In short
The standards cited by the acts come from ETSI, CEN, ISO/IEC or other bodies (IETF RFCs, NIST FIPS standard…) ETSI EN 319 401 V3.2.1, Foreword Annex RFC 3161 FIPS PUB 140-3. For trust services, the Regulation gives them different roles depending on the article: presumption of conformity, basis of the assessment, or basis of certification Art. 42(1a) Art. 45(1) Art. 30(3). Reading a standard starts with reading the act that refers to it: which version, which clauses, which adaptations Annex I List of reference standards and specifications for qualified time stamp services.
This page complements step 5 on trust and certification. The general distinction between a mandatory standard and a standard that gives rise to a presumption of conformity is presented in step 1.
Who writes the cited standards?
The implementing acts on trust services refer to many ETSI documents. The two documents below present themselves as produced by its Technical Committee “Electronic Signatures and Trust Infrastructures” (ESI), one as a European Standard (EN), the other as a Technical Specification (TS):
This European Standard (EN) has been produced by ETSI Technical Committee Electronic
Signatures and Trust Infrastructures (ESI).
This Technical Specification (TS) has been produced by ETSI Technical Committee Electronic
Signatures and Trust Infrastructures (ESI).
Other references point to CEN standards, such as the EN 419211 protection profiles for signature devices, or to ISO/IEC standards, such as the Common Criteria ISO/IEC 15408 Annex EN 419211-1 to -6 (2013/2014) ISO/IEC 15408 (1-5) and ISO/IEC 18045. The annex to Implementing Regulation 2025/1929 on time-stamping cites yet other documents: IETF RFC 3161, the FIPS PUB 140-3 standard and the Common Criteria CC:2022 published by the participants in the Arrangement on the Recognition of Common Criteria Certificates in the field of IT Security List of reference standards and specifications for qualified time stamp services RFC 3161 FIPS PUB 140-3 CC:2022 R1 Part 1. For these standards, this site publishes fact sheets written by us, which are not official texts.
The role of the standard, article by article
The Regulation does not give standards the same role for all services. The table reproduces the wording of each article.
| Subject | What the Regulation says about the standard | Source |
|---|---|---|
| Qualified certificate for electronic signatures; for electronic seals | a certificate that meets it is presumed to comply with Annex I; with Annex III | Art. 28(6) Art. 38(6) |
| Qualified electronic signature creation device | the Commission may designate standards; a device that meets them is presumed to comply with Annex II | Art. 29(2) |
| Validation of a qualified signature; qualified validation service | presumption of conformity | Art. 32(1) Art. 33(2) |
| Qualified preservation service | presumption of conformity | Art. 34(1a) |
| Qualified time stamp | the binding of date, time and data and the accuracy of the time source are presumed to comply | Art. 42(1a) |
| Qualified electronic registered delivery | the sending and receiving process is presumed to comply | Art. 44(1a) |
| Qualified certificate for website authentication | the evaluation of compliance with Annex IV “shall be carried out in accordance with” the standards | Art. 45(1) |
| Qualified attestation | the evaluation of compliance with Annex V “shall be carried out in accordance with” the standards | Art. 45d(2) |
| Public attestation | an attestation that meets the standards is “deemed” to comply (the text says deemed, not presumed) | Art. 45f(5) |
| Qualified archiving; electronic ledger | presumption of conformity | Art. 45j(2) Art. 45l(2) |
| Remote management of qualified devices | list of standards “for the purposes of paragraph 1”, without a presumption sentence; the implementing act applies the standard for the purpose of assessing conformity with the EU SSASP v2 policy of its annex A | Art. 29a(2) List of reference standards and specifications for the management of remote qualified electronic signature creation devices and of remote qualified electronic seal creation devices |
| Certification of a qualified device | certification is based on a security evaluation under one of the standards of the list, or on a comparable process | Art. 30(3) |
| Trusted list | the list meets the specifications in the annex to the Decision, which are based on an ETSI specification | Art. 1 Annex I |
Several mechanisms can therefore be distinguished. Where the text says “presumed”, the requirement remains that of the Regulation, and the standard is a recognised means of showing that it is met Art. 28(6) Art. 42(1a) Art. 45l(2). For the public attestation, the text uses a different term, “deemed” Art. 45f(5). Where it says that the evaluation “shall be carried out in accordance with” the standards, the conformity assessment must follow those standards Art. 45(1). Where it bases a certification on a standard, the body certifies under that standard or under the alternative process that the text regulates Art. 30(3). Each article must therefore be read: no single rule applies to all.
Reading a standard in five questions
1. Which act refers to it, and for what purpose?
In the articles of the table, it is implementing acts that designate the standards, for the use set by each article. For example, Implementing Regulation 2025/1929 refers, for qualified time-stamping, to two ETSI standards Art. 1 List of reference standards and specifications for qualified time stamp services.
2. Which version?
The act cites a precise version: ETSI EN 319 421 V1.3.1 and ETSI EN 319 422 V1.1.1 for time-stamping List of reference standards and specifications for qualified time stamp services ETSI EN 319 421 V1.3.1 ETSI EN 319 422 V1.1.1. In the ETSI documents of the corpus, the first line gives the reference, the version and the date, for example “ETSI EN 319 401 V3.2.1 (2026-01)” ETSI EN 319 401 V3.2.1, ETSI EN 319 401 V3.2.1 (2026-01). ETSI standards apply the same logic to their own references:
For specific references, only the cited version applies. For non-specific references, the
latest version of the referenced document (including any amendments) applies.
A standard may be cited in a version that is no longer the latest published: the annex to Implementing Regulation 2025/1929 cites ETSI EN 319 401 in version V3.1.1, whereas a more recent version has been published List of reference standards and specifications for qualified time stamp services ETSI EN 319 401 V3.1.1 ETSI EN 319 401 V3.2.1.
Cited version
The annex to Implementing Regulation 2025/1929 cites the ETSI EN 319 401 standard in version V3.1.1 List of reference standards and specifications for qualified time stamp services ETSI EN 319 401 V3.1.1. The latest published version is V3.2.1, of January 2026 ETSI EN 319 401 V3.2.1, ETSI EN 319 401 V3.2.1 (2026-01).
The same annex cites the 2022 edition of ISO/IEC 15408; according to our fact sheet, drawn up on 29-10-2026, the edition in force is that of 2026 § 1. Identification.
3. Which status?
The type of document is stated in its foreword: European Standard (EN) or Technical Specification (TS), as seen above ETSI EN 319 401 V3.2.1, Foreword ETSI TS 119 612 V2.4.1, Foreword. It is also necessary to check that it is a published version: the technical specifications that the Commission is drawing up for the wallet are held in this corpus in the form of a snapshot that has not been finalised TS1 TS14 (see step 3).
Non-final document
The technical specifications TS1 to TS14 of the Commission’s repository are held in the corpus in the form of a snapshot of the main branch (main@365f734) of 27-10-2026: they are not finalised versions TS1 TS14.
4. Which clauses, and which adaptations?
The act does not always take over the standard as it stands. Decision 2015/1505 on trusted lists gives a complete example:
When no specific requirement is set in the present specifications, requirements from ETSI
TS 119 612 clauses 5 and 6 shall apply in their entirety. When specific requirements are
set in the present specifications, they shall prevail over the corresponding requirements
from ETSI TS 119 612.
Other acts apply the standards “with the following adaptations”. For time-stamping, these adaptations replace normative references (for example with the 2022 edition of ISO/IEC 15408), modify certain requirements of the standard and add others, such as a vulnerability analysis at least once per quarter. They follow the numbering of the standard (OVR, TIS… codes): it is the act, not the code, that says which requirement is adapted List of reference standards and specifications for qualified time stamp services ETSI EN 319 421 V1.3.1.
Error in the act
In this annex, requirement TIS-7.6.3-02 refers to the Common Criteria “version CC:2002, Parts 1 through 5”. This is probably version CC:2022, which requirement TIS-7.6.2-03 of the same annex cites in identical wording List of reference standards and specifications for qualified time stamp services CC:2022 R1 Part 1. This reading is ours, not an official correction.
An act may also target only one part of a standard: for identity verification, the ETSI TS 119 461 specification applies for the purpose of conformity with clause C.3 of its annex C Reference standard for the verification of the identity and attributes of persons to whom a qualified certificate or qualified electronic attestation of attributes is to be issued. The standard to apply is therefore the standard as adapted by the act.
5. How to read the requirements?
Within an ETSI standard, a few landmarks help. The examples below come from ETSI EN 319 401:
- the scope says what the standard covers and what it does not cover. ETSI EN 319 401, for example, does not say how an independent party assesses its requirements, and refers for that to ETSI EN 319 403-1 ETSI EN 319 401 V3.2.1, § 1 Scope;
- normative references are necessary for the application of the standard, informative references are not ETSI EN 319 401 V3.2.1, § 2.1 Normative references ETSI EN 319 401 V3.2.1, § 2.2 Informative references;
- the verbs have a defined meaning:
In the present document “shall”, “shall not”, “should”, “should not”, “may”, “need not”,
“will”, “will not”, “can” and “cannot” are to be interpreted as described in clause 3.2 of
the ETSI Drafting Rules (Verbal forms for the expression of provisions).
- the identifiers: in ETSI EN 319 401, each requirement bears a code made up of three letters, the clause number and a sequence number (for example “REQ” for a general requirement); some are marked as conditional, as a choice, or proportionate ETSI EN 319 401 V3.2.1, § 3.4 Notation. Other standards use other prefixes, such as “OVR” in ETSI EN 319 421 ETSI EN 319 421 V1.3.1.
Consolidation without official value
This page cites the consolidated versions, published on EUR-Lex, of Regulation 910/2014 and Implementing Decision 2015/1505 Regulation (EU) No 910/2014 — consolidated version of 18/10/2024 Implementing Decision (EU) 2015/1505 — consolidated version of 29/04/2026. These consolidations are documentation tools: only the texts published in the Official Journal of the European Union are authentic.
Key points
- Depending on the article, the standard gives rise to a presumption of conformity, sets the assessment method or serves as the basis for certification Art. 42(1a) Art. 45(1) Art. 30(3).
- It is the implementing act that designates the standard and its precise version List of reference standards and specifications for qualified time stamp services.
- The act may target only certain clauses and impose adaptations, which take precedence over the standard Annex I.
- The act cites a precise version; when a more recent version exists, this site flags the gap List of reference standards and specifications for qualified time stamp services ETSI EN 319 401 V3.1.1.
- In an ETSI standard, the verbs “shall”, “should” and “may” have a defined meaning ETSI EN 319 401 V3.2.1, Modal verbs terminology.
Written by Asphalia.