A source-backed workflow for running qualified-certificate supervision tasks before a change, incident, assessment, trusted-list update, or service termination reaches an EU supervisory body.
Use it as operational guidance for certificate-service governance, not for legal interpretation or proof of qualified status.
Structured answer sets in this page tree.
Cited legal and guidance references.
ETSI EN 319 411-2 is a qualified-certificate standard, not a full eIDAS supervision rulebook. A must pair the standard's certificate controls with the binding eIDAS supervision, notification, audit, trusted-list, and termination rules. This workflow covers the qualified certificate service boundary, certificate policy evidence, relying-party trusted-list notice, breach and change escalation, termination planning, and conformity-assessment preparation.
Start each supervision review by naming the exact qualified certificate service: natural-person certificate, legal-person certificate, QSCD-backed certificate, or qualified website authentication certificate. Record the issuing TSP, CA hierarchy, certificate policy identifier, CP/CPS versions, subscriber terms, repository location, and certificate population in scope.
This boundary matters because EN 319 411-2 builds on EN 319 411-1 and EN 319 401. A supervision pack should not mix non-qualified CA evidence with qualified certificate evidence unless it shows which inherited Part 1 or EN 319 401 requirement is being reused.
Run this gate before any material change to qualified certificate issuance, certificate profiles, CA hierarchy, QSCD handling, revocation/status services, repository publication, subcontracted service components, or termination planning. Under the amended eIDAS Article 24, a QTSP must inform its supervisory body at least one month before changing the provision of a qualified trust service and at least three months before it intends to cease those activities.
The review should decide whether the event is only a CP/CPS maintenance item, an assessment item, a subscriber or relying-party notice item, or an Article 24 notification. Commission Implementing Regulation (EU) 2025/2530 identifies significant changes to service descriptions, policies, practice statements, terms, architecture, hosting, cryptography, registration, governance, termination, financial resources or insurance, trusted-list data, and third-party arrangements. The notice must describe the change, planned date and time, reasons and supporting evidence where applicable, and updated documents where applicable. The supervisory body may request more information or a conformity-assessment result and may condition permission to implement an intended change. Confirm the national submission channel with the qualified-service compliance owner.
Use the workflow to assign certificate policy, QSCD, incident, trusted-list, termination, and assessment evidence before a supervisory or assessor review.
Convert supervision triggers into accountable tasks, evidence requests, and assessment-ready records.
Resolve policy, QSCD, incident, trusted-list, or termination questions against the cited ETSI material.
Review EN 319 411-2 supervision scope, evidence gaps, owners, and next actions with Sorena.
When a security breach or service disruption has a significant impact on the qualified certificate service or personal data maintained in it, open an incident evidence pack immediately. The current eIDAS Article 24 requires notice to the supervisory body, identifiable affected individuals, and other relevant competent bodies where applicable, without undue delay and in any event within 24 hours of the incident. This differs from the older Article 19 wording that measured 24 hours from awareness.
Do not treat the incident review as a generic security ticket. The pack should identify the trust service affected, certificates or repositories affected, relying-party impact, personal-data impact, known start time, awareness time, containment status, notification decision, and whether subscribers or affected persons also need notice.
Before assessment or supervisory review, confirm that relying-party evidence is current. EN 319 411-2 says relying-party notices should explain that the trust anchor for relying on a certificate as an EU qualified certificate is identified in the service digital identifier of an appropriate EU trusted-list entry for the QTSP.
Also verify continuity evidence. EN 319 411-2 includes requirements for revocation status information beyond certificate validity and maps eIDAS qualified-provider requirements to record retention, certificate databases, revocation publication, and termination planning. Commission Implementing Regulation (EU) 2025/2530 now requires a termination plan for each qualified trust service, review at least every two years and whenever provider or service changes are implemented, coverage of anticipated, unanticipated, partial, and complete termination, and continued access to records needed for legal evidence and validation. A termination or status-service gap should block the workflow until the responsible owner documents the corrective action.
The workflow is complete only when the reviewer can hand the assessor or supervisory liaison a compact evidence set. EN 319 411-2 points to ETSI TR 119 411-4 for a conformity assessment checklist, so keep requirement identifiers visible rather than replacing them with informal task names.
Close the record with the decision, source clauses used, evidence files, gaps, owner, next review trigger, and whether a supervisory-body contact, conformity-assessment follow-up, subscriber notice, relying-party notice, or CP/CPS publication update remains open.
"within 24 hours of the incident"
"reporting obligations as mandated by relevant legislative frameworks"
"Conformity assessment checklist"
"used by the TSP itself to prepare for an assessment"