EU eIDAS qualified trust services and QTSP selection

Start with the exact trust-service function, because eIDAS distinguishes the provider from the qualified service it provides. A provider may be qualified for one service and not for another, and a certificate-issuing service may need further qualification for electronic signatures, electronic seals, or website authentication.

The consolidated eIDAS definition of trust service covers certificate issuance and validation, signature or seal creation and validation, preservation, remote signature or seal creation-device management, electronic attestations of attributes and their validation, electronic time stamps and their validation, registered delivery and related validation, electronic archiving, and electronic ledgers. Selection should begin with a service-type statement and the evidence output the relying party needs.

Article 24a requires listed qualified services and certificates from one Member State to be recognised in the other Member States for the categories it names. Cross-border recognition does not decide whether a person had authority to transact, whether a contract was formed, or whether Union or national law requires a separate form or sector-specific step.

Qualified status is not established by a sales deck or by a certificate chain alone. Under eIDAS, Member States maintain trusted lists with information on the qualified trust service providers they supervise and the qualified trust services those providers offer.

A relying team should validate the Member State trusted list through the Commission's List of Trusted Lists or a trusted-list browser, then record the service entry, service status, status start time, service digital identity, service supply points, and any service history that affects reliance.

A QTSP selection pack should include current service-level evidence. A historical listing alone is insufficient. eIDAS requires an audit by a conformity assessment body at least every 24 months, submission of the report within three working days of receipt, and notice to the supervisory body at least one month before a planned audit. Supervisory bodies may also audit or request conformity assessment and can withdraw qualified status where a failure is not remedied and withdrawal is justified by its extent, duration, and consequences.

For provider due diligence, ask for current conformity-assessment evidence, the certificate policy and certification practice statement where certificates are involved, the PKI disclosure statement or terms and conditions, security and incident-notification process, termination plan, and certificate-status service design. If the provider held qualified status before 20 May 2024, confirm the transition report required by 21 May 2026 for the amended identity and attribute-verification rules.

The retained evidence should let a later reviewer reconstruct why the service was treated as qualified at the time of use. This matters for signatures, seals, time stamps, registered delivery, QWACs, attestations, archiving, and ledgers where the legal or evidential conclusion depends on the qualified service and its validation context.

Keep evidence at the level of the transaction or certificate where reliance occurs as well as in procurement. A supplier file can support selection, but relying-party validation needs the certificate, signature or seal validation result, time-stamp or delivery evidence, trusted-list status, revocation status, and policy references used at the relevant validation time.

Review this checklist before approving a QTSP for production or relying-party use. Each item should produce a stored record that can be rechecked when the product changes, the service is renewed, or the trusted-list status changes.

Escalate selection if the service is cross-border, combines qualified and non-qualified services, uses remote signing or sealing, depends on a QWAC in browser-facing flows, or supports evidence that may need to survive certificate expiry. Reopen the review after a service-status change, material provider change, planned cessation, incident, certificate-policy change, new subcontractor, renewed contract, or change in the relying-party validation policy.