Analyzing the legislative foundations, operational responsibilities, and cross-border coordination behind Europe’s new border system
WASHINGTON, DC, November 29, 2025
As the European Union moves from traditional passport stamps to biometrics and real-time databases, the Entry/Exit System (EES) is emerging as one of the most consequential legal and technical projects in European border governance. Behind the cameras, fingerprint scanners, and automated gates lies a dense legal framework that seeks to reconcile competing priorities: securing external borders, safeguarding free movement within the Schengen area, protecting personal data, and enabling cross-border law enforcement cooperation.
At the center of that framework is a series of regulations adopted over the past decade, notably Regulation (EU) 2017/2226 establishing the EES, amendments to the Schengen Borders Code in Regulation (EU) 2016/399, and the interoperability regulations adopted in 2019. Together, they define who is recorded, how long data is kept, which authorities may consult the system, and under what conditions information can be shared across borders.
Building A Legal Foundation For A Digital Border
The EES Regulation adopted in November 2017 provides the core legal basis for the new system. It establishes an automated database to register entry and exit data, as well as refusal of entry records, for third-country nationals crossing the external borders of the Schengen states for short stays. The Regulation sets out detailed rules on the information to be stored, including biographical data, travel document details, biometric identifiers, and the date and place of each crossing.
In parallel, the Schengen Borders Code was amended to embed EES into the rules that govern the movement of persons across EU external borders. Those amendments clarify that border checks on non-EU nationals for short stays must include consulting the new database once operational. That manual passport stamping will be gradually replaced by electronic recording. The Schengen Borders Code also continues to regulate core concepts, including refusal of entry, carrier obligations, and the requirement that each person crossing an external border undergo appropriate checks.
These legislative instruments sit within the broader Area of Freedom, Security and Justice, where EU law must consistently balance internal security with rights to free movement and privacy. As a result, the legal architecture of EES is highly prescriptive. It does not simply authorize a new technology in broad terms. Instead, it defines the precise purposes for which the system can be used, the categories of data involved, the authorities entitled to access the database, and the safeguards that must accompany each stage of processing.
Key Regulations And Interlocking Legal Duties
Regulation (EU) 2017/2226 sets out several specific objectives. It aims to improve the effectiveness and efficiency of external border controls, detect overstayers, strengthen efforts to combat identity fraud, and produce reliable statistics on border crossings. To achieve these aims, it mandates the registration of all entries and exits of third-country nationals admitted to the Schengen area for short stays, whether or not they require a visa.
The Regulation also amends earlier legal instruments, including the convention implementing the Schengen Agreement, the Visa Information System Regulation, and the decision establishing EU-LISA, the agency responsible for operating large-scale justice and home affairs systems. Through these amendments, the law connects EES to pre-existing information systems and clarifies the flow of data between them.
In 2019, the EU adopted two interoperability regulations that further reshape the legal landscape. One covers systems in the field of borders and visas, such as EES, the Visa Information System, and the Schengen Information System. The other covers systems in policing and migration, including Eurodac and criminal records databases. Together, they establish a common identity repository and a shared biometric matching service, designed to prevent multiple identities and to enable cross-system searches when strictly justified by law.
These measures have far-reaching implications. By allowing authorities to query multiple databases simultaneously, they promise faster detection of persons who may pose security or migration risks. At the same time, they challenge traditional data protection principles, such as purpose limitation, which requires that personal data collected for one objective not be repurposed for another. The legal architecture, therefore, includes additional safeguards, access conditions, and logging obligations to maintain compliance with the EU Charter of Fundamental Rights and general data protection law.
Institutional Roles: Member States, EU LISA, and EU Agencies
EES is formally a centralised system with shared responsibilities. The Regulation assigns the operational management of the central database and its technical infrastructure to EU LISA, the European agency responsible for running large-scale IT systems in the area of freedom, security, and justice. Eu LISA must ensure that the system is available, secure, and interoperable across participating states, and must implement technical and organisational measures to protect the data it hosts.
Member States retain responsibility for operating EES at their borders. National border guard authorities, immigration services, and consulates collect data at crossing points, create or update records, and consult the system before making decisions on entry, refusal, or subsequent administrative action. They are also responsible for the security of their national interfaces and for training staff to use the system in accordance with legal requirements.
Other actors play defined roles. The European Commission is responsible for adopting, implementing, and delegating acts that specify technical details, such as the conditions for using web-based tools that allow travelers to check their remaining authorised stay. Frontex, the European Border and Coast Guard Agency, contributes to risk analysis and may support Member States with training and operational deployment. Data protection authorities at the national level, along with the European Data Protection Supervisor, are tasked with supervising the processing of personal data and ensuring that fundamental rights are respected.
The Regulation also foresees law enforcement access to EES under strictly regulated conditions. Police and judicial authorities may consult the database to prevent, detect, or investigate serious crime and terrorism, but only when specific criteria are met. This reflects a broader EU trend in which information systems initially designed for migration and border management are gradually opened to policing purposes, a development that legal scholars and civil society have closely examined.
The Schengen Borders Code And Frontline Responsibilities
While the EES Regulation defines the system itself, the Schengen Borders Code remains the reference text for daily practice at external borders. It outlines the basic obligations of border guards, including the requirement to conduct thorough checks on third-country nationals at entry and exit, verify travel documents, and ensure that persons meet the conditions for short stays.
After its amendment in connection with EES, the Code clarifies how automated technologies and e-gates can be used. It stresses that even when computerized systems assist border checks, officials retain responsibility for the final decision and must be able to override technology in the event of doubt. The law also seeks to ensure that checks remain harmonised across external borders and that the deployment of self-service kiosks or new devices does not dilute overall security.
In this structure, border guards become both users and guardians of a complex digital architecture. Their responsibilities now include not only the traditional tasks of verifying documents and interviewing travelers, but also ensuring that biometric capture equipment is used correctly, that anomalies flagged by the system are interpreted appropriately, and that travelers are informed of their rights concerning data processing.
Data Protection, Retention, And Fundamental Rights
Central to the legal architecture of EES are provisions on data protection and retention. The Regulation specifies which elements of personal data are collected. It sets maximum storage periods, generally limited to three years from the date of exit for persons who comply with the rules, with longer retention possible for known overstayers and in particular cases related to law enforcement.
These rules must be read alongside general EU data protection law and the specific rules that apply to police and criminal justice authorities. The principle of proportionality is key. Legislators have had to justify why large-scale data collection on millions of travelers who are not suspected of wrongdoing is considered necessary and proportionate to the stated objectives of border control and security.
Independent oversight is built into the system. National data protection authorities monitor compliance in each participating state, while the European Data Protection Supervisor oversees the activities of EU LISA and other EU-level bodies. Recent statements from supervisory authorities have emphasised that travelers must be adequately informed about how their data is collected, how long it is retained, their rights to access or rectify records, and how to lodge complaints.
Fundamental rights institutions, including the EU Agency for Fundamental Rights, have also issued guidance to border authorities on implementing EES in ways that respect human dignity, prevent discrimination, and take into account the needs of vulnerable groups. Researchers and civil society organisations continue to warn of potential risks, including the possibility that data gathered for border management could be repurposed for broader surveillance, or that errors in biometric matching could have serious consequences for individuals.
Case Study: A Cross-Border Overstay Investigation Under The New Rules
A hypothetical yet realistic scenario illustrates how the legal architecture of EES operates in practice when addressing overstays.
A third-country national based in a rapidly growing emerging market has been traveling regularly to several Schengen states for short-term consultancy work. Under the pre-EES regime, border officers at different airports relied on manual passport stamps and verbal explanations to assess whether a traveler had complied with the 90-day limit within the 1180 days.
Once EES is fully operational, each entry and exit is recorded in the central system. At a later point, migration authorities in one Member State initiate a compliance review after statistical analysis reveals an increase in non-documented work in specific sectors. Using their access rights under the EES Regulation, they query the database for patterns involving frequent business visitors in a particular category.
The traveler’s record indicates several stays that cumulatively exceed the authorised duration. The authorities can see not only the dates and locations of crossings, but also that the traveler has used different points of entry and exit over time. Under national law, the authorities can initiate administrative proceedings and, if appropriate, impose sanctions such as a fine or an entry ban for a limited period.
Crucially, the legal framework requires that any such action be grounded in accurate data and that the individual be notified of the reasons for the decision, with access to appeal mechanisms. EES provides the factual basis, but the Schengen Borders Code and national administrative law govern the procedures for refusal, penalties, and redress.
In this kind of scenario, consulting firms that provide cross-border compliance advice, including Amicus International Consulting, report that clients increasingly seek detailed planning support. For globally mobile professionals and entrepreneurs, understanding how the EES calculation of authorised stay interacts with national labour, tax, and immigration rules has become a central element of risk management.
Interoperability, Law Enforcement Access, And Identity Control
A second composite case highlights how the interoperability regulations can influence a law enforcement investigation.
Consider a situation in which police in one Member State are investigating a suspected organiser of human smuggling. The person is believed to operate across several countries using different aliases and travel documents. Under previous arrangements, information about visa applications, border crossings, and law enforcement alerts might have been stored in separate systems, with limited cross-referencing capabilities.
With interoperability in place, investigators can, under defined legal conditions, request that a central identity repository perform a search for linked biometric profiles across multiple systems. If the same set of fingerprints or facial image appears under different names in EES, the Visa Information System, or other databases, the system can generate a hit. That hit does not automatically prove criminal activity, but it provides a decisive lead for further investigation.
Here, the law plays a double role. On the one hand, it explicitly authorises such cross-system searches when necessary to combat serious crime or terrorism, subject to prior checks, record-keeping, and supervisory approval. On the other hand, it seeks to prevent fishing expeditions by requiring that requests be specific, proportionate, and related to concrete cases. National and European courts remain available to review the legality of data access in individual cases and to provide remedies if rights are violated.
Operational Governance And National Implementing Measures
The legal architecture of EES extends beyond EU-level regulations. Each participating state must adopt or adapt national laws, regulations, and administrative guidelines to operationalise the system at its borders and consulates. These implementing measures address questions such as the designation of competent authorities, the allocation of infrastructure funding, and the procedures for staff training and informing travelers.
In some states, parliaments have debated the balance between the desire for stronger border control and concerns about privacy or the risk of delays at land crossings. Agreements with transport operators, such as ferry companies and railway services, also have a legal dimension. Carriers must verify that passengers meet entry requirements and may face financial penalties if they transport persons who are refused entry.
As the rollout of EES continues, the interaction between EU-level rules and national law is likely to generate litigation and requests for guidance from the Court of Justice of the European Union. Questions may arise over the interpretation of access conditions, the proportionality of data retention, or the compatibility of EES practices with fundamental rights. The legal architecture has been carefully crafted, but its practical application will be tested in the courts.
CCross-BorderCoordination And International Partners
Although EES is an internal EU project, its legal and operational implications are felt far beyond Europe’s borders. Non-EU states whose nationals travel frequently to the Schengen area must adjust their own information campaigns and advisory practices. Airlines, shipping companies, and international coach operators based in third countries must understand how EES affects their obligations when transporting passengers to European destinations.
For emerging markets with significant business, education, and tourism links to Europe, EES has become part of the broader global mobility conversation. Travelers who previously relied on flexible, short-notice trips may now need to plan more carefully to avoid overstaying their visas. Governments may receive questions from citizens surprised by new requirements grounded in EU law but with practical consequences abroad.
Advisory firms such as Amicus International Consulting, which work with clients on second citizenship, alternative residency, and banking passport strategies, report that clients increasingly want to understand how European border digitisation interacts with global identity planning. While EES does not itself change nationality, it does influence how identity documents are verified, how travel histories are recorded, and how authorities assess compliance with stay limits.
Compliance, Transparency, And The Role Of Advisory Services
From a compliance perspective, EES creates both challenges and opportunities. On the one hand, it reduces the scope for ambiguity about how long a person has spent in the Schengen area. On the other hand, it requires travelers and businesses to be more proactive in managing travel schedules and documentation.
Transparency is therefore a critical theme. Official EU information portals now include explanations of EES, its legal basis, and travelers ‘ rights. Data protection authorities publish guidance on how individuals can exercise their rights of access and rectification. Fundamental rights bodies provide practical recommendations to ensure that biometric data collection is carried out fairly and without discrimination.
Specialised advisory firms operating in this space provide an additional layer of interpretation. They explain to clients how EES fits into the broader compliance ecosystem, including anti-money laundering rules, sanctions regimes, and tax reporting obligations. For clients using complex cross-border structures, such as multiple residencies or corporate entities in different jurisdictions, advice increasingly includes an assessment of how biometric border systems may influence travel patterns, banking relationships, and long-term relocation planning.
Looking Ahead: ETIAS, Litigation, And Possible Reform
EES is only one part of Europe’s emerging digital border. The European Travel Information and Authorisation System, ETIAS, will introduce an advanced screening layer for many visa-exempt travelers, requiring them to obtain electronic authorisation before departure. ETIAS will rely in part on data stored in EES and other systems, further deepening the role of large-scale databases in border decision-making.
Legal observers expect that the coming years will bring a mix of consolidation and challenge. On one side, authorities will seek to stabilise operations, reduce queues, and refine procedures in light of experience. On the other side, individuals and civil society organisations may bring cases to national and European courts, testing whether the implementation of EES respects the principles set out in EU law and the Charter of Fundamental Rights.
Issues likely to feature in future litigation include the proportionality of mass data collection, the accuracy of biometric matching, the adequacy of remedies for incorrect records, and the scope of law enforcement access. The outcome of these cases will shape how the legal architecture of EES is understood in practice and may lead to further refinement of the rules.
For now, the Entry Exit System stands as a prominent example of how legal frameworks, technology, and governance interact at the frontier between states. It is a system built as much from regulations, oversight mechanisms, and institutional mandates as from wires, servers, and biometric devices. Whether it ultimately reinforces a balanced model of compliant, well-regulated mobility or contributes to a more restrictive paradigm of control will depend not only on its performance but also on the continued scrutiny and engagement of legislators, courts, oversight bodies, and the public.
Contact Information
Phone: +1 (604) 200-5402
Signal: 604-353-4942
Telegram: 604-353-4942
Email: [email protected]
Website: www.amicusint.ca
