Manufacturing and importing tobacco products

What you need to do from 20 May 2019 if you manufacture or import tobacco products in the EU.

Contents

1. Existing stock 
2. Put security features on the packaging 
3. Get IDs for your business 
4. Put UIDs on the packaging 
5. Record sales 
6. Scan your products 
7. Get an anti-tamper device 
8. Get data storage 
9. Provide scanning equipment 
10. Transporting and transloading

From 20 May 2019, all unit packets of cigarettes and hand rolling tobacco manufactured or imported in the EU (except for existing stock) must:

• have unique identifiers (UIDs) on the packaging
• have 5 specific security features on the packaging
• be scanned at certain points in the supply chain

From May 2024, this will apply to all products containing tobacco.

Existing stock

You do not need to have security features or UIDs on the packaging of cigarettes or hand rolling tobacco that’s:

• manufactured in the EU before 20 May 2019
• imported into the EU and has left duty suspension before 20 May 2019

They can stay in free circulation until 20 May 2020 - after that, they’ll need to comply with the rules in this guidance.

Put security features on the packaging

You’ll need to find providers of 5 specific security features that must be on the packaging of all unit packets of cigarettes and hand rolling tobacco.

Get IDs for your business

You’ll need to register with the ID issuer to get:

• an economic operator ID
• machine IDs for all machines used in the manufacturing process
• facility IDs for all premises where you manufacture, store or sell your products

You will not have to pay for these IDs.

Put UIDs on the packaging

For your products, you’ll need to get:

• unit packet UIDs
• aggregate UIDs

You’ll need to encode them into barcodes and put them on the packaging of your tobacco products.

Aggregate UID specifications

Aggregate UIDs must meet one of the following standards (or their latest equivalents):

• ISO 15459-1:2014
• ISO 15459-4:2014

Record sales

You’ll need to record when, for a specific product, you:

• issue an order number
• generate an invoice
• receive payment

You must send this information to your data repository within 24 hours. This will change to 3 hours from 20 May 2028.

More information about this will be published here.

Scan your products

You must scan your products when:

• you apply the unit packet UID
• you apply the aggregated packaging UID
• they leave your premises
• they arrive at your premises

Get an anti-tamper device

You must have an anti-tamper device installed on your production line by 20 May 2019, unless:

• your manufacturing process is fully manual
• you’ll manufacture less than 120 million unit packets in 2019 - you must have the device installed by 20 May 2020
• you’re a small or medium sized enterprise - you must have the device installed by 20 May 2021

The device must verify that the unit packet UIDs have been applied correctly and can be scanned. It needs to record this information by either video or a log file that cannot be altered.

You must reapply a unit packet UID if the device confirms that it:

• has been incorrectly applied
• is not fully readable

The information recorded by the anti-tamper device must be:

• kept for 9 months
• given to the Customs Department if they request it

The provider of the anti-tamper device must meet certain criteria for being independent from the tobacco industry.

If your anti-tamper device provider is no longer independent, the Customs Department will tell you how long you have to either:

• find a new anti-tamper device provider
• make sure your existing provider takes action to meet the independence criteria

Get data storage

You must appoint a provider of data storage, where the UIDs and recorded movements of your products will be stored.

The provider of the data storage must meet certain criteria for being independent from the tobacco industry.

You must tell the European Commission which data storage provider you intend to use, as they’ll need to approve it.

Appoint an auditor

You must appoint an independent auditor who will check that your data repository is protecting the data properly.

The auditor will need to be approved by the Commission, and send them annual reports.

Provide scanning equipment

You must provide all economic operators involved in the trade of your products, up to the first retailer, with equipment and software that:

• can scan your products
• electronically sends scanned information to a central repository

Transporting and transloading

Contents

1. What you must put on the packaging
2. UID barcode specifications

For cigarettes and hand rolling tobacco that you’ll manufacture or import in the EU from 20 May 2019, you’ll need to get:

• unit packet UIDs - you need to buy these from the ID issuer
• aggregate UIDs - you can buy these from the ID issuer, or generate them yourself

This guidance will be updated when you can buy UIDs.

The UIDs you buy or generate will be codes of letters and numbers. From those codes, you’ll need to create scannable barcodes and put them on the packaging of your tobacco products.

What you must put on the packaging

So that your products can be scanned at certain points in the supply chain, you:

• must put unit packet UIDs on every unit packet - they must then be immediately verified by an anti-tamper device
• can put aggregate UIDs on anything that holds more than one unit packet - you need to link these to the unit packets that it contains

You can add ‘TTT’ next to the UID barcode to tell them apart from other barcodes on the packaging.

You must also put on the packaging a code that someone can read without equipment. It should be next to the UID barcode on the packaging if possible.

Examples of what can be classed as ‘aggregated packaging’ include:

• cartons
• master cases
• pallets
• trailers
• shipping containers

Aggregate UID specifications

If you generate your own aggregate UIDs, they must meet one of the following standards (or their latest equivalents):

• ISO 15459-1:2014
• ISO 15459-4:2014

Contents

1. Structure
2. Finances
3. Management

Your company and its subcontractors must be independent from the tobacco industry to:

• store data for manufacturers and importers of tobacco products
• provide anti-tamper devices to manufacturers and importers of tobacco products

Your company is responsible for making sure that its subcontractors meet the criteria set out here.

Structure

The legal form, organisation and decision making of your company must be independent from the tobacco industry.

Your company cannot be under direct or indirect control of the tobacco industry, including minority shareholding.

Finances

In the 2 years before your company starts providing data repositories or anti-tamper devices, less than 10% of your annual worldwide turnover (excluding VAT and other indirect taxes) can come from goods and services supplied to the tobacco industry.

After your company starts providing data repositories or anti-tamper devices, less than 20% of your annual worldwide turnover (excluding VAT and other indirect taxes) can come from goods and services supplied to the tobacco industry.

Management

Members of the board of directors, and anyone else responsible for managing your company, must not have any conflicts of interest with the tobacco industry, including:

working in the tobacco industry in the last 5 years
being influenced by any monetary or non-monetary interests from the tobacco industry, held by themselves or their partner, spouse or direct relatives, including stocks and pensions

Contents

1. What you need to do
2. Getting scanning equipment
3. If you also manufacture or import
4. If you also store or sell

From 20 May 2019, all unit packets of cigarettes and hand rolling tobacco manufactured or imported in the EU (except for existing stock) must:

• have unique identifiers (UIDs) on the packaging
• have 5 specific security features on the packaging
• be scanned at certain points in the supply chain

From May 2024, this will apply to all products containing tobacco.

What you need to do

You need to scan tobacco products when you ‘transload’ them - move them from one vehicle to another.

If you transport products only and do not move them between vehicles, you do not need to scan them.

For the movement of the products to be classed as transloading, you must know their final destination when you remove them from the vehicle.

The products do not need to be placed onto another vehicle immediately, but there must be people or vehicles with the products at all times until they’re put onto another vehicle.

You must scan the products up to 24 hours before they’re transloaded (put onto another vehicle). From 20 May 2028 you’ll need to scan them up to 3 hours before.

Getting scanning equipment

The importer or manufacturer of the products will need to provide you with equipment to scan them. You should ask them for more information if they do not contact you.

UID barcode specifications

Unit and aggregate UIDs must be encoded to at least one of the following types of barcode:

Barcode	Type of UID	Specifications	ISO standard
Data Matrix	Unit and aggregate	Error detection and correction equivalent to, or higher than those of the Data Matrix ECC200.	ISO/IEC 16022:2006
QR Code	Unit and aggregate	Recovery capacity of approximately 30% with the error correction level H.	ISO/IEC 18004:2015
DotCode	Unit	Error detection and correction equivalent to, or higher than those provided with the Reed-Solomon error correction algorithm, with the number of check characters (NC) equal to 3 plus the number of data characters (ND) divided by 2 (NC = 3 + ND/2).	ISS DotCode Symbology Specification published by the Association for Automatic Identification and Mobility (AIM) in revision 3.0, August 2014.
Code 128	Aggregate	Error detection equivalent to or higher than the one provided with the algorithm based on the even/odd – bar/space character parity and the check character.	ISO/IEC 15417:2007

You must make sure the quality of the barcodes are rated at least 3.5 in accordance with ISO/IEC 15415:2011.

Contents

1. Structure
2. Finances
3. Management

Your company and its subcontractors must be independent from the tobacco industry to:

• store data for manufacturers and importers of tobacco products
• provide anti-tamper devices to manufacturers and importers of tobacco products

Your company is responsible for making sure that its subcontractors meet the criteria set out here.

Structure

The legal form, organisation and decision making of your company must be independent from the tobacco industry.

Your company cannot be under direct or indirect control of the tobacco industry, including minority shareholding.

Finances

In the 2 years before your company starts providing data repositories or anti-tamper devices, less than 10% of your annual worldwide turnover (excluding VAT and other indirect taxes) can come from goods and services supplied to the tobacco industry.

After your company starts providing data repositories or anti-tamper devices, less than 20% of your annual worldwide turnover (excluding VAT and other indirect taxes) can come from goods and services supplied to the tobacco industry.

Management

Members of the board of directors, and anyone else responsible for managing your company, must not have any conflicts of interest with the tobacco industry, including:

• working in the tobacco industry in the last 5 years
• being influenced by any monetary or non-monetary interests from the tobacco industry, held by themselves or their partner, spouse or direct relatives, including stocks and pensions

Contents

1. What you need to do
2. Getting scanning equipment
3. If you also manufacture or import
4. If you also store or sell

From 20 May 2019, all unit packets of cigarettes and hand rolling tobacco manufactured or imported in the EU (except for existing stock) must:

• have unique identifiers (UIDs) on the packaging
• have 5 specific security features on the packaging
• be scanned at certain points in the supply chain

From May 2024, this will apply to all products containing tobacco.

What you need to do

You need to scan tobacco products when you ‘transload’ them - move them from one vehicle to another.

If you transport products only and do not move them between vehicles, you do not need to scan them.

For the movement of the products to be classed as transloading, you must know their final destination when you remove them from the vehicle.

The products do not need to be placed onto another vehicle immediately, but there must be people or vehicles with the products at all times until they’re put onto another vehicle.

You must scan the products up to 24 hours before they’re transloaded (put onto another vehicle). From 20 May 2028 you’ll need to scan them up to 3 hours before.

Getting scanning equipment

The importer or manufacturer of the products will need to provide you with equipment to scan them. You should ask them for more information if they do not contact you.