eIDAS vs NIS2 guideTrust services and cybersecurity
eIDAS and NIS2 for trust service providers
This comparison helps separate eIDAS trust-service obligations from NIS2 cybersecurity risk-management and incident-reporting duties for trust service providers and QTSPs.
The overlap is real but limited: eIDAS governs trust-service status, qualified service evidence, trusted lists, conformity assessment, trust-service risk and incident duties, and supervisory bodies; NIS2 governs cybersecurity governance, all-hazards controls, significant-incident reporting, and NIS competent authorities.
A sits under eIDAS for trust-service status and under NIS2 for cybersecurity. eIDAS decides whether a service is a trust service or qualified trust service, what evidence supports legal effects and qualified status, and how supervisory bodies and trusted lists work. NIS2 deleted the former eIDAS Article 19 on 18 October 2024, but current eIDAS Articles 19a and 24(2)(fa)-(fb) retain trust-service risk-management and 24-hour notification duties. NIS2 also governs risk-management measures, management-body oversight, significant-incident notification, and cybersecurity supervision, with Commission Implementing Regulation (EU) 2024/2690 supplying technical requirements and trust-service incident criteria.
Side-by-side comparison
eIDAS vs NIS2 for trust service providers: practical compliance differences
This comparison helps separate eIDAS trust-service and QTSP obligations from NIS2 cybersecurity governance, risk-management, and significant-incident duties.
Covers the trust service and its legal status: electronic signatures, seals, timestamps, registered delivery, website authentication certificates, electronic attestations of attributes, electronic archiving, electronic ledgers, validation, preservation, and qualified variants where applicable.
Covers the provider as a cybersecurity-regulated entity. NIS2 includes trust service providers regardless of size where the entity is in the covered type, and qualified trust service providers are essential entities regardless of size.
Start with two classifications: the eIDAS service classification and the NIS2 entity classification. Do not treat every relying party or certificate user as a .
The or QTSP, its conformity assessment body, the eIDAS supervisory body, the trusted-list operator, and internal owners for trust-service policy, certificate or attestation operations, termination, and user terms.
The essential or important entity, its management body, cybersecurity leadership, incident handling, business continuity, supplier management, asset owners, and the NIS CSIRT or competent authority notification path.
Give eIDAS status and trust-service evidence to the trust-service owner; give NIS2 risk treatment, control effectiveness, and incident notification to cybersecurity governance owners.
The trigger is providing a trust service or seeking, keeping, changing, or terminating qualified status for a qualified trust service. eIDAS supervision reacts to conformity-assessment findings, non-compliance, qualified-status changes, trusted-list changes, and the current Article 19a or Article 24 security and incident duties; significant incidents can also trigger NIS2 reporting.
The trigger is being a NIS2-covered or QTSP, then operating network and information systems for that service. A significant incident affecting trust-service provision triggers the NIS2 reporting path, with trust service providers subject to an early warning within 24 hours.
Requires trust-service rules: qualified-status process, conformity assessment reports, trustworthy systems and products, risk management, security-breach and disruption notifications under Articles 19a and 24, qualified-certificate or attestation data, terms and limitations, liability and termination arrangements, and trusted-list updates. The former Article 19 measures are no longer current law.
Convert eIDAS duties into trust-service operating evidence and NIS2 duties into cybersecurity governance and control evidence; link them only where the same system or supplier supports both.
Service classification, qualified-status grant or withdrawal, conformity assessment reports, trust-service policy and practice statement, trusted-list status, certificate or attestation profile, user terms and limitations, notification evidence, and termination plan.
Follows eIDAS service lifecycle events: starting a qualified service, submitting conformity assessment evidence, changing or ceasing qualified services, maintaining accessible records after cessation, handling security breaches or loss of integrity, and trusted-list updates.
Follows NIS2 governance and incident clocks: ongoing Article 21 measures, management-body oversight, and Article 23 reporting. For significant incidents, NIS2 requires an early warning within 24 hours. The incident notification is ordinarily due within 72 hours, but a must submit it within 24 hours when the incident affects provision of its trust services. A final report is generally due within one month after that notification.
Uses eIDAS supervisory bodies for trust services. They supervise QTSPs through ex ante and ex post activities, analyse conformity assessment reports, carry out or request audits, grant or withdraw qualified status, update trusted-list status, and require remediation.
Uses NIS2 competent authorities and CSIRTs for cybersecurity supervision, reporting, guidance, risk-based supervisory work, and enforcement under national transposition. Essential and important entities have different supervisory treatment under NIS2.
Route trust-service status and trusted-list issues to the eIDAS supervisory path; route cybersecurity incidents and Article 21 control issues to the NIS2 path, while coordinating when authorities must exchange information.
eIDAS 2 recognises that trust service cybersecurity duties and NIS2 duties are complementary and calls for cooperation between eIDAS supervisory bodies and NIS2 competent authorities.
NIS2 requires Member State authorities to cooperate and exchange relevant information with eIDAS authorities, including for relevant incidents and cyber threats.
Build one coordination playbook for incidents and supervision, but keep the legal basis, authority, notification recipient, and evidence label visible for each duty.
If the question is whether the service is qualified, whether evidence supports legal effects, whether a trusted-list entry is correct, or whether a conformity assessment or termination plan is adequate, start with eIDAS.
If the question is whether management approved controls, whether network and information systems are protected, whether a supplier or vulnerability risk is treated, or whether an incident is significant and reportable, start with NIS2.
For a QTSP, assume both workstreams may be needed: eIDAS to preserve trust-service assurance and NIS2 to prove cybersecurity governance and incident response.
Covers the trust service and its legal status: electronic signatures, seals, timestamps, registered delivery, website authentication certificates, electronic attestations of attributes, electronic archiving, electronic ledgers, validation, preservation, and qualified variants where applicable.
Covers the provider as a cybersecurity-regulated entity. NIS2 includes trust service providers regardless of size where the entity is in the covered type, and qualified trust service providers are essential entities regardless of size.
Start with two classifications: the eIDAS service classification and the NIS2 entity classification. Do not treat every relying party or certificate user as a .
The or QTSP, its conformity assessment body, the eIDAS supervisory body, the trusted-list operator, and internal owners for trust-service policy, certificate or attestation operations, termination, and user terms.
The essential or important entity, its management body, cybersecurity leadership, incident handling, business continuity, supplier management, asset owners, and the NIS CSIRT or competent authority notification path.
Give eIDAS status and trust-service evidence to the trust-service owner; give NIS2 risk treatment, control effectiveness, and incident notification to cybersecurity governance owners.
The trigger is providing a trust service or seeking, keeping, changing, or terminating qualified status for a qualified trust service. eIDAS supervision reacts to conformity-assessment findings, non-compliance, qualified-status changes, trusted-list changes, and the current Article 19a or Article 24 security and incident duties; significant incidents can also trigger NIS2 reporting.
The trigger is being a NIS2-covered or QTSP, then operating network and information systems for that service. A significant incident affecting trust-service provision triggers the NIS2 reporting path, with trust service providers subject to an early warning within 24 hours.
Requires trust-service rules: qualified-status process, conformity assessment reports, trustworthy systems and products, risk management, security-breach and disruption notifications under Articles 19a and 24, qualified-certificate or attestation data, terms and limitations, liability and termination arrangements, and trusted-list updates. The former Article 19 measures are no longer current law.
Convert eIDAS duties into trust-service operating evidence and NIS2 duties into cybersecurity governance and control evidence; link them only where the same system or supplier supports both.
Service classification, qualified-status grant or withdrawal, conformity assessment reports, trust-service policy and practice statement, trusted-list status, certificate or attestation profile, user terms and limitations, notification evidence, and termination plan.
Follows eIDAS service lifecycle events: starting a qualified service, submitting conformity assessment evidence, changing or ceasing qualified services, maintaining accessible records after cessation, handling security breaches or loss of integrity, and trusted-list updates.
Follows NIS2 governance and incident clocks: ongoing Article 21 measures, management-body oversight, and Article 23 reporting. For significant incidents, NIS2 requires an early warning within 24 hours. The incident notification is ordinarily due within 72 hours, but a must submit it within 24 hours when the incident affects provision of its trust services. A final report is generally due within one month after that notification.
Uses eIDAS supervisory bodies for trust services. They supervise QTSPs through ex ante and ex post activities, analyse conformity assessment reports, carry out or request audits, grant or withdraw qualified status, update trusted-list status, and require remediation.
Uses NIS2 competent authorities and CSIRTs for cybersecurity supervision, reporting, guidance, risk-based supervisory work, and enforcement under national transposition. Essential and important entities have different supervisory treatment under NIS2.
Route trust-service status and trusted-list issues to the eIDAS supervisory path; route cybersecurity incidents and Article 21 control issues to the NIS2 path, while coordinating when authorities must exchange information.
eIDAS 2 recognises that trust service cybersecurity duties and NIS2 duties are complementary and calls for cooperation between eIDAS supervisory bodies and NIS2 competent authorities.
NIS2 requires Member State authorities to cooperate and exchange relevant information with eIDAS authorities, including for relevant incidents and cyber threats.
Build one coordination playbook for incidents and supervision, but keep the legal basis, authority, notification recipient, and evidence label visible for each duty.
If the question is whether the service is qualified, whether evidence supports legal effects, whether a trusted-list entry is correct, or whether a conformity assessment or termination plan is adequate, start with eIDAS.
If the question is whether management approved controls, whether network and information systems are protected, whether a supplier or vulnerability risk is treated, or whether an incident is significant and reportable, start with NIS2.
For a QTSP, assume both workstreams may be needed: eIDAS to preserve trust-service assurance and NIS2 to prove cybersecurity governance and incident response.
How should teams decide which workstream owns the issue?
Choose eIDAS first when the question concerns trust-service status, qualified status, trusted-list representation, legal effect, conformity assessment, trust-service terms, or eIDAS supervisory-body action.
Choose NIS2 first when the question concerns cybersecurity governance, network and information system risk, management-body approval, supplier security, vulnerability handling, cyber hygiene, business continuity, or significant-incident reporting.
Use both when a QTSP system, cloud provider, cryptographic component, identity-proofing flow, certificate service, attestation service, or incident affects the trust service and the cybersecurity of the systems used to provide it.
Keep one cross-reference table, but preserve separate evidence labels for eIDAS supervisory evidence and NIS2 risk-management or incident-reporting evidence.
eIDAS is the trust framework. It covers electronic identification, trust services, qualified trust services, electronic signatures, seals, timestamps, registered delivery services, website authentication certificates, electronic attestations of attributes, electronic archiving, related legal effects, and current trust-service risk and incident duties. For a QTSP, eIDAS evidence normally includes qualified-status decisions, conformity assessment reports, trusted-list entries, service practice statements, certificate or attestation profiles, relying-party terms, security-breach records, and termination arrangements.
NIS2 is the cybersecurity framework. It applies to trust service providers regardless of size where the entity is within the covered type, and it treats qualified trust service providers as essential entities. Its core work is Article 20 governance, Article 21 cybersecurity risk-management measures, Article 23 significant-incident reporting, and Member State supervision through NIS competent authorities, CSIRTs, and single points of contact.
Use eIDAS when the question is trust-service status, qualified status, legal effect, trust marks, trusted lists, conformity assessment, trust-service risk and incident duties, or trust-service supervision.
Use NIS2 when the question is cybersecurity governance, network and information system risk, all-hazards controls, supply-chain security, cyber hygiene, or significant-incident notification.
Use both where the same provider, system, supplier, or incident affects a trust service and the network and information systems used to provide it.
The overlap starts at the provider, not at every relying party or every certificate user. A relying party that merely accepts a signature, seal, certificate, attestation, or wallet credential is not automatically a under eIDAS or a trust service provider under NIS2. The provider analysis should identify the legal entity offering the trust service, the Member State of establishment or main supervisory route, and whether the service is qualified.
NIS2 also matters for non-qualified trust service providers because trust service providers are one of the size-independent categories in Article 2. Qualified trust service providers have an additional classification consequence: NIS2 Article 3 treats QTSPs as essential entities regardless of size.
Record the eIDAS service category first: qualified certificate, timestamp, registered delivery, electronic attestation of attributes, website authentication certificate, validation, preservation, archiving, electronic ledger, or another covered trust service.
Record whether the provider is qualified, because qualified status changes eIDAS supervision, trusted-list status, conformity-assessment evidence, and NIS2 essential-entity classification.
Do not classify customers, browsers, wallet users, or relying parties as providers unless they actually provide the trust service.
Security and incident duties do not collapse into one process
NIS2 deleted the former eIDAS Article 19 with effect from 18 October 2024. Do not treat that deleted provision as current law. Current eIDAS Articles 19a and 24(2)(fa)-(fb) still impose trust-service risk-management and 24-hour notification duties, while NIS2 separately governs cybersecurity risk management and significant-incident reporting.
NIS2 Article 21 requires essential and important entities to use appropriate and proportionate technical, operational, and organisational measures for network and information systems, based on an all-hazards approach. Article 23 requires an early warning within 24 hours and ordinarily an incident notification within 72 hours, but a must submit that incident notification within 24 hours when the significant incident affects provision of its trust services. The final report is generally due within one month after the incident notification, subject to the ongoing-incident rule.
Keep an eIDAS path for current Article 19a or Article 24 risk and notification duties, qualified status, conformity-assessment follow-up, trusted-list changes, trust-service continuity, and eIDAS supervisory action.
Keep the current NIS2 notification path for significant incidents, CSIRT or competent-authority notification, cross-border impact, early warning, the trust-service-provider 24-hour incident notification, intermediate updates, final reporting, and recipient communications.
Link the paths in the incident playbook so one event can produce current eIDAS and NIS2 notifications, as well as separate eIDAS status or supervisory consequences, without presenting deleted Article 19 as current law.
A single control library can reference both laws, but the evidence labels should remain separate. eIDAS evidence proves the status and trustworthy operation of the trust service. NIS2 evidence proves cybersecurity governance, risk treatment, incident handling, supplier security, business continuity, training, access control, asset management, and security testing for the network and information systems used by the entity.
The most useful overlap evidence is operational rather than legal: system inventories, trust-service component maps, supplier registers, logging and monitoring records, vulnerability handling records, business continuity tests, incident post-reviews, and management approvals. Reuse those records only when the record explicitly names which eIDAS obligation and which NIS2 obligation it supports.
eIDAS file: qualified-status grant or withdrawal, conformity assessment report, trust-service policy and practice statement, trusted-list entry, certificate or attestation profile, terms and limitations, termination plan, and user notification evidence.
NIS2 file: management-body approval, Article 21 risk analysis and security policies, risk treatment plan, incident-handling procedure, business continuity and disaster recovery evidence, supplier-security clauses, vulnerability handling, access control, asset inventory, training, and notification records.
Joint file: cross-reference table showing which systems and suppliers support each trust service and which cybersecurity controls protect them.
Build one control map without merging the legal tests
Sorena can help trust service providers map eIDAS qualified-status, trusted-list, conformity-assessment, and trust-service evidence to NIS2 governance, Article 21 controls, and Article 23 incident reporting.
Specifies technical and methodological NIS2 cybersecurity risk-management requirements for trust service providers and other digital infrastructure entities.
Supports trust-service evidence areas such as risk assessment, information security policy, operations, incident management, supply chain, and termination.
Current eIDAS amendment source for the expanded trust-service framework and cooperation between eIDAS supervisory bodies and NIS2 competent authorities.