Commission sets shared security code standards for European disability and parking cards

The European Commission has fixed the mandatory QR code and the common security specifications for the physical versions of the European Disability Card and the European Parking Card for persons with disabilities, the technical layer required for both documents to be recognised in every Member State. The rules are set out in Commission Delegated Regulation (EU) 2026/1436 of 1 July 2026, signed by Commission President Ursula von der Leyen, and were published in the Official Journal of the European Union L series of 12 November 2026. The regulation enters into force on 2 December 2026, on the twentieth day following publication.

The delegated act supplements Directive (EU) 2024/2841 of 23 October 2024, which created both cards and provides in Articles 7(2) and 8(2) that cards issued by one Member State are mutually recognised in all of them. It rests on the empowerments in Article 7(7) and Article 8(7) of that directive, which pursue the same objectives: preventing and combating fraud, securing the physical cards — including the personal data they carry, in line with Regulation (EU) 2016/679 — and guaranteeing interoperability.

The Commission argues that a uniform approach is indispensable because QR codes are a mandatory digital feature to be printed on all physical cards. The new European Parking Card will replace every parking card issued under Council Recommendation 98/376/EC, a text never updated for digitalisation and under which Member States reported problems of fraud and forgery. The European Data Protection Supervisor was consulted and delivered an opinion on 12 May 2026, and the Commission consulted organisations of persons with disabilities in line with Article 14(4) of the directive.

A sealed code designed to be read offline

The two annexes describe a static, offline-verifiable code built to survive printing and handling. The main technical characteristics are:

• Model 2 QR code in accordance with ISO/IEC 18004:2024, with error correction level M, meaning 15 % redundancy against scratches or partial damage.
• Payload built as a CBOR structure plus a COSE_Sign1 signature object, compressed with zlib and encoded in Byte Mode.
• Fixed string prefixes: “ED1:MDOC:” on the disability card and “EP1:MDOC:” on the parking card.
• Minimum module size of 0,25 mm on the disability card and 0,35 mm on the parking card, with a maximum Version 20, or 97 × 97 modules.
• Disability card: 26,25 mm × 26,25 mm including the quiet zone, on the reverse side at the bottom-right corner, at least 5 mm from the right-hand and bottom edges.
• Parking card: 37 mm × 37 mm, on the front, slightly off-centre to the right towards the bottom edge.

The payload is sealed with a qualified electronic seal as defined in Regulation (EU) No 910/2014, using the ES256 algorithm. The disability card code carries the holder’s first name and surname, the card serial number and the expiry date; the parking card code carries only the serial number and the expiry date. Both include a 16-byte revocation identifier that is neither printed on the card nor displayed to verifiers.

Revocation lists published within 24 hours

Card issuers must publish revocation lists at a URI notified to the Commission and must update them within 24 hours of a revocation. Those lists may contain nothing but revocation identifiers — no serial numbers and no other personal data. Member States must communicate to the Commission which authorities or bodies issue the cards, and the Commission must guarantee public access to that information.

Where Member States use verification applications, those must check the electronic seal and the revocation status, display the data encoded in the code so it can be compared with the printed fields, and indicate whether the card is valid. Verification may not result in the issuing body being notified, and card verifiers may not retain the data once verification is complete. The Commission may supply sample source code for national applications.

Fraud-proofing the parking card

Beyond the code, the regulation makes three security features mandatory for the parking card:

• A material protecting against delamination, such as polycarbonate.
• A diffractive optically variable image device of about 20 mm × 20 mm on the front, showing a stylised map or the distinguishing code of the issuing Member State surrounded by the circle of 12 stars.
• An anti-scan pattern outside the QR code and its quiet zone, containing hidden “COPY” or “VOID” text or horizontal and vertical lines that appear when the card is photocopied.

Member States may add only the optional features listed in the regulation: a passive RFID chip on the front right-hand side, logically linked to the code and carrying the same revocation identifier, readable at about one metre and not designed for reliable reading beyond five metres, under Directive 2014/53/EU; optically variable or colour-shifting ink; and laser engraving of the data fields.

The cards are classified as a trans-European digital public service under the Interoperable Europe Act, Regulation (EU) 2024/903, and an interoperability assessment report is to be published on the Interoperable Europe Portal. For cardholders, the practical consequence is that a single code format replaces national patchworks: a card issued in one Member State can be checked by a parking operator or an inspector in another without contacting the issuing authority and without leaving a data trail. Member States and national issuing bodies now have a fixed technical template to align their production and their verification tools with.

Source: Official Journal of the European Union, L series, no. 2026/1436, 12 November 2026, Section I (official reference: Commission Delegated Regulation (EU) 2026/1436, ELI: http://data.europa.eu/eli/reg_del/2026/1436/oj).