eIDAS and NIS2 for trust service providers

Covers the trust service and its legal status: electronic signatures, seals, timestamps, registered delivery, website authentication certificates, electronic attestations of attributes, electronic archiving, electronic ledgers, validation, preservation, and qualified variants where applicable.

Covers the provider as a cybersecurity-regulated entity. NIS2 includes trust service providers regardless of size where the entity is in the covered type, and qualified trust service providers are essential entities regardless of size.

Start with two classifications: the eIDAS service classification and the NIS2 entity classification. Do not treat every relying party or certificate user as a trust service provider.

The trust service provider or QTSP, its conformity assessment body, the eIDAS supervisory body, the trusted-list operator, and internal owners for trust-service policy, certificate or attestation operations, termination, and user terms.

The essential or important entity, its management body, cybersecurity leadership, incident handling, business continuity, supplier management, asset owners, and the NIS CSIRT or competent authority notification path.

Give eIDAS status and trust-service evidence to the trust-service owner; give NIS2 risk treatment, control effectiveness, and incident notification to cybersecurity governance owners.

The trigger is providing a trust service or seeking, keeping, changing, or terminating qualified status for a qualified trust service. eIDAS supervision also reacts to significant security breaches, loss of integrity, conformity assessment, and trusted-list status changes.

The trigger is being a NIS2-covered trust service provider or QTSP, then operating network and information systems for that service. A significant incident affecting trust-service provision triggers the NIS2 reporting path, with trust service providers subject to an early warning within 24 hours.

Run the legal-effect and qualified-status trigger separately from the cybersecurity incident trigger; one outage or compromise can activate both.

Requires trust-service rules: qualified-status process, conformity assessment reports, trustworthy systems and products, qualified-certificate or attestation data, terms and limitations, liability and termination arrangements, trusted-list updates, and Article 19 trust-service security measures.

Requires Article 20 management-body approval and training, Article 21 all-hazards cybersecurity measures, supplier and vulnerability controls, business continuity, cryptography, access control, asset management, cyber hygiene, and Article 23 significant-incident reporting.

Convert eIDAS duties into trust-service operating evidence and NIS2 duties into cybersecurity governance and control evidence; link them only where the same system or supplier supports both.

Service classification, qualified-status grant or withdrawal, conformity assessment reports, trust-service policy and practice statement, trusted-list status, certificate or attestation profile, user terms and limitations, notification evidence, and termination plan.

NIS2 entity classification, management-body approvals, risk analysis, information-system security policies, risk treatment plan, asset inventory, access-control records, supplier-security clauses, vulnerability handling, business-continuity tests, incident logs, and CSIRT or competent-authority notifications.

A shared evidence system is useful only if every item is tagged to the eIDAS obligation, the NIS2 obligation, or both.

Follows eIDAS service lifecycle events: starting a qualified service, submitting conformity assessment evidence, changing or ceasing qualified services, maintaining accessible records after cessation, handling security breaches or loss of integrity, and trusted-list updates.

Follows NIS2 governance and incident clocks: ongoing Article 21 measures, management-body oversight, and Article 23 reporting. For significant incidents, NIS2 requires an early warning within 24 hours, a 72-hour incident notification, and a final report within one month; trust service providers must notify within 24 hours where a significant incident affects trust-service provision.

Use the faster clock during incidents and keep separate reminders for eIDAS qualified-status evidence and NIS2 control assurance.

Uses eIDAS supervisory bodies for trust services. They supervise QTSPs through ex ante and ex post activities, analyse conformity assessment reports, carry out or request audits, grant or withdraw qualified status, update trusted-list status, and require remediation.

Uses NIS2 competent authorities and CSIRTs for cybersecurity supervision, reporting, guidance, risk-based supervisory work, and enforcement under national transposition. Essential and important entities have different supervisory treatment under NIS2.

Route trust-service status and trusted-list issues to the eIDAS supervisory path; route cybersecurity incidents and Article 21 control issues to the NIS2 path, while coordinating when authorities must exchange information.

eIDAS 2 recognises that trust service cybersecurity duties and NIS2 duties are complementary and calls for cooperation between eIDAS supervisory bodies and NIS2 competent authorities.

NIS2 requires Member State authorities to cooperate and exchange relevant information with eIDAS authorities, including for relevant incidents and cyber threats.

Build one coordination playbook for incidents and supervision, but keep the legal basis, authority, notification recipient, and evidence label visible for each duty.

If the question is whether the service is qualified, whether evidence supports legal effects, whether a trusted-list entry is correct, or whether a conformity assessment or termination plan is adequate, start with eIDAS.

If the question is whether management approved controls, whether network and information systems are protected, whether a supplier or vulnerability risk is treated, or whether an incident is significant and reportable, start with NIS2.

For a QTSP, assume both workstreams may be needed: eIDAS to preserve trust-service assurance and NIS2 to prove cybersecurity governance and incident response.