Qualified Trust Service Provider QTSP

A trust service provider is qualified when the supervisory body of its member state has granted it that status for a specific service. Article 3(20) of the eIDAS Regulation builds both points into the definition. The status comes from a public authority, and it attaches to named services, not to the company as a whole.

The wider category is open to anyone. A trust service, under Article 3(16), is an electronic service normally provided for payment that does one of a fixed list of things. The list includes issuing certificates for electronic signatures, seals or websites, creating or validating signatures and seals, creating time stamps, running a registered delivery service and archiving electronic documents. Whoever provides one of these is a trust service provider (Article 3(19)). No permission is needed to be one.

Non-qualified providers are still regulated. They must manage their security risks and report a serious breach within 24 hours (Articles 19 and 19a). What differs is when the authority looks. With a non-qualified provider, the supervisory body acts after the event, once it is told that something is wrong. A qualified provider is checked before it starts and for as long as it operates (Article 46b(3)).

"Qualified" is therefore a legal status. A provider cannot award it to itself. It comes with a gatekeeper, a recurring audit and a public record.

It applies to the supervisory body of the member state where it is established, with an audit report in hand. Article 21 sets the order. The provider first has its service audited by a conformity assessment body, an independent auditor accredited for this work (Article 3(18)). It then notifies the supervisory body that it intends to start, and attaches the auditor's report. The supervisory body verifies that the provider and the service meet the regulation. Where they do, it grants qualified status. It has three months from the notification to finish, or it must tell the provider why it needs longer.

The last step is easy to miss. The supervisory body informs the body that keeps the national trusted list, and the provider may begin the qualified service only once the status is shown there (Article 21(3)).

Several parties are involved, and each one checks or records something different. The table shows who does what.

The auditor never grants the status, and the authority does not carry out the routine audit. Each depends on the other's work. ZealiD AB is one example: a QTSP on the EU Trusted List under Sweden, supervised by the Swedish Post and Telecom Authority (PTS) and assessed every year by TÜViT.

It is audited again at least every 24 months, and the supervisory body can step in at any time in between. Article 20(1) requires the recurring audit by a conformity assessment body, at the provider's own expense. The provider must send the report to the supervisory body within three working days of receiving it. It must also give one month's notice of a planned audit and let the supervisory body attend as an observer if it asks. Twenty-four months is the longest gap allowed, so a provider may be assessed more often.

The supervisory body may audit the provider itself, or order an extra conformity assessment, whenever it chooses (Article 20(2)). If a requirement is not met, it sets a deadline for a remedy. If the remedy does not come, it withdraws the qualified status of the provider or of the affected service, where the extent, duration and consequences of the failure justify that (Article 20(3)). The trusted list body is told, so the public record changes too.

Since the 2024 amendment, two other regulators can set off the same result. The national cybersecurity authority may find that the provider fails the risk-management requirements of the NIS2 Directive. The data protection authority may find that it fails the requirements of the GDPR. Each informs the supervisory body, which can withdraw the status on that ground (Article 20(3a) and (3b)).

Change is supervised as well. A qualified provider must tell the supervisory body at least one month before it changes how it provides a qualified service, and at least three months before it stops (Article 24(2)(a)).

Article 24 lists them. They cover three things: knowing who the customer is, running the service safely, and staying accountable when something goes wrong.

On identity, a provider that issues a qualified certificate must verify the identity of the person who receives it. Article 24(1a) limits how. The check can use a European Digital Identity Wallet or a notified electronic identification means at assurance level high. It can use a certificate of an existing qualified signature or seal. It can be done in the person's physical presence. Any other method must identify the person with a high level of confidence, and a conformity assessment body must confirm that it does. A remote check that uses neither a wallet nor a national electronic identity relies on that last option.

On operations, the provider must employ staff with the necessary expertise and training, use trustworthy systems that are protected against modification, and guard its data against forgery and theft. Before any contract is made, it must tell each prospective user the precise terms of the service, including any limits on its use. It must report a security breach or disruption that has a significant impact to the supervisory body and to the people affected within 24 hours (Article 24(2)). When a certificate is revoked, the new status must be published within 24 hours of the request. Anyone relying on a certificate can check its status free of charge, even after the certificate has expired (Article 24(3) and (4)).

On accountability, the provider must hold sufficient financial resources or liability insurance. It must keep records of the data it issued and received for as long as necessary after it ceases activity, so that they can serve as evidence in legal proceedings. It must also keep an up-to-date termination plan (Article 24(2)(c), (h) and (i)). These duties matter most to a firm that needs to rely on a signature years after it was made.

The provider is, and the regulation makes the claim easier to bring than a claim against an ordinary supplier. Under Article 13(1), every trust service provider is liable for damage it causes, intentionally or negligently, to any person through a failure to meet its obligations under the regulation. Against a non-qualified provider, the person claiming must prove the intention or negligence. Against a qualified provider it is presumed. The provider has to prove that the damage occurred without intention or negligence on its part.

That reversal is the practical value of the status for anyone who relies on a signature. Take a firm that accepts a signed guarantee and later learns that the certificate was issued to an impostor. The firm does not have to prove that the provider was careless in its identity check. The provider has to show that it was not.

Two limits apply. A provider is not liable for use of a service beyond limitations that it told customers about in advance, provided third parties can recognise those limitations (Article 13(2)). National liability rules also govern how a claim is brought (Article 13(3)).

The strongest legal effects in the regulation are reserved for services from qualified providers. A qualified electronic signature has the equivalent legal effect of a handwritten signature (Article 25(2)). It must be based on a qualified certificate, and by definition only a QTSP can issue one (Article 3(12) and (15)). A qualified electronic time stamp is presumed accurate as to the date and time it shows (Article 41(2)). A qualified electronic seal carries a presumption that the data is intact and comes from the stated origin (Article 35(2)).

A signature from a non-qualified provider is not worthless. Article 25(1) says it cannot be refused as evidence solely because it is electronic or because it is not qualified. It has no presumption behind it, though, so the party relying on it must be ready to prove who signed.

For a firm choosing a signing tool, the useful question is narrow. Which company issues the certificate, and is that company qualified for that service?

Look the provider up on the trusted list of the member state where it is established. Under Article 22, each member state publishes a list of the qualified providers it is responsible for, with the qualified services each one provides. The European Commission's Trusted List browser gives access to the national lists in one place.

Check the service, not only the name. A provider can be qualified for time stamps and not for signature certificates, and the list records the services separately.

The EU trust mark is a second signal, and it comes with its own test. A qualified provider may use the mark only after its status is shown on the trusted list. When it does, its website must link to the relevant list (Article 23). A trust mark with no such link is a reason to ask questions.