Qualified Signature Creation Device QSCD

A qualified signature creation device is an electronic signature creation device that meets the requirements laid down in Annex II of the eIDAS Regulation. That is the whole definition in Article 3(23), where the full name is "qualified electronic signature creation device". The plain version, one point earlier, is "configured software or hardware used to create an electronic signature" (Article 3(22)). The word "qualified" adds the Annex II requirements, together with a certificate from an independent body confirming that they are met.

What the device guards is the electronic signature creation data, the unique data a signatory uses to create a signature (Article 3(13)). In practice this is the signer's private key. Nearly everything else in a signature is meant to be seen. The signed document is shared, and the signer's certificate travels with it. The private key is the one item that must stay secret, because whoever can use it can sign as that person.

The device is one of the three conditions for a qualified electronic signature. Article 3(12) requires an advanced electronic signature, a qualified certificate, and creation by a QSCD. Take the device away and the result is an advanced signature based on a qualified certificate, which does not have the legal effect of a handwritten signature.

"Device" suggests an object in the signer's hand, and for many years it was one. The familiar forms are the chip on a smart card or national identity card and a USB token. Today the device can equally be built around a hardware security module in a provider's data centre, which the signer never sees.

It must guarantee four things about the signer's key and one thing about the document. Annex II lists them, and Article 29(1) makes them binding. The device has to achieve them "by appropriate technical and procedural means", so the rules cover how the device is used as well as how it is built.

The first requirement is that the confidentiality of the signature creation data is reasonably assured. The key cannot be read out of the device. The second is that the data can practically occur only once, so that no two signers end up with the same key. The third is that the data cannot, with reasonable assurance, be derived, and that the signature is reliably protected against forgery using currently available technology. The public key reveals nothing useful about the private one. The phrase "currently available technology" matters here. An algorithm that was safe ten years ago may not be safe now, which is why a certification now carries a time limit (Article 30(3a)).

The fourth requirement is the one a signer notices. The legitimate signatory must be able to reliably protect the signature creation data against use by others. On a smart card this is the PIN. In a remote service it is the authentication step the signer completes before each signature.

The last requirement concerns the document. The device must not alter the data to be signed, and it must not prevent that data from being presented to the signatory before signing (Annex II, point 2). A signer has to be able to see what they are about to sign.

The wording is cautious throughout: "reasonably assured", "reliably protected". The regulation does not claim that a device is unbreakable. It asks for a level of assurance that an independent evaluator can test.

The difference is who holds the hardware. A local device is in the signer's possession. A remote device stays with a provider, and the signer reaches it over the internet. Both must meet Annex II, and both must be certified. The table sets out what changes in practice.

The 2024 amendment gave the remote form its own definition. A remote qualified electronic signature creation device is a QSCD that is managed by a qualified trust service provider on behalf of a signatory (Article 3(23a)). Articles 29(1a) and 29a reserve the management of such a device to qualified providers and set the conditions for remote signing.

The legal result is identical. Article 3(12) asks for a qualified device and does not ask where it is, so a signature made with a remote device is as much a qualified electronic signature as one made with a card.

A certification body designated by a member state does. Under Article 30(1), conformity with Annex II is certified by "appropriate public or private bodies designated by Member States", whose names and addresses are notified to the Commission. The manufacturer cannot declare its own product qualified. Nor can the trust service provider that uses it.

The certificate has to rest on a security evaluation. Article 30(3) requires the evaluation to follow one of the standards for the security assessment of information technology products on a list that the Commission establishes by implementing act. Another process is allowed only where no listed standard exists or an evaluation under one is still under way. It must use comparable security levels, and the certifying body must notify it to the Commission.

Since the 2024 amendment a certification has an expiry date. Its validity may not exceed five years, and only on condition that vulnerability assessments are carried out every two years. Where vulnerabilities are identified and not remedied, the certification is cancelled (Article 30(3a)). A provider that runs a remote device carries a further duty. It must comply with any requirements identified in the certification report for that specific device (Article 29a(1)(c)), for instance on the environment in which the hardware is operated.

The European Commission keeps it. Article 31 requires each member state to notify the Commission of every device certified by its designated bodies, no later than one month after the certification is concluded. The same one-month limit applies when a certification is cancelled. On the basis of those notifications the Commission establishes, publishes and maintains a list of certified qualified electronic signature creation devices.

A device certified in one member state is recognised as a qualified device in all the others (Article 24a(2)). A card certified in France can therefore be used by a provider in Finland without a second certification.

This list is easy to confuse with the EU Trusted List, and they answer different questions. The Commission's device list names products. The Trusted List names providers and the qualified services each one is granted. A firm that wants to know whether a signing service is qualified starts with the Trusted List. The device list matters mostly to providers, auditors and supervisory bodies.

By validating the signature. Nobody can inspect the device after the event, so the evidence sits in the signer's certificate. Annex I, point (j), requires a qualified certificate to carry an indication, readable by software, where the signature creation data is located in a qualified device. Validation software reads that marker, and Article 32(1)(f) makes it one of the conditions for confirming a qualified signature: the signature was created by a qualified electronic signature creation device.

The reader sees the answer as the signature level in a validation report. A report from the European Commission's free signature validator separates a qualified electronic signature from an advanced signature supported by a qualified certificate. The second result usually means the certificate was genuine but the key was not held in a qualified device.

A firm that signs with clients does not need to buy or certify anything. The provider that issues the certificate supplies the card or runs the remote device. The useful questions for a supplier are which certified device it uses and whether its service appears on the Trusted List as qualified.