EU Advance Passenger Information Regulations (EU) 2025/12 and 2025/13

Two regulations, two purposes

The European Commission proposed the two regulations in December 2022. A political agreement between the European Parliament and the Council followed on 1 March 2024, and the rules were formally adopted in December 2024 ³. The Parliament adopted its first-reading position on 25 April 2024 by 492 votes to 33, with 10 abstentions ⁴.

Regulation (EU) 2025/12 deals with external border checks. The Commission says carriers must send API data for all passengers on flights into the Union to the competent border authorities ³. Regulation (EU) 2025/13 deals with law enforcement. The Commission says it covers all passengers and crew on extra-EU flights, and selected intra-EU flights where PNR data is collected, with data going to passenger information units ³.

What carriers must collect and send

Article 2 of Regulation (EU) 2025/12 says it applies to air carriers conducting flights into the Union ¹. Recital 7 excludes flight schools, medical, emergency and military flights. It asks the Commission to assess whether a scheme for private flights is feasible ¹.

Article 4(2) lists the passenger data. It includes surname and given names, date of birth, sex, nationality, travel document details, the PNR record locator, seat and baggage information where available ¹. Article 5 requires carriers to collect identity data by automated means from the machine-readable data of the travel document. Manual collection is allowed only where automated means are not technically possible ¹.

Under Article 6(2), carriers transfer data for each passenger at check-in, no earlier than 48 hours before scheduled departure. They send it again for boarded passengers immediately after flight closure ¹.

The central router

The European Parliament summary says eu-LISA, the EU agency for large-scale IT systems, should design, develop, host and technically manage a router for encrypted API data ⁴. The router checks in real time whether carriers have sent the data and alerts the carrier and authorities if not ⁴.

Article 34 says the Commission will set the date the router starts operations by implementing act, once eu-LISA reports that a full test of the router was successful ¹. The Commission says the law enforcement regulation requires carriers to send PNR data through the same router in a phased approach ³. The Swiss State Secretariat for Migration (SEM) says the router will replace the many separate connections between carriers and national authorities ⁵.

Retention, audits and penalties

• Carriers keep API data for 48 hours from receipt by the router. Border authorities keep it for 48 hours, with an extra 48 hours in exceptional cases for passengers who have not yet presented at a border crossing point ¹.
• National data protection authorities audit border authorities at least once every four years. The European Data Protection Supervisor audits eu-LISA at least once a year ¹.
• Article 37(4) sets penalties of up to 2% of the carrier's global turnover of the preceding financial year for recurrent failure to transfer API data ¹.

Timeline and status

Switzerland and the Schengen area

SEM says Regulation (EU) 2025/12 is a development of the Schengen acquis under Switzerland's association agreement and that SEM is responsible for implementing it ⁵. Its page, last modified 31 August 2026, says the rules will not be fully applied until two years after the router enters operation, probably 2031 ⁵. SEM says the border management rules apply to flights arriving in an EU country from a third country ⁵. The text of Article 46 of Regulation (EU) 2025/12, which sets its date of application, could not be opened for this page, so the 2031 date is SEM's estimate only ^1,5.