A cited guide to preparing EN 319 401 policies, practice statements, terms, records, and evidence for audit or assessor review.
EN 319 401 defines general TSP policy requirements; it does not define the independent assessment method, so assessor scope and scheme claims need separate support.
Structured answer sets in this page tree.
Cited legal and guidance references.
Use this page to prepare ETSI EN 319 401 V3.1.1 evidence for internal audit, customer review, or a . V3.2.1, published in January 2026, is the current ETSI edition; use this V3.1.1 clause map only when that earlier edition is expressly in scope, and otherwise map the engagement to V3.2.1. Start by naming the trust service, policy, service-specific standards, assessment scheme, period, and operating boundary. EN 319 401 sets general operation and management requirements; it does not define the independent assessment method or grant qualified status.
ETSI EN 319 401 defines general policy requirements for operation and management independent of the specific trust service type. Other specifications refine and extend those requirements for particular forms of TSP.
The standard explicitly excludes the independent-party assessment method, information to be made available to independent assessors, and assessor requirements from its scope. Its note points to ETSI EN 319 403-1 for body requirements. Keep three records separate: the EN 319 401 clause-to-evidence index, the service-specific requirement set, and the applicable assessment scheme or legal process.
Open the engagement only when the boundary is reviewable. The intake should identify the legal entity, trust service and policy, qualified or non-qualified claim, edition and service-specific standards, systems, facilities, suppliers, exclusions, assessment period, assessment criteria, assessor or customer, evidence-sharing controls, and intended output. If any of those inputs is disputed or missing, record it as a scope issue before testing controls.
This guide helps connect EN 319 401 clauses to owners, records, terms, practice statements, and assessment-scope decisions before evidence requests fragment across teams.
Convert EN 319 401 audit preparation into accountable tasks, evidence requests, and review milestones.
Use cited ETSI source material to resolve scope, applicability, evidence, and conformity-assessment boundaries before implementation.
Review trust-service scope, evidence owners, source coverage, and the next audit-readiness actions with Sorena.
A reviewable EN 319 401 audit file connects policies, practice statements, terms, records, and decisions to requirement identifiers. Clause 6 requires the to specify policies and practices for the trust services it provides, obtain management approval, publish and communicate them as relevant, and maintain a review process for the practice statement.
The terms and conditions are especially important because EN 319 401 requires them to identify the trust service policy, limitations on use, subscriber obligations, relying-party information, event-log retention, liability limitations, applicable legal system, complaints and dispute procedures, conformity-assessment status and scheme where applicable, and contact information.
A clause-to-evidence index should let a reviewer inspect the controls without undocumented internal context. At minimum, map risk assessment, information security policy, management and operations, incident management, continuity, termination planning, legal compliance, and supply-chain controls to owners and current evidence.
Clause 7.10 is central for audit readiness because it requires relevant information concerning data issued and received by the to be recorded and kept accessible for an appropriate period, including after TSP activities have ceased, for legal evidence and service continuity purposes. It also requires confidentiality and integrity of current and archived records, disclosed archival practices, availability for evidence of correct operation in legal proceedings, precise timing of significant events, and UTC synchronization for audit-log event times at least once a day.
EN 319 401 Annex B is an informative mapping to selected eIDAS provisions, not a legal conformity decision. The standard was published in June 2024 and retains references to the earlier eIDAS numbering in places. Use the amended consolidated regulation for current legal claims.
For qualified trust services, current eIDAS Article 20 requires an audit at the provider's expense at least every 24 months by a body and submission of the resulting report to the supervisory body within three working days of receipt. The provider must inform the supervisory body no later than one month before a planned audit and allow it to observe on request. The supervisory body may also audit or request a conformity assessment at any time. Article 21 governs initiation of a qualified trust service, and qualified status is tied to the supervisory process and trusted list. These legal steps are separate from preparing EN 319 401 evidence.
Audit files fail when the evidence is too broad or detached from the service being assessed. A generic security policy is not enough if it cannot be traced to the trust service practice statement, applicable policy, service records, and disclosed terms.
EN 319 401 supports an evidence model for operation and management. details, conformity assessment body competence, scheme rules, service-specific policies, and qualified-service status must come from the applicable scheme, service-specific standard, and legal or supervisory evidence.
No. EN 319 401 does not grant qualified status. For an EU qualified trust service, the provider needs the applicable report and supervisory process under eIDAS, and qualified status is reflected in the relevant trusted list. The service-specific standards and assessment scheme also need to be identified.
Article 20 of the amended consolidated eIDAS Regulation requires qualified trust service providers to be audited at their own expense at least every 24 months by a body. The provider must notify the supervisory body no later than one month before a planned audit and allow it to observe on request. The resulting conformity assessment report must be submitted to the supervisory body within three working days of receipt. The supervisory body may also audit or request an assessment at any time. These are eIDAS duties, not frequencies or procedures set by EN 319 401 itself.
Under current eIDAS Article 20, the supervisory body requires a remedy within a set time limit where applicable. If the provider does not remedy the failure, the supervisory body shall withdraw the qualified status of the provider or the affected service when justified by the extent, duration, and consequences of the failure. An EN 319 401 evidence pack can support the review and remedy, but it does not determine the supervisory outcome.