(title available in French only)
Official Binding
Note
ETSI standard setting the general policy requirements applicable to all trust service providers, the basis for eIDAS audits (version 3.1.1).
The full text is not reproduced here (copyright): see the official source.
Summary
Purpose
European standard ETSI EN 319 401 (version 3.1.1, June 2024) sets the general policy requirements applicable to all trust service providers, whatever the service provided ETSI EN 319 401 V3.1.1, § 1 Scope ETSI EN 319 401 V3.1.1, History. Its scope begins as follows:
The present document specifies general policy requirements relating to Trust Service Providers (TSPs) that are independent of the type of TSP.
Other standards refine and supplement these requirements for each type of service; the standard does not say how a third party assesses compliance with them ETSI EN 319 401 V3.1.1, § 1 Scope. It aims to support the NIS2 Directive and covers the security of trust services, whether qualified or not ETSI EN 319 401 V3.1.1, § 1 Scope.
Who it applies to
To trust service providers, qualified or not, through several routes: one act makes it applicable directly, another applies it with adaptations, and most go through the standard specific to a service, of which EN 319 401 is a normative reference (table below).
Key points
- Risk assessment (clause 5) and policies and practices: practice statement, terms and conditions, information security policy (clause 6) ETSI EN 319 401 V3.1.1, § 5 Risk Assessment ETSI EN 319 401 V3.1.1, § 6 Policies and practices.
- Management and operation (clause 7): organisation, human resources, assets, access control, cryptography, physical security, operation, network, incidents, evidence, continuity, termination, compliance and supply chain ETSI EN 319 401 V3.1.1, § 7 TSP management and operation.
- Vulnerability scanning and penetration testing: the standard requires regular scanning (REQ-7.8-13) and a penetration test at set-up and after significant changes (REQ-7.8-17X); it recommends, without imposing it, one scan per quarter and one test per year ETSI EN 319 401 V3.1.1, § 7.8 Network security.
- Mapping to eIDAS: an informative annex maps its requirements against Regulation 910/2014 ETSI EN 319 401 V3.1.1, Annex B (informative): Mapping ETSI EN 319 401 requirements with eIDAS Regulation.
What the acts apply, and how
| Act (service) | How the standard comes in | Regime |
|---|---|---|
| 2025/2160 (non-qualified services, risk management) | directly, clauses 5, 6, 7.1 to 7.4 and 7.6 only List of reference standards for non-qualified trust service providers | compliance with the requirements of the article presumed Art. 19a(2) |
| 2025/2531 (qualified electronic ledgers) | whole standard, with adaptations (references, practice statement, cryptography, network…) List of technical specifications and reference standards for qualified distributed electronic ledgers | ledger presumed to comply with paragraph 1 Art. 45l(2) |
| 2025/2532 (qualified electronic archiving) | the annex adapts CEN/TS 18170 and makes its clauses 5, 7.5, 7.8 and 7.10 applicable in it, with quarterly scanning and an annual test List of reference standards and specifications for qualified electronic archiving services CEN/TS 18170:2025 | service presumed to meet the requirements for qualified electronic archiving services Art. 45j(2) |
| 2025/1943 (qualified certificates for signatures and seals) | reference of EN 319 411-2 and EN 319 411-1 as adapted; trusted roles, quarterly scanning, annual test Annex I Annex II | certificate presumed to comply with Annexes I or III to the regulation Art. 28(6) Art. 38(6) |
| 2025/1942 (qualified validation) | reference of ETSI TS 119 441 and 119 172-4 as adapted; scanning, test, clause 7.14 Annex ETSI TS 119 441 V1.2.1 | service presumed to comply with paragraph 1 Art. 33(2) Art. 40 |
| 2025/1929 (qualified time-stamping) | reference of EN 319 421 and 319 422 as adapted; scanning, test List of reference standards and specifications for qualified time stamp services ETSI EN 319 421 V1.3.1 | binding of date and time to data, and accuracy of the time source, presumed to meet the requirements of paragraph 1 Art. 42(1a) |
| 2025/1944 (qualified registered delivery) | reference of EN 319 521 as adapted; clauses 7.3.3 and 7.14, scanning, test List of reference standards and specifications referred to in Article 1 ETSI EN 319 521 V1.1.1 | process for sending and receiving data presumed to meet the requirements of paragraph 1 Art. 44(1a) |
| 2025/1946 (qualified preservation) | reference of ETSI TS 119 511 and 119 172-4 as adapted; scanning, test, clause 7.14 List of reference standards and specifications referred to in Article 2 ETSI TS 119 511 V1.1.1 | qualified preservation service presumed to meet the requirements of paragraph 1; rule extended to seals Art. 34(1a) Art. 40 |
| 2025/1567 (remote management of qualified devices) | reference of ETSI TS 119 431-1, applied for the assessment of conformity with the SSASP policy of its Annex A, as adapted; quarterly scanning List of reference standards and specifications for the management of remote qualified electronic signature creation devices and of remote qualified electronic seal creation devices ETSI TS 119 431-1 V1.3.1 | no presumption sentence in the article Art. 29a(2) |
| 2025/1566 (identity verification) | reference of ETSI TS 119 461 as adapted, for Annex C, clause C.3, of that standard Reference standard for the verification of the identity and attributes of persons to whom a qualified certificate or qualified electronic attestation of attributes is to be issued ETSI TS 119 461 V2.1.1 | verification of identity and attributes carried out in accordance with the implementing acts Art. 24(1a) Art. 24(1b) |
The recitals of 2025/1929, 1942, 1943, 1944, 1946, 2160, 2531 and 2532 add that supervisory bodies should presume compliance with the relevant requirements of the regulation, the provider being able to demonstrate such compliance through other practices
laying down rules for the application of Regulation (EU) No 910/2014 of the European Parliament and of the Council as regards the binding of date and time to data and establishing the accuracy of the time sources for the provision of qualified electronic time stamps laying down rules for the application of Regulation (EU) No 910/2014 of the European Parliament and of the Council as regards qualified validation services for qualified electronic signatures and qualified validation services for qualified electronic seals laying down rules for the application of Regulation (EU) No 910/2014 of the European Parliament and of the Council as regards reference standards for qualified certificates for electronic signatures and qualified certificates for electronic seals laying down rules for the application of Regulation (EU) No 910/2014 of the European Parliament and of the Council as regards reference standards for processes for sending and receiving data in qualified electronic registered delivery services and as regards interoperability of those services laying down rules for the application of Regulation (EU) No 910/2014 of the European Parliament and of the Council as regards qualified preservation services for qualified electronic signatures and for qualified electronic sealslaying down rules for the application of Regulation (EU) No 910/2014 of the European Parliament and of the Council as regards reference standards, specifications and procedures for the management of risks to the provision of non-qualified trust services laying down rules for the application of Regulation (EU) No 910/2014 of the European Parliament and of the Council as regards reference standards and specifications for qualified electronic ledgers laying down rules for the application of Regulation (EU) No 910/2014 of the European Parliament and of the Council as regards reference standards and specifications for qualified electronic archiving services. Regulations 2025/1566 and 2025/1567 apply from 19 August 2027 Art. 2 Art. 2.
Other acts name the standard without a version. According to a recital of Implementing Regulation 2024/2690, adopted under the NIS2 Directive, the cybersecurity requirements of its annex are based in particular on ETSI EN 319401 (Text with EEA relevance). The annex to 2026/798 (remote onboarding to the wallet) refers, through ETSI TS 119 461, to its clauses 5, 7.10 and 7.12 (except requirement REQ-7.12-11) and to requirements of clauses 7.9 and 7.11 Section 2 – Adaptations. Annex II to 2025/2162 cites it in each of its fourteen rows of qualified services (in two of them, after correction); the owners of conformity assessment schemes ensure that their schemes include at least these standards, as applicable, with their year and version number Annex II Art. 6(3).
Cited version
The acts in the table cite version 3.1.1. The index of ETSI standards in the corpus gives 3.2.1 (January 2026) as the latest published version ETSI EN 319 401 V3.2.1, History, which is cited by Implementing Regulation 2025/1569 as amended by 2026/1735 Annex I ETSI EN 319 401 V3.2.1.
Error in the act
The French version of Implementing Regulation 2025/1946 designates the standard as “ETSI TS 319 401” in its references; the English version reads “ETSI EN 319 401” List of reference standards and specifications referred to in Article 2. In Implementing Regulations 2025/1929 and 2025/1942, the requirements on vulnerability scanning and penetration testing refer to “ETSI EN 319 401 [1]”, whereas the act places that standard as reference [4] (2025/1929) or [2] (2025/1942); the English version is identical. The reference probably targets reference [4] or [2]; this reading is ours List of reference standards and specifications for qualified time stamp services Annex. In two rows of Annex II to 2025/2162, “ETSI EN 310 401” was corrected to “ETSI EN 319 401” Corrigendum R(01) — Implementing Regulation (EU) 2025/2162.
Important clauses
- ETSI EN 319 401 V3.1.1, § 5 Risk Assessment: risk assessment.
- ETSI EN 319 401 V3.1.1, § 6 Policies and practices: policies and practices.
- ETSI EN 319 401 V3.1.1, § 7.8 Network security: network security.
- ETSI EN 319 401 V3.1.1, § 7.14 Supply chain: supply chain.
Links
- Version 3.2.1 of the same standard ETSI EN 319 401 V3.2.1.
- Bodies that assess providers: ETSI EN 319 403-1 ETSI EN 319 403-1 V2.3.1.
- Learning path: step 5, certification and standards.
Consolidation without official value
This summary relies on the consolidated versions, published on EUR-Lex, of Regulation 910/2014 and Implementing Regulation 2025/1569 Regulation (EU) No 910/2014 — consolidated version of 18/10/2024 Implementing Regulation (EU) 2025/1569 — consolidated version of 11/08/2026. They serve as documentation: only the texts published in the Official Journal are authentic.
ETSI standard: the site reproduces only short extracts; the full text is available from ETSI ETSI EN 319 401 V3.1.1. Written by Asphalia.