What do EU eIDAS Trusted Lists prove?
An eIDAS Trusted List is evidence of supervised qualified status for a specific trust service provider and service, not a general approval of every certificate, product, or business process the provider offers.
Article 21 links the start of qualified service provision to the qualified status being indicated in the trusted list. Article 23 also connects the EU trust mark to the relevant trusted list, so a trust-mark claim should still be checked against the list entry.
- Check the Member State responsible for the provider and use the current national trusted list reached through the Commission's published trusted-list information or LOTL tooling.
- Match the legal provider name and service name to the exact trusted-list entry instead of relying only on a brand, reseller, or certificate common name.
- Confirm the service type is the one needed for the use case, such as qualified certificate issuance, qualified timestamping, qualified electronic registered delivery, or qualified website authentication.
- Record the service current status and status starting date/time because a status change can affect whether the evidence supports the transaction at the validation time.
- Treat non-qualified or nationally defined services separately when a list includes them; the 2015 trusted-list implementing decision says they must be clearly indicated as not qualified under eIDAS.
Article 22 requires Member States to establish, maintain, and publish trusted lists for qualified trust service providers and their qualified trust services.
The implementing decision supports the distinction between qualified services and non-qualified services that Member States may include voluntarily.
ETSI TS 119 612 defines the trusted-list structure used for provider information, service information, service type identifiers, current status, and status starting date/time.