eIDAS vs NIS2 guideTrust services and cybersecurity
eIDAS and NIS2 for trust service providers
This comparison helps separate eIDAS trust-service obligations from NIS2 cybersecurity risk-management and incident-reporting duties for trust service providers and QTSPs.
The overlap is real but limited: eIDAS governs trust-service status, qualified service evidence, trusted lists, conformity assessment, trust-service risk and incident duties, and supervisory bodies; NIS2 governs cybersecurity governance, all-hazards controls, significant-incident reporting, and NIS competent authorities.
A sits under eIDAS for trust-service status and under NIS2 for cybersecurity. eIDAS decides whether a service is a trust service or qualified trust service, what evidence supports legal effects and qualified status, and how supervisory bodies and trusted lists work. NIS2 deleted the former eIDAS Article 19 on 18 October 2024, but current eIDAS Articles 19a and 24(2)(fa)-(fb) retain trust-service risk-management and 24-hour notification duties. NIS2 also governs risk-management measures, management-body oversight, significant-incident notification, and cybersecurity supervision, with Commission Implementing Regulation (EU) 2024/2690 supplying technical requirements and trust-service incident criteria.
Side-by-side comparison
eIDAS vs NIS2 for trust service providers: practical compliance differences
This comparison helps separate eIDAS trust-service and QTSP obligations from NIS2 cybersecurity governance, risk-management, and significant-incident duties.
Covers the trust service and its legal status: electronic signatures, seals, timestamps, registered delivery, website authentication certificates, electronic attestations of attributes, electronic archiving, electronic ledgers, validation, preservation, and qualified variants where applicable.
Supports eIDAS 2 scope additions for wallets, relying parties, electronic attestations of attributes, and cooperation with NIS2 authorities.
European Digital Identity Wallets
Covers the provider as a cybersecurity-regulated entity. NIS2 includes trust service providers regardless of size where the entity is in the covered type, and qualified trust service providers are essential entities regardless of size.
Supports NIS2 trust service provider scope, QTSP essential-entity classification, Article 21 controls, Article 23 reporting, and authority cooperation.
cybersecurity risk-management measures
Start with two classifications: the eIDAS service classification and the NIS2 entity classification. Do not treat every relying party or certificate user as a .
The or QTSP, its conformity assessment body, the eIDAS supervisory body, the trusted-list operator, and internal owners for trust-service policy, certificate or attestation operations, termination, and user terms.
The essential or important entity, its management body, cybersecurity leadership, incident handling, business continuity, supplier management, asset owners, and the NIS CSIRT or competent authority notification path.
Supports NIS2 trust service provider scope, QTSP essential-entity classification, Article 21 controls, Article 23 reporting, and authority cooperation.
cybersecurity risk-management measures
Give eIDAS status and trust-service evidence to the trust-service owner; give NIS2 risk treatment, control effectiveness, and incident notification to cybersecurity governance owners.
The trigger is providing a trust service or seeking, keeping, changing, or terminating qualified status for a qualified trust service. eIDAS supervision reacts to conformity-assessment findings, non-compliance, qualified-status changes, trusted-list changes, and the current Article 19a or Article 24 security and incident duties; significant incidents can also trigger NIS2 reporting.
The trigger is being a NIS2-covered or QTSP, then operating network and information systems for that service. A significant incident affecting trust-service provision triggers the NIS2 reporting path, with trust service providers subject to an early warning within 24 hours.
Requires trust-service rules: qualified-status process, conformity assessment reports, trustworthy systems and products, risk management, security-breach and disruption notifications under Articles 19a and 24, qualified-certificate or attestation data, terms and limitations, liability and termination arrangements, and trusted-list updates. The former Article 19 measures are no longer current law.
Supports NIS2 trust service provider scope, QTSP essential-entity classification, Article 21 controls, Article 23 reporting, and authority cooperation.
cybersecurity risk-management measures
Convert eIDAS duties into trust-service operating evidence and NIS2 duties into cybersecurity governance and control evidence; link them only where the same system or supplier supports both.
Service classification, qualified-status grant or withdrawal, conformity assessment reports, trust-service policy and practice statement, trusted-list status, certificate or attestation profile, user terms and limitations, notification evidence, and termination plan.
Follows eIDAS service lifecycle events: starting a qualified service, submitting conformity assessment evidence, changing or ceasing qualified services, maintaining accessible records after cessation, handling security breaches or loss of integrity, and trusted-list updates.
Follows NIS2 governance and incident clocks: ongoing Article 21 measures, management-body oversight, and Article 23 reporting. For significant incidents, NIS2 requires an early warning within 24 hours. The incident notification is ordinarily due within 72 hours, but a must submit it within 24 hours when the incident affects provision of its trust services. A final report is generally due within one month after that notification.
Uses eIDAS supervisory bodies for trust services. They supervise QTSPs through ex ante and ex post activities, analyse conformity assessment reports, carry out or request audits, grant or withdraw qualified status, update trusted-list status, and require remediation.
Uses NIS2 competent authorities and CSIRTs for cybersecurity supervision, reporting, guidance, risk-based supervisory work, and enforcement under national transposition. Essential and important entities have different supervisory treatment under NIS2.
Supports NIS2 trust service provider scope, QTSP essential-entity classification, Article 21 controls, Article 23 reporting, and authority cooperation.
cybersecurity risk-management measures
Route trust-service status and trusted-list issues to the eIDAS supervisory path; route cybersecurity incidents and Article 21 control issues to the NIS2 path, while coordinating when authorities must exchange information.
eIDAS 2 recognises that trust service cybersecurity duties and NIS2 duties are complementary and calls for cooperation between eIDAS supervisory bodies and NIS2 competent authorities.
Supports the eIDAS 2 position that trust service cybersecurity duties and NIS2 obligations are complementary and require authority cooperation.
Directive (EU) 2022/2555
NIS2 requires Member State authorities to cooperate and exchange relevant information with eIDAS authorities, including for relevant incidents and cyber threats.
Supports NIS2 trust service provider scope, QTSP essential-entity classification, Article 21 controls, Article 23 reporting, and authority cooperation.
cybersecurity risk-management measures
Build one coordination playbook for incidents and supervision, but keep the legal basis, authority, notification recipient, and evidence label visible for each duty.
If the question is whether the service is qualified, whether evidence supports legal effects, whether a trusted-list entry is correct, or whether a conformity assessment or termination plan is adequate, start with eIDAS.
If the question is whether management approved controls, whether network and information systems are protected, whether a supplier or vulnerability risk is treated, or whether an incident is significant and reportable, start with NIS2.
Supports NIS2 trust service provider scope, QTSP essential-entity classification, Article 21 controls, Article 23 reporting, and authority cooperation.
cybersecurity risk-management measures
For a QTSP, assume both workstreams may be needed: eIDAS to preserve trust-service assurance and NIS2 to prove cybersecurity governance and incident response.
Supports NIS2 trust service provider scope, QTSP essential-entity classification, Article 21 controls, Article 23 reporting, and authority cooperation.
cybersecurity risk-management measures
Scope and covered activity
eIDAS trust-service obligations
Covers the trust service and its legal status: electronic signatures, seals, timestamps, registered delivery, website authentication certificates, electronic attestations of attributes, electronic archiving, electronic ledgers, validation, preservation, and qualified variants where applicable.
Supports eIDAS 2 scope additions for wallets, relying parties, electronic attestations of attributes, and cooperation with NIS2 authorities.
European Digital Identity Wallets
NIS2 cybersecurity obligations
Covers the provider as a cybersecurity-regulated entity. NIS2 includes trust service providers regardless of size where the entity is in the covered type, and qualified trust service providers are essential entities regardless of size.
Supports NIS2 trust service provider scope, QTSP essential-entity classification, Article 21 controls, Article 23 reporting, and authority cooperation.
cybersecurity risk-management measures
Operational implication
Start with two classifications: the eIDAS service classification and the NIS2 entity classification. Do not treat every relying party or certificate user as a .
Supports NIS2 trust service provider scope, QTSP essential-entity classification, Article 21 controls, Article 23 reporting, and authority cooperation.
cybersecurity risk-management measures
Who must act
eIDAS trust-service obligations
The or QTSP, its conformity assessment body, the eIDAS supervisory body, the trusted-list operator, and internal owners for trust-service policy, certificate or attestation operations, termination, and user terms.
The essential or important entity, its management body, cybersecurity leadership, incident handling, business continuity, supplier management, asset owners, and the NIS CSIRT or competent authority notification path.
Supports NIS2 trust service provider scope, QTSP essential-entity classification, Article 21 controls, Article 23 reporting, and authority cooperation.
cybersecurity risk-management measures
Operational implication
Give eIDAS status and trust-service evidence to the trust-service owner; give NIS2 risk treatment, control effectiveness, and incident notification to cybersecurity governance owners.
Supports NIS2 trust service provider scope, QTSP essential-entity classification, Article 21 controls, Article 23 reporting, and authority cooperation.
cybersecurity risk-management measures
Trigger or threshold
eIDAS trust-service obligations
The trigger is providing a trust service or seeking, keeping, changing, or terminating qualified status for a qualified trust service. eIDAS supervision reacts to conformity-assessment findings, non-compliance, qualified-status changes, trusted-list changes, and the current Article 19a or Article 24 security and incident duties; significant incidents can also trigger NIS2 reporting.
The trigger is being a NIS2-covered or QTSP, then operating network and information systems for that service. A significant incident affecting trust-service provision triggers the NIS2 reporting path, with trust service providers subject to an early warning within 24 hours.
Supports NIS2 trust service provider scope, QTSP essential-entity classification, Article 21 controls, Article 23 reporting, and authority cooperation.
cybersecurity risk-management measures
Core obligations
eIDAS trust-service obligations
Requires trust-service rules: qualified-status process, conformity assessment reports, trustworthy systems and products, risk management, security-breach and disruption notifications under Articles 19a and 24, qualified-certificate or attestation data, terms and limitations, liability and termination arrangements, and trusted-list updates. The former Article 19 measures are no longer current law.
Supports NIS2 trust service provider scope, QTSP essential-entity classification, Article 21 controls, Article 23 reporting, and authority cooperation.
cybersecurity risk-management measures
Operational implication
Convert eIDAS duties into trust-service operating evidence and NIS2 duties into cybersecurity governance and control evidence; link them only where the same system or supplier supports both.
Supports NIS2 trust service provider scope, QTSP essential-entity classification, Article 21 controls, Article 23 reporting, and authority cooperation.
cybersecurity risk-management measures
Evidence and records
eIDAS trust-service obligations
Service classification, qualified-status grant or withdrawal, conformity assessment reports, trust-service policy and practice statement, trusted-list status, certificate or attestation profile, user terms and limitations, notification evidence, and termination plan.
Supports NIS2 trust service provider scope, QTSP essential-entity classification, Article 21 controls, Article 23 reporting, and authority cooperation.
cybersecurity risk-management measures
Timing and cadence
eIDAS trust-service obligations
Follows eIDAS service lifecycle events: starting a qualified service, submitting conformity assessment evidence, changing or ceasing qualified services, maintaining accessible records after cessation, handling security breaches or loss of integrity, and trusted-list updates.
Follows NIS2 governance and incident clocks: ongoing Article 21 measures, management-body oversight, and Article 23 reporting. For significant incidents, NIS2 requires an early warning within 24 hours. The incident notification is ordinarily due within 72 hours, but a must submit it within 24 hours when the incident affects provision of its trust services. A final report is generally due within one month after that notification.
Supports NIS2 trust service provider scope, QTSP essential-entity classification, Article 21 controls, Article 23 reporting, and authority cooperation.
cybersecurity risk-management measures
Enforcement or assurance route
eIDAS trust-service obligations
Uses eIDAS supervisory bodies for trust services. They supervise QTSPs through ex ante and ex post activities, analyse conformity assessment reports, carry out or request audits, grant or withdraw qualified status, update trusted-list status, and require remediation.
Uses NIS2 competent authorities and CSIRTs for cybersecurity supervision, reporting, guidance, risk-based supervisory work, and enforcement under national transposition. Essential and important entities have different supervisory treatment under NIS2.
Supports NIS2 trust service provider scope, QTSP essential-entity classification, Article 21 controls, Article 23 reporting, and authority cooperation.
cybersecurity risk-management measures
Operational implication
Route trust-service status and trusted-list issues to the eIDAS supervisory path; route cybersecurity incidents and Article 21 control issues to the NIS2 path, while coordinating when authorities must exchange information.
Supports NIS2 trust service provider scope, QTSP essential-entity classification, Article 21 controls, Article 23 reporting, and authority cooperation.
cybersecurity risk-management measures
Overlap and reuse
eIDAS trust-service obligations
eIDAS 2 recognises that trust service cybersecurity duties and NIS2 duties are complementary and calls for cooperation between eIDAS supervisory bodies and NIS2 competent authorities.
Supports the eIDAS 2 position that trust service cybersecurity duties and NIS2 obligations are complementary and require authority cooperation.
Directive (EU) 2022/2555
NIS2 cybersecurity obligations
NIS2 requires Member State authorities to cooperate and exchange relevant information with eIDAS authorities, including for relevant incidents and cyber threats.
Supports NIS2 trust service provider scope, QTSP essential-entity classification, Article 21 controls, Article 23 reporting, and authority cooperation.
cybersecurity risk-management measures
Operational implication
Build one coordination playbook for incidents and supervision, but keep the legal basis, authority, notification recipient, and evidence label visible for each duty.
Supports NIS2 trust service provider scope, QTSP essential-entity classification, Article 21 controls, Article 23 reporting, and authority cooperation.
cybersecurity risk-management measures
Practical decision rule
eIDAS trust-service obligations
If the question is whether the service is qualified, whether evidence supports legal effects, whether a trusted-list entry is correct, or whether a conformity assessment or termination plan is adequate, start with eIDAS.
If the question is whether management approved controls, whether network and information systems are protected, whether a supplier or vulnerability risk is treated, or whether an incident is significant and reportable, start with NIS2.
Supports NIS2 trust service provider scope, QTSP essential-entity classification, Article 21 controls, Article 23 reporting, and authority cooperation.
cybersecurity risk-management measures
Operational implication
For a QTSP, assume both workstreams may be needed: eIDAS to preserve trust-service assurance and NIS2 to prove cybersecurity governance and incident response.
Supports NIS2 trust service provider scope, QTSP essential-entity classification, Article 21 controls, Article 23 reporting, and authority cooperation.
cybersecurity risk-management measures
Practical decision rule
How should teams decide which workstream owns the issue?
Choose eIDAS first when the question concerns trust-service status, qualified status, trusted-list representation, legal effect, conformity assessment, trust-service terms, or eIDAS supervisory-body action.
Choose NIS2 first when the question concerns cybersecurity governance, network and information system risk, management-body approval, supplier security, vulnerability handling, cyber hygiene, business continuity, or significant-incident reporting.
Use both when a QTSP system, cloud provider, cryptographic component, identity-proofing flow, certificate service, attestation service, or incident affects the trust service and the cybersecurity of the systems used to provide it.
Keep one cross-reference table, but preserve separate evidence labels for eIDAS supervisory evidence and NIS2 risk-management or incident-reporting evidence.
Supports NIS2 trust service provider scope, QTSP essential-entity classification, Article 21 controls, Article 23 reporting, and authority cooperation.
cybersecurity risk-management measures
1
Section 1
What eIDAS controls and what NIS2 adds
eIDAS is the trust framework. It covers electronic identification, trust services, qualified trust services, electronic signatures, seals, timestamps, registered delivery services, website authentication certificates, electronic attestations of attributes, electronic archiving, related legal effects, and current trust-service risk and incident duties. For a QTSP, eIDAS evidence normally includes qualified-status decisions, conformity assessment reports, trusted-list entries, service practice statements, certificate or attestation profiles, relying-party terms, security-breach records, and termination arrangements.
NIS2 is the cybersecurity framework. It applies to trust service providers regardless of size where the entity is within the covered type, and it treats qualified trust service providers as essential entities. Its core work is Article 20 governance, Article 21 cybersecurity risk-management measures, Article 23 significant-incident reporting, and Member State supervision through NIS competent authorities, CSIRTs, and single points of contact.
Use eIDAS when the question is trust-service status, qualified status, legal effect, trust marks, trusted lists, conformity assessment, trust-service risk and incident duties, or trust-service supervision.
Use NIS2 when the question is cybersecurity governance, network and information system risk, all-hazards controls, supply-chain security, cyber hygiene, or significant-incident notification.
Use both where the same provider, system, supplier, or incident affects a trust service and the network and information systems used to provide it.
Grounds the NIS2 side of the comparison: trust service provider scope, essential-entity treatment for QTSPs, risk-management measures, and incident reporting.
cybersecurity risk-management measures
2
Section 2
Where the provider overlap starts
The overlap starts at the provider, not at every relying party or every certificate user. A relying party that merely accepts a signature, seal, certificate, attestation, or wallet credential is not automatically a under eIDAS or a trust service provider under NIS2. The provider analysis should identify the legal entity offering the trust service, the Member State of establishment or main supervisory route, and whether the service is qualified.
NIS2 also matters for non-qualified trust service providers because trust service providers are one of the size-independent categories in Article 2. Qualified trust service providers have an additional classification consequence: NIS2 Article 3 treats QTSPs as essential entities regardless of size.
Record the eIDAS service category first: qualified certificate, timestamp, registered delivery, electronic attestation of attributes, website authentication certificate, validation, preservation, archiving, electronic ledger, or another covered trust service.
Record whether the provider is qualified, because qualified status changes eIDAS supervision, trusted-list status, conformity-assessment evidence, and NIS2 essential-entity classification.
Do not classify customers, browsers, wallet users, or relying parties as providers unless they actually provide the trust service.
Supports the eIDAS classification distinction between trust services, qualified trust services, providers, and relying parties.
qualified trust service provider
3
Section 3
Security and incident duties do not collapse into one process
NIS2 deleted the former eIDAS Article 19 with effect from 18 October 2024. Do not treat that deleted provision as current law. Current eIDAS Articles 19a and 24(2)(fa)-(fb) still impose trust-service risk-management and 24-hour notification duties, while NIS2 separately governs cybersecurity risk management and significant-incident reporting.
NIS2 Article 21 requires essential and important entities to use appropriate and proportionate technical, operational, and organisational measures for network and information systems, based on an all-hazards approach. Article 23 requires an early warning within 24 hours and ordinarily an incident notification within 72 hours, but a must submit that incident notification within 24 hours when the significant incident affects provision of its trust services. The final report is generally due within one month after the incident notification, subject to the ongoing-incident rule.
Keep an eIDAS path for current Article 19a or Article 24 risk and notification duties, qualified status, conformity-assessment follow-up, trusted-list changes, trust-service continuity, and eIDAS supervisory action.
Keep the current NIS2 notification path for significant incidents, CSIRT or competent-authority notification, cross-border impact, early warning, the trust-service-provider 24-hour incident notification, intermediate updates, final reporting, and recipient communications.
Link the paths in the incident playbook so one event can produce current eIDAS and NIS2 notifications, as well as separate eIDAS status or supervisory consequences, without presenting deleted Article 19 as current law.
Maps the former eIDAS Article 19 and current Article 24 requirements to TSP controls; the Article 19 mapping is historical, while current eIDAS Articles 19a and 24 remain legal bases.
Security requirements applicable to trust service providers
Supports the separate NIS2 cybersecurity governance, Article 21 risk-management, and Article 23 reporting duties.
all-hazards approach
4
Section 4
What evidence should remain separate
A single control library can reference both laws, but the evidence labels should remain separate. eIDAS evidence proves the status and trustworthy operation of the trust service. NIS2 evidence proves cybersecurity governance, risk treatment, incident handling, supplier security, business continuity, training, access control, asset management, and security testing for the network and information systems used by the entity.
The most useful overlap evidence is operational rather than legal: system inventories, trust-service component maps, supplier registers, logging and monitoring records, vulnerability handling records, business continuity tests, incident post-reviews, and management approvals. Reuse those records only when the record explicitly names which eIDAS obligation and which NIS2 obligation it supports.
eIDAS file: qualified-status grant or withdrawal, conformity assessment report, trust-service policy and practice statement, trusted-list entry, certificate or attestation profile, terms and limitations, termination plan, and user notification evidence.
NIS2 file: management-body approval, Article 21 risk analysis and security policies, risk treatment plan, incident-handling procedure, business continuity and disaster recovery evidence, supplier-security clauses, vulnerability handling, access control, asset inventory, training, and notification records.
Joint file: cross-reference table showing which systems and suppliers support each trust service and which cybersecurity controls protect them.
Supports trust-service evidence areas such as risk assessment, information security policy, operations, incident management, supply chain, and termination.
Specifies technical and methodological NIS2 cybersecurity risk-management requirements for trust service providers and other digital infrastructure entities.
technical and methodological requirements
Recommended next step
Build one control map without merging the legal tests
Sorena can help trust service providers map eIDAS qualified-status, trusted-list, conformity-assessment, and trust-service evidence to NIS2 governance, Article 21 controls, and Article 23 incident reporting.
Primary NIS2 source for trust service provider scope, QTSP essential-entity status, management-body governance, Article 21 controls, and Article 23 reporting.
Grounds the NIS2 side of the comparison: trust service provider scope, essential-entity treatment for QTSPs, risk-management measures, and incident reporting.
Supports the NIS2 scope distinction: trust service providers are in scope regardless of size, and QTSPs are essential entities.
Show 2 more
Supports the separate NIS2 cybersecurity governance, Article 21 risk-management, and Article 23 reporting duties.
Supports NIS2 trust service provider scope, QTSP essential-entity classification, Article 21 controls, Article 23 reporting, and authority cooperation.
Grounds practical eIDAS trust-service evidence areas including risk assessment, information security policy, incident reporting, business continuity, supply-chain controls, and termination plans.
Maps the former eIDAS Article 19 and current Article 24 requirements to TSP controls; the Article 19 mapping is historical, while current eIDAS Articles 19a and 24 remain legal bases.
Supports trust-service evidence areas such as risk assessment, information security policy, operations, incident management, supply chain, and termination.
"General Policy Requirements for Trust Service Providers"
More quoted passages
"Security requirements applicable to trust service providers"
Specifies NIS2 technical and methodological cybersecurity risk-management requirements for trust service providers and significant-incident criteria for covered digital providers.
Specifies technical and methodological NIS2 cybersecurity risk-management requirements for trust service providers and other digital infrastructure entities.
Current eIDAS amendment source for the expanded trust-service framework and cooperation between eIDAS supervisory bodies and NIS2 competent authorities.