneously to the secondary repository system.

Manufacturers and importers who doubt the correct functioning of their primary repositories shall have the possibility to verify against the router, by consulting the operator of the router, whether messages concerning the final dispatch of products out of their physical possession that are sent to the primary repositories, have been transmitted correctly. The operator of the router may set a daily limit on the use of this functionality.

The provider of the secondary repository shall establish and communicate to economic operators and IT service providers the terms and conditions, including the fair use policy, applicable to the use of the secondary repository and the router. The terms and conditions shall guarantee the right of economic operators to use the secondary repository and the router in line with their business needs and shall prevent repeated cases of negligent use.

All ordinary costs related to the repositories system referred to in Article 24(1), including those that arise from its establishment, operation and maintenance, shall be borne by manufacturers and importers of tobacco products. Those costs shall be fair, reasonable, and proportionate:

The ordinary costs, as applicable, of establishing, operating and maintaining the secondary repository and the router shall be passed onto the manufacturers and importers of tobacco products through the costs charged to them by the providers of the primary repositories.

All extraordinary costs related to the reprocessing operations referred to in Article 28(4) charged by the provider of the secondary repository to the provider of the primary repository that made the request shall be fair, reasonable and proportionate to the services rendered. The provider of the secondary repository shall however itself bear any extraordinary costs of the reprocessing operations referred to in Article 28(4) to the extent that it is responsible for the causes leading to the reprocessing operations.

To allow the determination of the actual shipment route of unit packets manufactured in, or imported into the Union, economic operators shall record the following events:

Manufacturers and importers shall transmit the information listed in points 3.1 to 3.5 of Section 3 of Chapter II of Annex II, in the format indicated therein, to the primary repository contracted by them. All other economic operators shall transmit the information listed in points 3.1 to 3.5 of Section 3 of Chapter II of Annex II, in the format indicated therein, via the router.

For disaggregation of aggregated packaging marked pursuant to Article 10(4), where an economic operator intends to reuse an aggregated level UI in any future operations, manufacturers and importers shall transmit the information listed in point 3.6 of Section 3 of Chapter II of Annex II, in the format indicated therein, to the primary repository contracted by them. All other economic operators shall transmit the information listed in point 3.6 of Section 3 of Chapter II of Annex II, in the format indicated therein, via the router.

For deliveries to multiple first retail outlets by means of a vending van, manufactures and importers shall transmit the information listed in point 3.7 of Section 3 of Chapter II of Annex II, in the format indicated therein, to the primary repository contracted by them. All other economic operators shall transmit the information listed in point 3.7 of Section 3 of Chapter II of Annex II, in the format indicated therein, via the router.

For dispatch and trans-loading of unit or aggregated packaging of tobacco products with total weight below 10 kg destined outside the Union, Member States in which the dispatch facility is located may allow the recording obligation referred to in paragraph 1 in points (c) to (e) to be discharged by means of providing access to the logistic or postal operator's own track and trace system records.

If, after the application of the unique identifier, tobacco products are destroyed or stolen, economic operators shall promptly transmit a deactivation request in accordance with the scope and format specified in point 2.3 of Section 2 of Chapter II of Annex II.

The information concerning the event shall be deemed to have been transmitted correctly upon a positive acknowledgement by the primary repository or the router. The positive acknowledgement shall include the feedback information enabling the recipient to establish the correctness of its reporting activity, in particular the number of unit-level unique identifiers concerned by the event and in the case of disaggregation referred to in paragraph 3, the subordinate unique identifiers. The acknowledgement shall include a message recall code to be applied by the economic operator if the original message needs to be cancelled.

The responsibility for recording and transmitting the information concerning the events referred to in paragraph 1 shall lie with the economic operator that is in possession of the tobacco products. To that end, all the reporting activities shall use the identifier code of this economic operator. IT service providers may also transmit this information on behalf of the economic operator that is in possession of the tobacco products.

To allow the determination of the transactional information referred to in Article 15(2), points (j) and (k) of Directive 2014/40/EU, economic operators shall record the following events:

Manufacturers and importers shall transmit the information listed in Section 4 of Chapter II of Annex II, in the format indicated therein, to the primary repository contracted by them. All other economic operators shall transmit the information listed in Section 4 of Chapter II of Annex II, in the format indicated therein, via the router.

The responsibility for recording and transmitting the information referred to in paragraph 2 shall lie with the economic operator who is the vendor. To this end, all the reporting activities shall use the identifier code of this economic operator. IT service providers may also transmit this information on behalf of the economic operator who is the vendor of the tobacco products.

The information referred to in paragraph 2 shall be deemed to have been transmitted correctly upon the positive acknowledgement by the primary repositories or the router. The acknowledgement shall include a message recall code to be applied by the economic operator if the original message needs to be cancelled.

Economic operators shall transmit the information referred to in Article 32(1), points (a), (b) and (d), Article 32(3) and (4), and Article 33(1), within 3 hours from the occurrence of the event.

For the purposes of paragraph 1, the events referred to in Article 33 shall be deemed to occur at the moment when they can be associated with the relevant unit packets for the first time.

Economic operators shall transmit the information concerning the dispatch of tobacco products from a facility and trans-loading referred to in Article 32(1) points (c) and (e), within 24 hours prior to the occurrence of the event.

By way of derogation from paragraph 1, economic operators may transmit the information referred to in Article 32(1) points (a), (b) and (d), Articles 32(3) and (4), and Article 33(1), within 24 hours from the occurrence of the event, if they fulfil any of the following conditions:

The first subparagraph of paragraph 1 shall apply from 20 May 2028. Until that date all economic operators may transmit the information referred to in paragraph 1 within 24 hours from the occurrence of the event.

ID issuers, providers of repository services and anti-tampering devices as well as, where applicable, their subcontractors shall be independent and exercise their functions impartially.

For the purposes of paragraph 1, the following criteria shall be used to assess independence:

Where ID issuers, providers of repository services and providers of anti-tampering devices have recourse to sub-contractors, they shall remain responsible for ensuring compliance by those subcontractors with the independence criteria set out in paragraph 2.

For the purposes of complying with their obligations under Article 3(8)(a) Member States, as well as the Commission may require ID issuers, providers of repository services and providers of anti-tampering devices, including where applicable their sub-contractors to provide them with documents necessary to assess compliance with the criteria set out in paragraph 2. Such documents may include annual declarations of conformity with the independence criteria set out in paragraph 2. Member States and the Commission may require that the annual declarations include a full list of services provided to the tobacco industry during the last calendar year as well as individual declarations of financial independence from the tobacco industry provided by all management members of the independent provider.