Abstract The European Travel Information and Authorisation System (ETIAS) will profile visa- exempt third-country nationals using a screening rules algorithm to make automated predictive risk assessments. By using the screening rules algorithm as a case study, this article analyses if the ETIAS Regulation, and the legal safeguards it establishes for the decision-making process, comply with formal and substantive legality requirements as defined by the Venice Commission and the Court of Justice of the European Union. Three legality challenges are identified: [1] The regulatory design of ETIAS raises issues in relation to the foreseeability, clarity and accessibility of law, as well as insufficient limits to discretion. [2] The ETIAS screening rules algorithm represents a development towards a new form of arbitrariness through ‘algorithmic discretion’. [3] The safeguard of manual (human) processing in case of a ‘hit’ is not a panacea for the identified legality challenges.