ETSI EN 319 411-2 How should qualified trust service providers handle legal and natural persons under ETSI EN 319 411-2

Start with the certificate policy. ETSI EN 319 411-2 names QCP-n for EU qualified certificates issued to natural persons and QCP-l for EU qualified certificates issued to legal persons. If the private key corresponding to the certified public key resides in a QSCD, use the matching QSCD policy route: QCP-n-qscd for a natural person and QCP-l-qscd for a legal person.

That distinction also changes the intended certificate use. QCP-n supports advanced electronic signatures based on a qualified certificate, while QCP-l supports advanced electronic seals based on a qualified certificate. The QSCD variants support qualified electronic signatures for natural persons and qualified electronic seals for legal persons. For example, a certificate identifying an employee and the employee's organization remains a natural-person route; a certificate whose subject is the company itself uses the legal-person route.

The unadapted EN 319 411-2 text describes physical-presence or equivalent-assurance routes for natural persons and for authorized representatives of legal persons. For qualified signature and seal certificates using the Regulation (EU) 2025/1943 presumption-of-compliance route, that Regulation replaces those Part 2 clauses with identity verification under the implementing acts adopted pursuant to eIDAS Article 24(1c). EN 319 411-1 adds the registration evidence needed to distinguish the person, verify attributes, and prove subscriber authority.

Current eIDAS Article 24 supplies the legal method list. Identity may be verified through a European Digital Identity Wallet or notified electronic identification means at assurance level high, a qualified signature or seal certificate issued through an allowed route, another method that identifies the person with a high level of confidence and is confirmed by a conformity assessment body, or physical presence under national law. The file should identify the exact route used; a generic label such as remote verification is not enough. Commission Implementing Regulation (EU) 2025/1566 sets reference standards for the checks but does not apply until 19 August 2027.

For a legal person, preserve the organization's official identity and registration data where applicable, the representative's identity, and proof that the representative may act for the organization. For a natural person, preserve the identity and distinguishing attributes required by the applicable policy and certificate profile. If the natural person is identified in association with a legal person, also preserve the organization identity, registration data, affiliation, authorization, and approval of the organization attributes. Website authentication adds evidence that the subscriber controls or is otherwise linked to each certified domain name.

Use the checklist to avoid issuing or describing a qualified certificate before the subject route, policy identifier, identity evidence, and subscriber authority match the actual natural-person, legal-person, or website-authentication scenario.