Chapter II, Article 5 · Commission Implementing Regulation (EU) 2025/2243

Contents

Article 5Authorisation mechanism#

1.eFTI platforms shall use one or both of the following types of authorisation mechanisms:

(a)verification of the processing rights of the user, by means of authorisation registries where the processing rights of onboarded users are recorded, kept updated and remain available for auditing purposes, and which shall constitute the principal mechanism for authorisation;

(b)issuing and verification of temporary processing rights, by means of authorisation registries where temporary access credentials of occasional, non-onboarded users, are recorded.

2.The authorisation registries referred to in paragraph 1 shall be established and maintained as a separate ICT component. This separate ICT component shall be either internal to the eFTI platform or part of an ICT system external to the eFTI platform with which the eFTI platform establishes secure communications, in accordance with Article 12(4).

3.The authorisation registries referred to in paragraph 1, point (a), shall maintain a uniquely identified ‘user profile’ for each onboarded business user, by recording at least the following information:

(a)unique identification of the business user, expressed as a coded reference;

(b)processing rights, expressed as references, where those references include:

(i)references to the processing operations referred to in Article 8;

(ii)period of time for which each of the processing rights referred to in point (b) is granted;

(iii)the coded references of the eFTI data elements or groups of eFTI data elements, as specified in Section 2 of the Annex to Delegated Regulation (EU) 2024/2024, on which each of the processing operations referred to in Article 8 may be performed;

(c)an indication of whether the business user may act as primary or temporary authoriser;

(d)for business users designated as primary authoriser, the unique identification numbers of the existing onboarded user profiles that they are allowed to modify;

(e)for business users designated as temporary authoriser, the temporary processing rights they are entitled to issue to non-onboarded users, expressed as references to the processing operations referred to in Article 8;

(f)an indication of whether the business user may request notifications related to requests for access to eFTI data by competent authorities and related follow-up communications, when related to the eFTI CMDS for which the business user has processing rights.

4.The eFTI platform operator or, where the authorisation registry is established as a component of an ICT system external to the eFTI platform, the operator of the external ICT system, shall take measures to ensure the appropriate onboarding of the business users that may act as ‘primary authoriser’. Those measures shall, as a minimum, consist of:

(a)identification and authentication, in accordance with the requirements laid down in Article 4(2), point (a);

(b)verification of credentials stating that the business user is a data holder or constitutes the legal representative of a data holder, or that the business user is empowered to authorise, on behalf of a data holder, the processing of data in relation to which that data holder has rights or obligations as referred to in Article 1, point (23);

(c)keeping a record of those credentials for auditing purposes.

5.The authorisation mechanism referred to in paragraph 1, point (b), shall include functionalities that comply, as a minimum, with the following specifications:

(a)allow onboarded users with temporary authoriser designation to issue temporary processing rights to non-onboarded users, by recording in a dedicated registry the temporary access credentials of non-onboarded users, containing as a minimum:

(i)contact details that identify the non-onboarded user and where electronic messages can be sent;

(ii)the UUID of the eFTI CMDS to which the non-onboarded user is given temporary processing rights;

(iii)the processing rights given to the non-onboarded user, expressed as references to the processing operations referred to in Article 8;

(iv)the precise period of time within which those processing rights are valid;

(b)allow the onboarded users with temporary authoriser designation to give temporary access to eFTI data to the non-onboarded users for whom they recorded temporary access credentials by sending, using the recorded contact details of the non-onboarded user, a message containing:

(i)an access link to the eFTI platform;

(ii)the UUID of each eFTI CMDS to which the non-onboarded user is given temporary processing rights;

(c)when access to the eFTI platform is requested by a non-onboarded user, give the non-onboarded user access to the eFTI platform based on two-factor authentication, and allow them to perform processing operations based on their processing rights recorded in accordance with point (a);

(d)terminate the login session of a non-onboarded user as soon as one of the following events occur:

(i)the user acknowledges completion of the data processing session;

(ii)the period of time referred to in point (a)(iv) expires.

6.The information recorded in the authorisation registries in accordance with paragraphs 1 to 5 shall be retained for auditing purposes, as a minimum, for the same period of time for which the eFTI CMDS, on which the respective users performed processing operations, is required to be kept available, in accordance with the applicable national or Union law, pursuant to Article 9(1), point (i), of Regulation (EU) 2020/1056.

7.eFTI platforms shall delete all information that constitute personal data in accordance with Regulation (EU) 2016/679 within a reasonable time after the expiration of the period referred to in paragraph 6.

Defined terms · 30

Show every defined term

advanced electronic seal
means an electronic seal that meets the requirements laid down in Article 36 of Regulation (EU) No 910/2014;
advanced electronic signature
means an electronic signature that meets the requirements laid down in Article 26 of Regulation (EU) No 910/2014;
applicable regulatory information requirements
means the regulatory information requirements referred to in Article 2(1) of Regulation (EU) 2020/1056 that apply to a specific consignment movement;
authentication
means an electronic process that enables the confirmation of the electronic identification of a natural or legal person or the confirmation of the origin and integrity of data in electronic form;
business user
means a natural or legal person who constitutes or is authorised to represent an economic operator concerned in accordance with Regulation (EU) 2020/1056, or another economic operator who constitutes a data holder in accordance with paragraph 23, and who processes data on an eFTI platform on behalf of that economic operator concerned or other data holder;
certification mark
means a coded reference to the eFTI platform attesting the validity of its certification status, which should accompany all information made available to competent authorities by means of a certified eFTI platform, in accordance with Article 12(3) of Regulation (EU) 2020/1056;
combined transport details
means the regulatory information referred to in Article 3 of Council Directive 92/106/EEC;
consignment movement
means the transport of a collection of goods by a single own-powered means of transport, with or without transport equipment such as trailer, pallet or container, from the same place of loading or taking over to the same place of unloading or handover, under the terms of a single transport contract;
data holder
means a natural or legal person that has the right or obligation, in accordance with applicable Union law, national legislation, or private contractual agreements to use and make available data that also constitute regulatory information in accordance with the requirements referred to in Article 2(1) of Regulation (EU) 2020/1056;
digital waste shipment system
(DIWASS) means the central system referred to in Article 27(3) of Regulation (EU) 2024/1157;
eFTI CMDS
means a uniquely identified eFTI data set composed of the eFTI data that, together, constitute the regulatory information on freight transport related to a specific consignment movement;
eFTI data
means data corresponding to regulatory information as defined in Article 3(1) of Regulation (EU) 2020/1056;
eFTI Gate
means an ICT component or a set of ICT components performing the functionalities set out in Article 6 of Implementing Regulation (EU) 2024/1942;
eFTI platform operator
means a natural or legal person who is deemed legally responsible for the appropriate functioning of an eFTI platform;
electronic identification means
means a material or immaterial unit containing person identification data and which is used for authentication purposes to access an online service or, where appropriate, an offline service;
electronic identification scheme
means a system for electronic identification under which electronic identification means are issued to natural or legal persons or natural persons representing other natural persons or legal persons;
follow-up communication
means the communication between competent authorities and the economic operators concerned as defined in Article 1, point (6) of Implementing Regulation (EU) 2024/1942;
human-to-machine user interface
means a web or application based graphical user interface that allows natural persons to perform data processing operations on an eFTI platform;
identifiers of the eFTI data subsets
means the identifiers in the format ‘EUyy’ or ‘XXyy’ of the eFTI data subsets established in Sections 3 and 4 of the Annex to Delegated Regulation (EU) 2024/2024;
login session
means a restricted period of time during which a business user is given access to an eFTI platform;
non-onboarded user
means a business user that is allowed to access an eFTI platform based only on temporary access and processing rights, issued in accordance with the requirements established in Article 5(1) point (b);
onboarded user
means a business user for whom the identification, authentication and authorisation has been done in accordance with the requirements established in Article 4(2), point (a);
primary authoriser
means an onboarded business user who is allowed to modify the information recorded in an onboarded user profile, including the setting up or deletion of a user profile;
qualified electronic time stamp
means an electronic time stamp that meets the requirements laid down in Article 42 of Regulation (EU) No 910/2014.
temporary authoriser
means an onboarded business user who is allowed to issue temporary data processing rights to non-onboarded users;
tributary ICT system
means an identifiable ICT system external to an eFTI platform, including another eFTI platform, by means of which business users connect to an eFTI platform to access and process eFTI data;
two-factor authentication
means an identity and access management security method that requires two forms of identification to access an eFTI platform;
unique identification number of the request
means the unique number of a request for access to eFTI data lodged by a competent authority officer, issued and allocated to the request in accordance with Article 3(2), point (c) of Implementing Regulation (EU) 2024/1942;
waste shipment documents
means the documents referred to in Article 9(2), Article 16(1) and Article 18(4) of Regulation (EU) 2024/1157;
waste shipments operator
means an operator as defined in Article 2(2), point (13) of Implementing Regulation (EU) 2025/1290;