Trust services

In short

A trust service is an electronic service, normally provided for remuneration, used for example to sign, seal, time-stamp, send registered data or archive Art. 3(16). A signature, a seal or a time stamp cannot be denied legal effect solely on the grounds that it is in electronic form or not qualified Art. 25(1) Art. 35(1) Art. 41(1). The qualified version adds an effect defined by the regulation: equivalence with a handwritten signature, or a presumption of integrity, origin or accuracy Art. 25(2) Art. 35(2) Art. 41(2). It is recognised in all Member States Art. 24a.

Trust service providers, qualified or not, and the way qualified status is obtained are presented in step 2. This page describes the services themselves; the next page deals with attestations, archiving, ledgers and the remote management of signature creation devices.

What is a trust service?

The regulation defines a trust service as:

Fourteen activities follow, which can be grouped into families:

A qualified trust service is a service that meets the requirements of the regulation Art. 3(17). It is provided by a provider that has been granted qualified status by the supervisory body Art. 3(20).

What “qualified” changes: the common logic

For most services, the regulation follows the same two-step pattern.

1. No discrimination. Legal effect and admissibility as evidence in legal proceedings cannot be denied solely on the grounds that the signature, seal, time stamp or registered delivery data are in electronic form, or do not meet the requirements of the qualified version Art. 25(1) Art. 35(1) Art. 41(1) Art. 43(1).
2. A stronger effect for the qualified version. The regulation attaches a specific effect to the qualified version: equivalence with a handwritten signature for signatures, presumptions for the other services Art. 25(2) Art. 35(2) Art. 41(2) Art. 43(2).

Added to this is mutual recognition: a qualified signature based on a qualified certificate issued in one Member State is recognised as such in all the others, and the same applies to each qualified service Art. 24a(1) Art. 24a.

Electronic signatures

An electronic signature consists of data in electronic form attached to or associated with other data, which the signatory uses to sign Art. 3(10). The signatory is always a natural person Art. 3(9). The regulation distinguishes three levels.

The diagram reads from bottom to top. The advanced electronic signature meets four requirements: it is uniquely linked to the signatory, it is capable of identifying the signatory, it is created using electronic signature creation data that the signatory can, with a high level of confidence, use under their sole control, and it is linked to the data signed in such a way that any subsequent change is detectable Art. 26(a) Art. 26(b) Art. 26(c) Art. 26(d). The qualified electronic signature is an advanced signature created by a qualified electronic signature creation device (QSCD) and based on a qualified certificate for electronic signatures Art. 3(12). The device is the software or hardware that creates the signature; it is qualified if it meets the requirements of Annex II Art. 3(22) Art. 3(23). The certificate links signature validation data to a natural person and confirms at least that person’s name or pseudonym; it is qualified if it is issued by a qualified provider and meets Annex I Art. 3(14) Art. 3(15).

The effect of the qualified signature is set out in one sentence:

The qualified certificate. It is not subject to any mandatory requirement exceeding Annex I, but may include non-mandatory additional specific attributes Art. 28(2) Art. 28(3). If revoked after initial activation, it loses its validity from the moment of its revocation and its status cannot in any circumstances be reverted Art. 28(4). Member States may lay down national rules on temporary suspension, subject to two conditions: the certificate loses its validity for the period of suspension; the period of suspension is clearly indicated in the certificate database, and the suspension status is visible, during that period, from the service providing information on the status of the certificate Art. 28(5). The reference standards for this certificate are set out in Implementing Regulation 2025/1943 Art. 1(1); a certificate that complies with them is presumed to comply with Annex I Art. 28(6).

The qualified device. It complies with Annex II Art. 29(1), and its conformity is certified by bodies designated by Member States Art. 30(1). This certification is detailed in step 5.

Validation. Validating a qualified signature means checking in particular that the certificate was qualified and valid at the time of signing, that the signature was created by a qualified device and that the signed data have not been altered Art. 32(1). The validation system must provide the relying party with the correct result and allow it to detect any security-relevant issues Art. 32(2). A qualified validation service may be provided only by a qualified provider, which provides the result in an automated manner that is reliable and efficient, bearing its advanced signature or seal Art. 33(1). The reference standards are set out in Implementing Regulations 2025/1945 (validation) and 2025/1942 (qualified validation service) Art. 1(1) Art. 1.

Preservation. A qualified preservation service uses procedures and technologies capable of extending the trustworthiness of qualified signatures beyond their technological validity period Art. 34(1); its standards are set out in Implementing Regulation 2025/1946 Art. 1.

In public services. A Member State that requires an advanced signature for an online public service recognises advanced signatures, advanced signatures based on a qualified certificate and qualified signatures, at least in the formats or using the methods defined by implementing acts Art. 27(1). Implementing Regulation 2026/248 sets these formats; those in its Annex II are recognised only for signatures created before 23 February 2028 Art. 1(1) Art. 1(2). It also allows other formats, where the Member State of the signatory’s provider offers validation methods that meet the conditions it sets Art. 2. For cross-border use in an online service offered by a public sector body, a Member State may not require a security level higher than that of the qualified signature Art. 27(3).

Electronic seals

The electronic seal concerns legal persons: the creator of a seal is a legal person Art. 3(24), and the seal serves to ensure the origin and integrity of the data to which it is attached Art. 3(25). The levels are the same: the advanced seal meets four requirements, the qualified seal is an advanced seal created with a qualified device and based on a qualified certificate for electronic seals Art. 36 Art. 3(27). One nuance: for the advanced seal, the creation data are used by the creator “under its control”, whereas the advanced signature requires “sole control” Art. 36(c) Art. 26(c).

The effect of the qualified seal is not an equivalence but a presumption:

Qualified certificates for electronic seals meet Annex III Art. 38(1). For devices, their certification, validation and preservation, the signature rules apply mutatis mutandis Art. 39 Art. 40. The standards for qualified certificates for electronic seals are set out in Annex II to Implementing Regulation 2025/1943 Art. 1(2).

Electronic time stamps

An electronic time stamp binds data to a particular time and provides evidence that the data existed at that time Art. 3(33).

To be qualified, the time stamp binds the date and time to the data in such a manner as to reasonably preclude the possibility of the data being changed undetectably, is based on an accurate time source linked to Coordinated Universal Time, and is signed or sealed by the qualified provider using an advanced signature or seal, or by some equivalent method Art. 42(1). Compliance with the reference standards gives rise to a presumption of conformity for the binding of date, time and data and for the accuracy of the time source Art. 42(1a); these standards are set out in Implementing Regulation 2025/1929 Art. 1.

Electronic registered delivery

An electronic registered delivery service transmits data between third parties, provides evidence relating to their handling (including proof of sending and receiving) and protects them against the risk of loss, theft, damage or any unauthorised alterations Art. 3(36). In its qualified version, the data sent and received enjoy a presumption:

The qualified service is provided by one or more qualified providers; it identifies the sender with a high level of confidence and the addressee before the data are delivered; the sending and receiving are secured by an advanced signature or seal of the provider; any change needed for sending is clearly indicated; date and time are indicated by a qualified time stamp. Where the data are transferred between several qualified providers, these requirements apply to each of them Art. 44(1). Providers may agree to make their services interoperable; a conformity assessment body then confirms that this framework meets the same requirements Art. 44(2a). Implementing Regulation 2025/1944 sets the standards for the service and for interoperability Art. 1 Art. 2.

Website authentication

A certificate for website authentication makes it possible to authenticate a website and links it to the natural or legal person to whom it is issued Art. 3(38). The qualified certificate (QWAC, qualified website authentication certificate) is issued by a qualified provider and meets Annex IV Art. 3(39).

Here, the article on the qualified certificate does not speak of legal effect: it organises its recognition by web browsers. These recognise qualified certificates and display the identity data and attributes they attest in a user-friendly manner. They also ensure support for and interoperability with these certificates, with the exception of micro or small enterprises during their first five years of activity as providers of web-browsing services Art. 45(1a). A browser may take precautionary measures against a certificate only in the event of substantiated concerns related to breaches of security or loss of integrity; it must then notify them, in particular to the Commission and to the supervisory body, which investigates Art. 45a(2) Art. 45a(3) Art. 45a(4). Like the other qualified services, a qualified certificate issued in one Member State is recognised in all the others Art. 24a(7).

The assessment of compliance with Annex IV is carried out in accordance with the reference standards set by implementing act Art. 45(1). That is Implementing Regulation 2025/2527, applicable from 6 January 2027 Art. 1 Art. 2. Its annex distinguishes two cases. For certificates issued for use in “transport layer security authentication outside the context of a web-browser”, it cites either standard ETSI EN 319 411-2 V2.6.1, the certificates then being issued in accordance with one of the QNCP-w-gen, QEVCP-w or QNCP-w certificate policies it specifies, or specification ETSI TS 119 495 V1.7.1. For other certificates, including in a browser, specification ETSI TS 119 411-5 V2.1.1 List of reference standards for qualified certificates for website authentication ETSI EN 319 411-2 V2.6.1 ETSI TS 119 495 V1.7.1 ETSI TS 119 411-5 V2.1.1.

Summary table

For each service, the implementing regulation indicated contains the list of standards; the way these standards are imposed or give rise to a presumption of conformity varies from one article to another. Step 5 goes into detail.

Key points

• Fourteen activities make up trust services, from the issuance of certificates to recording in an electronic ledger Art. 3(16).
• A non-qualified service cannot be denied legal effect solely on the grounds that it is not qualified Art. 25(1) Art. 43(1).
• The qualified signature is equivalent to a handwritten signature; qualified seals, time stamps and registered delivery enjoy presumptions Art. 25(2) Art. 35(2) Art. 41(2) Art. 43(2).
• Qualified services are recognised in all Member States Art. 24a.
• Browsers must recognise qualified certificates for website authentication Art. 45(1a).

Written by Asphalia.