Under eIDAS, the grants qualified status to a trust service provider and its qualified service. The service may begin only after that status is indicated in the Member State ; branding, contract language, and a certificate policy do not replace that entry.
This page helps organize initiation, recurring conformity assessment, supervisory change notifications, trusted-list checks, incident reporting, and evidence for qualified trust services.
A provider becomes a for a specific service only after supervisory review and entry of the qualified provider-service pair in the relevant Member State . Track the full eIDAS lifecycle: the intended qualified trust service, conformity assessment report, grant or withdrawal decision, trusted-list entry, recurring audit, change and cessation notices, security breach handling, and service-specific evidence.
eIDAS defines a as a trust service provider that provides one or more qualified trust services and has been granted qualified status by the . That status is service-specific: a provider may be qualified for one trust service and not for another.
For a new qualified trust service, the provider must notify the and submit a conformity assessment report from a . The supervisory body grants status and initiates the trusted-list update no later than three months after notification when it concludes that the provider and service comply. If verification is not complete in three months, it must explain the delay and expected completion period. The provider may begin the qualified service only after qualified status appears in the .
Sources (2)
Defines qualified trust services, QTSPs, conformity assessment bodies, initiation of qualified trust services, and when a provider may begin providing a qualified service.
qualified status has been indicated in the trusted lists
ENISA describes Article 20 supervision guidance for qualified trust services and identifies supervisory authorities, providers, and stakeholders as the intended audience.
supervision of qualified trust services
Trusted lists are the public mechanism that lets relying parties check whether a provider and service have qualified status and see status history. eIDAS requires Member States to establish, maintain, and publish trusted lists for the QTSPs they are responsible for and the qualified services those QTSPs provide.
The European Commission publishes a central List Of Trusted Lists so systems can locate Member State trusted lists. ETSI explains that trusted lists have constitutive effect for EU qualified trust services: the legal effect associated with a qualified trust service depends on the service being listed as qualified.
Sources (2)
Explains that EU Member State trusted lists include supervised QTSPs and their qualified trust services, and that users rely on trusted lists to determine qualified status and status history.
provider/service will be qualified only if it appears in the trusted lists
Specifies trusted-list structure, status values, service digital identity information, LOTL location concepts, and the status meaning for granted or withdrawn qualified status.
Electronic Signatures and Trust Infrastructures (ESI); Trusted Lists
QTSP authorization is not finished after the initial trusted-list entry. eIDAS Article 24 requires a QTSP to inform the before changes to qualified trust services or intended cessation, maintain appropriate risk-management measures, use trustworthy systems, keep relevant issued and received information accessible, and maintain an up-to-date termination plan.
Notify the at least one month before implementing a change to a qualified trust service and at least three months before intended cessation. The authority may request more information or a conformity assessment and may condition permission for the change. Keep the notice, requested evidence, authority response, conditions, implementation date, and trusted-list update together.
For security breaches or disruptions that significantly affect the trust service or personal data maintained in it, Article 24(2)(fb) requires the QTSP to notify the , identifiable affected individuals, other relevant competent bodies where applicable, and, at the supervisory body's request, the public when disclosure is in the public interest. The consolidated text requires notification without undue delay and in any event within 24 hours of the incident. Keep that eIDAS trigger and deadline separate from NIS2 and GDPR notification tests.
Sources (3)
Article 24 covers QTSP operational duties, change and cessation notifications, risk measures, incident notifications, records, certificate status information, and termination planning. Article 24(2)(fb) uses a 24-hour-from-incident deadline for significant breaches or disruptions.
Provides operational requirements for TSP monitoring, logging, incident response, reporting procedures, event assessment, post-incident review, and evidence collection.
Vulnerabilities and Incident management
ENISA provides security-framework guidance for trust service providers, including technical guidelines for risk and incident-related controls.
Security framework for Trust Service Providers
A relying party, auditor, or procurement reviewer should be able to determine whether a claimed qualified service is qualified, current, and within scope. The review should connect legal status, technical validation, supervisory history, and operating controls.
Keep evidence at the service level. A provider-wide certificate, a marketing page, or a generic ISO certificate does not prove that a particular eIDAS trust service currently has qualified status.
No for the qualified service. Under eIDAS, a provider may begin providing the qualified trust service only after qualified status is indicated in the . Internal readiness, a passed audit, or a submitted conformity assessment report is not enough by itself.
A QTSP must be audited by a at least every 24 months and submit the resulting conformity assessment report to the within three working days of receipt. It must also notify the supervisory body at least one month before a planned audit and allow the supervisory body to observe on request. The supervisory body may audit or request conformity assessment at any time.
Use the current Member State trusted-list entry, including the service type, provider, service digital identity, status value, and status history. Pair that with the latest conformity assessment report, supervisory correspondence, and any change, incident, or cessation records that could affect the service.
Sources (2)
Supports the checklist items for initiation, periodic conformity assessment, trusted-list indication, change notifications, incident obligations, and withdrawal of qualified status.
submit the resulting conformity assessment report
Supports trusted-list evidence fields such as status values, service digital identity, status history, and LOTL-based discovery.
Service current status
Sorena can help structure QTSP evidence around the specific qualified service, trusted-list status, conformity assessment report, supervisory record, change notices, incident handling, and continuity evidence.
Ask questions tied to cited sources about QTSP status, trusted lists, conformity assessment, supervision, and incident evidence using the cited sources on this page.
Review your qualified trust service evidence file, trusted-list validation records, and supervisory workflow with Sorena.
"qualified trust service provider"
"qualified status has been indicated in the trusted lists"
"audited at their own expense at least every 24 months"
"submit the resulting conformity assessment report"
"General Policy Requirements for Trust Service Providers"
"Vulnerabilities and Incident management"
"Trusted Lists"
"Electronic Signatures and Trust Infrastructures (ESI); Trusted Lists"
"Service current status"
"supervision of qualified trust services"
"Security framework for Trust Service Providers"
"Trusted Lists and Other Nationally Maintained Information"
"provider/service will be qualified only if it appears in the trusted lists"
eIDAS 2 calendar separating binding EUDI Wallet, reporting, and trust-service dates from implementation milestones and technical programme updates.
Compare the original eIDAS electronic identification and trust-service framework with the eIDAS 2.0 amendments for EUDI Wallets, relying parties, attestations, QWACs, and supervision.
Official source guide to eIDAS qualified certificates, website authentication certificates, trusted lists, relying-party checks, and validation evidence.
Build an eIDAS evidence pack for qualified trust services, electronic signatures, trusted-list checks, certificate validation, supervisory records, and EUDI Wallet relying-party controls.
Official source eIDAS compliance guide for trust-service classification, QTSP supervision evidence, qualified signatures, seals, time stamps, certificates, trusted-list validation, and EUDI Wallet relying-party records.
An official source guide to eIDAS electronic-signature legal effect: SES, AES, QES, qualified certificates, QTSP trusted-list checks, validation, recognition, and evidence records.
Guide to eIDAS Article 16 fine floors, national penalty rules, supervisory action, qualified-status withdrawal, and trusted-list evidence.
How to validate a qualified electronic signature under eIDAS: certificate, QTSP, trusted-list, QSCD, integrity, validation result, and evidence records.
How to select an EU eIDAS qualified trust service provider: identify the qualified service type, verify trusted-list status, review supervision evidence, and retain certificate-policy records.
Source-grounded guide to eIDAS remote signature controls: remote QSCD scope, server-side signing, QTSP evidence, signer authentication, certificate validation, and trusted-list checks.
Compare eIDAS signature levels by legal effect, governing form rules, qualified certificate status, QTSP evidence, QSCD use, validation, and public-service recognition.
Classify an eIDAS role by evidence: trust service provider, qualified trust service provider, signature or seal validator, EUDI Wallet relying party, relying party, or customer of a QTSP.
How to validate EU eIDAS trusted-list evidence: start from the Commission LOTL, confirm QTSP and qualified-service status, check certificate path and revocation data, and retain validation reports.
Compare eIDAS with ESIGN and UETA for electronic signatures, qualified certificates, trust services, cross-border recognition, validation evidence, and source gaps.
Compare eIDAS and ETSI EN 319 401 for trust services: legal scope, QTSP supervision, conformity assessment, audits, incident evidence, and operational controls.
Compare eIDAS identity, trust-service, and EUDI Wallet rules with GDPR duties for personal-data processing, minimisation, lawful basis, evidence, security, and user rights.
Compare eIDAS trust-service and QTSP duties with NIS2 cybersecurity risk-management, incident reporting, supervision, and evidence duties for trust service providers.
Official source guide to electronic attestations of attributes under amended EU eIDAS: EAA, QEAA, public-sector authentic-source attestations, wallet use, issuer checks, relying-party validation, revocation, and legal effect.
An official source eIDAS scope test for QTSPs, trust services, electronic signatures, seals, timestamps, QWACs, EUDI Wallet relying parties, and cross-border recognition evidence.
Checklist for eIDAS trust-service and EUDI Wallet controls: qualified status, trusted lists, certificates, signatures, seals, timestamps, validation evidence, and relying-party records.
FAQ on eIDAS trust services and the European Digital Identity framework, covering advanced and qualified electronic signatures, QTSP status, trusted lists, QWACs, EUDI Wallet relying parties, attestations of attributes, and validation evidence.
Check a qualified trust service provider under eIDAS by validating trusted-list status, qualified service scope, certificates, policies, supervision, audits, and retained evidence.
Official source guide to core eIDAS requirements for trust service providers, qualified trust services, electronic signatures, seals, time stamps, trusted lists, and EUDI Wallet relying parties.
Readiness guide for organisations preparing to request or verify data from European Digital Identity Wallets: roles, registration, ARF alignment, selective disclosure, implementing acts, and evidence.
Prepare an eIDAS wallet-relying-party registration, intended-use record, access-certificate controls, attribute request, validation evidence, and intermediary safeguards.
What eIDAS Article 5b and the EUDI Wallet ARF say about wallet relying party registration, intended uses, attribute requests, certificates, evidence, and Member State gaps.
Technical guide to the EUDI Wallet architecture: ARF roles, wallet units, PID and attestations, relying parties, trust model, certificates, protocols, privacy, and security controls.
A source-grounded guide to qualified website authentication certificates under eIDAS, covering Annex IV data, trusted lists, browser recognition, validation evidence, and QTSP checks.
A source-grounded guide to the systems and services covered by EU eIDAS: notified electronic identification, trust services, signatures, seals, time stamps, registered delivery, website authentication, trusted lists, the EUDI Wallet, and attribute attestations.
What electronic attestations of attributes mean under eIDAS, how QEAAs differ from public-sector and non-qualified attestations, and what issuers, wallets, and relying parties should verify.
How EU eIDAS Trusted Lists and the Commission LOTL support QTSP and qualified trust-service validation, with practical evidence checks for relying parties.
What EUDI Wallet relying parties must do under eIDAS, when the harmonised registration rules apply, and how to control requested data, identification, validation, and evidence.
Compare qualified electronic signatures (QES) and advanced electronic signatures (AdES) under EU eIDAS, including legal effect, qualified certificates, QTSP status, QSCDs, and validation evidence.
How to verify QTSP status under eIDAS using the qualified service, supervisory body decision, trusted list entry, conformity assessment evidence, and service-specific records.
Plain-language FAQ on qualified website authentication certificates under eIDAS, including website identity, QTSP trusted-list checks, browser recognition, and validation evidence.