EU Directive 2014/40/EU (TPD2) adopted, introducing mandatory track and trace and security features for tobacco products.
TPD
Tobacco Products Directive (TPD): Track and Trace
Track and trace has been mandatory for all tobacco products in the EU since May 2024. TPD3 will extend obligations to vapes, nicotine pouches, and e-liquids from 2028.
Next deadline:
15 June 2026: public consultation on the TPD3 revision closes. A legislative proposal is expected by end of 2026.
The European Commission opened its formal consultation on the revision of the Tobacco Products Directive in May 2026. This is the last window to influence how scope expansion, track and trace obligations for novel product categories, and transition periods will be framed in the legislative proposal. For companies already manufacturing vapes, nicotine pouches or e-liquids, the consultation outcome will define whether their current infrastructure needs a structural rebuild or a targeted extension.
For existing tobacco products: track and trace has been mandatory for cigarettes and roll-your-own tobacco since 20 May 2019, and for all other tobacco products since 20 May 2024. Any other tobacco products manufactured before May 2024 without a Unique Identifier could no longer be distributed in the EU from 20 May 2026.
Regulation timeline
What the regulation requires
The EU Tobacco Products Directive (Directive 2014/40/EU) applies to manufacturers, importers, wholesalers, distributors, and retailers handling tobacco products in the EU and establishes two parallel compliance systems. First, track and trace, requiring every unit pack to carry a Unique Identifier that is scanned and recorded at every point of transfer throughout a network of 27 national repositories via the EU Router. Second, security features, requiring each pack to carry a tamper-evident authentication mark.
Track and trace has been mandatory for cigarettes and roll-your-own tobacco since May 2019, and for all other tobacco products since May 2024. Novel product categories including vapes, nicotine pouches, and e-liquids fall outside the current directive's scope; the TPD3 revision, with a legislative proposal expected by end of 2026, will extend these obligations to those categories.
Where TPD track and trace implementations fail
Every EU market has its own ID issuer, submission format, and validation rules.
Each EU Member State operates its own ID issuer under different technical standards, submission formats, and validation requirements. The ID issuer function is operated by a small number of providers including Dentsu, Crane NXT, and CRPT, each under market-specific configurations. A manufacturer or importer selling across multiple EU markets must connect to, maintain, and monitor each of the 27 markets independently.
A single submission error blocks the entire shipment.
Every unit pack must be physically serialized at line speed, aggregated into outers, master cases, and pallets with correct parent-child relationships, and submitted to the relevant repository before the shipment leaves the facility. A validation failure at any point in that sequence blocks the shipment.
Fragmented track and trace infrastructure cannot absorb TPD3 scope extension.
Many manufacturers assembled their current track and trace infrastructure one market at a time, with separate software vendors, separate line equipment, and separate ERP integrations per jurisdiction. When TPD3 extends obligations to vapes, nicotine pouches, and e-liquids, a system built in pieces will need to be rebuilt, not extended.
TPD3 preparation cannot wait for the legislative proposal.
The TPD3 legislative proposal is expected by the end of 2026, with application likely to be from 2028. Whether the existing track and trace infrastructure can absorb the scope extension without rearchitecturing is a question that will take longer to answer than the transition period allows.
OSAPIENS HUB FOR PRODUCT COMPLIANCE
Full TPD compliance for the EU market, built to extend to TPD3
The osapiens HUB for Track and Trace Tobacco manages serialization, ID issuer connections, aggregation, and repository submissions for all current tobacco product categories across all 27 EU markets. When TPD3 extends obligations to vapes, nicotine pouches, and e-liquids, the same platform will cover the new categories without the need for a separate implementation.
Connect to all 27 EU ID issuers through a single integration layer.
The osapiens HUB connects natively to all 27 EU Member State ID issuers and to primary repository providers including Dentsu, Zetes, Atos, KASI, and Honeywell through a single integration layer. Unique identifiers are requested, managed, and reordered centrally. Interface updates from ID issuers are handled by osapiens, not passed on to the customer.
Serialize and aggregate at line speed without replacing existing equipment.
Serialization and aggregation run at line speed through an on-premise Line Controller connected to existing labeling and coding equipment. Submissions to ID issuers and repositories are handled through the cloud layer. REST and SOAP APIs automatically connect production data to ERP and WMS systems.
Extend coverage to vapes, nicotine pouches and e-liquids without rebuilding.
When TPD3 takes effect, vapes, nicotine pouches, and e-liquids will be added to the platform. No rebuild, no new implementation. osapiens handles the regulatory update.
RESOURCES AND GUIDES ON TPD COMPLIANCE
Error 429 Too many requests
Too many requests
Error 54113
Details: cache-cmh1290070-CMH 1788982728 3939577999
Varnish cache server
Error 429 Too many requests
Too many requests
Error 54113
Details: cache-cmh1290070-CMH 1788982728 3939577999
Varnish cache server
Error 429 Too many requests
Too many requests
Error 54113
Details: cache-cmh1290070-CMH 1788982728 3939577999
Varnish cache server
Error 429 Too many requests
Too many requests
Error 54113
Details: cache-cmh1290070-CMH 1788982728 3939577999
Varnish cache server
Error 429 Too many requests
Too many requests
Error 54113
Details: cache-cmh1290070-CMH 1788982728 3939577999
Varnish cache server
Error 429 Too many requests
Too many requests
Error 54113
Details: cache-cmh1290070-CMH 1788982728 3939577999
Varnish cache server