Chapter II, Article 4 · Commission Implementing Regulation (EU) 2025/2243

Contents

Article 4Access to eFTI platforms by business users#

1.eFTI platforms shall allow business users to access and process eFTI data by means of one or both of the following modalities:

(a)human-to-machine user interfaces;

(b)machine-to-machine communication via secure connections to other ICT systems that act as tributary ICT systems.

2.For access and processing of eFTI data by means of human-to-machine interfaces, eFTI platforms shall provide functionalities that ensure:

(a)for each onboarded user:

(i)user identification and authentication by electronic identification means issued under an electronic identification scheme complying with the requirements laid down in paragraph 3;

(ii)user authorisation, by means of an authorisation registry referred to in Article 5(1), point (a);

(b)for non-onboarded users, user identification, authentication and authorisation by means of the authorisation mechanism referred to in Article 5(1), point (b).

3.The electronic identification scheme referred to in paragraph 2, point (a)(i), shall comply, as a minimum, with the requirements laid down in Article 8(2), point (b), of Regulation (EU) No 910/2014.For users accessing and processing eFTI data that corresponds to the information requirements referred to in Article 2(1), point (a)(iv), of Regulation (EU) 2020/1056, the electronic identification means referred to in paragraph 2, point (a)(i), of this Article shall include reference to the identification number of the waste shipments operator referred to in Article 9 of Implementing Regulation (EU) 2025/1290.

4.For access and processing of eFTI data by means of machine-to machine communication, eFTI platforms shall provide functionalities that ensure for each tributary ICT system:

(a)the identification and authentication of the business user under whose legal responsibility the tributary ICT system operates, by means of a registry where at least the following information is recorded and kept updated:

(i)identification reference of the business user;

(ii)details of the security key of the tributary ICT system;

(b)the authorisation of the business user under whose legal responsibility the tributary ICT system operates, by means of the authorisation registry referred to in Article 5(1), point (a).

5.eFTI platform operators shall establish and implement measures for the appropriate onboarding of tributary ICT systems that include, as a minimum:

(a)verifying that the tributary ICT system identifies and authenticates the users that are allowed to act as business users of the eFTI platform, by electronic identification means issued under an electronic identification scheme that complies with the requirements laid down in paragraph 3;

(b)verifying that the tributary ICT system controls the access of users that are allowed to act as business users of the eFTI platform, by means of an authorisation registry referred to in Article 5(1), point (a).

6.For each login session, the eFTI platform shall ensure the identification, authentication and authorisation of the business user, before allowing the business user to process eFTI data.

Defined terms · 30

Show every defined term

advanced electronic seal
means an electronic seal that meets the requirements laid down in Article 36 of Regulation (EU) No 910/2014;
advanced electronic signature
means an electronic signature that meets the requirements laid down in Article 26 of Regulation (EU) No 910/2014;
applicable regulatory information requirements
means the regulatory information requirements referred to in Article 2(1) of Regulation (EU) 2020/1056 that apply to a specific consignment movement;
authentication
means an electronic process that enables the confirmation of the electronic identification of a natural or legal person or the confirmation of the origin and integrity of data in electronic form;
business user
means a natural or legal person who constitutes or is authorised to represent an economic operator concerned in accordance with Regulation (EU) 2020/1056, or another economic operator who constitutes a data holder in accordance with paragraph 23, and who processes data on an eFTI platform on behalf of that economic operator concerned or other data holder;
certification mark
means a coded reference to the eFTI platform attesting the validity of its certification status, which should accompany all information made available to competent authorities by means of a certified eFTI platform, in accordance with Article 12(3) of Regulation (EU) 2020/1056;
combined transport details
means the regulatory information referred to in Article 3 of Council Directive 92/106/EEC;
consignment movement
means the transport of a collection of goods by a single own-powered means of transport, with or without transport equipment such as trailer, pallet or container, from the same place of loading or taking over to the same place of unloading or handover, under the terms of a single transport contract;
data holder
means a natural or legal person that has the right or obligation, in accordance with applicable Union law, national legislation, or private contractual agreements to use and make available data that also constitute regulatory information in accordance with the requirements referred to in Article 2(1) of Regulation (EU) 2020/1056;
digital waste shipment system
(DIWASS) means the central system referred to in Article 27(3) of Regulation (EU) 2024/1157;
eFTI CMDS
means a uniquely identified eFTI data set composed of the eFTI data that, together, constitute the regulatory information on freight transport related to a specific consignment movement;
eFTI data
means data corresponding to regulatory information as defined in Article 3(1) of Regulation (EU) 2020/1056;
eFTI Gate
means an ICT component or a set of ICT components performing the functionalities set out in Article 6 of Implementing Regulation (EU) 2024/1942;
eFTI platform operator
means a natural or legal person who is deemed legally responsible for the appropriate functioning of an eFTI platform;
electronic identification means
means a material or immaterial unit containing person identification data and which is used for authentication purposes to access an online service or, where appropriate, an offline service;
electronic identification scheme
means a system for electronic identification under which electronic identification means are issued to natural or legal persons or natural persons representing other natural persons or legal persons;
follow-up communication
means the communication between competent authorities and the economic operators concerned as defined in Article 1, point (6) of Implementing Regulation (EU) 2024/1942;
human-to-machine user interface
means a web or application based graphical user interface that allows natural persons to perform data processing operations on an eFTI platform;
identifiers of the eFTI data subsets
means the identifiers in the format ‘EUyy’ or ‘XXyy’ of the eFTI data subsets established in Sections 3 and 4 of the Annex to Delegated Regulation (EU) 2024/2024;
login session
means a restricted period of time during which a business user is given access to an eFTI platform;
non-onboarded user
means a business user that is allowed to access an eFTI platform based only on temporary access and processing rights, issued in accordance with the requirements established in Article 5(1) point (b);
onboarded user
means a business user for whom the identification, authentication and authorisation has been done in accordance with the requirements established in Article 4(2), point (a);
primary authoriser
means an onboarded business user who is allowed to modify the information recorded in an onboarded user profile, including the setting up or deletion of a user profile;
qualified electronic time stamp
means an electronic time stamp that meets the requirements laid down in Article 42 of Regulation (EU) No 910/2014.
temporary authoriser
means an onboarded business user who is allowed to issue temporary data processing rights to non-onboarded users;
tributary ICT system
means an identifiable ICT system external to an eFTI platform, including another eFTI platform, by means of which business users connect to an eFTI platform to access and process eFTI data;
two-factor authentication
means an identity and access management security method that requires two forms of identification to access an eFTI platform;
unique identification number of the request
means the unique number of a request for access to eFTI data lodged by a competent authority officer, issued and allocated to the request in accordance with Article 3(2), point (c) of Implementing Regulation (EU) 2024/1942;
waste shipment documents
means the documents referred to in Article 9(2), Article 16(1) and Article 18(4) of Regulation (EU) 2024/1157;
waste shipments operator
means an operator as defined in Article 2(2), point (13) of Implementing Regulation (EU) 2025/1290;