EU Directive 2014/40/EU (TPD2) adopted, introducing mandatory track and trace and security features for tobacco products.
TPD
Tobacco Products Directive (TPD): Track and Trace
Track and trace has been mandatory for all tobacco products in the EU since May 2024. TPD3 will extend obligations to vapes, nicotine pouches, and e-liquids from 2028.
Next deadline:
15 June 2026: public consultation on the TPD3 revision closes. A legislative proposal is expected by end of 2026.
The European Commission opened its formal consultation on the revision of the Tobacco Products Directive in May 2026. This is the last window to influence how scope expansion, track and trace obligations for novel product categories, and transition periods will be framed in the legislative proposal. For companies already manufacturing vapes, nicotine pouches or e-liquids, the consultation outcome will define whether their current infrastructure needs a structural rebuild or a targeted extension.
For existing tobacco products: track and trace has been mandatory for cigarettes and roll-your-own tobacco since 20 May 2019, and for all other tobacco products since 20 May 2024. Any other tobacco products manufactured before May 2024 without a Unique Identifier could no longer be distributed in the EU from 20 May 2026.
Regulation timeline
What the regulation requires
The EU Tobacco Products Directive (Directive 2014/40/EU) applies to manufacturers, importers, wholesalers, distributors, and retailers handling tobacco products in the EU and establishes two parallel compliance systems. First, track and trace, requiring every unit pack to carry a Unique Identifier that is scanned and recorded at every point of transfer throughout a network of 27 national repositories via the EU Router. Second, security features, requiring each pack to carry a tamper-evident authentication mark.
Track and trace has been mandatory for cigarettes and roll-your-own tobacco since May 2019, and for all other tobacco products since May 2024. Novel product categories including vapes, nicotine pouches, and e-liquids fall outside the current directive's scope; the TPD3 revision, with a legislative proposal expected by end of 2026, will extend these obligations to those categories.
Where TPD track and trace implementations fail
Every EU market has its own ID issuer, submission format, and validation rules.
Each EU Member State operates its own ID issuer under different technical standards, submission formats, and validation requirements. The ID issuer function is operated by a small number of providers including Dentsu, Crane NXT, and CRPT, each under market-specific configurations. A manufacturer or importer selling across multiple EU markets must connect to, maintain, and monitor each of the 27 markets independently.
A single submission error blocks the entire shipment.
Every unit pack must be physically serialized at line speed, aggregated into outers, master cases, and pallets with correct parent-child relationships, and submitted to the relevant repository before the shipment leaves the facility. A validation failure at any point in that sequence blocks the shipment.
Fragmented track and trace infrastructure cannot absorb TPD3 scope extension.
Many manufacturers assembled their current track and trace infrastructure one market at a time, with separate software vendors, separate line equipment, and separate ERP integrations per jurisdiction. When TPD3 extends obligations to vapes, nicotine pouches, and e-liquids, a system built in pieces will need to be rebuilt, not extended.
TPD3 preparation cannot wait for the legislative proposal.
The TPD3 legislative proposal is expected by the end of 2026, with application likely to be from 2028. Whether the existing track and trace infrastructure can absorb the scope extension without rearchitecturing is a question that will take longer to answer than the transition period allows.
OSAPIENS HUB FOR PRODUCT COMPLIANCE
Full TPD compliance for the EU market, built to extend to TPD3
The osapiens HUB for Track and Trace Tobacco manages serialization, ID issuer connections, aggregation, and repository submissions for all current tobacco product categories across all 27 EU markets. When TPD3 extends obligations to vapes, nicotine pouches, and e-liquids, the same platform will cover the new categories without the need for a separate implementation.
Connect to all 27 EU ID issuers through a single integration layer.
The osapiens HUB connects natively to all 27 EU Member State ID issuers and to primary repository providers including Dentsu, Zetes, Atos, KASI, and Honeywell through a single integration layer. Unique identifiers are requested, managed, and reordered centrally. Interface updates from ID issuers are handled by osapiens, not passed on to the customer.
Serialize and aggregate at line speed without replacing existing equipment.
Serialization and aggregation run at line speed through an on-premise Line Controller connected to existing labeling and coding equipment. Submissions to ID issuers and repositories are handled through the cloud layer. REST and SOAP APIs automatically connect production data to ERP and WMS systems.
Extend coverage to vapes, nicotine pouches and e-liquids without rebuilding.
When TPD3 takes effect, vapes, nicotine pouches, and e-liquids will be added to the platform. No rebuild, no new implementation. osapiens handles the regulatory update.
RESOURCES AND GUIDES ON TPD COMPLIANCE
Frequently asked questions (FAQs)
The EU track and trace system requires every tobacco product unit pack placed on the EU market to carry a Unique Identifier, which is applied before the product leaves the manufacturing site. The UI is scanned and recorded at every transfer point in the supply chain, from the manufacturer through to wholesalers and distributors as well as the final retailer, and is transmitted to the relevant primary repository. Each manufacturer or importer contracts a primary repository to store their traceability data. All primary repositories feed a single EU-wide secondary repository through the EU Router, creating an end-to-end auditable chain of custody for every unit pack from production to point of sale.
All economic operators who handle tobacco products commercially in the EU supply chain must comply: manufacturers, importers, wholesalers, and distributors. Each operator must register with the relevant national ID issuer to obtain an Economic Operator ID and Facility ID before submitting any track and trace messages. Retailers must register and are required to report product movements from distribution warehouses to point of sale, but are not required to report movements at the point of sale itself.
A Unique Identifier (UI) is the alphanumeric code assigned to each individual unit pack. It is generated by the national ID issuer of the Member State where the manufacturer or importer is registered. It must be printed directly on the unit pack in both machine-readable and human-readable format before the product leaves the manufacturing site. Aggregated containers at every level, outers, master cases and pallets, carry their own identifiers linking to the unit pack codes inside, creating a parent-child relationship across the full aggregation hierarchy.
No. Vapes, nicotine pouches, and e-liquids are currently outside the scope of EU Directive 2014/40/EU, as they do not contain tobacco. Products that contain tobacco, including heated tobacco products, are already in scope. The European Commission launched a formal consultation in May 2026 on a TPD3 revision that will bring non-tobacco nicotine products into scope for the first time. A legislative proposal is expected by the end of 2026, with new obligations taking effect approximately two years after formal adoption.
TPD3 is the working name for the third revision of the EU Tobacco Products Directive, which is currently under development. The revision is expected to bring non-tobacco nicotine products, including vapes, e-cigarettes, nicotine pouches, and e-liquids, formally into EU regulatory scope for the first time, introducing track and trace obligations for these categories. A legislative proposal is expected by the end of 2026. Following the standard two-year transposition period, new rules are expected to take effect around 2028 at the earliest.
Penalties are set by individual Member States. Consequences for non-compliance can include fines, blocked shipments, product seizure and restricted, market access. Products that cannot be verified through the EU track and trace system, because they lack a valid Unique Identifier or have no recorded movement history, are treated as potentially illicit and subject to enforcement action.
The EU TPD track and trace system applies to products placed on the EU market, and also to products manufactured in the EU that are destined for export outside the EU. Non-EU manufacturers exporting to the EU are required to serialize products before exporting them and ensure their EU importer has submitted the required registrations. The UK implemented its own Tobacco Track and Trace system separately following Brexit. Other markets including Serbia, Uzbekistan, and China operate in accordance with their own national track and trace requirements.
