ETSI EN 319 401 vs EN 319 403-1 TSP policy vs conformity assessment
A practical comparison for teams that need to separate a trust service provider's operating controls from the conformity-assessment context around those controls.
Use EN 319 401 to define what the TSP operates and EN 319 403-1 to understand how a CAB scopes, audits, reports, and decides on conformity.
Use EN 319 401 V3.2.1 to design and operate a trust service provider's controls. Use EN 319 403-1 V2.3.1 to understand the 's competence, impartiality, audit, reporting, corrective-action, review, and certification process. The standards meet at the evidence boundary: the TSP supplies policies, system and site information, records, personnel access, and corrective actions; the CAB defines and performs the assessment against stated criteria. Neither standard alone grants qualified status under eIDAS. For the qualified signature/seal certificate reference route in Implementing Regulation (EU) 2025/1943, retain the cited EN 319 401 V3.1.1 and the applicable adaptations. Publication of V3.2.1 does not replace that legally cited edition.
Side-by-side comparison
ETSI EN 319 401 vs ETSI EN 319 403-1: what changes operationally?
This table separates the TSP controls and records governed by EN 319 401 from the CAB competence, audit, reporting, corrective-action, and certification process governed by EN 319 403-1.
General policy requirements for trust service providers, focused on the TSP's operation and management practices across trust service policy, risk, security, incidents, continuity, termination, and suppliers.
Second framework
ETSI EN 319 403-1
Requirements for CABs assessing and certifying TSPs and trust services against defined criteria, including competence, impartiality, audit scope, evidence, reports, corrections, review, and decisions.
ETSI EN 319 401 vs ETSI EN 319 403-1: what changes operationally?
EN 319 401 applies to general policy requirements for TSPs and is independent of the type of TSP; it defines requirements on operation and management practices.
EN 319 403-1 applies ISO/IEC 17065 to CABs that assess and certify a TSP and its trust services against defined criteria. It also covers separate assessment of trust-service components.
Supports the TSP ownership and management-control framing.
The CAB owns application review, auditor competence, audit planning and performance, findings, review, and the certification decision. The applicant TSP must supply information, access, evidence, and corrective actions required by the process.
EN 319 401 work starts when a provider is defining, operating, changing, assessing, or evidencing a trust service policy and the related TSP operation.
Supports changes to policy and inventory being reviewed at planned intervals or significant changes.
EN 319 403-1 applies when a CAB assesses a TSP or trust-service component against stated criteria. Surveillance, changes affecting conformity, complaints, or scheme and legal requirements can also trigger assessment activity.
Grounds the listed TSP controls and evidence categories.
EN 319 403-1 requires a competent and impartial CAB process covering application review, scope and method, audit time, sites, two-stage audit work, reports, corrective actions, review, decision, certification documents, surveillance, reassessment, records, complaints, and appeals.
Evidence should include the risk assessment, risk treatment records, practice statement, terms and conditions, information security policy, asset inventory, trusted-role appointments, access records, monitoring and incident records, continuity and crisis-management tests, termination plan, and supplier agreements.
Before the on-site audit, the CAB requires service and activity information, relevant TSP and subcontractor locations, and policies, practices, infrastructure plans, manuals, and instructions. Audit access extends to relevant sites, records, personnel, and subcontractor areas.
Source for pre-audit information, evidence access, relevant sites, records, personnel, and subcontractor access.
Maintain one matrix with the criterion, EN 319 401 requirement, control owner, evidence location, site or component, confidentiality restriction, auditor finding, and corrective-action status.
EN 319 401 requires recurring review patterns, including regular risk-assessment review and review of the information security policy and asset inventory at planned intervals or when significant changes occur.
Supports regular risk review and planned-interval or significant-change review.
EN 319 403-1 sets no more than two years between full reassessment audits unless applicable legislation or the commercial scheme requires otherwise. Surveillance may occur under the surveillance programme or when required by an entitled party.
Source for surveillance and the maximum interval between full reassessment audits.
Schedule EN 319 401 evidence maintenance continuously and record the separate CAB surveillance and full-reassessment dates, including any shorter legal or scheme deadline.
EN 319 401 supplies control requirements. Any legal or scheme consequence depends on the regulation, contract, assessment criteria, and service-specific standard that calls for those controls.
Current legal source for qualified-provider audit, report, and supervisory requirements.
EN 319 403-1 governs the CAB assessment and certification process; it does not by itself grant qualified status under eIDAS. For qualified services, eIDAS separately governs CAB accreditation, reports, supervisory verification, and trusted-list status.
Source for the CAB assessment and certification process; legal status is determined separately.
Record the criteria and legal route separately from the standard: CAB and accreditation details, audit scope, report, certification decision, supervisory submission, and trusted-list status where applicable.
EN 319 401 evidence can be reused when the trust service boundary, version, policy, systems, suppliers, and assessment period match the claim being made.
Supports maintaining evidence around policies, assets, suppliers, incidents, continuity, and changes.
EN 319 403-1 permits component assessment and conditional multi-site sampling, but reuse depends on the assessment scope, criteria, common control, records, sites, and CAB judgment. Prior evidence does not remove the CAB's responsibility for its decision.
Source for component assessment, multi-site sampling, and CAB decision responsibilities.
Reuse evidence only with a visible boundary statement covering the service, component, criteria, sites, systems, period, standard version, evidence owner, and prior assessment status.
Primary source for provider operation and management controls.
If the task concerns CAB competence, audit scope, evidence access, site sampling, audit stages, findings, corrective action, review, or certification, use EN 319 403-1.
Supports the agreed assessment scope, findings, review, and certification decision trail.
Scope and covered activity
ETSI EN 319 401
EN 319 401 applies to general policy requirements for TSPs and is independent of the type of TSP; it defines requirements on operation and management practices.
EN 319 403-1 applies ISO/IEC 17065 to CABs that assess and certify a TSP and its trust services against defined criteria. It also covers separate assessment of trust-service components.
Supports the TSP ownership and management-control framing.
ETSI EN 319 403-1
The CAB owns application review, auditor competence, audit planning and performance, findings, review, and the certification decision. The applicant TSP must supply information, access, evidence, and corrective actions required by the process.
EN 319 401 work starts when a provider is defining, operating, changing, assessing, or evidencing a trust service policy and the related TSP operation.
Supports changes to policy and inventory being reviewed at planned intervals or significant changes.
ETSI EN 319 403-1
EN 319 403-1 applies when a CAB assesses a TSP or trust-service component against stated criteria. Surveillance, changes affecting conformity, complaints, or scheme and legal requirements can also trigger assessment activity.
Grounds the listed TSP controls and evidence categories.
ETSI EN 319 403-1
EN 319 403-1 requires a competent and impartial CAB process covering application review, scope and method, audit time, sites, two-stage audit work, reports, corrective actions, review, decision, certification documents, surveillance, reassessment, records, complaints, and appeals.
Supports using EN 319 401 as the provider evidence checklist.
Evidence and records
ETSI EN 319 401
Evidence should include the risk assessment, risk treatment records, practice statement, terms and conditions, information security policy, asset inventory, trusted-role appointments, access records, monitoring and incident records, continuity and crisis-management tests, termination plan, and supplier agreements.
Before the on-site audit, the CAB requires service and activity information, relevant TSP and subcontractor locations, and policies, practices, infrastructure plans, manuals, and instructions. Audit access extends to relevant sites, records, personnel, and subcontractor areas.
Source for pre-audit information, evidence access, relevant sites, records, personnel, and subcontractor access.
Operational implication
Maintain one matrix with the criterion, EN 319 401 requirement, control owner, evidence location, site or component, confidentiality restriction, auditor finding, and corrective-action status.
EN 319 401 requires recurring review patterns, including regular risk-assessment review and review of the information security policy and asset inventory at planned intervals or when significant changes occur.
Supports regular risk review and planned-interval or significant-change review.
ETSI EN 319 403-1
EN 319 403-1 sets no more than two years between full reassessment audits unless applicable legislation or the commercial scheme requires otherwise. Surveillance may occur under the surveillance programme or when required by an entitled party.
Source for surveillance and the maximum interval between full reassessment audits.
Operational implication
Schedule EN 319 401 evidence maintenance continuously and record the separate CAB surveillance and full-reassessment dates, including any shorter legal or scheme deadline.
EN 319 401 supplies control requirements. Any legal or scheme consequence depends on the regulation, contract, assessment criteria, and service-specific standard that calls for those controls.
Current legal source for qualified-provider audit, report, and supervisory requirements.
ETSI EN 319 403-1
EN 319 403-1 governs the CAB assessment and certification process; it does not by itself grant qualified status under eIDAS. For qualified services, eIDAS separately governs CAB accreditation, reports, supervisory verification, and trusted-list status.
Source for the CAB assessment and certification process; legal status is determined separately.
Operational implication
Record the criteria and legal route separately from the standard: CAB and accreditation details, audit scope, report, certification decision, supervisory submission, and trusted-list status where applicable.
Use for legal-status claims rather than unsupported shorthand.
Overlap and reuse
ETSI EN 319 401
EN 319 401 evidence can be reused when the trust service boundary, version, policy, systems, suppliers, and assessment period match the claim being made.
Supports maintaining evidence around policies, assets, suppliers, incidents, continuity, and changes.
ETSI EN 319 403-1
EN 319 403-1 permits component assessment and conditional multi-site sampling, but reuse depends on the assessment scope, criteria, common control, records, sites, and CAB judgment. Prior evidence does not remove the CAB's responsibility for its decision.
Source for component assessment, multi-site sampling, and CAB decision responsibilities.
Operational implication
Reuse evidence only with a visible boundary statement covering the service, component, criteria, sites, systems, period, standard version, evidence owner, and prior assessment status.
Primary source for provider operation and management controls.
ETSI EN 319 403-1
If the task concerns CAB competence, audit scope, evidence access, site sampling, audit stages, findings, corrective action, review, or certification, use EN 319 403-1.
Supports the agreed assessment scope, findings, review, and certification decision trail.
Practical decision rule
How should teams decide whether a task belongs in EN 319 401 or EN 319 403-1?
Use EN 319 401 when designing, implementing, documenting, or maintaining trust service policies, practices, controls, incident procedures, or security evidence.
Use EN 319 403-1 when selecting or evaluating a CAB, agreeing assessment criteria and scope, preparing Stage 1 and Stage 2 evidence, handling findings, or interpreting the certification process.
Keep TSP controls, audit evidence, CAB findings, corrective actions, review, and certification decisions distinct but linked by stable requirement and evidence identifiers.
Use eIDAS and the applicable assessment scheme in addition to these standards when the question concerns qualified status, supervisory submissions, trusted lists, or a legal audit deadline.
Primary standard source for CAB conformity assessment requirements under EN 319 403-1.
1
Section 1
Why compare ETSI EN 319 401 with ETSI EN 319 403-1?
ETSI EN 319 401 V3.2.1 specifies general policy requirements for trust service providers, independent of TSP type. It covers the provider's risk assessment, policy documents, information security policy, management and operation, incident handling, continuity, termination, compliance, and supply chain.
ETSI EN 319 403-1 V2.3.1 applies ISO/IEC 17065 to CABs assessing and certifying TSPs and their trust services against defined criteria. It covers CAB competence and impartiality, application review, audit scope and method, site sampling, two-stage audit work, reports, corrective actions, review, certification decisions, surveillance, reassessment, records, complaints, and appeals.
The editions also have different timelines. EN 319 403-1 V2.3.1 dates from June 2020. EN 319 401 V3.2.1 was adopted on 5 January 2026; its listed deadline for national publication or endorsement, and for withdrawal of conflicting national standards, is 31 October 2026. Record the edition used in every control map, application, report, and transition plan.
For EU qualified-service assessments, Implementing Regulation (EU) 2025/2162 requires CAB accreditation against EN ISO/IEC 17065:2012 supplemented by EN 319 403-1 V2.3.1. Article 9 treats qualifying accreditations obtained before 17 November 2025 under EN 319 403 V2.2.2 or earlier as meeting Article 2(1) until 17 May 2027. Check the accreditation certificate for the actual service, scheme and scope; this transition does not grant the TSP qualified status.
Use EN 319 401 to build or review TSP policy, practice, risk, security, operational, incident, continuity, and supplier evidence.
Use EN 319 403-1 to prepare the application, scope statement, site and subcontractor inventory, audit access, evidence index, corrective-action plan, and certification records.
State the assessment criteria and trust-service boundary explicitly. A CAB does not assess EN 319 401 by implication; the agreed criteria determine the audit.
Primary ETSI source for the scope, policy, risk assessment, management, incident, continuity, termination, and supply-chain requirements for trust service providers.
Article 2 specifies CAB accreditation standards, Article 3 the accreditation scope information, and Article 9 the grandfathering provision for qualifying earlier accreditations until 17 May 2027.
2
Section 2
What ETSI EN 319 401 controls before assessment starts
Start the EN 319 401 side with the trust service boundary. The standard defines policy requirements on the operation and management practices of TSPs and says the requirements are independent of the type of TSP.
The implementation file should name the trust service policy, TSP practice statement, terms and conditions, information security policy, risk assessment, management approvals, trusted roles, asset inventory, access controls, incident procedures, continuity plans, termination plan, and supplier controls that support the service.
Document the risk assessment and management approval of residual risk before treating a control set as complete.
Keep the TSP practice statement and terms and conditions aligned with the trust service policy being offered.
Tie evidence to named TSP systems, facilities, personnel roles, suppliers, and service components rather than broad claims of compliance.
Grounds the TSP-side controls: risk assessment, trust service practice statement, terms and conditions, information security policy, TSP management and operation, and supply chain.
Current legal context for trust services, qualified status, conformity assessment reports, supervisory verification, and trusted lists.
3
Section 3
What EN 319 403-1 requires from the assessment workflow
Before the on-site work, the CAB requires general information about the trust service, the relevant TSP and subcontractor sites, and the policies, practices, infrastructure plans, manuals, and operating instructions needed for the assessment. The CAB and TSP agree when and where the audit takes place, but the CAB remains responsible for the audit and certification process.
The audit has two stages. Stage 1 reviews the TSP and service documentation and helps plan Stage 2. Stage 2 includes on-site work, completes the assessment against the stated criteria, and leads to an audit report and, where needed, a TSP corrective-action plan reviewed by the CAB. Multi-site sampling is conditional; the CAB must assess whether common security-policy control and management review make sampling appropriate.
Application and scope: name the applicant, trust services, assessment criteria, locations, subcontractors, service components, and any existing component assessment.
Audit access: arrange access to relevant documentation, sites, subcontractor areas, records, internal audit reports, independent security reviews, and personnel.
Report and correction: trace each finding to the applicable criterion, its severity, the affected service or site, the corrective action, and the CAB's verification.
Certification: keep the audit team's findings separate from the independent review and certification decision required by the CAB process.
Direct source for application inputs, two-stage audits, site access and sampling, audit reports, corrective actions, review, and certification decisions.
4
Section 4
Evidence that usually belongs on the EN 319 401 side
EN 319 401 evidence should show that the TSP has translated policy requirements into working operations. The source material supports evidence around risk assessment, risk treatment, trust service practice statements, terms and conditions, information security policy, trusted roles, access control, physical and environmental security, operational security, network security, vulnerability and incident management, business continuity, termination, compliance, and supply chain.
Do not use public labels such as assessed, certified, qualified, or conformant unless the evidence identifies the assessment scheme, boundary, service, version, and source supporting the claim.
Assessment handoff: an evidence index that tells the CAB where each assessment criterion is implemented, which EN 319 401 requirement supports it, and which current record proves operation.
Primary source for EN 319 401 evidence topics, including risk, policies, operations, incidents, continuity, termination, compliance, and supply chain.
Recommended next step
Turn the EN 319 401 and EN 319 403-1 comparison into an evidence map
Assign TSP control owners, prepare the CAB evidence handoff, and keep audit findings, corrective actions, review, and certification decisions traceable.
Use this checklist for an audit package, procurement response, or internal release decision. Each item should be answerable from the evidence file, not from memory.
Name the trust service and the applicable trust service policy before mapping EN 319 401 controls.
Identify whether the user question is about TSP operations, CAB assessment, or both.
Attach each EN 319 401 claim to a cited evidence artifact and owner.
Agree the assessment criteria, scope, sites, subcontractors, component services, audit method, and evidence-access arrangements with the CAB.
Prepare separate Stage 1 documentation and Stage 2 operational evidence, then track each finding through corrective action and CAB review.
Review evidence after significant changes to services, systems, information security policy, suppliers, incidents, or termination arrangements.
Comparator source to verify direct CAB-side requirements before relying on them.
6
Section 6
Common mistakes in this comparison
Do not treat EN 319 401 and EN 319 403-1 as two labels for the same evidence. Keep the TSP operating evidence, the assessment criteria, and the CAB's audit and certification records visibly separate.
Do not overstate eIDAS or qualified-status claims. EN 319 401 includes an informative mapping to eIDAS requirements, but public claims still need the exact legal, service, assessment, supervisory, and trusted-list basis.
Do not state that a service is qualified, certified, assessed, or conformant unless the evidence file proves the boundary and scheme.
Do not assume the CAB will certify every control in the evidence pack; the stated assessment criteria and scope govern the conclusion.
Do not treat the audit report as the certification decision. EN 319 403-1 separates audit, review, and certification decision functions.
Do not mix generic cybersecurity controls with EN 319 401 evidence unless the control is mapped to a trust service risk, policy, or operation.
Do not publish draft notes, private evidence locations, or unverified references as public sources.
Primary ETSI source for general policy requirements for trust service providers, including risk, policy, operation, incident, continuity, termination, compliance, and supply-chain requirements.
Primary ETSI source for the scope, policy, risk assessment, management, incident, continuity, termination, and supply-chain requirements for trust service providers.
Grounds the TSP-side controls: risk assessment, trust service practice statement, terms and conditions, information security policy, TSP management and operation, and supply chain.
Show 21 more
EN 319 401 explicitly points to EN 319 403-1 for conformity assessment body requirements.
Primary source for EN 319 401 evidence topics, including risk, policies, operations, incidents, continuity, termination, compliance, and supply chain.
Grounds the checklist items around trust service policy, risk assessment, policy documentation, change review, and operational evidence.
Supports the distinction between EN 319 401 TSP policy requirements, eIDAS mapping, and EN 319 403-1 assessment-body context.
Grounds the EN 319 401 scope and TSP focus.
Supports starting the comparison with TSP scope.
Supports the TSP ownership and management-control framing.
Supports assigning TSP-side evidence owners.
Supports changes to policy and inventory being reviewed at planned intervals or significant changes.
Supports review after significant changes.
Grounds the listed TSP controls and evidence categories.
Supports using EN 319 401 as the provider evidence checklist.
Supports the named EN 319 401 evidence artifacts.
Supports traceable evidence and documentation.
Supports regular risk review and planned-interval or significant-change review.
Supports non-public evidence maintenance cadence.
Supports the eIDAS mapping context in EN 319 401 Annex B.
Supports maintaining evidence around policies, assets, suppliers, incidents, continuity, and changes.
Supports boundary-specific evidence and change review.
Primary source for provider operation and management controls.
Supports the separation between TSP requirements and the referenced CAB standard.
Primary ETSI source for conformity assessment bodies assessing trust service providers, including CAB competence, audit, reports, corrective actions, review, certification, and reassessment.
Primary ETSI source for CAB competence, impartiality, audit scope and method, multi-site sampling, audit reports, corrective actions, review, certification decisions, surveillance, and reassessment.
Direct source for application inputs, two-stage audits, site access and sampling, audit reports, corrective actions, review, and certification decisions.
Show 12 more
Comparator source to verify direct CAB-side requirements before relying on them.
Source for CAB and trust-service-component assessment scope.
Source for CAB responsibilities and the TSP's required assessment inputs.
Source for assessment, surveillance, and change-related activity.
Source for the CAB process requirements summarized in this row.
Source for pre-audit information, evidence access, relevant sites, records, personnel, and subcontractor access.
Source for surveillance and the maximum interval between full reassessment audits.
Source for the CAB assessment and certification process; legal status is determined separately.
Source for component assessment, multi-site sampling, and CAB decision responsibilities.
Primary source for the CAB activities listed in the decision rule.
Supports the agreed assessment scope, findings, review, and certification decision trail.
Primary standard source for CAB conformity assessment requirements under EN 319 403-1.
Article 1 and the Annex specify the adapted qualified signature/seal certificate reference route, including EN 319 401 V3.1.1. Recital 3 preserves other practices for demonstrating compliance; the reference route does not itself grant qualified status.
Article 2 specifies CAB accreditation standards, Article 3 the accreditation scope information, and Article 9 the grandfathering provision for qualifying earlier accreditations until 17 May 2027.