Chapter II, Article 6 · Commission Implementing Regulation (EU) 2024/1942

Contents

Article 6eFTI Gates#

1.The eFTI Gates shall ensure, directly or via connection to other eFTI Gates, that:

(a)the authorised requests for access to eFTI data are transmitted to the eFTI platform and contain the specific information requested;

(b)for each such request, the response received from the respective eFTI platform is transmitted to the user application of the competent authority officer responsible for that request, either directly or via an AAP, as applicable; and,

(c)when lodged, the follow-up communication to that request is transmitted to the eFTI platform that contains the eFTI data for which the request had been made and the response provided.

2.An eFTI Gate shall provide the following functionalities:

(a)validate the request for access to eFTI data and, where lodged, follow-up communication, in one of the following ways:

(i)when acting as ‘requesting Gate’, where the AAP is established as a separate component outside of the eFTI Gate, by verifying the security key of the AAP through which the request or follow-up communication was lodged;

(ii)when acting as ‘receiving Gate’, by verifying the security key of the eFTI Gate from which it received the request or follow-up communication;

(iii)when the validation of the security key of the respective eFTI Gate fails, by returning an error message to the ‘requesting Gate’, the AAP or the competent authority officer responsible for the request or follow-up communication, as appropriate;

(b)process the request for access to eFTI data and, where lodged, follow-up communication, by means of the search mechanism in accordance with Article 8 and, on that basis, forward the request or follow-up communication, as applicable:

(i)to the appropriate eFTI platform or eFTI Gate(s), when acting as ‘requesting Gate’;

(ii)to the appropriate eFTI platform, when acting as ‘receiving Gate’;

(c)keep an audit trail of all the requests for access to eFTI data or follow-up communications it has processed, by logging at least the following information:

(i)the unique identification number of the request for access to eFTI data or of the follow-up communication;

(ii)the identifier of the AAP or of the ‘requesting eFTI Gate’ from which it received that request or follow-up communication;

(iii)the date and time it received that request;

(d)validate the response received to a request it processed, as follows:

(i)when receiving the response directly from the eFTI platform, by checking the security key and certification status of the eFTI platform, on the basis of the registry referred to in paragraph 3(e);

(ii)when receiving the response from a ‘receiving eFTI Gate’, by checking the security key of that eFTI Gate on the basis of the registry referred to in paragraph 3(f);

(iii)when the validation of the security key of the respective eFTI Gate or eFTI platform fails, by sending a corresponding error message to the ‘requesting Gate’, the AAP or user application of the competent authority officer responsible for the request, as applicable;

(e)forward the response received to a request it processed through the same route, in reverse sequence, as the forwarded request, as applicable:

(i)to the ‘requesting eFTI Gate’; or

(ii)to the user application of the competent authority officer responsible for that request, directly or via the AAP;

(f)when an acknowledgement of receipt of the request is received but no other response is received within 60 seconds of that acknowledgement, transmit a ‘no response’ message to the ‘requesting Gate’, AAP or user application of the competent authority officer responsible for the request, as appropriate;

(g)keep an audit trail of all the responses to the requests for access it has forwarded, by logging at least the following information:

(i)the UIL of the eFTI data set it received in response to that request;

(ii)the unique identification number of the eFTI platform or ‘receiving eFTI Gate’ from which it received the response;

(iii)the date and time it received that response;

(iv)where no response was received, an indication to that end;

(h)archive and keep available for auditing purposes the logs specified in points (c) and (g), for a period of 2 years or, where national provisions on the availability of evidence for the enforcement of the provisions for which access to eFTI data is required provide for a longer period of time, for that period of time.

3.To enable the functionalities referred to in paragraph 2, an eFTI Gate shall:

(a)use a search mechanism, in accordance with Article 8;

(b)establish and maintain a secure connection to the AAPs that mediate the access to the eFTI exchange environment of the competent authority officers of the Member State that established the respective eFTI Gate;

(c)where the AAPs are established as integrated components to the eFTI Gate, establish and maintain a secure connection to the user application or applications, as applicable, of the competent authority officers of the Member State that established the respective eFTI Gate;

(d)where AAPs are established as separate components to the eFTI Gate, establish and maintain an up-to-date registry containing the unique identification numbers and security certificates of those AAPs;

(e)establish and maintain a secure connection to all the other eFTI Gates, as well as an up-to-date registry containing the unique identification numbers and the security certificates of those eFTI Gates;

(f)establish and maintain a secure connection to all the eFTI platforms that received certification in the Member State or Member States that established the respective eFTI Gate, as well as an up-to-date registry containing the unique identification numbers, security keys and certification status of those eFTI platforms;

(g)be able to use commonly defined services or artefacts, such as configuration, error codes, taxonomies or code lists in the eFTI exchange environment, where these services or artefacts are agreed in the framework of the network of operational support referred to in Article 13.

4.Where no conformity assessment body is accredited in a Member State to certify eFTI platforms in accordance with Article 11 of Regulation (EU) 2020/1056, that Member State shall ensure that its eFTI Gate establishes and maintains the secure connection and up-to-date registry, as referred in paragraph 3(f), for eFTI platforms that received certification from conformity assessment bodies accredited in other Member States. That Member State shall do so upon request from the economic operator or eFTI service provider operating that platform and after having requested and received confirmation from the Member State where the eFTI platform received the certification that it received no other confirmation request for that same eFTI platform from another Member State. That shall relieve the eFTI Gate of the Member State where the eFTI platform received the certification from the obligation to establish and maintain a secure connection to that platform.