eIDAS penalties and fines for trust service providers

Article 16, as replaced by Regulation (EU) 2024/1183, does not publish one EU-wide schedule of Member State fine amounts for every infringement. It requires Member States to lay down penalty rules for infringements of eIDAS, and those penalties must be effective, proportionate, and dissuasive.

For qualified and non-qualified trust service providers, Article 16 adds a harmonised floor for the maximum administrative fine that Member States must make available. For a natural-person trust service provider, the maximum must be at least EUR 5,000,000. For a legal-person trust service provider, the maximum must be at least EUR 5,000,000 or 1% of the total worldwide annual turnover of the undertaking in the preceding financial year, whichever is higher.

For trust services, Member States designate supervisory bodies. Under Article 46b, those bodies supervise qualified trust service providers by ex ante and ex post activities, and they may take action against non-qualified trust service providers when informed that the provider or service allegedly does not meet eIDAS requirements.

The same supervisory model matters for fines because Article 16 allows national rules where the competent supervisory body initiates a fine and a national court imposes it. The practical record should therefore identify the provider's establishment Member State, the supervisory body route, and any court route that national law uses.

For qualified trust service providers, monetary fines are not the only enforcement consequence. Article 20 allows the supervisory body to audit the provider or request a conformity assessment at the provider's expense. If the provider fails to fulfil eIDAS requirements, the supervisory body must require a remedy within a set time limit where applicable.

If the provider does not remedy the failure within the set time limit where applicable, the supervisory body must withdraw qualified status where justified by the extent, duration, and consequences of the failure. Article 20 also connects withdrawal to NIS2 and GDPR failures notified by the relevant authorities.

Trusted lists are enforcement evidence because they show the status and status history of qualified trust service providers and qualified trust services. Commission Implementing Decision (EU) 2015/1505 requires Member States to establish, publish, and maintain trusted lists with information on the qualified trust service providers they supervise and the qualified trust services provided by them.

For a penalties or fines review, trusted-list evidence should show the service type, the current status, the status start date, and relevant historical status. ETSI TS 119 612 gives status meanings that matter operationally, including under supervision, supervision in cessation, supervision ceased, supervision revoked, and withdrawn.

Use this checklist when a trust-service issue could become an eIDAS enforcement matter. It keeps the review focused on facts that the EU sources actually make relevant: provider type, Member State supervision, Article 16 fine route, qualified-status consequences, and trusted-list status.

The checklist does not supersede Member State legal analysis. It prevents unsupported assumptions before counsel or the responsible compliance owner checks the applicable national penalty rules.