The border now answers at check-in

The public argument about the Entry/Exit System has been about the booth: the temporary power to suspend biometric registration at congested crossings expired on 6 September, and industry groups including IATA want it back ⁹. The other half of the system never touches a fingerprint. It sits in the airline's departure-control system. Since 7 October it is also the way an airline is expected to tell whether a single- or double-entry visa still has entries left: the European Commission told carriers to keep verifying passport stamps until 6 October 2026 inclusive ².

The EU has wired a border-system query into the airline's check-in, on top of the document check carriers already owed under the Schengen Convention ⁵, but only as a document query and a liability. The biometrics stay with the state. The Digital Omnibus argument is about whether airlines may use the passenger's face for their own processes, and the new exception now proposed covers, as the EDPB and EDPS read it, only the case where the passenger holds the template or its key.

What the query actually is

The Entry/Exit System began a progressive roll-out on 12 October 2025 and became fully operational on 10 April 2026, replacing stamps with an electronic record of entries and exits that includes fingerprints and facial images ¹. The obligation on carriers to query the system started on the same April date ².

Article 13(3) of the EES Regulation requires carriers to use a web service to check whether a traveller holding a single- or double-entry short-stay visa has already used up the entries it allows, and the service returns an "OK/NOT OK" answer ⁵. Article 45 of the ETIAS Regulation adds a check for visa-exempt travellers once ETIAS runs: the carrier sends the passport's machine-readable data and the Member State of entry, and gets "OK/NOT OK" on whether a valid travel authorisation exists ⁶. Both texts say the answer is not a decision to authorise or refuse entry ⁵⁶.

eu-LISA's Carrier Interface takes a query of up to 99 passengers and replies per passenger with OK, NOK EES, NOK ETIAS or NA (not applicable) ³. System-to-system links use PAXLST and CUSRES messages under IATA guidelines, or JSON and XML over REST ³. The mandatory fields are passport data (name, date of birth, sex, nationality, document type, number, issuing country, expiry) and itinerary data such as entry point, times and flight number ³. A query can be sent at the earliest 48 hours before scheduled departure ⁴. Carriers can also use a web portal or mobile app ³⁴.

Nothing in that list is biometric: the airline's part of the border is a data exchange built on passport fields ³. The new API Regulation asks eu-LISA to design its future API router to be coherent with these carrier obligations as far as possible ⁸.

Who pays when the answer is wrong

Under Article 45(5) of the ETIAS Regulation, a carrier that transports a visa-exempt traveller without a valid authorisation faces the penalties of Article 26(2) of the Schengen Convention and Article 4 of Directive 2001/51/EC ⁶. That Directive requires Member States to set either a maximum penalty of not less than EUR 5,000 per person carried, a minimum of not less than EUR 3,000 per person, or a maximum lump sum of not less than EUR 500,000 per infringement ⁷.

eu-LISA's carrier material draws the line: a carrier that boards without querying may face penalties and must return the passenger; a carrier that queried, received OK, and saw the passenger refused for reasons it could not foresee is not penalised but still carries the return ⁴. Where the central system fails, carriers are exempted from the verification duty and from the penalty ⁶. eu-LISA keeps logs of every carrier query for two years, explicitly to settle disputes ⁵⁶. The query is also the airline's evidence.

What changes in the DCS and the retail flow

The answer cannot be had at the point of sale. Because the query window opens 48 hours before departure ⁴, a ticket is sold without it, and the airline first learns that a passenger cannot travel at check-in. The publication's reading, rated probable, is that refunds and rebookings triggered by NOT OK answers will land in check-in and disruption handling, not in shopping.

Some lawful travellers get NOT OK. eu-LISA suggested that at online check-in carriers either query everyone and resolve NOT OK answers afterwards, or first ask passengers whether they are out of scope ³. The Commission told carriers in April that residence-permit and long-stay-visa holders will get NOK until the second phase of the revised Visa Information System, scheduled for the third quarter of 2029, and that these passengers will need to show their documents at a counter ². eu-LISA added that, until a fix is activated, queries for multi-entry visa holders sent without the out-of-scope flag return NOT OK, and carriers should disregard that answer and check the visa sticker by hand ². For those passengers online check-in becomes a counter visit, and the DCS must tell an answer it may ignore from one it may not.

The volume will change shape. When ETIAS starts, visa-exempt travellers come into scope too ⁶. The Commission said in April it expected ETIAS in the final quarter of 2026 ²; Newland Chase reported on 9 September that the official portal had dropped that window ⁹. The date is unresolved.

Where the biometrics go, and the Omnibus

The coalition formed on 1 October by ACI EUROPE, Amadeus, IATA, IDEMIA Public Security and SITA asks that the Digital Omnibus support voluntary biometrics in travel, and says the proposal "could place unintended restrictions on the voluntary use of biometrics by passengers across Europe" ¹⁰. Its manifesto says that outside border management systems voluntary biometric deployment in European travel "remains extremely limited", argues for explicit consent under Article 9(2)(a) GDPR, and cites EDPB Opinion 11/2024 as restrictive interpretation ¹¹. These are the members' arguments, not findings.

The EDPB found that facial recognition to streamline airport flows could in principle be compatible where the template is on the passenger's own device, or held centrally but encrypted with a key only the passenger holds, and not compatible where an airport or airline holds templates centrally without that key ¹³. The Omnibus, proposed on 19 November 2025, adds an exception for one-to-one biometric verification where the data or the means of verification are under the person's sole control; the EDPB and EDPS welcome it and read it, in practice, as templates on a device held by the person or unusable without the person's key ¹².

The connection here is the publication's reading, rated possible: the proposed exception codifies the architecture the regulators already favour, so it may help passenger-held models while leaving airline- or airport-held galleries on the harder consent-and-proportionality route the coalition objects to. The state keeps the fingerprints and the face. The airline keeps the document query and the fine.

Where else this applies

The publication's reading, rated possible, is that wherever a state requires carriers to check eligibility before boarding, the same split will appear: a yes or no derived from document data, the liability attached to it, and no access to the state's biometric record. The EU has written each piece into separate law, which makes the seams visible.

What to watch

Two tests, both from public documents. First, the Omnibus text Council and Parliament agree: if the biometric exception keeps the sole-control condition, airline-run central galleries stay outside it and this reading holds; if it is widened to centrally stored templates under consent, the coalition has won and the reading is wrong. Second, eu-LISA's monthly Carriers Working Group summaries after ETIAS goes live: if NOT OK volume and technical-impossibility declarations rise sharply in the first months, the check-in flow, not the border booth, is where the system's cost appears.

The connection drawn between these sources is this publication's reading, not a statement by the EU institutions or by any coalition member. Terminair carries no byline.