EU Trusted List

Each member state publishes its own. Article 22(1) of the eIDAS Regulation requires every member state to establish, maintain and publish trusted lists covering the qualified trust service providers it is responsible for and the qualified services they provide. "The EU Trusted List" is therefore shorthand for a set of national lists. A provider appears on the list of the state where it is established, so a Lithuanian firm that uses a provider established in Sweden looks under Sweden.

Each state names a body that is responsible for its list. It tells the European Commission who that body is, where the list is published, and which certificates are used to sign or seal it (Article 22(3)). The body can be the national supervisory body or a separate one (Article 46b(4)).

The Commission connects the national lists. It publishes, in signed or sealed form, the information the member states have sent it about where each list is found (Article 22(4)). That central index is usually called the List of Trusted Lists. The Commission's Trusted List browser is the version meant for people to read.

Iceland, Liechtenstein and Norway, the EEA states outside the EU, publish trusted lists on the same basis.

An entry names a provider and then sets out its services one by one, each with its own status. The regulation asks for information on the qualified providers and on the qualified services they provide. It leaves the detailed format to Commission implementing acts (Article 22(5)).

In practice, an entry shows the provider's legal name. For every service it shows the type of service, such as certificates for electronic signatures or electronic time stamps. It shows the current status of that service, for example granted or withdrawn, with the date from which that status has applied. Earlier statuses stay visible as a history.

The status sits on the service, not on the company. Under Article 21(2) the supervisory body grants qualified status to the provider and to the trust services it provides. ZealiD AB, for example, is listed under Sweden with two granted qualified services: certificates for electronic signatures (since 9 September 2020) and electronic time stamps (since 10 October 2022). Those are two services with two dates. A provider can add a service years after its first. It can also lose one without losing the other, because Article 20(3) allows the supervisory body to withdraw the status of the provider or only of the affected service.

Listing is the point at which a qualified service may lawfully begin. The supervisory body grants the status, but Article 21(3) says a provider may begin to provide the qualified service only after the status has been indicated in the trusted list. The EU trust mark depends on the same event (Article 23(1)).

For anyone relying on a signature, the list is where the provider's status is proved. A qualified electronic signature must be based on a qualified certificate, and a qualified certificate is one issued by a qualified trust service provider (Article 3(12) and (15)). When such a signature is validated, one of the conditions is that the certificate was issued by a qualified provider and was valid at the time of signing (Article 32(1)). The trusted list is the public record that settles the first half of that condition.

A listing in one country counts in all of them. Qualified certificates, signatures, seals and time stamps from one member state must be recognised as qualified in every other member state (Article 24a). A court in Germany has no need for a Swedish provider to appear on the German list.

Listing does not make everything a provider sells a qualified service. Only the services shown with granted status are covered. A provider may run qualified and non-qualified services side by side.

Use the European Commission's Trusted List browser, which is open to the public. The check takes a few minutes. The steps below run from the provider to the single service you rely on, because that last detail is what decides whether a signature can be qualified.

1. Find the provider's exact legal name and the member state where it is established. The provider's terms normally give both. A qualified certificate must also state them, so they can be read from the signature itself.
2. Open the Trusted List browser. Choose that member state, or search for the provider by name.
3. Open the provider's entry and compare the legal name. Brand names and group companies can differ from the listed entity, and the status belongs only to the entity listed.
4. Find the service you intend to rely on. For a qualified electronic signature, that is the service issuing qualified certificates for electronic signatures. For a time stamp, it is the qualified time stamp service.
5. Read the status of that service and the date beside it. The status should be granted.
6. For a document that is already signed, compare the signing date with the status history. The service must have held granted status on the day of signing.

Record what you found and the date you looked. A firm that keeps that note can show later that it checked.

It reads them automatically. Article 22(2) requires the lists to be electronically signed or sealed, and published in a form suitable for automated processing. Software can therefore confirm that a list is genuine before it trusts what the list says.

When a validation tool opens a signed document, it traces the signer's certificate back to the provider that issued it. It then looks for that provider's service on the trusted lists. The result must be reported correctly to the person relying on the document, in a way that lets them detect any security issue (Article 32(2)).

The Commission runs a signature validator where a signed file can be uploaded and tested against the lists. It is a public demonstration tool, so think twice before uploading a confidential document.

The two checks answer different questions. A manual lookup tells a firm whether a provider is qualified. Validation tells it whether one signature on one document is qualified. Both rest on the same lists.

It tells you about providers and their services. It says nothing about a particular signature, signer or document.

It does not confirm that a given signature is qualified. That also depends on facts about the signature itself, including that it was created by a qualified signature creation device and that the certificate was valid when the document was signed (Article 32(1)). Only validation of the document can establish those.

It does not tell you whether your signing platform is the listed provider. A platform that sends documents for signature may be a different company from the one that issues the certificates. The entry to check is the certificate issuer's.

It does not tell you whether a document may be signed electronically at all. The regulation leaves national rules on the form of contracts untouched (Article 2(3)). A transaction that national law reserves for a notary stays with the notary, whatever the list says about the provider.

The entry is updated to show the withdrawal. When a supervisory body withdraws the status of a provider or of one service, it must inform the body responsible for the trusted list so that the list can be updated (Article 20(3c)).

A planned exit is handled in advance. A qualified provider must tell the supervisory body at least three months before it intends to stop. It must have a termination plan, and it must keep its records accessible after it has ceased, so they can still be used as evidence (Article 24(2)).

Signatures made earlier are judged by the status at the time. The validation conditions in Article 32(1) ask whether the certificate was qualified, and issued by a qualified provider, at the time of signing. A later withdrawal does not change that answer. This is why the history in an entry matters, and why proof of when a document was signed becomes more valuable as the years pass.