EU eIDAS qualified trust services and QTSP selection

Start with the exact trust-service function, because eIDAS distinguishes the provider from the qualified service it provides. A provider may be qualified for one service and not for another, and a certificate-issuing service may need further qualification for electronic signatures, electronic seals, or website authentication.

The consolidated eIDAS definition of trust service covers certificate issuance and validation, signature or seal creation and validation, preservation, remote signature or seal creation-device management, electronic attestations of attributes, timestamps, registered delivery, electronic archiving, and electronic ledgers. Selection should therefore begin with a service-type statement, not a generic supplier category.

Qualified status is not established by a sales deck or by a certificate chain alone. Under eIDAS, Member States maintain trusted lists with information on the qualified trust service providers they supervise and the qualified trust services those providers offer.

A relying team should validate the Member State trusted list through the Commission's List of Trusted Lists or a trusted-list browser, then record the service entry, service status, status start time, service digital identity, service supply points, and any service history that affects reliance.

A QTSP selection pack should include evidence that the provider can remain qualified, not only that it was once listed. eIDAS requires periodic conformity assessment for QTSPs, gives supervisory bodies powers to audit or request conformity assessment, and links non-remedied failures to withdrawal of qualified status for the provider or affected service.

For provider due diligence, ask for current conformity-assessment evidence, the certificate policy and certification practice statement where certificates are involved, the PKI disclosure statement or terms and conditions, security and incident-notification process, termination plan, and certificate-status service design.

The retained evidence should let a later reviewer reconstruct why the service was treated as qualified at the time of use. This matters for signatures, seals, timestamps, registered delivery, QWACs, and attestations where the legal or evidential value depends on the qualified service and its validation context.

Keep evidence at the level of the transaction or certificate where reliance occurs, not only in procurement. A supplier file that proves selection is useful, but relying-party validation needs the certificate, signature or seal validation result, timestamp or delivery evidence, trusted-list status, revocation status, and policy references used at the relevant validation time.

Use this checklist before approving a QTSP for production or relying-party use. Each item should produce a stored record that can be rechecked when the product changes, the service is renewed, or the trusted-list status changes.

Escalate selection if the service is cross-border, combines qualified and non-qualified services, uses remote signing or sealing, depends on a QWAC in browser-facing flows, or supports evidence that may need to survive certificate expiry.