What does it mean for a provider to be “qualified” under EU law?
A qualified trust service provider (QTSP) is an organization officially recognized under the eIDAS Regulation to deliver trust services with the highest legal assurance. Qualification means the provider meets strict legal, technical, and organizational requirements defined at EU level. These requirements are verified by national supervisory authorities. Only providers that pass this process can issue qualified trust services.
Which EU regulation governs qualified trust service providers?
Qualified trust service providers operate primarily under Regulation (EU) No 910/2014, known as eIDAS. This regulation defines how electronic signatures, seals, timestamps, electronic registered delivery, and electronic identification must be issued and managed. eIDAS ensures that trust services are legally valid and mutually recognized across all EU member states. Compliance with eIDAS is mandatory for QTSPs.
How do QTSPs prove ongoing compliance with eIDAS?
QTSPs must regularly demonstrate compliance through independent conformity assessments. These assessments are performed by accredited auditors who evaluate whether the provider continues to meet all regulatory requirements. The assessment covers technical security, identity verification processes, operational procedures, and risk management. Successful assessments are reported to the national supervisory authority.
What technical standards must QTSPs follow?
QTSPs must implement specific European technical standards, mainly developed by ETSI. These standards define how systems must operate securely and reliably. They typically cover areas such as:
- cryptographic algorithms and key management
- secure signature creation devices
- identity verification processes
- system availability and incident handling
Following these standards ensures consistent security levels across the EU.
How is identity verification kept compliant with EU rules?
Identity verification must follow procedures defined by eIDAS and related standards. QTSPs use controlled e-Identification processes to ensure that the identity of each user is accurately established. These processes are documented, audited, and monitored for misuse or fraud. Any deviation from approved procedures can lead to sanctions or loss of qualified status.
Who supervises qualified trust service providers?
Each EU member state appoints a national supervisory authority responsible for overseeing QTSPs. This authority monitors compliance, reviews audit reports, and has the power to investigate incidents. Supervisory bodies can impose corrective measures or revoke qualified status if requirements are not met. This external oversight ensures accountability and trust.
In Bulgaria, where Evrotrust is based, the local regulator is the CRC.
How do QTSPs handle security incidents and data protection?
QTSPs are required to maintain incident management and reporting procedures. They must detect, document, and report security breaches that could affect trust services. Personal data is handled in accordance with GDPR, with strict access controls and encryption. Incident transparency is a key element of regulatory compliance.
Why does compliance matter for users of trust services?
Compliance ensures that trust services have full legal effect across the EU. Users can rely on qualified electronic signatures, electronic identification, and electronic registered delivery without legal uncertainty. It also guarantees a high level of security and protection against fraud. For end users and organizations, compliance translates into trust and legal certainty.
