1. The ETIAS Central System shall be hosted by eu-LISA in its technical sites and shall provide the functionalities laid down in this Regulation in accordance with the conditions of security, availability, quality and speed pursuant to paragraph 3 of this Article and to Article 74(1).
2. The infrastructures supporting the public website, the app for mobile devices, the email service, the secure account service, the verification tool for applicants, the consent tool for applicants, the assessment tool for the ETIAS watchlist, the carrier gateway, the web service, the software to process the applications, ►M1 the central repository for reporting and statistics referred to in Article 39 of Regulation (EU) 2019/817, insofar as it contains data obtained from the ETIAS Central System under Article 84 of this Regulation ◄ and the technical solutions referred to in Article 92(8) shall be hosted in eu-LISA sites or in Commission sites. These infrastructures shall be geographically distributed to provide the functionalities laid down in this Regulation in accordance with the conditions of security, data protection and data security, availability, quality and speed pursuant to paragraph 3 of this Article and to Article 74(1). The ETIAS watchlist shall be hosted in an eu-LISA site.
3. eu-LISA shall be responsible for the technical development of the ETIAS Information System, for any technical development required for establishing interoperability between the ETIAS Central System and the EU information systems referred to in Article 11 and for enabling querying of Interpol databases referred to in Article 12.
eu-LISA shall define the design of the physical architecture of the system including its communication infrastructure as well as its technical specifications and their evolution and the NUIs. Those technical specifications shall be adopted by eu-LISA’s Management Board, subject to a favourable opinion from the Commission. eu-LISA shall also implement any necessary adaptations to the EES, SIS, Eurodac or VIS deriving from the establishment of interoperability with ETIAS.
eu-LISA shall develop and implement the ETIAS Central System, including the ETIAS watchlist, the NUIs, the communication infrastructure, and the secure communication channel between the ETIAS Central System and the EES Central System, as soon as possible after the entry into force of this Regulation and the adoption by the Commission of:
(a)
the measures provided for in Articles 6(4), 16(10), 17(9), Article 31 and Articles 35(7), 45(2), 54(2), 74(5), 84(2) and 92(8); and
(b)
the measures adopted in accordance with the examination procedure referred to in Article 90(2) necessary for the development and technical implementation of the ETIAS Central System, the NUIs, the communication infrastructure, the secure communication channel between the ETIAS Central System and the EES Central System and the carrier gateway, in particular implementing acts for:
(i)
accessing the data in accordance with Articles 22 to 29 and Articles 33 to 53;
(ii)
amending, erasing and advance erasure of data in accordance with Article 55;
(iii)
keeping and accessing the logs in accordance with Articles 45 and 69;
(iv)
performance requirements;
(v)
specifications for technical solutions to connect central access points in accordance with Articles 51, 52 and 53.
The development shall consist of the elaboration and implementation of the technical specifications, testing and overall project coordination. In this regard, the tasks of eu-LISA shall also be to:
(a)
perform a security risk assessment;
(b)
follow the principles of privacy by design and by default during the entire lifecycle of the development of ETIAS; and
(c)
conduct a security risk assessment regarding the interoperability of ETIAS with the EU information systems and Europol data referred to in Article 11.
4. During the design and development phase, a Programme Management Board composed of a maximum of 10 members shall be established. It shall be composed of six members appointed by eu-LISA’s Management Board from among its members or its alternates, the Chair of the EES-ETIAS Advisory Group referred to in Article 91, a member representing eu-LISA appointed by its Executive Director, a member representing the European Border and Coast Guard Agency appointed by its Executive Director and one member appointed by the Commission. The members appointed by eu-LISA’s Management Board shall be elected only from those Member States which are fully bound under Union law by the legislative instruments governing the development, establishment operation and use of all the large-scale IT systems managed by eu-LISA and which will participate in ETIAS. The Programme Management Board shall meet regularly and at least three times per quarter. It shall ensure the adequate management of the design and development phase of ETIAS. The Programme Management Board shall submit written reports every month to eu-LISA’s Management Board on progress of the project. It shall have no decision-making power nor any mandate to represent the members of eu-LISA’s Management Board.
5.
eu-LISA’s Management Board shall establish the rules of procedure of the Programme Management Board which shall include in particular rules on:
(a)
chairmanship;
(b)
meeting venues;
(c)
preparation of meetings;
(d)
admission of experts to the meetings;
(e)
communication plans to ensure that non-participating members of eu-LISA’s Management Board are fully informed.
The chairmanship shall be held by a Member State which is fully bound under Union law by the legislative instruments governing the development, establishment, operation and use of all the large-scale IT systems managed by eu-LISA.
All travel and subsistence expenses incurred by the members of the Programme Management Board shall be paid by eu-LISA. Article 10 of the eu-LISA Rules of Procedure shall apply mutatis mutandis. The Programme Management Board’s secretariat shall be ensured by eu-LISA.
The EES-ETIAS Advisory Group shall meet regularly until the start of operations by ETIAS. It shall report after each meeting to the Programme Management Board. It shall provide the technical expertise to support the tasks of the Programme Management Board and shall follow-up on the state of preparation of the Member States.