What ETIAS is, and why the 2027 date keeps moving
ETIAS, the European Travel Information and Authorisation System, is the EU's planned travel authorisation for visa-free visitors, a lighter and cheaper step up from a Schengen visa. You apply online, no consulate visit is needed and no biometrics are collected, and it costs a fraction of a visa[4]. The most common confusion is the word visa. ETIAS is not one. Visa-exempt nationals, from the US, the UK, Canada, Australia and Japan among dozens more, will need it to enter Spain for a short stay, while travellers who already need a Schengen visa keep needing the full thing.
The state of play in late 2026 is deliberately unglamorous: the system is not in operation and no applications are being collected, and the EU says it will announce the start date only several months prior to its launch[5]. An earlier target in the last quarter of 2026 has been removed from the official site, and reporting now suggests travellers will not need a permit before 2027 at the earliest[6]. Plan around a phased rollout rather than a fixed countdown, and treat any apply now prompt as wrong, because there is nothing to apply for yet.
ETIAS and the EES are easy to confuse because they meet at the border together. The EES is the biometric register that already records your comings and goings at the external border; ETIAS is the background check that sits behind it, cleared before you travel and linked to your passport. When both are running, the border system reads the two in combination, which is why the pair are almost always announced in the same breath.
When it does go live, the fee will be €20, up from the €7 first announced[1]. That is the whole financial commitment, and it is set once: a new passport is the only thing that forces a fresh application.
The arrival: Málaga airport, EES gates, then the AVE
For almost every long-haul visitor, the trip to Córdoba begins not at a station in the city but at Málaga-Costa del Sol airport, the region's main international gateway. Because Spain sits inside the Schengen Area, you clear the external border the moment you land there; once you are through, Córdoba is an internal journey.
Your ETIAS authorisation, once it exists, will be checked together with your travel documents by the border guards at that crossing[7]. From April 2026 the same check has run through the EES, the Entry/Exit System, an automated register that records your name, travel-document data, biometric data such as fingerprints and a captured facial image, and the date and place of entry and exit[8]. On a first entry you provide your passport information, facial image and fingerprints at the border; on later visits a quick verification is enough, and some countries use self-service kiosks[9]. This is the standard Schengen rule of first point of entry: you are checked where you enter the area, not where you sleep.
Explore nearby · Monument
Mezquita-Catedral de Córdoba
856 columns, 1,300 years of Islamic and Christian history. UNESCO monument in Córdoba, Andalusia. Red-and-white arches, Byzantine mosaics, a Renaissance nave.
From Málaga you take the AVE high-speed train. Renfe runs AVE, Avlo and Avant services on the line, city centre to city centre[10], and the quickest of them covers the run in about 49 minutes[11], so most trips land just under the hour. Because you have already cleared the Schengen border at the airport, the rail journey is a domestic hop with no further checks, just olive groves and the climb into the Guadalquivir valley before the platform at Córdoba's María Zambrano station, a short ride or walk from the historic centre. For the full range of ways in, beyond this same rail corridor, see our guide to getting to Córdoba.
The biometric border step that now greets every visa-free arrival at Málaga before the AVE north to Córdoba.
Leave a comfortable margin on arrival day, because the chain is longer than the flight. You clear the EES queue at the airport, make your way from the terminal to the train, and only then board the AVE. On a first visit, budget two hours from landing to a seat on the train, and remember the corridor is a busy tourist route in peak season, so book the service you want rather than turning up and hoping.
The 90/180-day rule on an Andalusia itinerary
A Córdoba trip usually travels in company. Most visitors land at Málaga, spend a few days, and roll on to Seville or Granada, which is exactly where the 90/180-day rule bites. ETIAS and the EES both work to the same short-stay limit: a visa-free traveller may stay up to 90 days in any 180-day period across the whole Schengen Area[3]. The key word is whole: a week in Málaga, four days in Córdoba and a weekend in Seville are not three separate allowances but one single clock running against the same 90 days.
The EES now keeps that clock for you automatically, recording each entry and exit electronically[12] and flagging overstayers in place of the old paper stamps. For a holiday of a week or two this is a non-issue, but it matters if you are linking a longer trip or returning within the same rolling 180 days, so keep a rough tally across the whole itinerary rather than just the Córdoba leg. For day-to-day planning once you are here, our Córdoba practical info covers transport, opening hours and the rest.
Here is how the count plays out in practice. Land at Málaga on the 1st and fly home from Granada on the 14th, with Córdoba and Seville in between, and every one of those days draws from the same 90-day allowance, day trips included. Because the 180-day window rolls forward, the habit that works is to note the calendar dates of each entry and exit rather than a running total, and to count backwards over the previous six months before any new arrival.
The scam sites: how fake ETIAS applications work
The sharpest risk in all of this is not the EU's timeline but the fake application sites that already exist. The EU has warned that many websites claim to be the official ETIAS application page, using the official logo and in some cases collecting travellers' personal data[13]. Because the system is not yet live, any site that lets you apply or reserve an authorisation today is either phishing for money or harvesting passport details, and several claim to have processed applications that cannot exist yet. The EU's own guidance is blunt: any current site other than the official one should not be trusted[14], and scam sites routinely charge well above the €20 fee[19] while inventing urgency to push you through a fake form.
When ETIAS does go live, applications will be accepted only through the official website and mobile app[15], and nothing else. Type the address yourself rather than following a link, treat unsolicited offers to fast-track your authorisation as the scams they are, and guard your passport details the way you would any document. Staying safe with your data on the road is covered in our Córdoba safety tips.
Never pay a third party to apply
ETIAS costs €20 and is applied for only on the official EU website and app. Any agency, travel site or fast-track service that offers to file your application for a fee is not the EU and has no right to charge you. If it asks for payment or a passport scan before the official launch, walk away.
The playbook is consistent. A plausible domain, an official-looking shield, a notice that your authorisation is expiring, and a card form that collects your details before anything is verified. Some charge several times the official fee; others harvest enough passport data to fuel identity fraud. None of them can produce a genuine authorisation, because none exists yet.
Before you fly: what to do now, what to wait for
Right now the correct action is to do very little. Do not apply for ETIAS, because there is nothing to apply for; do not pay anyone who offers to; and do check the official page when you book, because an announced start date is the one thing that could change your plans[5]. When applications do open, most are processed within minutes, with a decision normally within four days and up to 14 or 30 more if extra information or an interview is requested[16], so a few weeks of lead time is plenty rather than months.
After launch the EU has promised a transitional period of at least six months, plus a grace period, before the requirement is fully enforced[17], which takes the pressure off early 2027 travellers. Note too that a valid authorisation does not by itself guarantee entry: border guards still verify that you meet the entry conditions on arrival[18]. And because your authorisation is tied to your passport, renew the document before you apply and you will not need a second application later.
Recommended tours
Tours are selected for quality, not commission. We earn a small fee if you book — at no extra cost to you.
Book your arrival with the border in mind: give yourself room for the biometric step at Málaga, then the short AVE hop north. If this is your first visit, our first-time visitor tips run through what to sort before you arrive.
Deep dive · Article
10 Mistakes to Avoid on Your First Trip to Córdoba
Ten costly mistakes first-time visitors make in Córdoba, from walk-up Mezquita queues to misjudging Patios Festival dates, and how to avoid them before you fly.
Before you fly, run a short pre-departure list:
- Check the official ETIAS page for an announced start date before you book.
- Apply only through the official website or app once it is live, never through a third party.
- Count your Schengen days across the whole itinerary, not just the Córdoba leg.
- Confirm your passport will be valid for the entire trip, since the authorisation attaches to that document.
- Give arrival day a buffer for the EES biometric step before your train north.