ETSI EN 319 411-2 compliance checklist

First establish the service boundary: issuance, maintenance, and lifecycle management of qualified certificates for natural persons (individual people), legal persons (organisations recognised by law), or website authentication. Identify the trust service provider (TSP), certification authority (CA) and registration authority (RA), certificate population, certificate policy (CP), and certification practice statement (CPS). Record which inherited EN 319 411-1 controls apply. Keep non-qualified services outside this qualified-policy checklist.

Next establish the legal layer. Record the applicable eIDAS provisions and implementing regulations, including each adaptation to EN 319 411-2. Record the national trusted-list service entry and service digital identifier separately. A provider may offer qualified and non-qualified services; only the listed service has qualified status.

Treat policy selection as the first compliance decision. EN 319 411-2 defines separate EU qualified certificate policy identifiers, and the certificate profile should show whether the service is using the ETSI policy identifier, a provider-allocated object identifier (OID), or both.

The selected policy should match the subject type and relying-party use. QCP-n and QCP-n-qscd are for natural persons; QCP-l and QCP-l-qscd are for legal persons; QEVCP-w, QNCP-w, and QNCP-w-gen cover qualified website authentication variants. A TSP-allocated OID must identify the certificate policy actually applied; the policy should incorporate or further constrain the applicable EN 319 411-2 requirements.

The compliance pack should show how the certificate policy, certification practice statement, subscriber terms, repository practices, and certificate lifecycle controls implement the selected EN 319 411-2 policy. Tie each requirement family to the operating record that shows how it was applied.

Prioritize evidence for identity validation, application processing, issuance, acceptance, renewal, re-key, modification, revocation, suspension, status services, and termination. For identity, apply current eIDAS Article 24 and the adaptations in Regulation (EU) 2025/1943 rather than treating the standard's unadapted physical-presence or equivalent-assurance wording as the complete legal route list. Regulation (EU) 2025/1566 makes ETSI TS 119 461 V2.1.1, with adaptations, the identity-verification reference standard from 19 August 2027.

For QCP-n-qscd and QCP-l-qscd, confirm that the device is certified as a QSCD, the certificate request links the public key to a key pair generated by a QSCD, and the CPS states what happens if QSCD status changes before certificate expiry. When the TSP manages a remote QSCD for the subject, Regulation (EU) 2025/1943 also requires that TSP to provide the corresponding qualified remote-QSCD management service.

Certificate status services also need specific evidence. EN 319 411-2 requires revocation status information beyond the certificate validity period using a method used during validity, such as a certificate revocation list (CRL) or the Online Certificate Status Protocol (OCSP), unless a validity-assured short certificate exception is being used. The CPS and terms should explain the availability period, CA key compromise handling, and TSP termination handling. If relying on the standard's validity-assured short-certificate exception, retain the certificate profile and the validity-assured short-term certificate extension required by CSS-6.3.10-02B, and check the applicable legal adaptations before omitting a status service.

A qualified certificate compliance review should include relying-party evidence, not only issuer-side controls. EN 319 411-2 says the notice to relying parties should explain that the trust anchor for validating the certificate as an EU qualified certificate is identified in the service digital identifier of an appropriate EU trusted-list entry for the qualified TSP.

Record the date checked, national trusted-list source, service digital identifier, current and historical service status where relevant, certificate population covered, and any mismatch with the certificate policy claim. Do not infer that every service from a listed provider is qualified.

Regulation (EU) 2025/2530 adds binding requirements that a standard-only checklist can miss. It requires notification of significant service changes, a risk management framework, and a termination plan for each qualified trust service. These duties sit beside the certificate-policy and lifecycle controls in EN 319 411-2.

For change control, the notification record must cover the change, planned date and time, reasons, supporting evidence where applicable, and updated documents where applicable. The Regulation identifies service policies, practice statements, terms, architecture, hosting, cryptography, registration, governance, termination, trusted-list data, and third-party arrangements as change areas. Article 24(2)(a) of eIDAS requires at least one month's notice before a service change and at least three months before intended cessation.