EU eIDAS QTSP Authorization and Supervision

eIDAS defines a qualified trust service provider as a trust service provider that provides one or more qualified trust services and has been granted qualified status by the supervisory body. That status is service-specific: a provider may be qualified for one trust service and not for another.

For a new qualified trust service, the provider must notify the supervisory body and submit a conformity assessment report from a conformity assessment body. The provider may begin providing the qualified service only after the qualified status is indicated in the trusted list.

The useful operating record is not a single approval email. It should connect the qualified service, the conformity assessment scope, the supervisory body decision, the trusted-list status, and the operational controls that keep the service inside the approved scope.

eIDAS requires QTSPs to be audited at their own expense at least every 24 months by a conformity assessment body, and to submit the resulting conformity assessment report to the supervisory body within three working days of receipt. The supervisory body may also audit a QTSP or request a conformity assessment at any time.

Trusted lists are the public mechanism that lets relying parties check whether a provider and service have qualified status and see status history. eIDAS requires Member States to establish, maintain, and publish trusted lists for the QTSPs they are responsible for and the qualified services those QTSPs provide.

The European Commission publishes a central List Of Trusted Lists so systems can locate Member State trusted lists. ETSI explains that trusted lists have constitutive effect for EU qualified trust services: the legal effect associated with a qualified trust service depends on the service being listed as qualified.

QTSP authorization is not finished after the initial trusted-list entry. eIDAS Article 24 requires a QTSP to inform the supervisory body before changes to qualified trust services or intended cessation, maintain appropriate risk-management measures, use trustworthy systems, keep relevant issued and received information accessible, and maintain an up-to-date termination plan.

For security breaches or disruptions that have a significant impact on the trust service or personal data maintained in it, eIDAS requires notification to the supervisory body, affected identifiable individuals, other relevant competent bodies where applicable, and, if the supervisory body determines that disclosure is in the public interest, the public. The notification must be made without undue delay and in any event within 24 hours after the provider becomes aware of the breach or disruption.

A relying party, auditor, or procurement reviewer should be able to determine whether a claimed qualified service is actually qualified, current, and within scope. The strongest evidence combines legal status, technical validation, supervisory history, and operating controls.

Keep evidence at the service level. A provider-wide certificate, a marketing page, or a generic ISO certificate does not prove that a particular eIDAS trust service currently has qualified status.