Trust services: attestations, archiving, ledgers, remote management

In short

Regulation 2024/1183 added new trust services: electronic attestations of attributes, electronic archiving, electronic ledgers and the remote management of signature and seal creation devices Art. 3(16) Art. 45b Art. 45i Art. 45k Art. 29a. Archiving and ledgers follow the common logic: legal effect not denied solely on the grounds of electronic form or non-qualified status, and a defined effect for the qualified version Art. 45i Art. 45k. The implementing regulations that concern them do not all apply immediately: the one on remote management applies from 19 August 2027 Art. 2.

This page supplements step 4 on trust services.

Electronic attestations of attributes

The three kinds of attestations (non-qualified, qualified, public) and their legal effects are presented in step 2; their place in the wallet in step 3. Here is what the regulation adds for providers.

The qualified attestation (QEAA) meets the requirements of Annex V Art. 45d(1). The assessment of compliance with those requirements is carried out in accordance with the reference standards set by implementing act Art. 45d(2), and it is not subject to any mandatory requirement in addition to those of Annex V Art. 45d(3). If revoked after issuance, it loses its validity and cannot in any circumstances regain it Art. 45d(4). Implementing Regulation 2025/1569 sets the standards applicable to qualified and public attestations, to the list of public sector bodies that issue the latter, to catalogues of attributes and to the verification of attributes against authentic sources Art. 1.

Before issuing a qualified certificate or a qualified attestation, the provider verifies the identity and, where applicable, the attributes of the person Art. 24(1). The standards for this verification are set out in Implementing Regulation 2025/1566, applicable from 19 August 2027 Art. 24(1c) Art. 1 Art. 2. Its annex makes specification ETSI TS 119 461 V2.1.1 applicable, for the purposes of compliance with its clause C.3, subject to adaptations Reference standard for the verification of the identity and attributes of persons to whom a qualified certificate or qualified electronic attestation of attributes is to be issued ETSI TS 119 461 V2.1.1.

Verification against authentic sources. Member States ensure, within 24 months of the entry into force of the implementing acts provided for by two provisions of the regulation Art. 5a(23) Art. 5c(6), that qualified providers that issue attestations can verify certain attributes by electronic means, at the request of the user. This applies at least to the attributes listed in Annex VI, where they rely on authentic sources within the public sector, and in accordance with Union or national law Art. 45e(1).

The public attestation (issued by or on behalf of a public sector body responsible for an authentic source) meets the requirements of Annex VII. The qualified certificate supporting the body’s qualified signature or seal identifies it as the body responsible for the authentic source (or designated to act on its behalf), unambiguously represents that source and identifies the law that establishes it Art. 45f(1). The Member State ensures that these bodies meet a level of reliability equivalent to that of qualified providers Art. 45f(2), and notifies their list to the Commission together with a conformity assessment report Art. 45f(3). A public attestation that complies with the reference standards is “deemed to be compliant” with these requirements Art. 45f(5).

In public services, where national law requires electronic identification to access an online service, the identification data contained in an attestation do not substitute for it, unless the Member State specifically allows it. In that case, qualified attestations issued in other Member States are also accepted Art. 45c.

For the wallet and privacy, attestation providers allow wallet users to request, obtain, store and manage their attestations, irrespective of the Member State in which the wallet is provided Art. 45g(1); providers of qualified attestations provide an interface with wallets Art. 45g(2). The prohibition on combining data and their logical separation are presented in step 2; qualified providers also provide this service in a manner that is functionally separate from their other services Art. 45h(3).

Electronic archiving

Electronic archiving is a service that receives, stores, retrieves and deletes electronic data and documents in order to ensure their durability and legibility, and to preserve their integrity, confidentiality and proof of origin throughout the preservation period Art. 3(48).

The qualified service is provided by a qualified provider. It ensures the durability and legibility of documents beyond the technological validity period and at least throughout the legal or contractual preservation period; it protects them against loss and alteration, except for changes concerning their medium or electronic format; it allows authorised relying parties to receive, in an automated manner, a report confirming that the documents retrieved enjoy the presumption of integrity from the beginning of the preservation period to the moment of retrieval. This report bears the provider’s qualified signature or seal Art. 45j(1). A service that complies with the reference standards is presumed to comply Art. 45j(2). These standards are set out in Implementing Regulation 2025/2532 Art. 2. That regulation also requires, where the archived documents contain qualified signatures or seals, that their trustworthiness be preserved, including beyond their technological validity period; to do so, the provider may rely on a qualified preservation service for signatures or seals Art. 1(1) Art. 1(2).

Electronic ledgers

An electronic ledger is a sequence of electronic data records that ensures their integrity and the accuracy of their chronological ordering Art. 3(52).

The qualified ledger is created and managed by one or more qualified providers; it establishes the origin of the records, ensures their unique sequential chronological ordering and makes any subsequent change immediately detectable Art. 45l(1). The regulation words the presumption of conformity as follows:

These standards are set out in Implementing Regulation 2025/2531 Art. 1.

Remote management of signature and seal creation devices

A remote qualified signature creation device is a qualified device managed by a qualified provider on behalf of a signatory; the same applies to seals Art. 3(23a) Art. 3(23b).

The basic rule is strict:

This qualified provider generates or manages the signature creation data on behalf of the signatory; it duplicates them only for back-up purposes, with the same level of security and with the number of duplicates limited to the minimum needed to ensure continuity of the service; it complies with the requirements of the device’s certification report Art. 29a(1). These rules also apply to seals Art. 39a. A transitional measure allowed other qualified providers to carry out this management without qualified status for that service, until 21 May 2026 Art. 51(3).

The reference standards are set out in Implementing Regulation 2025/1567, applicable from 19 August 2027 Art. 1 Art. 2. Its annex provides that specification ETSI TS 119 431-1 V1.3.1 applies for the purposes of conformity assessment with a specific policy defined in its Annex A (the “EU Server Signing Application Service v2” policy, SSASP), subject to adaptations List of reference standards and specifications for the management of remote qualified electronic signature creation devices and of remote qualified electronic seal creation devices ETSI TS 119 431-1 V1.3.1. Unlike other articles, the one that calls for these standards does not contain a presumption of conformity sentence Art. 29a(2).

What “qualified” changes: summary

For remote management, the dash indicates that the regulation provides for no specific legal effect: it reserves the management of signature creation data to the qualified provider that provides this qualified service.

In Belgium

Key points

• The qualified attestation is assessed against the reference standards and is not subject to any mandatory requirement beyond Annex V Art. 45d(2) Art. 45d(3).
• Qualified attestation providers provide this service in a manner that is functionally separate from their other services Art. 45h(3).
• Qualified archiving and ledgers enjoy presumptions of integrity, origin or chronological ordering Art. 45i(2) Art. 45k(2).
• Only a qualified provider providing the qualified remote management service may manage signature creation data on behalf of the signatory Art. 29(1a).
• Several implementing regulations apply only from 2027: 2025/1566 and 2025/1567 from 19 August 2027 Art. 2 Art. 2.

Written by Asphalia.