--- title: "EU eIDAS FAQ: signatures, QTSPs, trusted lists, QWACs, wallets, and validation" canonical_url: "https://www.sorena.io/artifacts/eu/electronic-identification-and-trust-services-regulation/faq" source_url: "https://www.sorena.io/artifacts/eu/electronic-identification-and-trust-services-regulation/faq/items/page/2" author: "Sorena AI" description: "FAQ on eIDAS trust services and the European Digital Identity framework, covering advanced and qualified electronic signatures, QTSP status, trusted lists, QWACs, EUDI Wallet relying parties, attestations of attributes, and validation evidence." published_at: "2026-05-09" updated_at: "2026-07-25" keywords: - "EU eIDAS" - "qualified electronic signature" - "advanced electronic signature" - "qualified trust service provider" - "trusted lists" - "QWAC" - "EUDI Wallet" - "electronic attestations of attributes" - "validation" - "EU eIDAS Regulation" - "electronic signatures" - "qualified trust services" --- **[SORENA](https://www.sorena.io/)** - AI-Powered GRC Platform [Home](https://www.sorena.io/) | [Solutions](https://www.sorena.io/solutions) | [Artifacts](https://www.sorena.io/artifacts) | [About Us](https://www.sorena.io/about-us) | [Contact](https://www.sorena.io/contact) | [Portal](https://app.sorena.io) --- # EU eIDAS FAQ: signatures, QTSPs, trusted lists, QWACs, wallets, and validation FAQ on eIDAS trust services and the European Digital Identity framework, covering advanced and qualified electronic signatures, QTSP status, trusted lists, QWACs, EUDI Wallet relying parties, attestations of attributes, and validation evidence. *FAQ* *EU* ## EU eIDAS Regulation FAQ for trust services and wallets Answers to common eIDAS questions about advanced and qualified electronic signatures, qualified trust service providers, trusted lists, qualified website authentication certificates, EUDI Wallet relying parties, attestations of attributes, and validation. This page helps separate legal effect, technical validation, trust-list status, wallet registration, and evidence records before accepting a signature, certificate, attestation, or wallet presentation. eIDAS covers electronic identification and trust services for electronic transactions in the EU internal market. This FAQ focuses on the checks a product, legal, security, or compliance team can perform before relying on an electronic signature, qualified certificate, trusted-list entry, website authentication certificate, EUDI Wallet presentation, or electronic attestation of attributes. ## Definitions ### Qualified electronic signature A qualified electronic signature is an advanced electronic signature created by a qualified electronic signature creation device and based on a qualified certificate for electronic signatures issued by a qualified trust service provider. **Why it matters here:** Only this signature level receives the equivalent legal effect of a handwritten signature under eIDAS. A signature format, digital certificate, audit trail, or strong login does not establish qualified status without the qualified certificate, provider, device, and validation evidence. Sources: - [Regulation (EU) No 910/2014, Articles 3 and 25 to 32](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02014R0910-20241018&ref=sorena.io) ### Qualified trust service provider A qualified trust service provider is a trust service provider that has been granted qualified status by the competent supervisory body for one or more qualified trust services. The provider may offer other services that are not qualified. **Why it matters here:** A relying party should verify the specific service, not only the provider name. Qualified service provision begins after the qualified status is shown in the relevant Member State trusted list. Sources: - [Regulation (EU) No 910/2014, Articles 3, 21, and 22](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02014R0910-20241018&ref=sorena.io) ### EU trusted lists **Term:** trusted lists Trusted lists are Member State lists that identify qualified trust service providers and the qualified services for which status has been granted, including current and historical service-status information. **Why it matters here:** The FAQ uses trusted lists as the primary qualified-status check for signatures, seals, certificates, attestations, and validation services. A provider's marketing claim or current certificate does not replace the service-specific list entry at the relevant time. Sources: - [Regulation (EU) No 910/2014, Articles 21 and 22](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02014R0910-20241018&ref=sorena.io) - [Commission Implementing Decision (EU) 2015/1505 on trusted lists](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A32015D1505&ref=sorena.io) ## Browse sub-FAQ modules ### [EU eIDAS attribute attestations: EAA, QEAA, wallet, and relying party checks](/artifacts/eu/electronic-identification-and-trust-services-regulation/faq/attribute-attestations.md) What electronic attestations of attributes mean under eIDAS, how QEAAs differ from public-sector and non-qualified attestations, and what issuers, wallets, and relying parties should verify. - 3 items ### [EU eIDAS Trusted Lists FAQ: LOTL, QTSP status, and validation evidence](/artifacts/eu/electronic-identification-and-trust-services-regulation/faq/trusted-lists.md) How EU eIDAS Trusted Lists and the Commission LOTL support QTSP and qualified trust-service validation, with practical evidence checks for relying parties. - 3 items ### [EUDI Wallet Relying Parties under eIDAS](/artifacts/eu/electronic-identification-and-trust-services-regulation/faq/eudi-wallet-relying-party.md) What EUDI Wallet relying parties must do under eIDAS, when the harmonised registration rules apply, and how to control requested data, identification, validation, and evidence. - 4 items ### [QES vs AdES under EU eIDAS: legal effect, certificates, QTSPs, and validation evidence](/artifacts/eu/electronic-identification-and-trust-services-regulation/faq/qes-vs-ades.md) Compare qualified electronic signatures (QES) and advanced electronic signatures (AdES) under EU eIDAS, including legal effect, qualified certificates, QTSP status, QSCDs, and validation evidence. - 3 items ### [What is a qualified trust service provider under eIDAS?](/artifacts/eu/electronic-identification-and-trust-services-regulation/faq/qualified-trust-service-provider.md) How to verify QTSP status under eIDAS using the qualified service, supervisory body decision, trusted list entry, conformity assessment evidence, and service-specific records. - 3 items ### [What is a QWAC under the EU eIDAS Regulation?](/artifacts/eu/electronic-identification-and-trust-services-regulation/faq/qwac.md) Plain-language FAQ on qualified website authentication certificates under eIDAS, including website identity, QTSP trusted-list checks, browser recognition, and validation evidence. - 3 items Browse all indexed questions: [/artifacts/eu/electronic-identification-and-trust-services-regulation/faq/items](/artifacts/eu/electronic-identification-and-trust-services-regulation/faq/items.md) ## All FAQ items *Page 2 of 2. Showing 4 of 19 items.* ### [What supervision and operating evidence matters?](/artifacts/eu/electronic-identification-and-trust-services-regulation/faq/qualified-trust-service-provider.md#what-supervision-and-operating-evidence-matters) *Module: [What is a qualified trust service provider under eIDAS?](/artifacts/eu/electronic-identification-and-trust-services-regulation/faq/qualified-trust-service-provider.md)* QTSP status is supervised, not self-declared. eIDAS requires qualified trust service providers to be audited at their own expense at least every 24 months by a conformity assessment body, with the conformity assessment report submitted to the supervisory body within three working days of receipt. Supervisory bodies may also audit or require additional conformity assessment at any time. - Conformity assessment report scope, date, assessment body, and the qualified services covered. - Supervisory body grant or withdrawal evidence and any conditions, remediation requests, or change approvals. - Policies for identity verification, attribute verification, certificate issuance, revocation, status services, cryptographic controls, logging, staff competence, subcontractors, and termination. - Incident and disruption records, including notifications required by applicable eIDAS, NIS2, and data-protection rules. - Contract and architecture evidence showing the deployed product uses the listed qualified service, not a non-qualified variant or separate reseller service. Sources for this answer: - [Regulation (EU) No 910/2014 (eIDAS), QTSP supervision and operating requirements](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02014R0910-20241018&ref=sorena.io) - Article 20 sets recurring conformity assessment and supervisory powers; Article 24 covers identity checks, trustworthy systems, records, termination planning, and certificate revocation-status publication. - [ENISA - Guidelines on Supervision of Qualified Trust Services](https://www.enisa.europa.eu/publications/tsp-supervision?ref=sorena.io) - ENISA guidance supports supervisory practice and technical oversight of qualified trust service providers. - [ETSI EN 319 401 - General Policy Requirements for Trust Service Providers](https://www.etsi.org/deliver/etsi_en/319400_319499/319401/03.01.01_60/en_319401v030101p.pdf?ref=sorena.io) - ETSI baseline policy standard for trust service providers, useful for mapping operational controls to TSP evidence. ### [What does a QWAC prove under eIDAS?](/artifacts/eu/electronic-identification-and-trust-services-regulation/faq/qwac.md#what-does-a-qwac-prove-under-eidas) *Module: [What is a QWAC under the EU eIDAS Regulation?](/artifacts/eu/electronic-identification-and-trust-services-regulation/faq/qwac.md)* A certificate for website authentication makes it possible to authenticate a website and link that website to the natural or legal person to whom the certificate is issued. A QWAC adds the eIDAS qualified layer: the certificate must be issued by a qualified trust service provider and meet Annex IV requirements. - Confirm that the certificate is explicitly indicated as a qualified certificate for website authentication. - Check that the subject identity, address elements, and domain names match the website or service being authenticated. - Record the certificate validity period, serial or certificate identity code, issuer, and status-service location. - Treat QWAC evidence as website identity evidence, not as proof that the whole transaction, application, or message payload has been sealed or signed. Sources for this answer: - [Regulation (EU) No 910/2014 (eIDAS) - website authentication certificate definitions](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02014R0910-20241018&ref=sorena.io) - Defines certificate for website authentication and qualified certificate for website authentication, including the QTSP and Annex IV elements that make the certificate qualified. - [ETSI EN 319 412-5 - QCStatements for EU qualified certificates](https://www.etsi.org/deliver/etsi_en/319400_319499/31941205/02.05.01_60/en_31941205v020501p.pdf?ref=sorena.io) - Maps eIDAS Annex IV QWAC requirements to certificate-profile fields, including qualified-certificate indication, subject identity, domain names, validity, serial number, and status-service locations. ### [How should a relying party validate a QWAC?](/artifacts/eu/electronic-identification-and-trust-services-regulation/faq/qwac.md#how-should-a-relying-party-validate-a-qwac) *Module: [What is a QWAC under the EU eIDAS Regulation?](/artifacts/eu/electronic-identification-and-trust-services-regulation/faq/qwac.md)* Validation should combine certificate checks with eIDAS status checks. First confirm that the issuer and service are qualified for the relevant trust service on an EU trusted list, because eIDAS allows a qualified trust service provider to provide a qualified trust service after qualified status appears in the trusted lists. - Use the EU and national trusted-list information to confirm the QTSP and qualified service status. - Check the website domain against the certificate's domain-name information before treating it as the authenticated endpoint. - Use the certificate validity-status service, such as the CRL or OCSP location identified in the certificate profile, before relying on the certificate. - Keep validation logs that show the certificate examined, trusted-list result, revocation or validity status, validation time, and any exception decision. Sources for this answer: - [Regulation (EU) No 910/2014 (eIDAS) - trusted lists and certificate status](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02014R0910-20241018&ref=sorena.io) - Supports checking qualified status through trusted lists and checking qualified-certificate validity or revocation status before relying on a QWAC. - [ETSI TS 119 612 - Trusted Lists](https://www.etsi.org/deliver/etsi_ts/119600_119699/119612/02.04.01_60/ts_119612v020401p.pdf?ref=sorena.io) - Specifies trusted-list structure and service information used by validators to interpret qualified trust service provider and qualified service status. - [European Commission eSignature building block - trusted-list tooling](https://ec.europa.eu/digital-building-blocks/sites/spaces/DIGITAL/pages/467109036/eSignature?ref=sorena.io) - Commission Digital Building Blocks page points users to eIDAS Dashboard resources such as the Trusted List Browser and validation-test tooling. ### [What changed for browsers and QWACs under eIDAS 2?](/artifacts/eu/electronic-identification-and-trust-services-regulation/faq/qwac.md#what-changed-for-browsers-and-qwacs-under-eidas-2) *Module: [What is a QWAC under the EU eIDAS Regulation?](/artifacts/eu/electronic-identification-and-trust-services-regulation/faq/qwac.md)* The eIDAS 2 amendments add browser-facing duties for qualified certificates for website authentication. Providers of web browsers must recognise QWACs issued in accordance with Article 45 and display the identity data and additional attested attributes in a user-friendly way. The small-enterprise exception applies only to the support and interoperability duty. - For website owners, confirm whether the intended browser and client environment recognises and displays the QWAC identity information needed for the user journey. - For relying-party systems, do not rely on browser display alone; keep machine-readable validation evidence for issuer, service status, certificate status, and domain match. - For incidents, remember that eIDAS allows browser precautionary measures only for substantiated concerns about security breaches or loss of integrity of an identified certificate or set of certificates. - For procurement, ask certificate providers how the QWAC profile, trusted-list status, revocation publication, and renewal process will be evidenced. Sources for this answer: - [Regulation (EU) 2024/1183 - eIDAS 2 browser recognition amendments](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32024R1183&ref=sorena.io) - Amends eIDAS Article 45 and adds browser-recognition and precautionary-measure provisions for qualified certificates for website authentication. - [ETSI EN 319 412-4 - certificate profile for website authentication](https://www.etsi.org/deliver/etsi_en/319400_319499/31941204/01.04.01_60/en_31941204v010401p.pdf?ref=sorena.io) - Explains the website-certificate profile for TLS-accessed websites, useful for distinguishing website authentication from other eIDAS certificate purposes. - [ETSI EN 319 412-5 - certificate type QCStatement](https://www.etsi.org/deliver/etsi_en/319400_319499/31941205/02.05.01_60/en_31941205v020501p.pdf?ref=sorena.io) - Supports the distinction between website-authentication certificates, electronic-signature certificates, and electronic-seal certificates through certificate-type QCStatements. - [Commission Implementing Regulation (EU) 2025/2527 on QWAC reference standards](https://eur-lex.europa.eu/eli/reg_impl/2025/2527/oj/eng?ref=sorena.io) - Lists the QWAC reference standards for TLS outside web-browser contexts and for other QWAC contexts; it applies from 6 January 2027. ## FAQ Pagination - Canonical index (page 1): [/artifacts/eu/electronic-identification-and-trust-services-regulation/faq/items](/artifacts/eu/electronic-identification-and-trust-services-regulation/faq/items.md) - Page 1 rule: `/page/1` is intentionally not generated; use the canonical index markdown URL. - Current page: 2 of 2 Pages: [1](/artifacts/eu/electronic-identification-and-trust-services-regulation/faq/items.md) | [2](/artifacts/eu/electronic-identification-and-trust-services-regulation/faq/items/page/2.md) [Previous page](/artifacts/eu/electronic-identification-and-trust-services-regulation/faq/items.md) *Recommended next step* *Placement: before sources* ## Review eIDAS signatures, certificates, wallets, and attestations with cited checks Sorena can help convert eIDAS FAQ answers into validation records, trusted-list checks, relying-party evidence, and cited review notes for product, security, and compliance teams. - [Open Research Copilot for eIDAS](/solutions/research-copilot.md): Ask cited questions about eIDAS signatures, QTSPs, trusted lists, QWACs, EUDI Wallets, attestations, and validation evidence. - [Talk through implementation](/contact.md): Review your eIDAS reliance checks, wallet relying-party flow, trusted-list evidence, and validation records with Sorena. --- [Privacy Policy](https://www.sorena.io/privacy.md) | [Terms of Use](https://www.sorena.io/terms-of-use.md) | [DMCA](https://www.sorena.io/dmca.md) | [About Us](https://www.sorena.io/about-us.md) (c) 2026 Sorena AB (559573-7338). All rights reserved. Source: https://www.sorena.io/artifacts/eu/electronic-identification-and-trust-services-regulation/faq/items/page/2.md