ANNEX

Additional technical specifications for the EU Emergency Travel Document

Part I

Pre-requisites, instructions and standards for production (1)

1.

CONTENTS

50

2.

INSTRUCTIONS REGARDING PRODUCERS

50

3.

PHYSICAL SECURITY

50

3.1.

PRODUCTION BUILDINGS

50

3.2.

SECURITY PERSONNEL

50

3.3.

SECURITY CONTROL ROOM

51

3.4.

VISITORS OR THIRD-PARTY ACCESS

51

3.5.

PERSONNEL ACCESS

51

3.6.

PRODUCTION AREA CONTROL

51

3.7.

HANDLING OF INCOMING & OUTGOING MATERIALS

51

3.8.

DELIVERY ASPECTS

51

4.

SECURITY OF PRODUCTION METHODS AND MATERIALS

52

4.1.

PLATES

52

4.2.

PAPER

52

4.3.

DIFFRACTIVE OPTICALLY VARIABLE IMAGE DEVICE

52

4.4.

SECURITY INKS

53

4.5.

STORAGE

53

5.

QUALITY CONTROL

53

6.

REFERENCES

53

1.   CONTENTS

This part of the Annex document sets out the rules for the production of EU Emergency Travel Documents (EU ETD).

This part of the Annex may be provided to potential security printers, for example as part of a tender process.

2.   INSTRUCTIONS REGARDING PRODUCERS

The production of EU ETDs shall only be carried out by public or private security printing houses or institutions, commissioned by the Member States and capable of producing high-security documents.

Such companies or institutions must be able to prove their competence to undertake such production. The producer must have its head office located in the Union and the EU ETD production must also take place in the Union.

The production of EU ETDs must not be outsourced to a third party (this does not apply to the raw materials and components, such as fibres and security paper) unless this is authorised by the Member State issuing the contract for the EU ETD production and notified to the Commission. Third-party companies that undertake part of the production of EU ETDs must also adhere to the security standards and practices listed in this document.

The producer must be certified in accordance with the standard ‘ISO 9001 Quality Management System’ and ISO/IEC 27001 ‘Information security management systems’.

Furthermore, the producer must hold a current ISO 14298 Management of Security Printing Processes Certificate (formerly CWA 14641) certified to at least the level ‘Governmental’ or according to equivalent national regulation.

Producers must supply details of security audit certificates upon request of the Member State.

Member States must ensure that the producers adhere to these rules and must notify the Commission of the company that has been selected to carry out the production.

The producer must report any breach of security regarding EU ETDs, basic materials or the physical security of facilities at the time of production to the Member State, which must inform the Commission without undue delay.

3.   PHYSICAL SECURITY

The requirements set out in this section are additional to ISO 14298 and mandatory when the production of EU ETDs is taking place. They are also applicable to the materials, semi-finished products and storage of EU ETDs.

The physical security of the production premises and buildings must be maintained in accordance with ISO 14298 and Intergraf Certification Requirements (especially Risk Category E ‘Physical intrusion and access related risk’) or equivalent national regulations.

All persons (employees, security personnel, visitors, third parties, etc.) who are present on the premises or in the production buildings of the producer must be controlled in accordance with ISO 14298 Intergraf Certification Requirements or equivalent national regulations.

3.1.   PRODUCTION BUILDINGS

All buildings in which raw material, semi-finished, and finished products are stored and processed must be certified at least as ‘Governmental’ level in accordance with ISO 14298 or equivalent national regulations.

3.2.   SECURITY PERSONNEL

The producer must use a special and separate department or reputable and certified security company and well-trained security personnel to be responsible for the security of the premises and production areas. It is recommended that an external security company be certified with regard to quality aspects (e. g. ISO 9001, DIN 77200).

3.3.   SECURITY CONTROL ROOM

The producer must run a security control room on the production premises. Physical security measures must meet the requirements of EN 50518 (certification is not required) or national regulations/standards. By derogation from the previous sentence, deviations from EN 50518 are possible provided they are based on a risk assessment. The access door to the security control room must be equipped at the entrance and at the exit with a card reader or biometric access control system recording all entrances and exits and be equipped with an anti-pass back function.

A minimum of two operators (guards) are recommended to be present at all time. It is recommended that these operators (guards) be employees of the producer.

3.4.   VISITORS OR THIRD-PARTY ACCESS

Any third party or visitor access to the production areas must be strictly controlled with regard to ISO 14298. Such persons must be accompanied at all times and must always wear their ID badge in a visible manner.

3.5.   PERSONNEL ACCESS

Access to the production areas must be restricted to authorised employees through an access control system working on a strict person-by-person basis. An access control procedure must be in place. It is recommended that access only be given on a need-to-know basis.

3.6.   PRODUCTION AREA CONTROL

The production areas must be controlled at all times. When production areas are not in use, they must be physically locked and monitored.

Should access to such production areas become necessary at non-production times, the security department must be informed and be present during such access. In such cases, it must not be possible to enter production areas without the security department being physically present (separate key(s) holder(s)).

3.7.   HANDLING OF INCOMING & OUTGOING MATERIALS

The producer must have dedicated shipping and delivery areas available for dealing with incoming and outgoing materials and products. All shipping and delivery doors including the perimeter fence gate, intermediate door and the internal shipping and delivery door must operate on an electronic and interlocking basis that implies that, when one of the doors is open, the other(s) are electronically secured.

There must be processes in place for the screening of visitors and drivers of the transport vehicles for such materials. A log must be kept of each delivery of material.

3.8.   DELIVERY ASPECTS

The delivery of EU ETDs must be regulated by the Member State issuing the contract together with the producer. As complete yet non-personalised EU ETDs are considered to be high-risk security items, the transport must be of the highest level possible.

A generic risk assessment must be carried out and documented for each type of transport and any additional security measures assessed to be necessary must be implemented (e.g. armoured vehicle, accompanying vehicle). These assessments must be reviewed whenever there is a change in the relevant circumstances.

All loading and unloading activities – including delivery to the receiving party – must be monitored under dual control, that is, involving two or more persons.

The serial numbers of the EU ETDs being transported must be indicated on the transport papers.

It is recommended that the status and position of vehicles carrying security printing products be checked at regular intervals during transport. There must be at least two independent systems, which ensure effective communication with external partners in the event of any disruption to the transport.

Any irregularity (e.g. the failure of any party involved to meet these minimum transport requirements, an attack on the transport or a loss by any cause during the transport) must be reported to the producing company immediately.

There must be no access to the secure products from inside the drivers cab and the compartment in which the goods are transported must be made from metal and entirely enclosed (no curtain-sided vehicles) with access for loading and un-loading via a locked door. Keys to the locks must not be carried inside the vehicle.

4.   SECURITY OF PRODUCTION METHODS AND MATERIALS

This section sets out the necessary security information regarding the items used for the production of the EU ETD. A full and complete audit trail from the arrival of incoming security materials to the delivery of the EU ETDs, as well as the destruction of unwanted, spoiled material or semi-finished material, must be kept by the producer.

In addition, the choice of and responsibility for suppliers for raw materials lies with the producer and where necessary must also be approved by the relevant Member State. It is recommended that the security raw material suppliers are certified to the same degree as the producers – especially with regard to ISO 14298. Should a supplier be considered by the producer as reputable and reliable (and checked by the producer accordingly) but not be certified, then approval must be obtained from the relevant Member State issuing the contract and the Commission must be notified by the Member State accordingly.

4.1.   PLATES

All printing plates for the EU ETD are recommended to be produced on the premises of the authorised producer where the EU ETD production takes place. Should the printing plates no longer be needed (e.g. due to wear and tear, faults, etc.) they must be rendered unusable and securely destroyed in an appropriate manner.

Any plates that may be needed for further production runs must be stored in a secure area on the company’s premises.

Should the producer be unable to produce the plates on their own premises, then the printing plates necessary may only be ordered from a reputable plate producer, which has, for example, previously produced plates for the EU Visa Sticker. However, such plate producer must be certified according to ISO 14298. Such plates may only be delivered to authorised producers on receipt of authorisation by the Member State. Notification of such must also be sent to the Commission.

4.2.   PAPER

The paper produced for the EU ETD must be strictly controlled. This applies to both the paper manufacturing and the further steps necessary (adding the adhesive backing). All rolls and sheets must undergo a security audit to ensure accountability in the supply chain.

All paper to be delivered to the EU ETD producer must be counted before delivery. The sheets delivered to the producer and used during production must be checked and accounted for.

Secure transport must be used for the delivery of the paper to the producers. A generic risk assessment must be carried out and documented for the transport and any additional security measures assessed to be necessary must be implemented (e.g. armoured vehicle, accompanying vehicle). These assessments must be reviewed whenever there is a change in the relevant circumstances.

4.3.   DIFFRACTIVE OPTICALLY VARIABLE IMAGE DEVICE

The production and use of the Diffractive Optically Variable Image Device (DOVID) for the EU ETD must be subject to a control process and accounted for. This includes not only the full DOVID patches but also semi-finished products and spoiled or waste products.

Delivery of the DOVID patches to the authorised producers must take place using secure transport. The number of DOVID’s to be delivered must be registered.

The DOVID patches to be used at the producers’ premises must also be controlled and accounted for. Any wasted materials must be stored in a secure manner and may be securely destroyed at a later date as appropriate. The patches must be accounted for, so that a full audit trail can be made available if required.

The Commission or a Member State may order the DOVID on an annual basis in the form of a grouped order in order to reduce the price for the individual Member States. Member States are responsible for the contractual and financial arrangements according to the group order. Only notified producers can participate in the grouped order for the DOVID.

4.4.   SECURITY INKS

Security inks are used to produce the EU ETD and the use of such inks is restricted. The inks can be ordered from reputable suppliers, ordered from other EU ETD producers, or produced on the producers’ premises. A producer may deliver such inks to another authorised producer only after having received proof of the latter’s authorisation to produce EU ETDs.

The security inks must be stored in a secure area. An audit process is necessary to keep track of the security inks used in the production process.

4.5.   STORAGE

The materials used in the production of EU ETDs can be categorised as follows:

—	Basic Materials (e.g. inks, security paper)

—	Basic Means (e.g. printing plates)

—	Semi-Finished Products (incomplete Forms and/or Stickers that have not been subject to all production stages)

—	Complete EU ETD – Form and Sticker

Storage and the handling of the product require suitable security, accountability and control at each stage. It is recommended that the storage areas fulfil the requirements of strong rooms (see ISO 14298).

5.   QUALITY CONTROL

Each EU ETD producer may specify, in consultation with the Member State authorising production, which quality controls are recommended to take place at each stage of the production. Those quality controls must ensure that the EU ETDs produced are in accordance with the technical specifications established by Council Directive (EU) 2019/997 and the implementing acts adopted on its basis – so that the quality of the EU ETDs varies as little as possible between production batches.

In the event that EU ETDs have been produced and put into circulation that do not comply with the technical specifications, the Member State concerned must immediately notify other Member States as well as the Commission.

6.   REFERENCES

ISO 14298	Management of security printing processes (former CWA 14641)
EN 50518	Monitoring and alarm receiving centre
ISO 9001	Quality management systems
ISO/IEC 27001	Information Security Management Systems

---

(1)  SECRET UE/EU SECRET non classifiée en l’absence de la partie II de l’annexe/when detached from Part II of the Annex – non-classified.