eIDAS and are not substitutes. eIDAS is the binding EU framework for electronic identification, trust services, qualified status, supervision, trusted lists, liability, and legal effects. ETSI EN 319 401 V3.2.1 is a voluntary technical standard unless legislation, an assessment scheme, a contract, or another applicable rule makes particular requirements relevant. It sets baseline policy, security-management, and cybersecurity requirements for qualified and non-qualified trust service providers and is designed to support both eIDAS and NIS2 evidence.
Side-by-side comparison
eIDAS vs ETSI EN 319 401: what each one controls
This comparison helps assign legal, supervisory, audit, and operational evidence work without treating the EU regulation and ETSI standard as interchangeable.
Binding EU framework for electronic identification and trust services, including qualified trust-service status, supervision, conformity assessment reports, trusted lists, legal effects, liability, and notifications.
Second framework
ETSI EN 319 401
European Standard setting general policy and security requirements for trust service providers, including risk, practices, information security, incident handling, continuity, termination, compliance, and supply chain.
Applies to notified electronic identification schemes, European Digital Identity Wallets, and trust service providers established in the Union, with separate rules for qualified and non-qualified trust services.
Applies as a general TSP policy and security requirements standard for qualified and non-qualified trust services; service-specific ETSI standards can add further requirements.
Defines qualified status, trusted-list consequences, liability rules, legal effects for electronic signatures and related trust services, and supervisory withdrawal of qualified status when requirements are not met.
Do not tell customers that EN 319 401 conformance alone makes a service qualified. Qualified service status depends on the eIDAS supervisory and trusted-list route.
A provider intending to start a qualified trust service notifies the supervisory body with a conformity assessment report; qualified services may start after qualified status is indicated in the trusted lists.
Requires provider-controlled documentation such as trust service practice statements, terms and conditions, security policy, and risk treatment evidence that can feed the conformity assessment.
QTSPs are audited at their own expense at least every 24 months by a conformity assessment body and submit the resulting conformity assessment report to the supervisory body within three working days of receipt.
EN 319 401 references conformity assessment bodies and provides requirement-level material that an assessor can test, including risk assessment, security policy, logs, compliance, continuity, and suppliers.
For qualified providers, eIDAS requires relevant information concerning data issued and received to be recorded and kept accessible for an appropriate period, including after activities cease, to support legal evidence and service continuity.
EN 319 401 requires evidence such as practice statements, terms, log retention periods, risk assessments, incident documentation, continuity records, termination planning, compliance evidence, and supplier assurance records.
Store legal-status records and control-operation records together only if metadata makes the purpose clear: legal evidence, trusted-list status, conformity assessment, security operation, continuity, or supplier assurance.
The former eIDAS Article 19 24-hour breach rule was deleted with effect from 18 October 2024. Trust service providers must determine their current risk-management and incident-reporting duties under eIDAS Articles 19a and 24(2)(fa)-(fb), NIS2, national transposition, and Commission Implementing Regulation (EU) 2024/2690; eIDAS also continues to govern trust-service status and supervision.
EN 319 401 requires monitoring, logging, incident response, communication plans, stakeholder notification procedures, vulnerability handling, and documentation through the incident lifecycle, but it does not replace the NIS2 significance test or reporting route.
Use EN 319 401 to operate detection and response, then apply NIS2 and the 2024 implementing regulation to decide whether, when, and where a cybersecurity incident must be reported.
Member State supervisory bodies supervise QTSPs, analyse conformity assessment reports, carry out audits or request assessments, grant or withdraw qualified status, and inform trusted-list bodies of status decisions.
is not an enforcement authority. It creates a requirements baseline that management, assessors, supervisors, customers, and procurement teams can use to evaluate TSP controls.
Escalate legal-status failures through the supervisory route; escalate control gaps through remediation, assessment findings, customer assurance, or supplier governance.
eIDAS keeps the provider responsible for qualified-service compliance, change notifications, continuity, and supervisory outcomes even when technology or service components are supplied by others.
eIDAS sets trust-service status and operation duties, including qualified-service requirements, risk management, incident and change notification, recordkeeping, and termination-plan expectations. NIS2 supplies additional binding cybersecurity risk-management duties for trust service providers.
EN 319 401 V3.2.1 provides operational requirements for management-approved risk assessment, trust service practice statements, terms and conditions, information security policy, access control, cryptographic controls, operations security, network security, and supply-chain security.
Translate each legal duty into EN 319 401 control evidence where applicable, but keep the source label visible so an auditor can see which requirement is being tested.
Applies to notified electronic identification schemes, European Digital Identity Wallets, and trust service providers established in the Union, with separate rules for qualified and non-qualified trust services.
Applies as a general TSP policy and security requirements standard for qualified and non-qualified trust services; service-specific ETSI standards can add further requirements.
Defines qualified status, trusted-list consequences, liability rules, legal effects for electronic signatures and related trust services, and supervisory withdrawal of qualified status when requirements are not met.
Do not tell customers that EN 319 401 conformance alone makes a service qualified. Qualified service status depends on the eIDAS supervisory and trusted-list route.
A provider intending to start a qualified trust service notifies the supervisory body with a conformity assessment report; qualified services may start after qualified status is indicated in the trusted lists.
Requires provider-controlled documentation such as trust service practice statements, terms and conditions, security policy, and risk treatment evidence that can feed the conformity assessment.
QTSPs are audited at their own expense at least every 24 months by a conformity assessment body and submit the resulting conformity assessment report to the supervisory body within three working days of receipt.
EN 319 401 references conformity assessment bodies and provides requirement-level material that an assessor can test, including risk assessment, security policy, logs, compliance, continuity, and suppliers.
For qualified providers, eIDAS requires relevant information concerning data issued and received to be recorded and kept accessible for an appropriate period, including after activities cease, to support legal evidence and service continuity.
EN 319 401 requires evidence such as practice statements, terms, log retention periods, risk assessments, incident documentation, continuity records, termination planning, compliance evidence, and supplier assurance records.
Store legal-status records and control-operation records together only if metadata makes the purpose clear: legal evidence, trusted-list status, conformity assessment, security operation, continuity, or supplier assurance.
The former eIDAS Article 19 24-hour breach rule was deleted with effect from 18 October 2024. Trust service providers must determine their current risk-management and incident-reporting duties under eIDAS Articles 19a and 24(2)(fa)-(fb), NIS2, national transposition, and Commission Implementing Regulation (EU) 2024/2690; eIDAS also continues to govern trust-service status and supervision.
EN 319 401 requires monitoring, logging, incident response, communication plans, stakeholder notification procedures, vulnerability handling, and documentation through the incident lifecycle, but it does not replace the NIS2 significance test or reporting route.
Use EN 319 401 to operate detection and response, then apply NIS2 and the 2024 implementing regulation to decide whether, when, and where a cybersecurity incident must be reported.
Member State supervisory bodies supervise QTSPs, analyse conformity assessment reports, carry out audits or request assessments, grant or withdraw qualified status, and inform trusted-list bodies of status decisions.
is not an enforcement authority. It creates a requirements baseline that management, assessors, supervisors, customers, and procurement teams can use to evaluate TSP controls.
Escalate legal-status failures through the supervisory route; escalate control gaps through remediation, assessment findings, customer assurance, or supplier governance.
eIDAS keeps the provider responsible for qualified-service compliance, change notifications, continuity, and supervisory outcomes even when technology or service components are supplied by others.
eIDAS sets trust-service status and operation duties, including qualified-service requirements, risk management, incident and change notification, recordkeeping, and termination-plan expectations. NIS2 supplies additional binding cybersecurity risk-management duties for trust service providers.
EN 319 401 V3.2.1 provides operational requirements for management-approved risk assessment, trust service practice statements, terms and conditions, information security policy, access control, cryptographic controls, operations security, network security, and supply-chain security.
Translate each legal duty into EN 319 401 control evidence where applicable, but keep the source label visible so an auditor can see which requirement is being tested.
For a new or changed trust service, first write the eIDAS classification: service type, qualified or non-qualified status, supervisory body, trusted-list consequence, notification duty, and legal-status evidence.
Then write the control plan: risk assessment owner, practice statement owner, terms owner, security-policy owner, incident owner, continuity owner, supplier owner, and evidence location.
Before audit or procurement review, cross-reference each shared artifact to both sources when it genuinely supports both, and leave it single-labelled when it supports only one side.
Use eIDAS to decide whether a service is a trust service, whether qualified status is involved, which supervisory body route applies, what must be notified, and when trusted-list status controls market availability.
Use V3.2.1 to build control evidence that a trust service provider can show during assessment or supervisory review: risk assessment, trust service practice statement, terms and conditions, security policy, logs, incident records, business continuity, termination planning, compliance evidence, and supplier governance. Service-specific ETSI standards and the applicable conformity-assessment scheme may add requirements.
A QTSP cannot treat EN 319 401 conformance as a replacement for eIDAS qualified status; eIDAS requires supervisory-body verification and trusted-list indication for qualified service provision.
A TSP cannot treat eIDAS scope analysis as an operational control set; EN 319 401 turns trust-service obligations into auditable management, security, incident, continuity, and supplier records.
The strongest reuse pattern is a single evidence pack with separate labels for the eIDAS article, ETSI requirement, owner, assessment status, and trusted-list or supervisory consequence.
The overlap is where legal supervision needs technical and organisational evidence. eIDAS requires QTSP audits, conformity assessment reports, supervisory-body verification, qualified-status decisions, and trusted-list updates. NIS2 deleted the former eIDAS Article 19 on 18 October 2024, but current eIDAS Articles 19a and 24(2)(fa)-(fb) retain trust-service risk-management and 24-hour notification duties alongside NIS2. EN 319 401 V3.2.1 supplies a structured way to document controls relevant to both frameworks.
For example, eIDAS Article 20 audits and Article 21 initiation rely on conformity assessment and supervisory review. EN 319 401 points teams toward the material an assessor or supervisor will expect to see, such as approved practice statements, risk treatment, policy publication, incident procedures, logs, termination plans, and compliance records.
Keep the eIDAS record focused on legal status, supervisory communications, trusted-list state, notification obligations, and qualified-service permissions.
Keep the EN 319 401 record focused on requirement-level control design and operating evidence.
When the same artifact serves both, cite both sides separately; do not describe a standard requirement as if it were a statutory fine or a legal authorisation.
An eIDAS evidence folder should answer legal and supervisory questions: is the provider qualified, is the service qualified, has the conformity assessment report been submitted, has the supervisory body granted or withdrawn status, and is the service shown on the trusted list. Cybersecurity risk and incident records should identify current eIDAS Articles 19a and 24(2)(fa)-(fb), NIS2, its national transposition, and Commission Implementing Regulation (EU) 2024/2690 as applicable sources rather than treating deleted eIDAS Article 19 as current law.
An EN 319 401 evidence folder should answer operational control questions: has management approved the risk assessment, are policy and practice statements maintained, are subscribers and relying parties given service terms, are logs reviewed, are incident procedures tested, are critical vulnerabilities handled, are termination arrangements documented, and are suppliers governed by security requirements and agreements.
Do not use an ETSI control checklist as proof that a qualified service may start; eIDAS ties that start to trusted-list indication.
Do not use a trusted-list entry as proof that every EN 319 401 control is operating effectively; keep control evidence current.
For procurement, require both legal status evidence and standard-based control evidence when buying qualified trust services or trust-service components.
Separate eIDAS status evidence from ETSI EN 319 401 control evidence
Sorena can help structure eIDAS and ETSI EN 319 401 records so legal, security, procurement, product, and audit reviewers can see which evidence supports qualified status, supervision, conformity assessment, incident handling, and TSP controls.
Confirms deletion of the former eIDAS Article 19 from 18 October 2024 and supplies the NIS2 incident-reporting framework that applies alongside current eIDAS Articles 19a and 24(2)(fb).