ETSI EN 319 411-2 QTSP supervision evidence for qualified certificate services

No. ETSI EN 319 411-2 expressly warns that conformance to the standard alone does not mean that the TSP or its certificates are qualified. A supervision answer should therefore avoid treating an EN 319 411-2 audit result as a substitute for qualified status.

For a QTSP issuing EU qualified certificates, the standard is still central evidence. It incorporates EN 319 411-1 general policy and security requirements, then adds requirements for EU qualified certificates for signatures, seals, and website authentication.

Current eIDAS Article 20 requires an audit by a conformity assessment body at the QTSP's expense at least every 24 months. The QTSP must notify the supervisory body at least one month before a planned audit and submit the resulting report within three working days after receiving it. The supervisory body may also audit the QTSP or request another assessment at any time. Article 21 governs the supervisory decision for a new qualified service; the service may begin only after qualified status appears in the trusted list. Commission Implementing Regulation (EU) 2025/2162 supplies the current accreditation, assessment-scheme, and report rules.

A useful supervision file should start with the certificate service and policy identifier, then link the CPS, certificate profile, repository, identity proofing, revocation, status service, incident, and termination evidence to the relevant EN 319 411-2 and incorporated EN 319 411-1 requirements.

The record should also prove the relying-party path. EN 319 411-2 says relying-party notices for EU qualified certificates need to explain that the trust anchor is identified in the service digital identifier of an appropriate EU trusted-list entry for the QTSP. Record the provider, the specific qualified service, its status and status history, and the certificates or other service identifiers carried by that entry. Keep subcontracted operations in the same map: the QTSP identified in the trusted list retains overall responsibility for issuing the certificates even when another party performs a component activity.

The most common mistakes are to blur qualified-status evidence with standards conformance, omit the trusted-list reliance path, or leave the supervision file without a traceable link from the selected certificate policy to the operational records.

Another common problem is treating incident, revocation, and records-retention evidence as optional. EN 319 411-2 and EN 319 411-1 map those topics into the qualified-certificate supervision file, while eIDAS Article 46b gives the supervisory body powers to request conformity assessments, grant or withdraw qualified status, require remediation, and verify termination plans.