eIDAS and are not substitutes. eIDAS is the binding EU framework for electronic identification, trust services, qualified status, supervision, trusted lists, liability, and legal effects. ETSI EN 319 401 V3.2.1 is a voluntary technical standard unless legislation, an assessment scheme, a contract, or another applicable rule makes particular requirements relevant. It sets baseline policy, security-management, and cybersecurity requirements for qualified and non-qualified trust service providers and is designed to support both eIDAS and NIS2 evidence.
Side-by-side comparison
eIDAS vs ETSI EN 319 401: what each one controls
This comparison helps assign legal, supervisory, audit, and operational evidence work without treating the EU regulation and ETSI standard as interchangeable.
Binding EU framework for electronic identification and trust services, including qualified trust-service status, supervision, conformity assessment reports, trusted lists, legal effects, liability, and notifications.
Second framework
ETSI EN 319 401
European Standard setting general policy and security requirements for trust service providers, including risk, practices, information security, incident handling, continuity, termination, compliance, and supply chain.
Applies to notified electronic identification schemes, European Digital Identity Wallets, and trust service providers established in the Union, with separate rules for qualified and non-qualified trust services.
Supports the eIDAS scope statement for eID schemes, wallets, and EU-established trust service providers.
trust service providers established in the Union
Applies as a general TSP policy and security requirements standard for qualified and non-qualified trust services; service-specific ETSI standards can add further requirements.
Defines qualified status, trusted-list consequences, liability rules, legal effects for electronic signatures and related trust services, and supervisory withdrawal of qualified status when requirements are not met.
Supports the standard's role as policy and security requirements rather than a legal grant of qualified status.
policies and practices
Do not tell customers that EN 319 401 conformance alone makes a service qualified. Qualified service status depends on the eIDAS supervisory and trusted-list route.
A provider intending to start a qualified trust service notifies the supervisory body with a conformity assessment report; qualified services may start after qualified status is indicated in the trusted lists.
Supports the notification, conformity assessment report, supervisory verification, and trusted-list start condition for qualified services.
after the qualified status has been indicated
Requires provider-controlled documentation such as trust service practice statements, terms and conditions, security policy, and risk treatment evidence that can feed the conformity assessment.
QTSPs are audited at their own expense at least every 24 months by a conformity assessment body and submit the resulting conformity assessment report to the supervisory body within three working days of receipt.
Supports the QTSP audit frequency and conformity assessment report submission requirement.
at least every 24 months
EN 319 401 references conformity assessment bodies and provides requirement-level material that an assessor can test, including risk assessment, security policy, logs, compliance, continuity, and suppliers.
For qualified providers, eIDAS requires relevant information concerning data issued and received to be recorded and kept accessible for an appropriate period, including after activities cease, to support legal evidence and service continuity.
Supports the qualified-provider recordkeeping purpose for legal proceedings and continuity, including after cessation.
providing evidence in legal proceedings
EN 319 401 requires evidence such as practice statements, terms, log retention periods, risk assessments, incident documentation, continuity records, termination planning, compliance evidence, and supplier assurance records.
Supports the specific operational evidence categories for TSP controls and assessments.
provide evidence
Store legal-status records and control-operation records together only if metadata makes the purpose clear: legal evidence, trusted-list status, conformity assessment, security operation, continuity, or supplier assurance.
The former eIDAS Article 19 24-hour breach rule was deleted with effect from 18 October 2024. Trust service providers must determine their current risk-management and incident-reporting duties under eIDAS Articles 19a and 24(2)(fa)-(fb), NIS2, national transposition, and Commission Implementing Regulation (EU) 2024/2690; eIDAS also continues to govern trust-service status and supervision.
Confirms deletion of the former eIDAS Article 19 from 18 October 2024 and supplies the NIS2 incident-reporting framework that applies alongside current eIDAS Articles 19a and 24(2)(fb).
Article 19 is deleted
EN 319 401 requires monitoring, logging, incident response, communication plans, stakeholder notification procedures, vulnerability handling, and documentation through the incident lifecycle, but it does not replace the NIS2 significance test or reporting route.
Supports the operational incident-management evidence categories: monitoring, logs, response procedures, reporting, communications, and post-incident records.
Vulnerabilities and Incident management
Use EN 319 401 to operate detection and response, then assess the current eIDAS and NIS2 notification duties separately. Identify each applicable significance test, deadline, recipient, and national reporting route; one notification does not automatically satisfy both regimes.
Member State supervisory bodies supervise QTSPs, analyse conformity assessment reports, carry out audits or request assessments, grant or withdraw qualified status, and inform trusted-list bodies of status decisions.
Supports the supervisory-body responsibilities for QTSPs, assessment reports, audits, qualified status, and trusted-list updates.
grant qualified status
is not an enforcement authority. It creates a requirements baseline that management, assessors, supervisors, customers, and procurement teams can use to evaluate TSP controls.
Supports the standard's role as an auditable requirements baseline rather than a public enforcement route.
Compliance
Escalate legal-status failures through the supervisory route; escalate control gaps through remediation, assessment findings, customer assurance, or supplier governance.
eIDAS keeps the provider responsible for qualified-service compliance, change notifications, continuity, and supervisory outcomes even when technology or service components are supplied by others.
eIDAS sets trust-service status and operation duties, including qualified-service requirements, risk management, incident and change notification, recordkeeping, and termination-plan expectations. NIS2 supplies additional binding cybersecurity risk-management duties for trust service providers.
Supports the high-level legal duties for security, changes, records, and termination in trust-service operation.
termination plan
EN 319 401 V3.2.1 provides operational requirements for management-approved risk assessment, trust service practice statements, terms and conditions, information security policy, access control, cryptographic controls, operations security, network security, and supply-chain security.
Supports the listed operational control domains and the requirement for management-approved risk assessment.
management shall approve the risk assessment
Translate each legal duty into EN 319 401 control evidence where applicable, but keep the source label visible so an auditor can see which requirement is being tested.
Supports mapping legal duties to concrete policy, practice, security, and risk-treatment evidence.
security requirements and operational procedures
Scope boundary
eIDAS Regulation
Applies to notified electronic identification schemes, European Digital Identity Wallets, and trust service providers established in the Union, with separate rules for qualified and non-qualified trust services.
Supports the eIDAS scope statement for eID schemes, wallets, and EU-established trust service providers.
trust service providers established in the Union
ETSI EN 319 401
Applies as a general TSP policy and security requirements standard for qualified and non-qualified trust services; service-specific ETSI standards can add further requirements.
Supports using the standard for TSP control evidence after legal scoping.
trust service policy
Legal status and assurance
eIDAS Regulation
Defines qualified status, trusted-list consequences, liability rules, legal effects for electronic signatures and related trust services, and supervisory withdrawal of qualified status when requirements are not met.
Supports the standard's role as policy and security requirements rather than a legal grant of qualified status.
policies and practices
Operational implication
Do not tell customers that EN 319 401 conformance alone makes a service qualified. Qualified service status depends on the eIDAS supervisory and trusted-list route.
Supports the point that qualified trust services may begin only after trusted-list indication.
trusted lists
Qualified-service entry and assessment documentation
eIDAS Regulation
A provider intending to start a qualified trust service notifies the supervisory body with a conformity assessment report; qualified services may start after qualified status is indicated in the trusted lists.
Supports the notification, conformity assessment report, supervisory verification, and trusted-list start condition for qualified services.
after the qualified status has been indicated
ETSI EN 319 401
Requires provider-controlled documentation such as trust service practice statements, terms and conditions, security policy, and risk treatment evidence that can feed the conformity assessment.
Supports the need for operational policy documentation before assessment.
terms and conditions
Audit and conformity assessment
eIDAS Regulation
QTSPs are audited at their own expense at least every 24 months by a conformity assessment body and submit the resulting conformity assessment report to the supervisory body within three working days of receipt.
Supports the QTSP audit frequency and conformity assessment report submission requirement.
at least every 24 months
ETSI EN 319 401
EN 319 401 references conformity assessment bodies and provides requirement-level material that an assessor can test, including risk assessment, security policy, logs, compliance, continuity, and suppliers.
Supports the supervisory-review context for QTSP assessments under eIDAS Article 20.
pursuant to Art.20
Evidence record
eIDAS Regulation
For qualified providers, eIDAS requires relevant information concerning data issued and received to be recorded and kept accessible for an appropriate period, including after activities cease, to support legal evidence and service continuity.
Supports the qualified-provider recordkeeping purpose for legal proceedings and continuity, including after cessation.
providing evidence in legal proceedings
ETSI EN 319 401
EN 319 401 requires evidence such as practice statements, terms, log retention periods, risk assessments, incident documentation, continuity records, termination planning, compliance evidence, and supplier assurance records.
Supports the specific operational evidence categories for TSP controls and assessments.
provide evidence
Operational implication
Store legal-status records and control-operation records together only if metadata makes the purpose clear: legal evidence, trusted-list status, conformity assessment, security operation, continuity, or supplier assurance.
Supports including log retention, incident documentation, compliance evidence, and supplier records in the evidence model.
event logs are retained
Incident and breach requirements
eIDAS Regulation
The former eIDAS Article 19 24-hour breach rule was deleted with effect from 18 October 2024. Trust service providers must determine their current risk-management and incident-reporting duties under eIDAS Articles 19a and 24(2)(fa)-(fb), NIS2, national transposition, and Commission Implementing Regulation (EU) 2024/2690; eIDAS also continues to govern trust-service status and supervision.
Confirms deletion of the former eIDAS Article 19 from 18 October 2024 and supplies the NIS2 incident-reporting framework that applies alongside current eIDAS Articles 19a and 24(2)(fb).
Article 19 is deleted
ETSI EN 319 401
EN 319 401 requires monitoring, logging, incident response, communication plans, stakeholder notification procedures, vulnerability handling, and documentation through the incident lifecycle, but it does not replace the NIS2 significance test or reporting route.
Supports the operational incident-management evidence categories: monitoring, logs, response procedures, reporting, communications, and post-incident records.
Vulnerabilities and Incident management
Operational implication
Use EN 319 401 to operate detection and response, then assess the current eIDAS and NIS2 notification duties separately. Identify each applicable significance test, deadline, recipient, and national reporting route; one notification does not automatically satisfy both regimes.
Supports using the standard for incident operating procedures while reserving legal notification decisions for applicable law.
supervisory authorities and CSIRTs
Enforcement
eIDAS Regulation
Member State supervisory bodies supervise QTSPs, analyse conformity assessment reports, carry out audits or request assessments, grant or withdraw qualified status, and inform trusted-list bodies of status decisions.
Supports the supervisory-body responsibilities for QTSPs, assessment reports, audits, qualified status, and trusted-list updates.
grant qualified status
ETSI EN 319 401
is not an enforcement authority. It creates a requirements baseline that management, assessors, supervisors, customers, and procurement teams can use to evaluate TSP controls.
Supports the standard's role as an auditable requirements baseline rather than a public enforcement route.
Compliance
Operational implication
Escalate legal-status failures through the supervisory route; escalate control gaps through remediation, assessment findings, customer assurance, or supplier governance.
Supports keeping supervisory issues separate from internal control remediation.
facilitating the implementation
Provider responsibility and supply-chain controls
eIDAS Regulation
eIDAS keeps the provider responsible for qualified-service compliance, change notifications, continuity, and supervisory outcomes even when technology or service components are supplied by others.
Supports contract controls and audit mechanisms for outsourced or supplier-supported trust-service components.
documented agreement
Legal duties and operational requirements
eIDAS Regulation
eIDAS sets trust-service status and operation duties, including qualified-service requirements, risk management, incident and change notification, recordkeeping, and termination-plan expectations. NIS2 supplies additional binding cybersecurity risk-management duties for trust service providers.
Supports the high-level legal duties for security, changes, records, and termination in trust-service operation.
termination plan
ETSI EN 319 401
EN 319 401 V3.2.1 provides operational requirements for management-approved risk assessment, trust service practice statements, terms and conditions, information security policy, access control, cryptographic controls, operations security, network security, and supply-chain security.
Supports the listed operational control domains and the requirement for management-approved risk assessment.
management shall approve the risk assessment
Operational implication
Translate each legal duty into EN 319 401 control evidence where applicable, but keep the source label visible so an auditor can see which requirement is being tested.
Supports mapping legal duties to concrete policy, practice, security, and risk-treatment evidence.
security requirements and operational procedures
Practical decision rule
How should teams use the comparison?
For a new or changed trust service, first write the eIDAS classification: service type, qualified or non-qualified status, supervisory body, trusted-list consequence, notification duty, and legal-status evidence.
Then write the control plan: risk assessment owner, practice statement owner, terms owner, security-policy owner, incident owner, continuity owner, supplier owner, and evidence location.
Before audit or procurement review, cross-reference each shared artifact to both sources when it genuinely supports both, and leave it single-labelled when it supports only one side.
Supports the control-plan items for risk, practice statements, terms, security policy, incident handling, continuity, suppliers, and evidence.
TSP management and operation
1
Section 1
The short answer for trust-service teams
Use eIDAS to decide whether a service is a trust service, whether qualified status is involved, which supervisory body route applies, what must be notified, and when trusted-list status controls market availability.
Use V3.2.1 to build control evidence that a trust service provider can show during assessment or supervisory review: risk assessment, trust service practice statement, terms and conditions, security policy, logs, incident records, business continuity, termination planning, compliance evidence, and supplier governance. Service-specific ETSI standards and the applicable conformity-assessment scheme may add requirements.
A QTSP cannot treat EN 319 401 conformance as a replacement for eIDAS qualified status; eIDAS requires supervisory-body verification and trusted-list indication for qualified service provision.
A TSP cannot treat eIDAS scope analysis as an operational control set; EN 319 401 turns trust-service obligations into auditable management, security, incident, continuity, and supplier records.
The strongest reuse pattern is a single evidence pack with separate labels for the eIDAS article, ETSI requirement, owner, assessment status, and trusted-list or supervisory consequence.
Supports the operational-control side of the comparison: TSP risk assessment, practice statements, security policy, incidents, continuity, compliance, and supply chain.
General Policy Requirements for Trust Service Providers
2
Section 2
Where the frameworks overlap in practice
The overlap is where legal supervision needs technical and organisational evidence. eIDAS requires QTSP audits, conformity assessment reports, supervisory-body verification, qualified-status decisions, and trusted-list updates. NIS2 deleted the former eIDAS Article 19 on 18 October 2024, but current eIDAS Articles 19a and 24(2)(fa)-(fb) retain trust-service risk-management and 24-hour notification duties alongside NIS2. EN 319 401 V3.2.1 supplies a structured way to document controls relevant to both frameworks.
For example, eIDAS Article 20 audits and Article 21 initiation rely on conformity assessment and supervisory review. EN 319 401 points teams toward the material an assessor or supervisor will expect to see, such as approved practice statements, risk treatment, policy publication, incident procedures, logs, termination plans, and compliance records.
Keep the eIDAS record focused on legal status, supervisory communications, trusted-list state, notification obligations, and qualified-service permissions.
Keep the EN 319 401 record focused on requirement-level control design and operating evidence.
When the same artifact serves both, cite both sides separately; do not describe a standard requirement as if it were a statutory fine or a legal authorisation.
Supports the evidence categories used for assessor-ready TSP controls, including risk assessment, practice statements, incidents, compliance, and supply chain.
Supports the supervisory context for qualified trust services and Article 20 supervision without adding a separate legal obligation.
supervision of qualified trust service providers
3
Section 3
Evidence that should not be confused
An eIDAS evidence folder should answer legal and supervisory questions: is the provider qualified, is the service qualified, has the conformity assessment report been submitted, has the supervisory body granted or withdrawn status, and is the service shown on the trusted list. Cybersecurity risk and incident records should identify current eIDAS Articles 19a and 24(2)(fa)-(fb), NIS2, its national transposition, and Commission Implementing Regulation (EU) 2024/2690 as applicable sources rather than treating deleted eIDAS Article 19 as current law.
An EN 319 401 evidence folder should answer operational control questions: has management approved the risk assessment, are policy and practice statements maintained, are subscribers and relying parties given service terms, are logs reviewed, are incident procedures tested, are critical vulnerabilities handled, are termination arrangements documented, and are suppliers governed by security requirements and agreements.
Do not use an ETSI control checklist as proof that a qualified service may start; eIDAS ties that start to trusted-list indication.
Do not use a trusted-list entry as proof that every EN 319 401 control is operating effectively; keep control evidence current.
For procurement, require both legal status evidence and standard-based control evidence when buying qualified trust services or trust-service components.
Supports the need to distinguish qualified status, trusted-list indication, supervisory reports, and incident notification from control-level evidence.
Supports the operational evidence list for TSP risk, policies, terms, incidents, continuity, termination, compliance, and suppliers.
Supply chain
Recommended next step
Separate eIDAS status evidence from ETSI EN 319 401 control evidence
Sorena can help structure eIDAS and ETSI EN 319 401 records so legal, security, procurement, product, and audit reviewers can see which evidence supports qualified status, supervision, conformity assessment, incident handling, and TSP controls.
Primary standard source for general TSP policy and security requirements used to build assessment-ready operational evidence.
Supports the operational-control side of the comparison: TSP risk assessment, practice statements, security policy, incidents, continuity, compliance, and supply chain.
Supports the evidence categories used for assessor-ready TSP controls, including risk assessment, practice statements, incidents, compliance, and supply chain.
Show 17 more
Supports the operational evidence list for TSP risk, policies, terms, incidents, continuity, termination, compliance, and suppliers.
Supports the EN 319 401 scope statement for general security management and cybersecurity requirements for trust services.
Supports using the standard for TSP control evidence after legal scoping.
Supports the standard's role as policy and security requirements rather than a legal grant of qualified status.
Supports the TSP documentation and risk-treatment records that are relevant to assessment preparation.
Supports the need for operational policy documentation before assessment.
Supports the assessment-ready control domains used as audit workpaper structure.
Supports the specific operational evidence categories for TSP controls and assessments.
Supports including log retention, incident documentation, compliance evidence, and supplier records in the evidence model.
Supports the operational incident-management evidence categories: monitoring, logs, response procedures, reporting, communications, and post-incident records.
Supports using the standard for incident operating procedures while reserving legal notification decisions for applicable law.
Supports the standard's role as an auditable requirements baseline rather than a public enforcement route.
Supports the supplier, outsourcing, cloud, SLA, traceability, and audit-mechanism controls for TSP operations.
Supports contract controls and audit mechanisms for outsourced or supplier-supported trust-service components.
Supports the listed operational control domains and the requirement for management-approved risk assessment.
Supports mapping legal duties to concrete policy, practice, security, and risk-treatment evidence.
Supports the control-plan items for risk, practice statements, terms, security policy, incident handling, continuity, suppliers, and evidence.
"General Policy Requirements for Trust Service Providers"
More quoted passages
"Risk Assessment"
"Supply chain"
"qualified and non-qualified"
"trust service policy"
"policies and practices"
"Trust Service Practice statement"
"terms and conditions"
"conformity assessment bodies"
"provide evidence"
"event logs are retained"
"Vulnerabilities and Incident management"
"supervisory authorities and CSIRTs"
"Compliance"
"direct suppliers and service providers"
"documented agreement"
"management shall approve the risk assessment"
"security requirements and operational procedures"
Primary legal source for eIDAS trust-service scope, qualified status, supervisory bodies, conformity assessment reports, trusted lists, and trust-service incident notification.
Supports the legal distinction between trust services, qualified status, supervisory bodies, conformity assessment reports, and trusted lists.
Supports the supervision, QTSP audit, conformity assessment, initiation, and trusted-list claims used in this overlap section.
Show 13 more
Supports the need to distinguish qualified status, trusted-list indication, supervisory reports, and incident notification from control-level evidence.
Supports the eIDAS scope statement for eID schemes, wallets, and EU-established trust service providers.
Supports using eIDAS first for legal classification and qualified-status consequences.
Supports the legal-status, liability, supervisory withdrawal, and trusted-list aspects of eIDAS.
Supports the point that qualified trust services may begin only after trusted-list indication.
Supports the notification, conformity assessment report, supervisory verification, and trusted-list start condition for qualified services.
Supports the distinction between assessment inputs and the eIDAS trusted-list gate.
Supports the QTSP audit frequency and conformity assessment report submission requirement.
Supports the qualified-provider recordkeeping purpose for legal proceedings and continuity, including after cessation.
Supports the supervisory-body responsibilities for QTSPs, assessment reports, audits, qualified status, and trusted-list updates.
Supports provider responsibility for qualified-service duties and supervisory-facing outcomes.
Supports the high-level legal duties for security, changes, records, and termination in trust-service operation.
Supports the legal classification, supervisory, trusted-list, and notification items in the recommended use of the comparison.
"trust service providers"
More quoted passages
"trusted lists"
"conformity assessment report"
"qualified status"
"trust service providers established in the Union"
Primary source confirming that the former eIDAS Article 19 was deleted with effect from 18 October 2024 and supplying the NIS2 cybersecurity framework that applies alongside current eIDAS Articles 19a and 24(2)(fa)-(fb).
Confirms deletion of the former eIDAS Article 19 from 18 October 2024 and supplies the NIS2 incident-reporting framework that applies alongside current eIDAS Articles 19a and 24(2)(fb).