eIDAS checklist and evidence pack

Start by naming the actor and service because the evidence differs for a trust service provider, a qualified trust service provider, a signatory, a certificate issuer, a website-authentication certificate user, a wallet provider, an attestation provider, or an EUDI Wallet relying party.

For each product flow, record whether the evidence concerns electronic identification, an electronic signature or seal, a certificate, validation or preservation, registered delivery, electronic attestation of attributes, electronic archiving, an electronic ledger, or a wallet presentation.

Do not treat a provider's marketing page or certificate common name as proof of qualified status. For qualified trust services, keep the supervisory and trusted-list evidence that connects the provider, service type, service status, service digital identity, and relevant dates.

The evidence should make it possible for a reviewer to reproduce the qualified-status decision at the time the transaction, certificate, attestation, or signature was accepted.

For a qualified electronic signature, the evidence must support more than a cryptographic pass result. It must show that the supporting certificate was qualified and valid at signing time, the provider was qualified, the validation data matched the signed data, the signatory identity data was provided, any pseudonym was indicated, the signature creation device requirement was met, and the signed data remained intact.

Keep the validation policy, validation time, certificate chain, revocation data, timestamp evidence, and validation report together so the result can be reviewed after certificate expiry, revocation, or trust-list changes.

A relying party that requests wallet data should keep evidence for registration, request scope, user display, wallet authenticity checks, Person Identification Data (PID) and electronic attestation of attributes (EAA) validation, and pseudonym handling. The record should show what was registered for each intended use, what was requested from the wallet, why the service needed it, and what the user approved.

Commission Implementing Regulation (EU) 2025/848, as amended by Commission Implementing Regulation (EU) 2026/1730, supplies the harmonised national-register, access-certificate, registration-certificate, suspension, and record-keeping rules from 24 December 2026. The amended rules require automatic registration-certificate issuance without undue delay after registration. Until the applicable Member State process is operating, record the available national route and do not treat a draft application or test certificate as accepted registration.

For attestations, keep separate records for Person Identification Data, qualified electronic attestations of attributes, public-body authentic-source attestations, and non-qualified electronic attestations of attributes because the validation and legal-effect evidence is not the same.

The checklist is complete only when another reviewer can repeat the validation with the same sources, records, and timestamps. A screenshot without the underlying trusted-list source, certificate status response, validation report, or supervisory reference is not enough for a durable eIDAS evidence pack.

Reopen the pack when a service status changes, a certificate is revoked or suspended, a wallet provider or attestation provider loses the status relied on, a relying-party registration is suspended, cancelled, or changed, validation tooling or policy changes, or the product begins relying on a new qualified trust service. eIDAS does not set one universal retention period for every relying-party record; document the period from the applicable transaction, sector, limitation, evidence, data-protection, and contract rules. Article 24 separately requires a QTSP to keep relevant issued and received information accessible for as long as necessary after its activities cease.