Document 124 a
Ref. Ares(2019)2901103 - 30/04/2019
ANNEX
Additional Information Relating to the Traceability System
(1) The complexity and inter-dependence of the various parts of the traceability system
Article 15 of the Tobacco Products Directive 2014/40/EU (
TPD ) introduced what amounts to the
most extensive traceability system for any product in the world. In essence, the traceability system
enables the tracking of each individual cigarette pack from its manufacture in, or import into the
European Union, al the way through the supply chain to the final retail outlet.
The specific details of the traceability system are set out in Commission Implementing Regulation (EU)
2018/574 of 15 December 2017 on technical standards for the establishment and operation of a
traceability system for tobacco products (
IR ). In particular, under the IR, each Member State is
required to appoint an "ID Issuer", which is responsible for issuing "unique identifiers" in that Member
State for unit packs, as well as identifier codes for al economic operators involved in the supply chain,
including their facilities and machines used to manufacture tobacco products. To al ow for immediate
and ful traceability down to the pack-level, each economic operator in the supply chain is required to
record virtual y every movement of every cigarette pack with reference to the above identifiers, and also
the relevant invoices and payment records.
The relevant information is to be col ected and made accessible through a two-level repositories system.
Manufacturers and importers appoint so-cal ed "Primary Repositories" which host information relating
to that particular manufacturer or importer. Data from each Primary Repository is then instantaneously
forwarded to a single "Secondary Repository" for the whole of the EU. This Secondary Repository is
effectively the gateway through which the Commission and Member State authorities can access all
information relating to the manufacturing and transportation of each pack, essential y in real time.
In short, the EU traceability system is extremely complex and requires the proactive involvement of a
vast number of independent actors for it to function. Moreover, the technology used by each individual
actor must be interoperable with that used by the others. As such, the traceability system can only work
if each and every individual component of the system functions properly on its own, as well as with al
other parts. Furthermore, a project of this magnitude requires significant time for a proper
implementation, including testing and lead-in periods.
(2) The issues that have arisen in establishing the traceability system
Under Article 15(13) of the TPD, the traceability system is to apply to cigarettes and rol -your-own
tobacco from 20 May 2019. To summarise, the traceability system wil not be operational on time for
the fol owing reasons:
Delays by the Member States in appointing their ID Issuers, with the result that a significant
number of the ID Issuers will not be operational by 6 May 2019 deadline, which wil have a
knock-
2019.
Delays relating to the Secondary Repository, both in terms of it issuing final specifications by
21 February 2019 and the Secondary Repository being made available for testing by 20 March
2019, as required by the IR.
Delays in the appointment of ID Issuers
Broadly speaking, ID Issuers have two areas of responsibility. Once an ID Issuer is appointed by a
Member State, with respect to each area of responsibility, the fol owing steps need to be completed in
order to have a ful y operational ID Issuer that can generate and issue the identifier codes required
under the traceability system:
1
Part 1: Registration of economic operators
ID Issuer develops a system to process, generate, register and issue identifier codes.
ID Issuer makes available to economic operators a system (e.g. a website) that could be used
for registration. The system should be ready to process such registration in the manner and
the scale that is required.
Upon registration, ID Issuer issues identifier codes for each economic operator, including
identifier codes for facilities, factories, warehouses, local depots and individual machines.
Part 2: Supply unique identifiers for unit packs
ID Issuer develops a system which sets out, for example, how the unique identifiers would be
ordered / issued and how the payments would be made.
ID Issuer releases specifications to the manufacturers. All economic operators then have to
make adjustments to their own systems to make them compatible with the specifications set
out by each of the 28 ID Issuers. The specifications must be clear and sufficiently detailed so
that al economic operators interpret the requirements in the same way.
The systems of the ID Issuer and the manufacturer go through a process of integration and
testing to ensure that the interface between all the systems functions correctly. Multiple systems
need to be interfaced, including that of the ID Issuer, Router, Primary Repository and
Secondary Repository. For example, an ID Issuer transmits the unit level identifier codes via
the Router to the Primary Repository of the requesting manufacturer or importer. The ID Issuer
also needs to submit the data that they receive to the Secondary Repository. Given the cross-
border nature of the supply chain, this process is likely to involve multiple Member States. For
example, a pack wil have a code issued by the Polish ID Issuer if it was manufactured in
Poland. However, authorities in other Member States need to be able to check that the Polish
code is valid. This verification can only be done through the Secondary Repository.
There are approximately 900,000 economic operators operating in the EU that need to be registered.
Because of the sheer number of registrations that need to be completed, even if al ID Issuers are ful y
operational by 6 May 2019 (which is the applicable deadline under Article 3(1) of the IR), it would still
be extremely difficult, if not impossible, to have al economic operators registered in time for the system
2019. Further, our experience shows that testing interfaces between the systems
and making any necessary adjustments take approximately two months. In light of the above, in
2019,
available for registration by economic operators as soon as possible.
Further, we note that there are some discrepancies between the self-reported status of the Member
with the Member States.
Notwithstanding the urgency in ensuring that the ID Issuers are operational, as of 23 April 2019,
only two Member States Croatia and Germany have ID Issuers that have been duly
appointed and have been confirmed to be ful y operational through testing.
Most Member States have indicated that they have appointed ID Issuers. However, we
estimate that only a handful of Member States wil have ID Issuers that wil be in the position to
issue codes by 6 May 2019. For example, we estimate that only the ID Issuers for Belgium,
Czech Republic, Denmark, Ireland, Italy, Latvia, Lithuania, Luxembourg and Netherlands may
be ful y operational by 20 May 2019.
Some Member States have indicated that they have appointed ID Issuers but, given the
progress made to date and the steps that still need to be completed in order to become ful y
operational, it is unlikely that they wil have an ID Issuer that is ful y operational by 6 May
2019. Member States that fal into this category are Austria, Bulgaria, Hungary, UK, Malta,
Spain, Cyprus, France, Sweden, Greece and Romania.
2
Failure by the Secondary Repository to issue its specifications on time
The Secondary Repository is responsible for providing: (i) the data dictionary, which sets out the
specifications of information describing the contents, format, and structure of a database and the
relationship between its elements (which are used to control access to and manipulation of the
databases common for al Primary and Secondary Repositories); (i ) the list of specifications required
to allow the data exchanges with the Secondary Repository; and (i i) a Router, which is a device
established within the Secondary Repository that transfers data between different components of the
repositories system. Without a Secondary Repository, the traceability system cannot function, even if
al Member State ID Issuers are ful y operational.
Once the Secondary Repository publishes the data dictionary and specifications, all manufacturers and
economic operators need to adjust their systems to comply with those specifications. Building the
solution to the specifications ensures that the entities involved in the supply chain are sending and
receiving correct information that is readable and verifiable across the supply chain, in compliance with
the specification.
The Secondary Repository published its specifications (version 1) on 21 February 2019. Subsequent
updates to its specifications were made on 8 March 2019 (version 1.1) and 29 March 2019 (version
1.2). These updates introduced ambiguities, some of which have still not been clarified. The risk of
such ambiguities is that there could be varying interpretations and approaches by different operators
that could, in turn, undermine the integrity and effectiveness of the traceability system.
Primary Repositories were notified at the meeting of the Subgroup on Traceability and Security Features
on 12 April 2019 that further updates wil be released on 28 April 2019. The expectation is that these
will clarify existing issues, not introduce new ones. However, that remains to be seen.
5 April 2019, fol owing the Subgroup meeting of 12 April 2019,
introduced a new layer of complications. The result is that the tobacco supply chain is now waiting for
the publication of the updated specifications from the Secondary Repository reflecting the latest
changes to the unit pack coding structure. These changes will require significant software changes to
These software updates are
unlikely to be achievable in the remaining timeframe.
Under Article 28(1) of the IR, the final specifications should have been issued by 21 February 2019 and
the repositories system should have been available for testing purposes by 20 March 2019. As
explained above, we are expecting further updates to the specifications on 28 April 2019 and we
understand that the Secondary Repository wil not be made available for testing until 10 May 2019, only
10 days before the
3