Under eIDAS, the supervisory body grants qualified status to a trust service provider and its qualified service. The service may begin only after that status is indicated in the Member State trusted list; branding, contract language, and a certificate policy do not replace that entry.
This page helps organize initiation, recurring conformity assessment, supervisory change notifications, trusted-list checks, incident reporting, and evidence for qualified trust services.
Structured answer sets in this page tree.
Cited legal and guidance references.
A provider becomes a for a specific service only after supervisory review and entry of the qualified provider-service pair in the relevant Member State . Track the full eIDAS lifecycle: the intended qualified trust service, conformity assessment report, grant or withdrawal decision, trusted-list entry, recurring audit, change and cessation notices, security breach handling, and service-specific evidence.
eIDAS defines a as a trust service provider that provides one or more qualified trust services and has been granted qualified status by the . That status is service-specific: a provider may be qualified for one trust service and not for another.
For a new qualified trust service, the provider must notify the and submit a conformity assessment report from a . The supervisory body grants status and initiates the trusted-list update no later than three months after notification when it concludes that the provider and service comply. If verification is not complete in three months, it must explain the delay and expected completion period. The provider may begin the qualified service only after qualified status appears in the .
Trusted lists are the public mechanism that lets relying parties check whether a provider and service have qualified status and see status history. eIDAS requires Member States to establish, maintain, and publish trusted lists for the QTSPs they are responsible for and the qualified services those QTSPs provide.
The European Commission publishes a central List Of Trusted Lists so systems can locate Member State trusted lists. ETSI explains that trusted lists have constitutive effect for EU qualified trust services: the legal effect associated with a qualified trust service depends on the service being listed as qualified.
QTSP authorization is not finished after the initial trusted-list entry. eIDAS Article 24 requires a QTSP to inform the before changes to qualified trust services or intended cessation, maintain appropriate risk-management measures, use trustworthy systems, keep relevant issued and received information accessible, and maintain an up-to-date termination plan.
Notify the at least one month before implementing a change to a qualified trust service and at least three months before intended cessation. The authority may request more information or a conformity assessment and may condition permission for the change. Keep the notice, requested evidence, authority response, conditions, implementation date, and trusted-list update together.
For security breaches or disruptions that significantly affect the trust service or personal data maintained in it, Article 24(2)(fb) requires the QTSP to notify the , identifiable affected individuals, other relevant competent bodies where applicable, and, at the supervisory body's request, the public when disclosure is in the public interest. The consolidated text requires notification without undue delay and in any event within 24 hours of the incident. Keep that eIDAS trigger and deadline separate from NIS2 and GDPR notification tests.
A relying party, auditor, or procurement reviewer should be able to determine whether a claimed qualified service is qualified, current, and within scope. The review should connect legal status, technical validation, supervisory history, and operating controls.
Keep evidence at the service level. A provider-wide certificate, a marketing page, or a generic ISO certificate does not prove that a particular eIDAS trust service currently has qualified status.
No for the qualified service. Under eIDAS, a provider may begin providing the qualified trust service only after qualified status is indicated in the . Internal readiness, a passed audit, or a submitted conformity assessment report is not enough by itself.
A QTSP must be audited by a at least every 24 months and submit the resulting conformity assessment report to the within three working days of receipt. It must also notify the supervisory body at least one month before a planned audit and allow the supervisory body to observe on request. The supervisory body may audit or request conformity assessment at any time.
Use the current Member State trusted-list entry, including the service type, provider, service digital identity, status value, and status history. Pair that with the latest conformity assessment report, supervisory correspondence, and any change, incident, or cessation records that could affect the service.
Sorena can help structure QTSP evidence around the specific qualified service, trusted-list status, conformity assessment report, supervisory record, change notices, incident handling, and continuity evidence.
Ask questions tied to cited sources about QTSP status, trusted lists, conformity assessment, supervision, and incident evidence using the cited sources on this page.
Review your qualified trust service evidence file, trusted-list validation records, and supervisory workflow with Sorena.
"supervision of qualified trust services"
"Security framework for Trust Service Providers"
"provider/service will be qualified only if it appears in the trusted lists"
"Vulnerabilities and Incident management"
"Service current status"
"submit the resulting conformity assessment report"