Analyzing the legislative foundations, operational responsibilities, and cross-border coordination behind Europe’s new border system
WASHINGTON, DC, November 29, 2025
As the European Union moves from ink stamps to biometric databases, the Entry/Exit System, known as EES, is becoming one of the most significant legal and technical projects in European border governance. Behind the cameras, fingerprint scanners, and automated gates sits a layered legal framework that aims to reconcile several demands at once: securing external borders, preserving lawful mobility, protecting personal data, and enabling cross-border law enforcement cooperation.
At the core of that framework are a series of EU regulations adopted over the last decade, including Regulation (EU) 2017/2226 establishing the EES, amendments to the Schengen Borders Code, and the 2019 interoperability regulations that link EES with other large-scale databases. Together, these instruments define who is recorded, which authorities can access the system, how long data can be kept, and under what safeguards it can be used.
For governments, carriers, and travelers, the system represents a shift from fragmented records to a single digital history of border crossings. For advisory firms working on residency, citizenship planning, and banking passport strategies, including Amicus International Consulting, it is reshaping how compliance and identity risk must be understood in Europe and in emerging markets that depend on access to European hubs.
Regulation 2017/2226: Building A Legal Basis For Digital Borders
The legal architecture of EES begins with Regulation (EU) 2017/2226, adopted in 2017. That regulation creates an automated system for registering the entry and exit of non-EU nationals admitted for short stays of up to 90 days within any 180 days in the Schengen area. It replaces manual passport stamping with electronic records that combine biographic data, document details, and biometrics, such as facial images and fingerprints.
The regulation defines several specific objectives. It seeks to:
- improve the effectiveness and efficiency of controls at external borders
• help detect overstayers by providing an accurate calculation of days spent in the Schengen area
• strengthen the fight against document fraud and identity abuse
• provide reliable statistics on cross-border movements for migration and security policy
To achieve these goals, the law specifies precisely which data must be stored, such as the traveler’s name, nationality, travel document number, type of border crossing point, date and time of entry or exit, and, in many cases, biometric identifiers. It also sets maximum retention periods, distinguishing among compliant travelers, known overstayers, and individuals whose records are relevant to law enforcement.
Crucially, EES is not a free-standing initiative. The regulation amends other instruments in the EU border and visa framework, including the Schengen Borders Code and the rules governing the Visa Information System. This approach integrates EES into an existing legal ecosystem rather than creating an isolated database.
The Schengen Borders Code: Embedding EES In Daily Practice
While Regulation 2017/2226 creates EES, the Schengen Borders Code remains the primary text governing how border checks are carried out. It sets out general principles for crossing external borders, obligations on border guards, and conditions for entry and refusal.
Amendments linked to EES clarify that checks on non-EU nationals for short stays must include consultation of the new system once it is fully operational. Manual passport stamping will be phased out as electronic records become the legal reference point for determining lawful stay. At the same time, the Code confirms that border checks must continue to be applied in a proportionate and non-discriminatory manner, and that even when automated gates and kiosks are used, human officers retain responsibility for the final decision.
In legal terms, this means that EES cannot be viewed solely as an IT upgrade. It is a change in the way legal obligations are implemented at the frontier. Officers must use EES consistently with the Code’s rules on refusal of entry, protection of vulnerable persons, and respect for fundamental rights.
Interoperability: Connecting EES To The Wider Information Landscape
In 2019, the EU adopted two interoperability regulations that extend the architecture beyond EES itself. One regulation covers systems in the field of borders and visas, including EES, the Visa Information System, and the Schengen Information System. The other covers systems in policing, asylum, and migration.
These laws establish shared components such as:
- a common identity repository that consolidates identity data from several systems
• a shared biometric matching service that can compare fingerprints and facial images across databases
• a multiple identity detector that highlights cases where one person appears under different identities
The stated goal is to close information gaps that might otherwise allow individuals to use multiple identities or exploit inconsistencies between systems. Authorities can, under regulated conditions, perform cross-system searches that would previously have required several separate checks.
From a compliance and rights perspective, this raises important questions. EU law is built on principles such as purpose limitation and data minimisation. Collecting data for border management does not automatically permit its use for unrelated aims. The interoperability regulations, therefore, include detailed provisions on permitted purposes, categories of authorities that may access each component, logging and audit trails, and independent supervision.
Institutional Responsibilities: Member States, EU-LISA, and Oversight Bodies
The legal framework divides responsibilities among several actors.
Eu LISA, the EU agency for large-scale IT systems, is tasked with the technical and operational management of the central EES infrastructure. It must ensure that the system is secure, available, and interoperable with national systems and other EU databases. The agency also provides support to Member States during the rollout and manages the shared components created by the interoperability regulations.
Member States remain responsible for the national interfaces and for the frontline use of EES. Their border guard services, consulates, and immigration authorities collect data at crossing points, create or update records, and consult the system when making decisions on entry or exit. National laws and administrative guidelines specify which agencies may access EES, how staff must be trained, and how compliance with EU-level rules is monitored domestically.
The European Commission oversees implementation and may adopt implementing and delegated acts to refine technical aspects, such as the functioning of web services used by travelers or carriers to verify their remaining authorized stay.
Data protection authorities and the European Data Protection Supervisor supervise compliance with data protection obligations. They have the power to conduct inspections, issue guidance, and, if needed, impose corrective measures. Fundamental rights bodies, such as the EU Agency for Fundamental Rights, provide additional expertise on implementing EES in a way that respects the EU Charter of Fundamental Rights.
Case Study 1: A Composite Cross-Border Overstay Investigation
A composite scenario, drawn from publicly documented practices and official guidance, illustrates how this legal architecture plays out in practice.
A consultant from an emerging market state travels frequently to the Schengen area for short projects across several countries. Before EES, border guards relied on manual passport stamps to determine whether the traveler complied with the 90-day limit within any 180 days. Stamps could be hard to read, and it was difficult to calculate the total days across several trips.
After EES becomes operational, each entry and exit is recorded centrally. When the consultant arrives at a major hub airport, the border officer scans the passport and retrieves the EES record. The system displays a calculated total of days spent in the Schengen area over the relevant 180-day window.
The officer sees that the consultant has already accumulated 85 days. The planned two-week visit would clearly exceed the authorised limit. Under the Schengen Borders Code, the officer must assess conditions of entry, including respect for stay limits. The legal framework requires that the consultant be informed of the situation and allowed to clarify the intended duration of stay.
If the traveler cannot adjust the itinerary, the officer may refuse entry or authorise a shorter stay. Any decision must be recorded and justified. EES provides the factual evidence of previous crossings, while national administrative law and EU rules on free movement and procedural rights govern the decision-making process.
Advisory firms like Amicus International Consulting, which specialise in cross-border compliance, report that such scenarios are increasingly common topics of planning conversations. Clients who rely on frequent travel to Europe want to structure their movements to respect EES calculations while maintaining business continuity.
Data Protection, Retention, And Rights Of Travelers
The EES Regulation includes a detailed chapter on data protection and retention. Data categories are strictly defined, and retention periods differ depending on whether a person leaves on time or becomes an overstayer. For compliant travelers, data is kept for a limited number of years from the last exit. For known overstayers or individuals linked to serious crime investigations, retention may be longer, subject to conditions.
These rules must be applied in conjunction with the EU’s general data protection law and the specific directive applicable to police and criminal justice authorities. Principles such as lawfulness, fairness, transparency, and proportionality apply. In practice, this means that:
- Only data strictly necessary for the defined purposes may be collected
• Access must be restricted to authorised personnel who need it for specific tasks
• Travelers must be informed in clear language about data processing
• Individuals have the right to access their records and request correction of inaccuracies
Supervisory authorities have already issued guidance reminding border and migration services that biometric collection and automated processing do not remove obligations to treat people fairly and with respect. For example, children and vulnerable adults require particular care, and systems must be designed with accessibility in mind.
Civil society organisations and academic commentators point to long-term questions such as the risk of function creep, in which data initially collected for border control is gradually used for broader surveillance, and the possibility that algorithmic tools might reproduce or reinforce discriminatory patterns. The legal framework anticipates some of these concerns by specifying purposes and safeguards, but how effectively those protections work will depend on implementation, oversight, and case law.
Case Study 2: Interoperability In A Human Smuggling Investigation
A second composite case highlights the interaction between EES and the interoperability regulations in a law enforcement context.
Police in one Member State are investigating a suspected organiser of human smuggling. Intelligence suggests that the organiser uses multiple aliases and travels frequently under different documents. Under pre-interoperability arrangements, investigators might need to search each database separately, including EES, the Visa Information System, and national criminal records.
Under the 2019 interoperability framework, and within the limits set by law, investigators can request a search through the central identity repository and shared biometric matching service. If the same set of fingerprints or a similar facial image appears under several names in different systems, the tools can flag potential multiple identities.
The legal basis for such a search lies not only in the interoperability regulations but also in the specific provisions of the EES Regulation that allow law enforcement access for the prevention, detection, or investigation of serious crime and terrorism. Requests must be justified, recorded, and subject to ex post review.
In this scenario, a hit in the shared biometric service does not automatically prove wrongdoing. Still, it directs investigators toward a set of records that may belong to the same individual. Further checks, including cross-referencing travel dates, visa applications, and other evidence, are required. Courts remain responsible for assessing whether the underlying investigation respects procedural safeguards and fundamental rights.
Operational Governance And National Implementation
Beyond EU-level legislation, each participating state must transpose and operationalise EES through its own legal and administrative measures. This includes:
- designating which ministries and agencies are competent to use EES
• adopting national data protection frameworks that align with EU obligations
• budgeting for infrastructure such as kiosks, biometric scanners, and secure networks
• establishing complaint procedures for travelers who believe their data has been misused
Parliamentary debates in several Member States have focused on the risk of longer processing times, particularly at busy land crossings, and the balance between security objectives and privacy. Transport operators, such as ferry companies and cross-channel rail services, have also underlined the need for clear rules on how they must verify that passengers meet entry conditions, including the use of web-based tools linked to EES.
National courts and the Court of Justice of the European Union are expected to play a central role as disputes arise. Questions may include whether specific uses of EES data exceed the purposes defined in the regulation, whether retention periods are applied correctly, and how errors in records should be corrected. Early case law in related areas suggests that judges will scrutinize the proportionality and transparency of large-scale data processing.
Implications For Emerging Markets And Cross-Border Compliance
For travelers and businesses in emerging markets, EES changes the practical landscape of access to Europe. Entrepreneurs, investors, and professionals who rely on frequent short visits must now assume that their travel history will be calculated automatically and shared among Member States.
This has several implications:
- Travel schedules should be planned with explicit reference to the 90-day rule in the 180-day rule, using realistic assumptions about future trips
• Individuals with complex mobility patterns may need professional advice to understand how EES interacts with tax, labour, and immigration law
• Companies that move staff frequently in and out of Europe must adjust their internal compliance processes and HR planning
From the perspective of Amicus International Consulting, which provides professional services in cross-border residency, citizenship strategy, and banking passport planning, EES is now a central factor in long-term mobility design. For clients considering second citizenship or alternative residency options, understanding how European border systems handle data and compliance is as important as understanding visa policies or tax treaties.
In particular, clients from emerging markets who combine European access with banking and corporate structures in other jurisdictions need to align their travel patterns with broader transparency frameworks, including anti-money laundering rules and automatic exchange of financial information. The same digital identity that appears at the border can be relevant for bank KYC procedures, sanctions screening, and other checks.
Future Developments: ETIAS, Litigation, And Possible Reform
EES is only one component of Europe’s evolving digital border. The European Travel Information and Authorisation System, ETIAS, is scheduled to add an advanced screening layer for many visa-exempt travelers. ETIAS will rely in part on data accessible through EES and other systems to assess applications and detect potential risks before a person boards a plane or ship.
Legal observers expect several trends in the coming years:
- consolidation of practice, as Member States gain experience and refine procedures
• increased transparency, as official information campaigns and guidance materials expand
• strategic litigation from individuals and advocacy groups, testing the limits of data collection and access
• continued technical development of biometric matching and risk analysis tools, with corresponding adjustments to legal safeguards
Suppose courts find that certain aspects of EES implementation are disproportionate or insufficiently transparent. In that case, legislators may face pressure to amend retention periods, tighten rules on law enforcement access, or strengthen remedies for individuals. Conversely, high-profile security incidents or migration crises could prompt calls for broader use of the system.
Balancing Compliance, Control, And Rights
The Entry/Exit System illustrates how border management has become a field where legal design, technology, and politics intersect. Regulations, oversight bodies, and judicial review form the architecture around servers, cables, and biometric devices. The system seeks to deliver more accurate enforcement of stay limits, a more coherent response to identity fraud, and richer information for policymakers, while maintaining compliance with the EU Charter of Fundamental Rights and data protection law.
Whether EES ultimately achieves a sustainable balance between compliance and control will depend less on the technical specifications than on governance: how strictly access rules are enforced, how seriously redress mechanisms are treated, and how open authorities are to scrutiny and reform.
For governments, carriers, and travelers, understanding the legal foundations of EES is no longer optional. For professional advisory firms such as Amicus International Consulting, legal architecture is now a core part of how cross-border mobility, financial privacy, and global identity planning are explained to clients navigating Europe’s increasingly digital border while maintaining lawful, transparent, and resilient global strategies.
Contact Information
Phone: +1 (604) 200-5402
Signal: 604-353-4942
Telegram: 604-353-4942
Email: info@amicusint.ca
Website: www.amicusint.ca
