COMMISSION IMPLEMENTING REGULATION (EU) 2026/818

| Official Journal of the European Union | EN L series ---|---|--- * * * | 2026/818 | 10.4.2026 ---|---|--- COMMISSION IMPLEMENTING REGULATION (EU) 2026/818 of 9 April 2026 setting out detailed arrangements for the provision of a common data structure, standardised metadata, standardised authentication and common application programming interface for the European repository for online political advertisements in accordance with Regulation (EU) 2024/900 of the European Parliament and of the Council (Text with EEA relevance) THE EUROPEAN COMMISSION, Having regard to the Treaty on the Functioning of the European Union, Having regard to Regulation (EU) 2024/900 of the European Parliament and of the Council of 13 March 2024 on the transparency and targeting of political advertising (1), and in particular Article 13(6) thereof, Whereas: (1) | Regulation (EU) 2024/900 provides for the establishment of the European repository for all online political advertisements published in the Union or directed to Union citizens or residents in the Union (‘the European repository’). The information in the European repository shall be available in machine-readable format, shall allow for multicriteria queries and shall be publicly accessible. To support these objectives the Commission is to set out detailed arrangements for the provision of a common data structure, standardised metadata, standardised authentication and a common application programming interface for the European repository. ---|--- (2) | To ensure interoperability with other network and information systems, in particular between the European repository and advertising repositories, as referred to in Article 39 of Regulation (EU) 2022/2065 of the European Parliament and of the Council (2), and to facilitate indexation of online political advertisements by online search engines, it is necessary to put in place arrangements for developing a controlled vocabulary with standardised and organised arrangements of relevant terms and phrases presented as lists of terms or as a thesaurus, and taxonomies with a hierarchical structure of broader and narrower terms, including by making best use of existing Core Vocabularies (3), underpinning the common data structure and metadata standards. ---|--- (3) | To ensure that interoperability, particularly in the multilingual context of online political advertising provided in the Union, and indexation by online search engines each metadata element should have a unique value domain, which could take the form of dates, character strings or codes derived from international standards. To support the effective functioning of the European repository and searchability of information about political advertisements therein, such metadata elements should include the elements of the transparency notice as set out in point 3 of Annex II to Commission Implementing Regulation (EU) 2025/1410 (4), information enabling the identification of the online political advertisements, where available, the permanent uniform resource locator (URL) to where the political advertisement is available, and the language of the metadata elements. To ensure consistent linkages between datasets, the information enabling the identification of the political advertisement could include, for instance, as the case may be, the text used in the political advertisement, the alternative presentation of the non-textual content of the political advertisement, the automated transcript or subtitles for audio or video political advertisements, the link(s) to the media files used in the political advertisement, or a unique identifier attributed by the publisher and other contextual information, such as the platform on which the political advertisement was published. ---|--- (4) | To ensure future-proofing and allow for constant innovation, the measures provided for in this Regulation should respect the principle of technological neutrality, that is to say to neither impose nor discriminate in favour of the use of a particular type of technology. and should retain flexibility with regard to technological advances and developments. ---|--- (5) | To deliver on the objectives set out in Article 13(6), second subparagraph, of Regulation (EU) 2024/900, it should be ensured that the European repository (5) is maintainable over time, capable of supporting evolving standards and practices, increased data volumes, and new user or regulatory requirements. It is necessary to ensure that the technical arrangements for the provision of the common data structure, metadata standards and common application programming interface will be compatible with and support the development of other components and layers of the European repository, notably the hosting infrastructure and the schema definitions, the description of which will be made publicly available sufficiently in advance of the date when the European repository will be functional. It is also necessary to ensure that the European repository maintains robust data integrity, effective governance, and strong security protocols. The first version of the European repository should be compatible with existing Commission information systems, including by requiring the use of Extensible Markup Language (XML) or JavaScript Object Notation (JSON) to ensure that the European repository will be rolled out as soon as possible. The date of functioning of the first version of the European repository should be announced on the public portal of the repository sufficiently in advance to allow publishers of online political advertisements to undertake preparations and familiarise themselves with the new standards. ---|--- (6) | Coherent and timely technical implementation of the common data structure, metadata standards and common application programming interface requires the active involvement of a wide range of stakeholders, in particular economic operators which are providers of political advertising services, including publishers, and associations representing them. The Commission has established an informal Union Expert group of providers of political advertising services to support the implementation of Regulation (EU) 2024/900 and contribute to the sharing of experience and good practices in the field of transparency and targeting of political advertising. ---|--- (7) | To support third-party and public access to transparency notices of political advertisements, the provision of the common data structure, metadata standards and common application programming interface should enable, among other things, the creation of easily accessible, machine-readable and user-friendly transparency notices of political advertisements, which would also reinforce compliance with Article 12(3) and Article 13(2) and (4) of Regulation (EU) 2024/900 and minimise the administrative burden on publishers of political advertisements. ---|--- (8) | The implementation of a common data structure, standardised metadata, standardised authentication and common application programming interface for the European repository may entail the processing of personal data, such as the elements of transparency notices set out in points 3.1-3.3 of Annex II to Implementing Regulation (EU) 2025/1410, which should comply with the rules on the protection of personal data laid down in Regulations (EU) 2016/679 (6) and (EU) 2018/1725 (7) of the European Parliament and of the Council. ---|--- (9) | This Regulation introduces binding requirements for cross-border digital public services within the meaning of Regulation (EU) 2024/903 of the European Parliament and of the Council (8). An interoperability assessment has therefore been completed. The Digital Dimensions chapter of the Legislative Financial and Digital Statement constitutes the resulting report. ---|--- (10) | The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 and delivered an opinion on 30 January 2026. ---|--- (11) | The measures provided for in this Regulation are in accordance with the opinion of the Committee established by Article 29(1) of Regulation (EU) 2024/900, ---|--- HAS ADOPTED THIS REGULATION: Article 1 The detailed arrangements for the provision of a common data structure, standardised metadata, standardised authentication and common application programming interface for the European repository for online political advertisements are set out in the Annex. Article 2 This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union. This Regulation shall be binding in its entirety and directly applicable in all Member States. Done at Brussels, 9 April 2026. For the Commission The President Ursula VON DER LEYEN * * * (1) OJ L, 2024/900, 20.3.2024, ELI: http://data.europa.eu/eli/reg/2024/900/oj. (2) Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market For Digital Services and amending Directive 2000/31/EC (Digital Services Act) (OJ L 277, 27.10.2022, p. 1, ELI: http://data.europa.eu/eli/reg/2022/2065/oj). (3) https://op.europa.eu/en/web/eu-vocabularies/corevocs. (4) Commission Implementing Regulation (EU) 2025/1410 of 9 July 2025 on the format, template and technical specifications of the labels and transparency notices of political advertisements in accordance with Articles 11 and 12 of Regulation (EU) 2024/900 of the European Parliament and of the Council (OJ L, 2025/1410, 16.7.2025, ELI: http://data.europa.eu/eli/reg_impl/2025/1410/oj). (5) Information system development and procurement strategy choices will be subject to pre-approval by the European Commission Information Technology and Cybersecurity Board. (6) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1, ELI: http://data.europa.eu/eli/reg/2016/679/oj). (7) Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018, on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39, ELI: http://data.europa.eu/eli/reg/2018/1725/oj). (8) Regulation (EU) 2024/903 of the European Parliament and of the Council of 13 March 2024 laying down measures for a high level of public sector interoperability across the Union (Interoperable Europe Act) (OJ L, 2024/903, 22.3.2024, ELI: http://data.europa.eu/eli/reg/2024/903/oj). * * * ANNEX Detailed arrangements for the provision of a common data structure, standardised metadata, standardised authentication and a common application programming interface for the European repository for online political advertisements I. COMMON DATA STRUCTURE AND STANDARDISED METADATA | 1. | A common data structure shall be provided based on a published controlled vocabulary and datasets, which shall ensure the consistent organisation, management, and retrieval of information within the European repository. ---|---|--- | 2. | The common data structure must enable data integrity, interoperability with other network and information systems, including with the advertising repositories as referred to in Article 39 of Regulation (EU) 2022/2065, and accessibility in compliance with applicable data governance, transparency, and information management standards. ---|---|--- | 3. | The European repository shall be based on the following metadata elements: | (a) | information enabling the identification of the online political advertisement(s); ---|--- (b) | where available, the permanent URL to the political advertisement(s); ---|--- (c) | the language of the metadata elements; ---|--- (d) | the elements of the transparency notice as set out in point 3 of Annex II to Implementing Regulation (EU) 2025/1410. ---|--- | 4. | Each metadata element listed in point 3 shall have a unique value domain. ---|---|--- | 5. | The metadata elements listed in point 3 shall be provided according to schema definitions which shall be integrated in the European repository, and shall use 8-bit Unicode Transformation Format (UTF-8) character encoding to ensure multilingual interoperability. ---|---|--- II. STANDARDISED AUTHENTICATION | 1. | Authentication to the European repository shall take place in two phases: | (a) | via EU Login, the European Commission Authentication Service; ---|--- (b) | as part of the onboarding process, requiring the identification and authorisation of the users. ---|--- | 2. | Only onboarded users shall be able to make available information in the European repository. They shall also have access to the information in the European repository which they have submitted or to which they have been given access by another onboarded user. ---|---|--- | 3. | Each onboarded user shall be able to request and receive unique credentials that grant access to a common application programming interface (API). ---|---|--- III. COMMON APPLICATION PROGRAMMING INTERFACE | 1. | An API shall allow automated transmission of the information listed in Section I, point 3, based on markup languages, such as Extensible Markup Language (XML), JavaScript Object Notation (JSON) and JavaScript Object Notation for Linked Data (JSON-LD), through web services using either Simple Object Access Protocol (SOAP) or Representational State Transfer (REST). This includes transmissions between the advertising repositories as referred to in Article 39 of Regulation (EU) 2022/2065 and the European repository, based on data artefacts provided by the European repository. ---|---|--- | 2. | The API shall ensure the integrity, authenticity, and confidentiality of transmissions. It shall be required to perform the following actions: | (a) | receive and store messages sent by the client system; ---|--- (b) | receive and store the responses sent by the target systems; ---|--- (c) | validate entry messages; ---|--- (d) | secure all communications with the target systems; ---|--- (e) | invoke target systems using protocols or architecture layers, such as SOAP and REST. ---|--- | 3. | Where SOAP is used, validation shall be synchronous and performed against the published XML schema definition within a defined time limit. Transmissions that do not comply with the schema shall be automatically rejected with a response containing standardised error codes, descriptive messages, and field-specific details. ---|---|--- | 4. | Where REST is used, initial validation against the published schema definition shall be synchronous, with immediate responses for non-compliant transmissions. Business rule validation may be asynchronous, with results communicated through callbacks or status endpoints using standardised error codes, descriptive messages, and field-specific details. ---|---|--- | 5. | The API shall conform to and support high security standards, including Hyper-Text Transfer Protocol Secure (HTTPS) over the latest stable and officially supported version of Transport Layer Security (TLS) in use in the European Commission’s information and communication technology environment. The API shall implement robust authentication and authorisation mechanisms, such as JSON Web Tokens (JWT). ---|---|--- | 6. | When pushing the data listed in Section I, point 3, onboarded users shall receive a unique identifier for each data transmission to the European repository. If an onboarded user decides to change the data, it shall be required to push a correction with the same base identifier and a version tag incremented, enabling the identification of the correction. ---|---|--- * * * ELI: http://data.europa.eu/eli/reg_impl/2026/818/oj ISSN 1977-0677 (electronic edition) * * *