1.   Member States shall ensure that evidence requesters are connected to an eIDAS-node to enable user authentication pursuant to Article 11, either directly or through an intermediary platform.

2.   Member States shall ensure that eDelivery Access Points are installed, configured and integrated in the procedure portals of evidence requesters, in the data services of evidence providers and in intermediary platforms.

3.   Member States may choose the number of eDelivery Access Points they use for the OOTS.

1.   The Commission in cooperation with Member States shall establish the following services of the OOTS (‘common services’):

2.   Member States shall ensure the technical connection between the procedure portals of evidence requesters, directly or through intermediary platforms, with the common services and the proper registration of their data services in the common services. In implementing these connections, Member States shall be guided by the descriptions contained in the technical design documents.

3.   Member States shall ensure that only evidence requesters are connected, directly or through intermediary platforms, to the common services and that only evidence requesters and evidence providers can use the OOTS. Member States shall check the functioning of the connections to the common services at regular intervals.

1.   Without prejudice to Article 8 of this Regulation, Member States shall ensure that all evidence providers and evidence types issued by them that are relevant for the online procedures referred to in Article 14(1) of Regulation (EU) 2018/1724 are registered in the data service directory.

2.   The Commission shall be responsible for the development and maintenance of interfaces allowing national coordinators referred to in Article 28 of Regulation (EU) 2018/1724, competent authorities, intermediary platforms where applicable, and the Commission, each within the scope of their responsibilities and the limits of the access rights defined by the Commission, to:

The Commission shall ensure that national coordinators, competent authorities and intermediary platforms can choose between graphical user interfaces for authorised persons and programmatic interfaces for automated uploads.

3.   Member States shall ensure that each type of evidence registered in the data service directory is accompanied by:

4.   The data service directory shall make a clear distinction between the additional attributes referred to in paragraph 3, point (b), of this Article and the attributes exchanged using the electronic identification means notified in accordance with Regulation (EU) No 910/2014 referred to in Article 13(1), point (f), of this Regulation.

5.   The level of assurance referred to in paragraph 3, point (a), required for cross-border users shall not exceed the level of assurance required for non-cross-border users.

6.   Member States shall ensure that the information in the data service directory is kept up to date.

1.   The evidence broker shall allow evidence requesters to determine which evidence types issued in other Member States correspond to the evidence types required in the context of procedures for which that evidence requester is competent.

2.   Member States shall, through the interface referred to in Article 5(2), complement the list of evidence types in the data service directory as referred to in Article 5(1) with the facts or compliance with procedural requirements they prove, possibly jointly with other evidence types, if needed. Member States shall ensure that this information is accurate and kept up to date.

3.   The Commission shall be responsible for the development and maintenance of interfaces that allow national coordinators, competent authorities, intermediary platforms where applicable, and the Commission, each within the scope of their responsibilities and the limits of the access rights defined by the Commission, to:

The Commission shall ensure that national coordinators, competent authorities and intermediary platforms can choose between graphical user interfaces for authorised persons and programmatic interfaces for automated uploads.

4.   The Commission shall facilitate the mapping of the evidence types issued in one Member State to facts or compliance with procedural requirements that have to be proved in a procedure in another Member State by structuring the discussion and organising the work in the relevant sub-group referred to in Article 19. The sub-group shall set out a formal domain-specific language, whenever possible referencing relevant international standards, and propose that language to the gateway coordination group in accordance with Article 18, point (f).

1.   The semantic repository shall provide access to the OOTS generic metadata model, which is designed to display metadata that uniquely identify the evidence and the evidence provider and which includes additional fields designed to display the metadata referred to in Article 13(1), points (a), (b) and (c).

2.   For the types of structured evidence agreed in the gateway coordination group, the semantic repository shall contain an OOTS data model consisting of at least the following components:

3.   For each type of evidence, the semantic repository shall offer version control and a change log to keep track of different versions.

4.   The semantic repository shall contain a methodology for developing new OOTS data models for evidence types exchanged through the OOTS, consisting of examples and learning materials.

5.   Schedules for updates and adaptations to the OOTS generic metadata models and the OOTS data models shall be regularly discussed by Member States and the Commission in the framework of one of sub-groups of the gateway coordination group referred to in Article 19 and adopted by the gateway coordination group. The evidence providers or intermediary platforms, where applicable, shall apply those updates and adaptations at the latest 12 months after their publication in the semantic repository.

6.   The Commission shall provide Member States with an IT tool which will help them to verify the compliance of the evidence with the OOTS generic metadata model and the OOTS data models.

7.   The Commission shall make the semantic repository publicly available on a dedicated Commission website.

1.   Member States that have national registries or services that are equivalent to the data service directory or evidence broker may choose not to register evidence providers, the types of evidence they issue and the facts or compliance with procedural requirements they prove, possibly jointly with other evidence types, and the level of assurance of the electronic identification means required to access each type of evidence as provided for in Articles 5 and 6. In such a case, they shall instead do one of the following:

2.   When implementing paragraph 1, Member States shall be guided by the descriptions contained in the technical design documents.

1.   Evidence requesters shall ensure that their procedure portals contain an explanation of the OOTS and its features, including the information that:

The information referred to in point (b) of the first subparagraph of this paragraph shall not be required in the case of the procedures referred to in Article 14(5) of Regulation (EU) 2018/1724.

2.   The obligation to provide explanations referred to in paragraph 1 of this Article shall be without prejudice to the obligation to provide the data subjects with the information referred to in Articles 13 and 14 of Regulation (EU) 2016/679.

1.   Evidence requesters shall give users the possibility to request the types of evidence that correspond, based on the information registered in the evidence broker, to types that would be acceptable under the applicable law in the relevant procedure by direct submission, provided that evidence providers make these types of evidence available through the OOTS in accordance with Article 5(1).

2.   If multiple pieces of evidence can be requested the evidence requester shall ensure that users can select all, a sub-set of, or a specific type of, the evidence.

1.   Evidence requesters shall rely on electronic identification means that have been issued under an electronic identification scheme that has been notified in accordance with Regulation (EU) No 910/2014 to authenticate the users, acting either on their own behalf or through a representative, when and to the extent to which solutions for representation in accordance with Regulation (EU) No 910/2014 and any implementing acts adopted on its basis, have been found.

2.   Once the user has selected the type of evidence to be exchanged through the OOTS, the evidence requesters shall inform users:

3.   Where preview is not required in accordance with Article 14(5) of Regulation (EU) 2018/1724, paragraph 2, point (b), of this Article shall not apply. In that case the evidence provider, evidence providers or, where applicable, intermediary platform or platforms may ask the evidence requester to redirect the user to reidentify and reauthenticate for the purpose of identity and evidence matching. The user may choose not to be redirected. In that case, the evidence requester shall inform the user that the process of identity and evidence matching carried out by the evidence provider might not result in a match as referred to in Article 16 of this Regulation.

1.   The evidence requester shall ensure that the evidence request is transmitted to the evidence provider or intermediary platform, where applicable, and contains the following information:

2.   The evidence requester shall make a clear distinction between the additional attributes referred to in paragraph 1, point (h), and the attributes referred to in paragraph 1, point (f).

1.   Without prejudice to the procedures referred to in Article 14(5) of Regulation (EU) 2018/1724, evidence requesters shall ensure that users, after selecting the evidence to be exchanged through the OOTS in the procedure portal in accordance with Article 10 of this Regulation and stating their explicit request in accordance with Article 12 of this Regulation are redirected to the evidence provider, evidence providers or intermediary platform or platforms, where applicable, to exercise the option to preview the evidence.

2.   For the procedures referred to in Article 14(5) of Regulation (EU) 2018/1724, users can be redirected to the evidence provider, evidence providers or intermediary platform or platforms, where applicable, in accordance with Article 11(3) of this Regulation.

1.   Member States shall ensure that, for the purpose of the evidence exchange through the OOTS, the evidence providers or intermediary platforms, where applicable, shall use application services capable of the following:

2.   If an evidence response is returned, it shall include the requested evidence and be accompanied by:

3.   The evidence response may also include the metadata that uniquely identifies the language or languages of the requested evidence.

4.   If an error report is returned, it shall include metadata that uniquely identifies the evidence request, the date and time at which it was generated and a description of the error that occurred.

5.   Where evidence is not yet available for exchange through the OOTS but in the process of being converted to structured or unstructured evidence as defined in Article 1, points (16) and (17), a report as referred to in paragraph 1, point (c), of this Article shall be returned. That report shall include metadata that uniquely identifies the evidence request, the date and time at which it was generated and a message that the evidence concerned is in the process of being converted to structured or unstructured evidence as defined in Article 1, points (16) and (17), and will be ready for the transmission through the OOTS in the future. The evidence provider shall include in the report the preliminary date and time for when the evidence will be available.

1.   Evidence providers or intermediary platforms, where applicable, may require users to reidentify and reauthenticate for the purpose of identity and evidence matching, including by providing additional attributes.

2.   Evidence providers, or intermediary platforms, where applicable, shall ensure that evidence is only exchanged through the OOTS if the identity attributes of the user, and of the representative where applicable, exchanged using the electronic identification means referred to in Article 11(1) and additional attributes as referred to in Article 11(2), point (a) and provided by the user to facilitate identification by the relevant evidence provider, match the attributes held by them.

3.   Where the process of identity and evidence matching does not result in a match or the identity matching generates two or more results, the user or the representative where applicable shall not be allowed to preview the requested evidence and the evidence shall not be exchanged. In the absence of no such match:

1.   For each evidence request transmitted through the OOTS, the evidence requester, evidence provider(s) or intermediary platform(s), where applicable, shall log the following elements:

2.   For each piece of evidence exchanged through the OOTS, the evidence provider or intermediary platform, where applicable, shall log the decision of the user after previewing the evidence to approve, or not, the use of the piece of evidence for the procedure, or where applicable the fact that the user leaves the preview space or procedure portal without making a specific decision.

3.   The Commission and, in situations referred to in Article 8(1), point (a), the relevant Member States, shall log all interactions with the common services referred to in Article 4(1).

4.   Without prejudice to longer retention periods required under national law for the logs referred to in paragraphs 1, 2 and 3 for the purposes of the OOTS or for other purposes, the Commission and the evidence requesters, evidence providers or intermediary platforms, where applicable, shall keep those logs for a period of 12 months.

5.   In case of suspicion of incidents and for the purposes of audits and random checks of security performed within their respective areas of responsibility referred to in Article 26, the evidence requesters, evidence providers and intermediary platforms, where applicable, shall make available to each other on request the relevant logs referred to in paragraphs 1 and 2 of this Article through the technical support dashboard referred to in Article 22. For those same purposes and in the same manner, Member States and the Commission, where applicable, shall make available to the relevant evidence requesters, evidence providers and intermediary platforms, where applicable, the relevant logs referred to in paragraph 3 of this Article.

1.   To ensure a coordinated development and operation of the OOTS, the sub-groups referred to in Article 18, point (f), shall discuss and where necessary draw up proposals of the operational modalities to be submitted to the gateway coordination group on the following areas, in particular:

The operational modalities shall include drawing up and proposing standards necessary for interoperability in the respective areas of the sub-groups, following international standards whenever possible. Once approved by the gateway coordination group, these standards shall be included in technical design documents.

2.   The sub-groups shall adopt their proposals for operational modalities by consensus whenever possible. Where it appears that consensus cannot be reached, the chair may decide, if it is supported by the simple majority of the members of the subgroup present at the meeting, that a proposal of the sub-group can be submitted to the gateway coordination group.

1.   The Commission shall designate a single point of contact for technical support ensuring operation and maintenance of the common services referred to in Article 4(1).

2.   The single point of contact for technical support shall liaise with other relevant Commission contact points and coordinate the resolution of problems with eDelivery Access Points or eIDAS nodes.

3.   The Commission shall ensure that its single point of contact for technical support is organised in a way which allows it to perform its tasks in all circumstances and to react at short notice.

1.   Each Member State shall designate a single point of contact for technical support to ensure operation and maintenance of the relevant components of the OOTS for which they are responsible pursuant to Section 9.

2.   The single points of contact for technical support shall:

3.   When informed by an evidence provider about doubts as to the lawfulness of one or several evidence requests, the single point of contact for technical support shall:

4.   Member States shall ensure that their respective single point of contact for technical support is organised in a way which allows it to perform its tasks in all circumstances and is able to react at short notice.

1.   The Commission shall establish a dashboard to facilitate the communication between all technical support contact points.

2.   Member States and the Commission shall record in the dashboard the contact details of the technical support contact points and keep it updated.

3.   The contact points shall, through the dashboard:

4.   The national coordinators and the chair of the gateway coordination group shall have access to the dashboard.

5.   The Commission and the national coordinators shall use the dashboard to provide information referred to in Article 27 and Article 28(2).

1.   The Commission shall inform Member States of changes and updates to the common services.

2.   Member States shall inform the Commission of changes and updates to the components under their responsibility that may have repercussions on the functioning of the OOTS.

3.   Information on critical updates shall be provided without undue delay. In the case of other, non-critical updates that are likely to affect OOTS components that are owned by other Member States or the common services, the lead time shall be decided by the gateway coordination group on the basis of a proposal from the relevant sub-group.

1.   The OOTS operating time frame shall be 24 hours a day/7 days a week, with an availability rate of the eDelivery access points, preview spaces and common services of at least 98 % excluding maintenance scheduled in accordance with paragraph 2 of this Article. The service level targets of the remaining OOTS components shall be specified in the service level agreements referred to in Article 19(1), point (d).

2.   Member States and the Commission shall notify the scheduled maintenance activities related to the relevant components of the OOTS as follows:

To the extent possible, maintenance operations shall be planned outside working hours.

3.   Where Member States have fixed weekly service windows, they shall inform the Commission of the time and day when such fixed weekly windows are planned. Without prejudice to the obligations set out in paragraph 2, points (a), (b) and (c), if Member States systems become unavailable during such a fixed window, Member States are exempted from the obligation to notify the Commission on each occasion.

4.   In the case of unexpected technical failure of the Member States OOTS components, the relevant Member State shall inform the other Member States and the Commission without delay of their unavailability, and, if known, of the projected resuming of the functioning of the components.

5.   In the case of unexpected failure of the common services, the Commission shall inform Member States without delay of the unavailability of one or more common services, and if known, of the projected resuming of the service.

6.   The notifications referred to in this Article shall be made through the technical support dashboard referred to in Article 22.

1.   The Commission shall ensure the security of the common services referred to in Article 4(1) and the integration elements and interfaces referred to in Article 2, point (h), for which it is responsible.

2.   Member States shall ensure the security of the national components of the OOTS and the integration elements and interfaces referred to in Article 2, point (h), for which they are responsible.

3.   For the purposes referred to in paragraphs 1 and 2, Member States and the Commission shall, at least, and each for the component for which they are responsible, take the necessary measures to:

4.   Member States shall ensure, in particular:

5.   In accordance with paragraph 4, the Member State of the evidence provider in any given exchange of evidence shall be responsible for the quality, confidentiality, integrity and availability of the requested evidence until it reaches the eDelivery Access Point of the evidence requester or an intermediary platform, where applicable. The Member State of the evidence requester in any given exchange of evidence shall be responsible for the confidentiality and integrity of the requested evidence from the moment it reaches its eDelivery Access Point.

6.   Member States and the Commission shall ensure the confidentiality, integrity and availability of the logs referred to in Article 17(1), (2) and (3) through appropriate and proportionate security measures, each for the logs that they have recorded.

1.   Member States and the Commission shall conduct regular checks on the components of the OOTS for which they are responsible.

2.   The single points of contact for technical support referred to in Articles 20 and 21 shall use the technical support dashboard referred to in Article 22 to inform each other of problems discovered during the checks that might result in a breach or a suspected breach of the security of the OOTS.

1.   Member States and the Commission shall, in the framework of the gateway coordination group, adopt a testing schedule and a set of indicators according to which testing results can be measured and considered as positive.

2.   The Commission shall provide testing services that Member States can use to test the conformity of technical solutions with the indicators referred to in paragraph 1.

3.   Member States and the Commission shall test the functioning of each of the OOTS components and verify that they can function properly according to the indicators referred to in paragraph 1. Only those components of the OOTS for which the tests yield positive results shall be made available for users.

1.   For each evidence exchange through the OOTS, the relevant evidence requester or intermediary platform, where applicable, shall be solely responsible for the completeness and lawfulness of the evidence request. The evidence requester shall ensure, in particular, that the evidence is required for the particular procedure for which it is requested by a user.

2.   Once the evidence exchanged through the OOTS becomes available to the evidence requester or intermediary platform, where applicable, either following the user’s choice to proceed with the exchange of evidence in accordance with Article 14(3), point (f), of Regulation (EU) 2018/1724, or in the case of the procedures referred to in Article 14(5) of Regulation (EU) 2018/1724, the evidence requester or intermediary platform, where applicable, shall ensure the same level of protection of personal data in accordance with Regulation (EU) 2016/679 as in a situation where the user submits or uploads the evidence without having recourse to the OOTS.

1.   Without prejudice to their obligations set out in Regulation (EU) 2016/679, for each evidence exchange through the OOTS, the relevant evidence provider or intermediary platform, where applicable, shall be solely responsible for verifying:

2.   When an intermediary platform provides the preview space in accordance with Article 15(1), point (b)(ii), of this Regulation it shall be considered as a processor acting on behalf of the evidence provider according to Article 4(8) of Regulation (EU) 2016/679.