Use this workflow before relying on a qualified trust service provider for signatures, seals, timestamps, website authentication certificates, attestations, archiving, ledgers, or related qualified trust services.
The checks focus on trusted-list validation, exact qualified service scope, certificate and revocation evidence, published policies, supervision, audits, termination planning, incident posture, and records to retain.
Structured answer sets in this page tree.
Cited legal and guidance references.
A QTSP is not selected only by brand name or by a marketing claim that it is eIDAS compliant. Under eIDAS, qualified status is tied to a provider, the qualified services it provides, supervisory decisions, trusted-list entries, and service-specific evidence. This workflow gives procurement, product, security, legal, and compliance teams a concrete review path before onboarding or continuing to rely on a QTSP.
Start with the Member State trusted list and the Commission List Of Trusted Lists, not with a vendor certificate bundle or sales deck. eIDAS requires Member States to establish, maintain, and publish trusted lists that identify qualified trust service providers and the qualified trust services for which they are responsible.
Record the legal provider name, Member State, trusted-list location, scheme operator, service name, service type identifier, service digital identity, current service status, status start time, and relevant service history. If the service is not shown as qualified for the exact service you intend to rely on, treat the due diligence result as blocked until the provider or supervisory record explains the gap.
A QTSP can provide more than one service, and only some services may be qualified. Scope the review to the exact certificate, timestamp, validation, preservation, registered delivery, attestation, archiving, ledger, or remote signing service that the product will consume.
For certificate-based services, review the certificate policy, certification practice statement, certificate profile, usage limits, revocation mechanism, validity information, and any qualified-certificate statements that indicate the applicable legal framework and certificate purpose. Qualified certificate diligence should distinguish electronic signature, electronic seal, and website authentication uses rather than treating all qualified certificates as interchangeable.
The operational diligence should connect provider claims to supervisory and conformity-assessment evidence. eIDAS requires qualified trust service providers to be audited by a conformity assessment body at least every 24 months and to submit the resulting conformity assessment report to the supervisory body within three working days of receipt.
The monitoring plan should also cover changes in the qualified service, planned cessation, security incidents, supply-chain dependencies, and termination arrangements. If the provider changes the service, loses qualified status for the provider or affected service, changes the trusted-list status, or announces cessation, reopen the review before further reliance.
Keep the record useful for a later customer question, audit, dispute, incident, or migration. The evidence should show why the provider and exact qualified service were acceptable at onboarding and what would trigger a new review.
For ongoing monitoring, separate static onboarding evidence from time-sensitive status evidence. Trusted-list status, service scope, revocation availability, incident posture, and material provider changes can change after the initial selection.
Sorena can help structure the trusted-list checks, certificate evidence, policy review, supervision questions, and monitoring triggers into a reusable QTSP diligence record.
Ask source-linked questions about QTSP status, qualified services, trusted lists, certificates, revocation evidence, and supervision using the cited sources on this page.
Review your provider shortlist, trusted-list evidence, certificate scope, policy gaps, and monitoring triggers with Sorena.
"guidelines on supervision of qualified trust service providers pursuant to Art.20"
"Collection of evidence"
"Information on how to validate the certificate"
"The qcStatements certificate extension can contain any statement by the certificate issuer"
"at a given time in the past"
"audited at their own expense at least every 24 months"