eIDAS vs ETSI EN 319 401 legal framework vs trust-service policy standard

Applies to notified electronic identification schemes, European Digital Identity Wallets, and trust service providers established in the Union, with separate rules for qualified and non-qualified trust services.

Applies as a general TSP policy and security requirements standard for qualified and non-qualified trust services; service-specific ETSI standards can add further requirements.

Start with eIDAS to classify the legal service and status, then use EN 319 401 to identify the baseline control evidence for the provider.

Defines qualified status, trusted-list consequences, liability rules, legal effects for electronic signatures and related trust services, and supervisory withdrawal of qualified status when requirements are not met.

Does not grant legal status by itself; it documents policy and security requirements that can support conformity assessment and operational assurance.

Do not tell customers that EN 319 401 conformance alone makes a service qualified. Qualified service status depends on the eIDAS supervisory and trusted-list route.

A provider intending to start a qualified trust service notifies the supervisory body with a conformity assessment report; qualified services may start after qualified status is indicated in the trusted lists.

Requires provider-controlled documentation such as trust service practice statements, terms and conditions, security policy, and risk treatment evidence that can feed the conformity assessment.

Treat the ETSI evidence pack as input to assessment, not as the final market-access gate for a qualified trust service.

QTSPs are audited at their own expense at least every 24 months by a conformity assessment body and submit the resulting conformity assessment report to the supervisory body within three working days of receipt.

EN 319 401 references conformity assessment bodies and provides requirement-level material that an assessor can test, including risk assessment, security policy, logs, compliance, continuity, and suppliers.

Build audit workpapers around requirement evidence, but track eIDAS audit timing, report submission, and supervisory-body communication separately.

For qualified providers, eIDAS requires relevant information concerning data issued and received to be recorded and kept accessible for an appropriate period, including after activities cease, to support legal evidence and service continuity.

EN 319 401 requires evidence such as practice statements, terms, log retention periods, risk assessments, incident documentation, continuity records, termination planning, compliance evidence, and supplier assurance records.

Store legal-status records and control-operation records together only if metadata makes the purpose clear: legal evidence, trusted-list status, conformity assessment, security operation, continuity, or supplier assurance.

eIDAS requires notification of significant security breaches or disruptions affecting the trust service or maintained personal data without undue delay and no later than 24 hours after awareness.

EN 319 401 requires monitoring, logging, incident response, communication plans, stakeholder notification procedures, vulnerability handling, and documentation through the incident lifecycle.

Use EN 319 401 to operate detection and response, but use eIDAS to determine whether the supervisory body, affected persons, public, or other authorities must be notified.

Member State supervisory bodies supervise QTSPs, analyse conformity assessment reports, carry out audits or request assessments, grant or withdraw qualified status, and inform trusted-list bodies of status decisions.

ETSI EN 319 401 is not an enforcement authority. It creates a requirements baseline that management, assessors, supervisors, customers, and procurement teams can use to evaluate TSP controls.

Escalate legal-status failures through the supervisory route; escalate control gaps through remediation, assessment findings, customer assurance, or supplier governance.

eIDAS keeps the provider responsible for qualified-service compliance, change notifications, continuity, and supervisory outcomes even when technology or service components are supplied by others.

EN 319 401 requires supply-chain security policies, supplier-selection criteria, subcontracting agreements, security requirements, monitoring, component traceability, and audit or SLA mechanisms.

For QTSP procurement, require contracts to preserve eIDAS obligations while also demanding EN 319 401 evidence from suppliers and component providers.

eIDAS sets high-level trust-service duties, including security-risk management, qualified-service requirements, change notification, recordkeeping, and termination-plan expectations.

EN 319 401 makes those duties operational through management-approved risk assessment, trust service practice statement, terms and conditions, information security policy, access control, cryptographic controls, operations security, and network security.

Translate each legal duty into EN 319 401 control evidence where applicable, but keep the source label visible so an auditor can see which requirement is being tested.