We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

Penalties GuideEU eIDAS

eIDAS penalties and fines for trust service providers

Article 16 requires Member States to set effective, proportionate, and dissuasive penalties. For infringements by qualified and non-qualified trust service providers, national law must allow maximum administrative fines of at least the EU amounts.

The Article 16 amounts are floors for national maximums, not automatic fines. Check the applicable Member State law for the offence, procedure, decision-maker, calculation, appeal route, and any higher ceiling.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Jul 24, 2026
Sections
6

Structured answer sets in this page tree.

Primary sources
6

Cited legal and guidance references.

Publication metadata
Sorena AI
Published May 9, 2026
Updated Jul 24, 2026
Overview

eIDAS does not set one automatic fine for an infringement. requires each Member State to create its own penalty rules. For an infringement by a qualified or non-qualified , national law must make available a maximum administrative fine of at least EUR 5,000,000 for a natural-person provider and, for a legal-person provider, at least the higher of EUR 5,000,000 or 1% of the relevant undertaking's worldwide annual turnover in the financial year before the year of infringement. The actual exposure still depends on the Member State rule, facts, procedure, and available remedies.

Section 1

What Article 16 says about eIDAS penalties

, as replaced by Regulation (EU) 2024/1183, does not publish an EU-wide tariff for individual infringements. It requires Member States to lay down penalty rules for infringements of eIDAS, and those penalties must be effective, proportionate, and dissuasive.

For infringements by qualified and non-qualified trust service providers, sets a floor for the maximum administrative fine available under national law. For a natural-person provider, that maximum must be at least EUR 5,000,000. For a legal-person provider, it must be at least the higher of EUR 5,000,000 or 1% of the total worldwide annual turnover of the undertaking to which the provider belonged in the financial year before the year in which the infringement occurred.

  • Treat the values as a minimum for national maximum fines, not as a single automatic fine for every case.
  • Check whether the alleged infringer is a and whether the conduct is an infringement of eIDAS before using the (2) fine floor.
  • For a legal-person provider, identify the undertaking to which it belonged and use the financial year before the year of infringement. Do not substitute the provider's current-year revenue without a national-law basis.
  • Do not assume the same procedure in every Member State; allows fines to be initiated by a competent and imposed by national courts where that fits the Member State legal system.
  • Keep NIS2 exposure separate. applies without prejudice to NIS2 Article 31, and the same event may also engage data protection or national liability rules.
Sources for this answer
Regulation (EU) No 910/2014 consolidated - Article 16 penalties
Consolidated Article 16 provides the Member State penalty duty, the minimum national maximums, the undertaking and turnover-year wording, and the possible court-imposed fine route.
Section 2

Who enforces trust-service obligations

For trust services, Member States designate supervisory bodies. Under Article 46b, those bodies supervise qualified trust service providers through ex ante and ex post activities. They take action against non-qualified trust service providers through ex post supervision when informed that a provider or service allegedly fails to meet eIDAS requirements.

The same supervisory model matters for fines because allows national rules where the competent initiates a fine and a national court imposes it. The practical record should therefore identify the provider's establishment Member State, the supervisory body route, and any court route that national law uses.

  • Identify the , its establishment Member State, and whether the affected service is qualified, non-qualified, or recognised only under a national scheme.
  • Record which is responsible for the provider or affected service.
  • Separate a monetary fine file from non-monetary supervisory action, because the evidence and escalation path may differ.
  • If a security breach, loss of integrity, NIS2 issue, or personal data issue is involved, record the cross-notification path to the relevant authority.
Sources for this answer
Regulation (EU) No 910/2014 consolidated - Articles 16 and 46b
Article 46b defines supervision of qualified and non-qualified trust service providers and the supervisory body's tasks. Article 16 allows a national procedure in which the supervisory body initiates a fine and a national court imposes it.
Section 3

Non-monetary enforcement consequences to track

For qualified trust service providers, monetary fines are not the only consequence. Article 20 requires an independent conformity assessment at the provider's expense at least every 24 months and delivery of the resulting report to the within three working days of receipt. The supervisory body may also audit the provider or request another conformity assessment at the provider's expense.

If the provider fails to fulfil an eIDAS requirement, the must require a remedy within a set time limit where applicable. This remedy process is separate from the Member State's monetary penalty procedure.

If the provider does not remedy the failure within the set time limit where applicable, the must withdraw qualified status where justified by the extent, duration, and consequences of the failure. Article 20 also connects withdrawal to NIS2 and GDPR failures notified by the relevant authorities.

  • Track the 24-month conformity assessment cycle, one-month advance notice of a planned audit, reports sent within three working days of receipt, additional audit requests, remedy notices, deadlines, and response evidence.
  • For qualified services, track whether the issue could affect the provider's qualified status or only a specific affected service.
  • Save correspondence showing whether the , NIS2 competent authority, or data protection authority was involved.
  • When qualified status is withdrawn, confirm that the national trusted-list body is informed for the Article 22 trusted-list update.
Sources for this answer
Regulation (EU) No 910/2014 consolidated - Article 20 supervision of qualified trust service providers
Article 20 grounds the 24-month assessment cycle, report and audit-notice timing, additional audits, remedy process, withdrawal of qualified status, and authority notifications.
Section 4

Trusted-list evidence for enforcement review

Trusted lists show the qualified status and status history of listed trust services. Article 22 requires each Member State to establish, maintain, and publish a securely signed or sealed list suitable for automated processing. The current version of Implementing Decision (EU) 2015/1505, as amended by Decision (EU) 2025/2164 and applicable from 29 April 2026, bases the common template on ETSI TS 119 612 v2.4.1.

For an enforcement review, preserve the service type, current status, status start date, service digital identity, and relevant history. A provider's marketing claim or certificate alone does not establish current qualified status; read the combination of fields required by the trusted-list interpretation rules.

  • Capture the trusted-list entry used at the time of the incident, onboarding decision, or enforcement review.
  • Preserve current and historical status evidence rather than only a screenshot of today's provider name.
  • Escalate any entry showing supervision revoked, withdrawn, supervision ceased, or a mismatch between claimed qualified status and trusted-list status.
  • Do not call a non-qualified or nationally recognised service qualified unless the trusted-list status and service type support that conclusion.
Sources for this answer
Implementing Decision (EU) 2015/1505 consolidated from 29 April 2026 - trusted lists
Current technical specifications and interpretation rules for Member State trusted lists, including ETSI TS 119 612 v2.4.1 and current and historical service-status information.
Section 5

What national law must answer before estimating a fine

supplies the EU framework, not the final exposure calculation. Identify the Member State rule that applies to the provider and alleged infringement before stating a ceiling, likely amount, procedure, or outcome.

Do not combine the floor, civil compensation under Article 13, NIS2 measures, GDPR fines, contractual remedies, or withdrawal of qualified status into one number. They have different legal bases, decision-makers, conditions, and remedies.

  • Scope: the national provision that makes the conduct an infringement and any territorial or establishment rule.
  • Maximum: the national ceiling and whether it is higher than the minimum maximum.
  • Turnover: the undertaking perimeter, relevant financial year, currency conversion, and evidence required by national law.
  • Procedure: the investigating authority, decision-maker, court involvement, notice, hearing, limitation period, and appeal route.
  • Assessment: the facts and any national factors used to set the actual amount, including aggravating or mitigating circumstances where the applicable law provides them.
  • Parallel consequences: Article 20 remedy or status action, Article 13 compensation claims, NIS2 or data protection action, and contractual or sector-specific remedies.
Sources for this answer
Regulation (EU) No 910/2014 consolidated - Articles 13, 16, and 20
Separates compensation, Member State penalties, administrative-fine floors, and qualified-status supervision. Article 16 leaves the detailed penalty rules to Member States.
Section 6

Penalty-review checklist for eIDAS trust services

This checklist is relevant when a trust-service issue could become an eIDAS enforcement matter. It keeps the review focused on facts that the EU sources actually make relevant: provider type, Member State supervision, fine route, qualified-status consequences, and trusted-list status.

The checklist does not replace Member State legal analysis. Use it to collect the facts before counsel or the responsible compliance owner checks the national offence, ceiling, procedure, limitation period, and appeal route.

Does eIDAS set one EU-wide fine amount for every infringement?

No. requires Member States to lay down effective, proportionate, and dissuasive penalty rules. For infringements by qualified and non-qualified trust service providers, national law must allow a maximum administrative fine of at least EUR 5,000,000 for a natural-person provider and at least the higher of EUR 5,000,000 or 1% of the relevant undertaking's worldwide annual turnover in the financial year before the year of infringement for a legal-person provider. The actual fine and procedure come from the applicable national law.

Can eIDAS enforcement lead to loss of qualified status?

Yes. For qualified trust service providers, Article 20 allows the to require a remedy for failure to meet eIDAS requirements and, where justified by the extent, duration, and consequences of the failure, withdraw the provider's qualified status or the qualified status of the affected service.

What evidence matters most in an eIDAS penalties review?

The core evidence is the provider classification, the alleged eIDAS infringement, the Member State supervisory route, any audit or remedy records, the fine analysis, and trusted-list current and historical status for the affected qualified service.

  • Classify the actor: qualified , non-qualified trust service provider, provider of a specific qualified service, relying party, wallet actor, or another eIDAS role.
  • Identify the alleged eIDAS infringement and the affected service, certificate, signature, seal, timestamp, delivery service, website-authentication certificate, electronic attestation of attributes, or electronic ledger.
  • Check exposure: Member State penalty rule, trust-service-provider fine floor, natural-person or legal-person provider status, and the relevant turnover year if the legal-person percentage route is being assessed.
  • Check supervisory consequences: audit or conformity assessment request, remedy notice, remedy deadline, possible withdrawal of qualified status, and trusted-list update.
  • Save evidence: analysis, supervisory-body identity, correspondence, conformity assessment reports, trusted-list current and historical status, incident or breach notifications, and the final outcome.
Sources for this answer
Regulation (EU) No 910/2014 consolidated - Article 16 penalties
Supports the checklist fields for Article 16 penalty rules, administrative fine mechanics, and Member State procedure.
Implementing Decision (EU) 2015/1505 consolidated from 29 April 2026 - trusted lists
Supports the trusted-list evidence fields for current and historical status of listed trust services.
Recommended next step

Turn Article 16 exposure into a reviewed evidence pack

Sorena can help structure the provider classification, supervisory route, trusted-list evidence, Article 16 fine analysis, and qualified-status risk record for eIDAS trust-service work.

Research workflow
Open Research Copilot for eIDAS

Ask official source questions about Article 16 penalties, supervisory powers, and trusted-list evidence using the cited sources on this page.

Explore next step
Talk to Sorena
Review enforcement readiness

Check whether your trust-service evidence covers fine exposure, remedy actions, qualified-status risks, and trusted-list updates.

Explore next step
Primary sources

References and citations

Regulation (EU) No 910/2014 consolidated - Articles 16 and 46b
eur-lex.europa.eu
Referenced sections
  • Article 46b defines supervision of qualified and non-qualified trust service providers and the supervisory body's tasks. Article 16 allows a national procedure in which the supervisory body initiates a fine and a national court imposes it.
"Member States shall designate a supervisory body"
Related guides

Explore more topics

eIDAS 2 deadlines and compliance calendar for EUDI Wallet and trust services
eIDAS 2 calendar separating binding EUDI Wallet, reporting, and trust-service dates from implementation milestones and technical programme updates.
eIDAS 2.0 vs eIDAS: EUDI Wallet and trust-service changes
Compare the original eIDAS electronic identification and trust-service framework with the eIDAS 2.0 amendments for EUDI Wallets, relying parties, attestations, QWACs, and supervision.
eIDAS Certificates and Authentication: qualified certificates, QWACs, and validation checks
Official source guide to eIDAS qualified certificates, website authentication certificates, trusted lists, relying-party checks, and validation evidence.
eIDAS checklist and evidence pack for trust services, signatures, and EUDI Wallet relying parties
Build an eIDAS evidence pack for qualified trust services, electronic signatures, trusted-list checks, certificate validation, supervisory records, and EUDI Wallet relying-party controls.
eIDAS compliance guide for trust services, QTSPs, signatures, and EUDI Wallet relying parties
Official source eIDAS compliance guide for trust-service classification, QTSP supervision evidence, qualified signatures, seals, time stamps, certificates, trusted-list validation, and EUDI Wallet relying-party records.
eIDAS electronic signatures: SES, AES, QES legal effect and evidence
An official source guide to eIDAS electronic-signature legal effect: SES, AES, QES, qualified certificates, QTSP trusted-list checks, validation, recognition, and evidence records.
eIDAS QES validation checks for relying parties
How to validate a qualified electronic signature under eIDAS: certificate, QTSP, trusted-list, QSCD, integrity, validation result, and evidence records.
eIDAS Qualified Trust Services: QTSP Selection
How to select an EU eIDAS qualified trust service provider: identify the qualified service type, verify trusted-list status, review supervision evidence, and retain certificate-policy records.
eIDAS remote signature and cloud HSM controls for QTSPs
Source-grounded guide to eIDAS remote signature controls: remote QSCD scope, server-side signing, QTSP evidence, signer authentication, certificate validation, and trusted-list checks.
eIDAS signature legal effect selector: SES, AES, AES-QC, or QES
Compare eIDAS signature levels by legal effect, governing form rules, qualified certificate status, QTSP evidence, QSCD use, validation, and public-service recognition.
eIDAS trust service role scoping workflow: TSP, QTSP, validator, relying party, or QTSP customer
Classify an eIDAS role by evidence: trust service provider, qualified trust service provider, signature or seal validator, EUDI Wallet relying party, relying party, or customer of a QTSP.
eIDAS trusted list validation: LOTL, QTSP status, and evidence
How to validate EU eIDAS trusted-list evidence: start from the Commission LOTL, confirm QTSP and qualified-service status, check certificate path and revocation data, and retain validation reports.
eIDAS vs ESIGN and UETA: EU qualified signatures vs U.S. e-signature laws
Compare eIDAS with ESIGN and UETA for electronic signatures, qualified certificates, trust services, cross-border recognition, validation evidence, and source gaps.
eIDAS vs ETSI EN 319 401: legal supervision and TSP policy requirements
Compare eIDAS and ETSI EN 319 401 for trust services: legal scope, QTSP supervision, conformity assessment, audits, incident evidence, and operational controls.
eIDAS vs GDPR for identity data: wallet, trust-service, and privacy obligations
Compare eIDAS identity, trust-service, and EUDI Wallet rules with GDPR duties for personal-data processing, minimisation, lawful basis, evidence, security, and user rights.
eIDAS vs NIS2 for trust service providers: QTSP and cybersecurity obligations
Compare eIDAS trust-service and QTSP duties with NIS2 cybersecurity risk-management, incident reporting, supervision, and evidence duties for trust service providers.
Electronic Attestations of Attributes under EU eIDAS: EAA, QEAA, issuers, wallets, and validation
Official source guide to electronic attestations of attributes under amended EU eIDAS: EAA, QEAA, public-sector authentic-source attestations, wallet use, issuer checks, relying-party validation, revocation, and legal effect.
EU eIDAS Applicability Test for Trust Services, Wallets, and Certificates
An official source eIDAS scope test for QTSPs, trust services, electronic signatures, seals, timestamps, QWACs, EUDI Wallet relying parties, and cross-border recognition evidence.
EU eIDAS attribute attestations: EAA, QEAA, wallet, and relying party checks
What electronic attestations of attributes mean under eIDAS, how QEAAs differ from public-sector and non-qualified attestations, and what issuers, wallets, and relying parties should verify.
EU eIDAS checklist for signatures, trust services, and wallets
Checklist for eIDAS trust-service and EUDI Wallet controls: qualified status, trusted lists, certificates, signatures, seals, timestamps, validation evidence, and relying-party records.
EU eIDAS FAQ: signatures, QTSPs, trusted lists, QWACs, wallets, and validation
FAQ on eIDAS trust services and the European Digital Identity framework, covering advanced and qualified electronic signatures, QTSP status, trusted lists, QWACs, EUDI Wallet relying parties, attestations of attributes, and validation evidence.
EU eIDAS QTSP authorization and supervision guide
How qualified trust service providers obtain and keep qualified status under eIDAS, including conformity assessment reports, supervision, trusted lists, incidents, and evidence.
EU eIDAS QTSP Due Diligence Workflow for Trusted Lists, Certificates, and Evidence
Check a qualified trust service provider under eIDAS by validating trusted-list status, qualified service scope, certificates, policies, supervision, audits, and retained evidence.
EU eIDAS Requirements for Trust Services, Signatures, Seals, Wallets, and Evidence
Official source guide to core eIDAS requirements for trust service providers, qualified trust services, electronic signatures, seals, time stamps, trusted lists, and EUDI Wallet relying parties.
EU eIDAS Trusted Lists FAQ: LOTL, QTSP status, and validation evidence
How EU eIDAS Trusted Lists and the Commission LOTL support QTSP and qualified trust-service validation, with practical evidence checks for relying parties.
EUDI Wallet readiness for service providers under eIDAS
Readiness guide for organisations preparing to request or verify data from European Digital Identity Wallets: roles, registration, ARF alignment, selective disclosure, implementing acts, and evidence.
EUDI Wallet Relying Parties under eIDAS
What EUDI Wallet relying parties must do under eIDAS, when the harmonised registration rules apply, and how to control requested data, identification, validation, and evidence.
EUDI Wallet Relying Party Onboarding Workflow under eIDAS
Prepare an eIDAS wallet-relying-party registration, intended-use record, access-certificate controls, attribute request, validation evidence, and intermediary safeguards.
EUDI Wallet Relying Party Registration Under eIDAS
What eIDAS Article 5b and the EUDI Wallet ARF say about wallet relying party registration, intended uses, attribute requests, certificates, evidence, and Member State gaps.
EUDI Wallet Technical Architecture Guide under eIDAS
Technical guide to the EUDI Wallet architecture: ARF roles, wallet units, PID and attestations, relying parties, trust model, certificates, protocols, privacy, and security controls.
QES vs AdES under EU eIDAS: legal effect, certificates, QTSPs, and validation evidence
Compare qualified electronic signatures (QES) and advanced electronic signatures (AdES) under EU eIDAS, including legal effect, qualified certificates, QTSP status, QSCDs, and validation evidence.
QWACs under eIDAS: website authentication certificates
A source-grounded guide to qualified website authentication certificates under eIDAS, covering Annex IV data, trusted lists, browser recognition, validation evidence, and QTSP checks.
What eIDAS Covers: eID, Trust Services, EUDI Wallet, and QWACs
A source-grounded guide to the systems and services covered by EU eIDAS: notified electronic identification, trust services, signatures, seals, time stamps, registered delivery, website authentication, trusted lists, the EUDI Wallet, and attribute attestations.
What is a qualified trust service provider under eIDAS?
How to verify QTSP status under eIDAS using the qualified service, supervisory body decision, trusted list entry, conformity assessment evidence, and service-specific records.
What is a QWAC under the EU eIDAS Regulation?
Plain-language FAQ on qualified website authentication certificates under eIDAS, including website identity, QTSP trusted-list checks, browser recognition, and validation evidence.