British citizens may have to apply online and pay to travel to Europe after the UK leaves the EU, under plans being drawn up by the bloc for a visa waiver programme similar to the US system.

The European commission is due to unveil draft legislation for the EU travel information and authorisation system (Etias) later this year as part of a broader response to calls for greater security across the continent following recent terror attacks in France and Belgium.

The scheme would cover all visitors to the passport-free 26-nation Schengen zone – of which Britain is not a member – from countries that do not need a visa to enter, EU sources confirmed.

France and Germany both back a system based on the US ESTA scheme, under which visitors from countries that do not require full visas must apply online for permission to travel, preferably 72 hours before they leave, at a cost of $14 (£10).

Currently, as citizens of the EU but not part of Schengen, UK nationals must show a valid passport to enter the zone but can then travel freely within it. But after Brexit, British citizens could have to apply through the Etias scheme and pay to visit, legal experts said.

“In theory UK citizens, as third-country nationals, would certainly be subject to the obligations” of such a scheme, said Camino Mortera-Martinez, a research fellow specialising in justice and home affairs at the Centre for European Reform. “This will have to be part of the Brexit talks. It will all have to be negotiated.”

Steve Peers, a professor of EU law at the University of Essex, said he could envisage British holidaymakers having to apply online through a future EU electronic visa waiver scheme before travelling to Spain or France, for example.

“It’s going to annoy a lot of people,” he said. “We can ask for full free movement, but any arrangement is going to have to be reciprocal, so you have to ask what Nigel Farage and the others will accept. We have no idea what the rules will be.”

Peers said the only guarantee that British citizens would not be subject to any future EU ESTA-style system and instead would still be able, for example, to use fast-track channels at EU airports would be if the government negotiated a deal similar enough to Norway’s or Switzerland’s to satisfy Brussels on free movement.

British residents made more than 30m holiday trips to EU countries last year, according to the Office for National Statistics, with Spain (13m visits) and France (8.8m) the most popular destinations.

The EU plan is part of series of measures planned in the wake of the Paris attacks in January and November last year and the Brussels airport and metro bombings in March this year, which exposed serious failings in the EU’s external and internal border security systems.

The plan for a European ESTA was first outlined in 2011. The French interior minister, Bernard Cazeneuve, said last month that France supported “a European ESTA, like that in the US, Canada and Australia”.

Under the US system, introduced in 2009, immigration authorities assess whether a visitor is eligible to enter the country under its visa waiver programme before they arrive at the border.

Citing Brussels sources, the specialist EU news site Euractiv said the UK government was not involved in Etias, which is the responsibility of Dimitris Avramopoulos, the EU’s migration and home affairs commissioner, and not Britain’s future EU commissioner Julian King, who will take over the security portfolio.

The Schengen zone includes all 27 other EU member states except Ireland, which opted out like Britain, and Bulgaria, Croatia, Cyprus, and Romania, which are waiting to join the zone. Iceland, Liechtenstein, Norway and Switzerland have signed Schengen association agreements.

The British government has given no clear indication of the form its preferred Brexit model will take, but appears to be aiming for a bespoke agreement that would give it control over EU immigration, possibly at the expense of single market membership, rather than a deal based on that of Norway and Switzerland.

Negotiations with the EU are likely to be long and tough, with European leaders repeatedly stressing that privileged access to the EU’s single market will not be on offer unless Britain accepts the fundamental principle of free movement.

Britain has also so far refused to guarantee the residence and other rights of EU citizens already in Britain unless it receives assurances from the EU on the status of British nationals on the continent.

Mortera-Martinez said Etias “may be some time coming” and stressed that that in practice Britain’s future deal with the EU would almost certainly include some form of provision for free travel – as opposed to the right to live and work – on the continent. But the free travel question will be one of many bargaining chips.

“Britain is a neighbouring country, it is a safe country, this would be very bad for business and there would always be a possibility of retaliation,” Mortera-Martinez said. “But this question will have to be dealt with. The two are not remotely comparable of course, but after Brexit Britain will be a third country like Turkey.”

The Paris and Brussels attacks exposed the ease with which even people flagged by police and intelligence services can move around the Schengen zone once they have crossed the EU’s external border, prompting France and some other countries to temporarily reinstate internal border controls.

Among a raft of new security measures, the EU has already adopted a passenger name record, obliging airlines to hand EU countries their passengers’ data, and is working on an advanced entry-exit system aimed at registering all border crossings by third-country nationals in the Schengen area.