Electronic Signatures and Trust Infrastructures (ESI); General Policy Requirements for Trust Service Providers

Note

ETSI standard setting the general policy requirements applicable to all trust service providers, the basis for eIDAS audits (version 3.2.1).

Summary

Purpose

European standard ETSI EN 319 401 (version 3.2.1, January 2026) sets the general policy requirements applicable to all trust service providers, whatever the service provided ETSI EN 319 401 V3.2.1, § 1 Scope ETSI EN 319 401 V3.2.1, History. Its scope begins as follows:

Other standards refine these requirements for each type of service; the standard does not say how a third party assesses compliance with them. It aims to support the NIS2 Directive and covers trust services, whether qualified or not ETSI EN 319 401 V3.2.1, § 1 Scope.

Who it applies to

The only act in the corpus that cites this version is Implementing Regulation 2025/1569, as amended by 2026/1735. It targets providers of qualified electronic attestations of attributes and providers of attestations issued by or on behalf of a public sector body responsible for an authentic source Art. 3(1).

Key points

• Same architecture as version 3.1.1: risk assessment (clause 5, now entitled risk management framework and risk assessment), policies and practices (clause 6), management and operation (clause 7) ETSI EN 319 401 V3.2.1, § 5 Risk Management Framework and Risk Assessment ETSI EN 319 401 V3.2.1, § 6 Policies and practices ETSI EN 319 401 V3.2.1, § 7 TSP management and operation.
• Proportionality: when applying the requirements, the provider takes due account of its exposure to risks, its size, the likelihood of incidents and their severity ETSI EN 319 401 V3.2.1, § 4.2 Applicability of Conditional Requirements.
• Regulatory alignment: according to the history of the standard, version 3.2.0 aligns it with the NIS2 Directive and with a published implementing regulation, which the standard identifies as Implementing Regulation 2024/2690 (reference [i.27]) ETSI EN 319 401 V3.2.1, Annex D (informative): Change history ETSI EN 319 401 V3.2.1, § 2.2 Informative references. Three informative annexes map the requirements against the DORA Regulation, Regulation 910/2014 and Implementing Regulation 2024/2690 ETSI EN 319 401 V3.2.1, Annex A (informative): Mapping ETSI EN 319 401 requirements with DORA Regulation ETSI EN 319 401 V3.2.1, Annex B (informative): Mapping ETSI EN 319 401 requirements with eIDAS Regulation ETSI EN 319 401 V3.2.1, Annex C (informative): Mapping ETSI EN 319 401 requirements with Commission Implementing Regulation (EU) 2024/2690 (NIS2).

What the act applies, and how

• Through an intermediate standard: Annex I to Implementing Regulation 2025/1569 makes ETSI TS 119 471 version 1.1.1 applicable, subject to adaptations; the first adaptation replaces its normative references and places EN 319 401 version 3.2.1 among them Annex I ETSI TS 119 471 V1.1.1.
• Obligation: both categories of providers comply with the standards and specifications of Annex I Art. 3(1).
• Effect: for an attestation issued by or on behalf of a public sector body responsible for an authentic source, Regulation 910/2014 provides that it is deemed to be compliant with the requirements laid down in paragraph 1 of the article cited where it complies with the standards, specifications and procedures referred to in paragraph 6 Art. 45f(5). For qualified attestations, the regulation provides for no presumption; it states that the assessment of compliance with the requirements of Annex V is carried out in accordance with the standards, specifications and procedures provided for Art. 45d(2) Art. 45d(5).
• Origin of the text: the current Annex I comes from Implementing Regulation 2026/1735, which replaced it Art. 1(4) List of reference standards and specifications referred to in Article 3. Only the amendment concerning the verification of attributes applies from 1 January 2027 Art. 1(3) Art. 2.

Implementing Regulation 2025/2162 cites EN 319 401 without a version; the owners of conformity assessment schemes ensure that their schemes state the year and version number of the standards selected Annex II Art. 6(3). The other acts in the corpus that set a version cite 3.1.1 ETSI EN 319 401 V3.1.1.

Important clauses

• ETSI EN 319 401 V3.2.1, § 1 Scope: scope.
• ETSI EN 319 401 V3.2.1, § 5 Risk Management Framework and Risk Assessment: risk management and assessment.
• ETSI EN 319 401 V3.2.1, § 7 TSP management and operation: management and operation.
• ETSI EN 319 401 V3.2.1, Annex D (informative): Change history: change history.

Links

• Version 3.1.1 of the same standard ETSI EN 319 401 V3.1.1.
• Intermediate standard: ETSI TS 119 471 ETSI TS 119 471 V1.1.1.
• Learning path: step 5, certification and standards.

ETSI standard: the site reproduces only short extracts; the full text is available from ETSI ETSI EN 319 401 V3.2.1. Written by Asphalia.