Products
Read the chip, not just the picture
NeuroVision reads the NFC chip of identity documents. The data comes from the chip, not from a photo of the document.
What it is
NFC chip reading
NeuroVision reads the NFC chip of identity documents. The data comes from the chip, not from a photo of the document.
The rest of this page explains the standards and the law around identity-document chips. It is background for reading about the subject, and it is not a list of the checks NeuroVision performs.
Four questions
Reading the chip, authenticating the data, checking the holder
These are separate questions. The ICAO standard answers each one with its own mechanism, and a yes to one is not a yes to the others.
| The question | What the standard uses | What a yes shows |
|---|---|---|
| Can the chip be read? | Chip access control, with Basic Access Control or PACE, where the chip enforces it (Part 11, section 4). Inspection systems must also support chips without access control (section 4.1). | For a protected chip: the reader holds the access information derived from the document, and the chip lets it in. |
| Is the data genuine and unchanged? | Passive Authentication: a certificate path, the signature of the Document Security Object, and a hash comparison of the data groups read (Part 11, section 5.1.1). | The data groups read are the ones the issuing State signed. |
| Is the chip the original? | Active Authentication, Chip Authentication, or PACE with Chip Authentication Mapping, where the issuer implemented them (Part 11, section 6). | Under the conditions of each mechanism, the chip is genuine and not a substitute. |
| Is the person the holder? | Not a chip mechanism. Data Group 2 holds the face of the holder as an input to face recognition (Part 10). | The comparison with a live face is a separate step. |
Our reading: a statement that a service reads a chip answers the first question. The other three need their own answers, and the sections of Part 11 named in the table say what each requires.
NeuroVision reads the NFC chip of identity documents. The documents and markets you need covered are a conversation with the team.
Documents
Which documents carry a chip
What the standard and the law say. Your own list of documents and markets is a conversation with the team.
Travel documents
Passports and other travel documents that follow ICAO Doc 9303 can carry a contactless chip. The standard calls them eMRTDs.
EU identity cards
Council Regulation (EU) 2025/1208 requires identity cards issued by Member States to their own nationals (Article 2(a)) to include a highly secure storage medium with a facial image of the holder and two fingerprints, accessible in contactless form (Article 3(5) and (6)).
The Regulation in short
- Instrument: Council Regulation (EU) 2025/1208 of 12 June 2025, adopted under Article 77(3) of the Treaty on the Functioning of the European Union. It entered into force on the twentieth day after its publication in the Official Journal on 20 June 2025, that is on 10 July 2025 (Article 16).
- History: the Court of Justice declared the earlier Regulation (EU) 2019/1157 invalid on 21 March 2024 in Case C-61/22 and maintained its effects until the entry into force of a new regulation based on Article 77(3), by 31 December 2026 at the latest.
- Scope (Article 2): identity cards issued by Member States to their own nationals as referred to in Article 4(3) of Directive 2004/38/EC, and the registration certificates, documents certifying permanent residence, residence cards and permanent residence cards issued under that Directive. It does not apply to identification documents issued on a provisional basis with a period of validity of six months or less.
- Fingerprints (Article 3(7)): children under 12 may be exempt, children under 6 are exempt, and persons for whom fingerprinting is physically impossible are exempt.
- Phasing out (Article 5(1)): cards that do not meet Article 3 cease to be valid at their expiry or by 3 August 2031, whichever is earlier.
- Earlier deadline (Article 5(2)): cards that do not meet the minimum security standards in part 2 of ICAO Doc 9303 or have no functional MRZ cease to be valid at their expiry or by 3 August 2026, whichever is earlier. For holders aged 70 and above on 2 August 2021, whose cards meet those standards and have a functional MRZ, validity ends at expiry.
- Territory: the Regulation is binding in the Member States. Denmark is not bound by it (recital 47), and Ireland takes part (recital 48).
Access to the data stored on the card is limited by Article 11 of the Regulation. The article on chip verification sets out the conditions.
By the standard
What is on a chip
ICAO Doc 9303 Part 10 defines the logical data structure of an eMRTD chip, called LDS1 (sections 4.6 and 4.7). This table is that structure, and it is not a statement about every identity card chip: whether a given card follows it is a matter for the issuer of the card.
| Data group | Holds | In the LDS1 structure |
|---|---|---|
| Data Group 1 | Machine readable zone information | Mandatory |
| Data Group 2 | Encoded face image of the holder | Mandatory |
| Data Group 3 | Fingerprints | Optional |
| Data Group 4 | Iris images | Optional |
| Data Group 5 | Displayed portrait | Optional |
| Data Group 7 | Displayed signature or usual mark | Optional |
| Data Group 11 | Additional personal details | Optional |
| Data Group 12 | Additional document details | Optional |
| Data Group 14 | Security options | Conditional: required if Chip Authentication or certain PACE mappings are supported |
| Data Group 15 | Active Authentication public key | Conditional: required when Active Authentication is implemented |
| Document Security Object | Hash values of the data groups, signed by the issuing State | Mandatory |
Optional groups depend on the choice of the issuer. The mandatory groups and the conditional groups that apply to the chip are required.
By the standard
What the ICAO standard defines for chip security
This section describes what the ICAO and BSI standards define. It is not a list of the checks NeuroVision performs.
Written by the issuer
In the ICAO eMRTD structure the chip holds the data the issuing State stored in it, including a digital portrait of the holder (Part 10).
Signed by the issuer
The issuing State signs the Document Security Object, which holds hash values of the stored data groups (Part 10, section 4.6.2).
A check on the data itself
The standard defines Passive Authentication: a validated certificate path, a verified signature on the Document Security Object and a hash comparison of the data groups that were read (Part 11, section 5.1.1).
Five mechanisms
They are mechanisms, not a fixed sequence. Passive and Active Authentication work on data groups that have been read, and access to sensitive data groups needs Terminal Authentication first.
- Open the chipA chip with access control answers a reader only after the reader proves knowledge of access information derived from the document: the MRZ data, or with PACE the card access number. Under the assumption that this information cannot be obtained from an unviewed document, the standard takes it to mean that the document was knowingly handed over. Two protocols exist, Basic Access Control and PACE (Part 11, section 4). Documents without chip access control are deprecated, and inspection systems must still support them (section 4.1).
- Read the data groupsThe reader reads the data groups it is allowed to read, including the Document Security Object (Part 10).
- Authenticate the dataPassive Authentication has three parts: validate a certificate path from a trust anchor to the Document Signer certificate, verify the signature of the Document Security Object, and hash each data group that was read and compare the result with the signed value (Part 11, section 5.1.1).
- Authenticate the chipActive Authentication, Chip Authentication or PACE with Chip Authentication Mapping, optional in the eMRTD application; Chip Authentication is required for LDS2 (Part 11, Table 1). They address what Passive Authentication does not, an exact copy of the chip content or a substituted chip (Part 11, section 6). Active Authentication supports the conclusion that chip and document belong together only after the visual MRZ has been compared with Data Group 1, Data Group 15 has been authenticated by Passive Authentication, and the challenge-response has succeeded (section 6.1.6).
- Protect sensitive dataTerminal Authentication limits access to sensitive data, such as secondary biometrics, to terminals that prove they are entitled to it. The standard marks it conditional, and its implementation is required for LDS2 applications (Part 11, section 7.1).
The chain of trust
Each issuing State establishes a single Country Signing CA, the CSCA. It issues certificates to Document Signers, and a Document Signer signs the Document Security Object of each document (Part 12). The Document Signer certificate is stored on the chip. A reader that holds the State's CSCA certificate as a trust anchor can validate the path from the anchor to the signature. The article on chip verification covers revocation lists, the ICAO Public Key Directory and the protocols in detail.
Honest limits
What a chip read does not prove
The standard says this itself.
A copy of the data
Passive Authentication proves the signed data is unchanged. It does not prevent an exact copy of the chip content or a substitution of the chip (Part 11, Table 1).
One measure among several
The ICAO standard assumes a chip check is not the sole measure for determining authenticity and says it should not be relied on as a single determining factor (Part 11, section 2).
A failed read is not a verdict
If the chip data cannot be used, for example after a certificate revocation or with an invalid signature, the document is not necessarily invalid. The receiving State may rely on other security features (Part 11, section 2).
Next
Tell us your documents and your markets
Describe the documents and the countries your users come from, and we will go through them with you.
Sources
Read on 27 October 2026.
- ICAO Doc 9303 Part 10, Logical Data Structure, eighth edition, with amendment No. 1 of 14 June 2024, International Civil Aviation Organization.
- ICAO Doc 9303 Part 11, Security Mechanisms for MRTDs, eighth edition, with amendments of 14 June 2024 and 23 February 2026.
- ICAO Doc 9303 Part 12, Public Key Infrastructure for MRTDs, eighth edition, with amendment No. 1 of 14 June 2024.
- BSI Technical Guideline TR-03110, Federal Office for Information Security, Germany.
- Council Regulation (EU) 2025/1208 of 12 June 2025 on strengthening the security of identity cards of Union citizens and of residence documents, Official Journal of the European Union, 20 June 2025 (ELI: http://data.europa.eu/eli/reg/2025/1208/oj).
- Judgment of the Court of Justice of 21 March 2024, Case C-61/22, and press release No 50/24 of the Court.
Questions, answered plainly
What is an NFC chip in a passport or ID card?
A small contactless integrated circuit built into the document. A reader held close to the document exchanges data with it by radio. The ICAO standard calls a travel document with such a chip an eMRTD, an electronic machine readable travel document.
What does NeuroVision's NFC chip reading do?
NeuroVision reads the NFC chip of identity documents. The data comes from the chip, not from a photo of the document. To go through your documents and markets, contact the team.
What is the MRZ, and what has the chip to do with it?
The MRZ, the machine readable zone, is the block of machine-readable lines printed on the document. A chip with access control opens only for a reader that knows access information derived from the document: for Basic Access Control the document number, the date of birth and the date of expiry from the MRZ, and for PACE a password derived from the MRZ or, optionally, the card access number printed on the document. ICAO Doc 9303 Part 11, section 4, says this information has to be retrieved optically or visually from the document and that an inspector must also be able to type it in. Older documents without chip access control exist, and the standard still requires inspection systems to support them.
What is a data group?
In the ICAO eMRTD structure, called LDS1, a data group is a file on the chip that holds one kind of data. Data Group 1 holds the MRZ information and Data Group 2 holds the face image, and both are mandatory. Data Group 14 and Data Group 15 are required when the security mechanisms they serve are implemented. The other groups, such as fingerprints, iris images and additional personal details, are optional.
What is the Document Security Object?
A file on the chip, digitally signed by the issuing State, that holds hash values of the data groups. A reader uses it to check that the data groups it read are unchanged.
What is Passive Authentication?
The process in which a reader checks the data it read from the chip against the issuing State's signature. Part 11, section 5.1.1, has three parts: the reader builds and validates a certificate path from a trust anchor to the Document Signer certificate; it verifies the signature of the Document Security Object with the Document Signer public key; and it hashes the contents of each data group it read and compares the result with the hash value in the Document Security Object. The standard says this proves that the contents of the Document Security Object and of the data groups are authentic and not changed. It does not prevent an exact copy of the chip or a substitution of the chip.
What is Active Authentication?
An optional mechanism in which the reader sends the chip a challenge and the chip signs it with a private key stored in the chip. The matching public key is in Data Group 15. Part 11, section 6.1.6, concludes that the chip and the physical document belong together only after three things: the visual MRZ has been compared with Data Group 1, whose authenticity Passive Authentication has checked; Passive Authentication has also proven the authenticity of Data Group 15; and the challenge-response has succeeded.
What is the difference between BAC and PACE?
Both open the chip with a key based on the printed document. Basic Access Control, BAC, uses symmetric cryptography only. Password Authenticated Connection Establishment, PACE, uses asymmetric cryptography and gives strong session keys that do not depend on the strength of the password. The standard says PACE offers better protection against eavesdropping than BAC.
Can a chip be copied?
The data on a chip can be copied exactly. The ICAO standard says Passive Authentication does not prevent an exact copy or a substitution of the chip, and it defines Active Authentication and Chip Authentication to address substitution.
Does a chip read replace the other document checks?
The ICAO standard assumes that a chip check is not the sole measure for determining authenticity, and says it should not be relied on as a single determining factor. A failed chip check does not necessarily invalidate a document either: the receiving State may rely on other security features.