Vendor GuideEU

EU eIDAS QTSP Selection

Choose qualified trust services with evidence-first due diligence, transition awareness, and operational resilience checks.

Designed for relying parties and procurement/security teams buying qualified trust services.

Back to main artifact Review sources

Author

Sorena AI

Published

Feb 21, 2026

Updated

Feb 21, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published Feb 21, 2026

Updated Feb 21, 2026

Overview

QTSP selection is not a procurement exercise. It is a security, supervision, and evidence decision. The biggest failure mode is buying a qualified service that cannot actually produce the qualification proof, conformity evidence, interoperability, or exit support your product needs. Use this guide to evaluate QTSPs with measurable acceptance criteria: service scope, trust-list proof, security controls, transition status under the amended regulation, operational resilience, and exit readiness.

Section 1

Step 1: Define what you actually need (service + assurance + journeys)

Start with a service inventory and the journeys that depend on it. Your QTSP requirements depend on which trust services you rely on and what legal effect and dispute posture you need.

Make the decision explicit: AdES vs QES, and where qualified services are required or expected.

Service type: QES, qualified seals, qualified timestamps, qualified ERDS, website authentication certificates, validation/preservation.
Journey mapping: onboarding, contract signing, high-risk actions, document sealing, archival.
Evidence outputs: validation reports, status proofs, timestamp proofs, and long-term preservation artifacts.

Section 2

Step 2: Qualification and scope validation (avoid "marketing qualification")

Qualification is service-specific. Ensure the provider is qualified for the exact service and scope you plan to use.

Also confirm its transition status under the amended regulation if it was already qualified before 20 May 2024, because Article 24 identity-proofing evidence changes have a 21 May 2026 conformity deadline.

Qualification proof and scope: confirm qualified status for the specific service or services you plan to use.
Trust-list and supervisory evidence: capture current proof of listing, service status, and the supervising body.
Geographic or service coverage: confirm where the service is valid and how cross-border reliance works in practice.
Change notification: document how you are informed of certification-status changes, incidents, or service modifications.

Section 3

Step 3: Security and supervision evidence (what to request)

Request evidence aligned to the provider's service and your risk profile. Don't accept "we are certified" without scope and recency validation.

Use ENISA guidance to drive practical security controls and supervision expectations.

Security framework evidence: policies, secure operations, access control, incident procedures, and BC or DR testing outputs.
Audit evidence: latest relevant conformity assessments or audits, plus the provider's plan for ongoing refresh and the amended Article 24 deadline if applicable.
Key management and HSM controls: ceremonies, separation of duties, audit logs, and compromise handling.
Incident handling: notification timelines, root-cause deliverables, and joint customer-communications workflow.

Section 4

Step 4: Interoperability and integration (reduce product risk)

Integration failure is the most common reason QTSP projects slip: certificate profiles, validation rules, and status endpoints behave differently.

Treat integration as a test program, not an API call.

Format support matrix: document and test which signature formats and profiles you support end-to-end.
Validation reports: ensure you can generate reproducible validation outcomes with reason codes.
Status service reliability: monitor and test revocation and status checks; define outage behavior.
Support model: escalation paths and incident drills with the QTSP.

Section 5

Step 5: Exit strategy (don't get trapped)

Your compliance posture depends on being able to change providers without breaking your product or losing evidentiary integrity.

Define a migration path and test it.

Portability: validation evidence, audit logs, and certificate history must remain accessible after exit.
Transition plan: timeline and steps for certificate replacement, trust list dependencies, and customer communications.
Contingencies: emergency signing continuity and fallback procedures.

Recommended next step

Use EU eIDAS QTSP Selection as a cited research workflow

Research Copilot can take EU eIDAS QTSP Selection from getting cited answers and faster research on this topic to a reusable workflow inside Sorena. Teams working on EU eIDAS can keep owners, evidence, and next steps aligned without copying this guide into separate documents.

Research workflow

Open Research Copilot for EU eIDAS QTSP Selection

Start from EU eIDAS QTSP Selection and answer scope, timing, and interpretation questions with cited outputs.

Explore next step

Talk to Sorena

Talk through EU eIDAS

Review your current process, evidence gaps, and next steps for EU eIDAS QTSP Selection.

Explore next step

Primary sources