Qualified trust services under eIDAS

Short answer: A qualified trust service is a trust service that meets the stringent requirements of the eIDAS Regulation and is included in the national trusted list. Only providers that have formally obtained qualified status — granted by the national supervisory body — may display the EU trust mark. In the Netherlands, the Rijksinspectie Digitale Infrastructuur (RDI) is the competent supervisory body.

What are qualified trust services?

The eIDAS Regulation (Regulation (EU) 910/2014, as amended by Regulation (EU) 2024/1183) draws a clear distinction between ordinary trust services and qualified ones. Qualified services carry specific legal effects across all EU Member States: a qualified electronic signature has the same legal effect as a handwritten signature (Art. 25), a qualified electronic seal enjoys a presumption of integrity and correctness of origin (Art. 35), and a qualified electronic timestamp enjoys a presumption of accuracy of the date and time it indicates (Art. 41).

The following categories may be provided as qualified trust services: qualified electronic signatures and the certificates underpinning them, qualified electronic seals, qualified website authentication certificates (QWACs), qualified electronic timestamps, qualified electronic registered delivery services, electronic archiving services, remote management of qualified signature and seal creation devices, qualified electronic attestations of attributes, and qualified electronic ledgers.

Obtaining qualified status (Art. 21)

A provider wishing to obtain qualified status must notify the supervisory body and include a conformity assessment report issued by an accredited conformity assessment body confirming compliance with eIDAS requirements. The supervisory body must grant qualified status no later than three months after notification. The provider may only offer qualified services once its status has been entered in the national trusted list.

Ongoing supervision (Art. 20)

Qualified providers must be audited at least once every 24 months, at their own expense, by a conformity assessment body. The provider must inform the supervisory body at least one month before any planned audit. The conformity assessment report must be submitted to the supervisory body within three working days of receipt — meaning the three-day clock starts when the provider receives the report from the conformity assessment body, not when the body issues or finalises it. The supervisory body may at any time request an ad hoc conformity assessment.

National trusted lists and the EU trust mark (Art. 22-23)

Each Member State must establish, maintain and publish a trusted list in electronically signed form suitable for automated processing (Art. 22). Once qualified status appears in the trusted list, the provider may use the EU trust mark for its qualified services (Art. 23). A service is only considered qualified if it is listed as such in the valid national trusted list. The European Commission provides the EU Trusted List Browser as a central access point to all national lists.

Obligations for qualified providers (Art. 24)

Beyond the audit requirement, qualified providers must maintain sufficient financial resources or appropriate liability insurance, employ personnel with the necessary expertise and reliability, notify the supervisory body at least one month before any planned change (and three months before ceasing activities), and revoke certificates within 24 hours of receiving a valid revocation request.