eIDAS trust service role scoping workflow

Classify the role by the activity performed for another party. Under eIDAS, a trust service includes services such as issuing or validating certificates, creating or validating electronic signatures or seals, preserving signatures or seals, managing remote signature or seal creation devices, issuing or validating electronic attestations of attributes, timestamping, registered delivery, electronic archiving, and electronic ledgers.

A relying party is different: it relies on electronic identification, an EUDI Wallet, another electronic identification means, or a trust service. A relying party may be a bank, platform, employer, public body, marketplace, or internal business unit that consumes identity, attestation, certificate, signature, seal, or validation results.

A trust service provider is the actor that provides one or more trust services. A qualified trust service provider is narrower: it provides one or more qualified trust services and has been granted qualified status by the supervisory body.

Do not treat marketing language, a procurement checklist, or use of a QTSP supplier as proof of qualified status. eIDAS ties qualified status to supervisory verification and trusted-list indication. A provider may begin providing the qualified trust service only after qualified status is indicated in the trusted lists.

Signature or seal validation is not one role. The organization may provide a qualified validation service, provide non-qualified validation software or API services, or only validate a signature or seal for its own reliance.

For qualified electronic signatures, eIDAS validation checks include whether the supporting certificate was qualified and issued by a QTSP, whether it was valid at signing time, whether signature validation data corresponds to the relying-party data, whether the signatory data and any pseudonym indication are correctly provided, whether the signature was created by a qualified creation device, and whether signed-data integrity is intact.

A wallet relying party is an organization that intends to rely on EUDI Wallets to provide public or private services by digital interaction. eIDAS Article 5b requires that relying party to register in the Member State where it is established and provide registration information, contact details, and the intended wallet use including the data it will request from users.

This role is separate from QTSP status. A wallet relying party requests or verifies wallet-presented data; it is not automatically a QTSP, a wallet provider, a PID provider, or an attestation provider.

The workflow output should be a role-scoping record that separates each transaction role before assigning controls, contracts, or regulatory owners. One legal entity can have more than one row if it performs different activities in different products or countries.

Keep the record specific enough that a reviewer can see why the organization is a provider, qualified provider, relying party, wallet relying party, validator, or QTSP customer without reading internal project history.