Trust, certification and standards

In short

Trust rests on a chain: the Regulation sets a requirement, an implementing act designates the standards, a body assesses or certifies, and a list publishes the result Art. 20(1) Art. 21(3) Art. 22(1). Trusted lists follow a common template based on the ETSI TS 119 612 specification Annex I. Qualified signature creation devices are certified for no more than five years Art. 30(3). The European EUCC scheme, based on the Common Criteria, is used to certify the cybersecurity of products Art. 1; national certification schemes for wallets use it where it is available and applicable Art. 4(1).

Supervisory bodies, conformity assessment bodies, accreditation and the definition of trusted lists are presented in step 2; the principle of wallet certification in step 3. This page goes one step further. The next page explains how to read a standard.

The chain of trust

The diagram reads from left to right; its boxes 2 and 3 vary with the subject. For a qualified service, the path (audit, status, entry on the list) is described in step 2 Art. 21(3). For a qualified signature creation device, a body designated by the Member State (not an accredited body) certifies it, the Member State notifies it and the Commission publishes the list of certified devices Art. 30(1) Art. 31(1) Art. 31(2). For a wallet, the national schemes define the requirements and the evaluation plan, an accredited certification body certifies, and the Commission publishes the list of certified wallets Art. 3(5) Art. 9(1) Art. 5d(3). The trusted list is used mainly to validate what qualified services produce:

These “tokens” are, for example, qualified signatures and seals, qualified time stamps or qualified electronic delivery evidences Annex I.

Trusted lists in practice

Implementing Decision 2015/1505 sets the common template for the lists. It adds several rules to the definition recalled in step 2:

• a Member State may include non-qualified providers and services, provided that the list clearly indicates that they are not qualified Art. 2;
• the list bears an electronic signature or seal, and any human-readable version contains the same data and is signed as well Art. 3(1) Art. 3(2);
• the Member State notifies the Commission of at least two public key certificates of the list operator, whose expiry dates are at least three months apart Art. 4(2);
• the Commission publishes this information through a secure channel, in a signed or sealed version suitable for automated processing Art. 4(3);
• the list contains the current information and the full history of the status of the services since the provider was included Annex I.

The template is based on the ETSI TS 119 612 v2.4.1 specification: its clauses 5 and 6 apply in their entirety where the Decision sets no requirement, and the Decision’s own requirements prevail Annex I ETSI TS 119 612 V2.4.1. This mechanism serves as an example on the next page.

Reading a list. The list of the lists (LOTL) indicates where to find each national list, but gives neither its sequence number nor its date: these must be read in the national list itself Summary of the EU LOTL, sequence 397. An example of a national list, the Belgian list, is described below, in the Belgian situation.

Certification of qualified devices

Qualified electronic signature creation devices (QSCD) are certified by public or private bodies designated by the Member States, which notify their names and addresses to the Commission Art. 30(1) Art. 30(2). Certification is based:

• either on a security evaluation carried out in accordance with one of the standards of a list established by implementing act;
• or on another process, provided that it uses comparable security levels and that the body notifies it to the Commission. This process may be used only in the absence of those standards or while an evaluation in accordance with those standards is ongoing Art. 30(3).

The list of standards is that of Implementing Decision 2016/650. It applies where the signature or seal creation data are held in an environment that is fully, but not necessarily exclusively, managed by the user Art. 1(1). Its annex cites the Common Criteria ISO/IEC 15408 (parts 1 to 3, 2009 and 2008 editions), the evaluation methodology ISO/IEC 18045:2008 and the EN 419211 protection profiles (parts 1 to 6) Annex EN 419211-1 to -6 (2013/2014). Where a qualified trust service provider manages these data on behalf of the signatory, the Decision refers, pending a list of standards, to the other process of comparable level, notified to the Commission Art. 1(2).

The duration of certification is limited (paragraph 3a of the article):

Member States notify the Commission of certified devices no later than one month after certification, and of those no longer certified no later than one month after cancellation; the Commission establishes, publishes and maintains the list of certified devices Art. 31(1) Art. 31(2). Implementing Regulation 2025/1570 governs this notification. It applies from 19 November 2025, a date set by a corrigendum published in the Official Journal, which replaced the 19 December 2025 indicated in the original text Corrigendum R(01) — Implementing Regulation (EU) 2025/1570 Art. 2. Its content: minimum content set out in the annex, submission through a secure electronic channel made available by the Commission, update in the event of a change of status Art. 1. A device certified in one Member State is recognised as qualified in all the others Art. 24a(2). The same rules apply to seal creation devices Art. 39.

EUCC: the European scheme based on the Common Criteria

Regulation (EU) 2019/881 on cybersecurity allows European cybersecurity certification schemes to be adopted; the wallet relies on them for its cybersecurity Art. 5c(2). Among these schemes is EUCC, established by Implementing Regulation 2024/482 for information and communication technology (ICT) products and protection profiles Art. 1.

• The standards. Evaluations apply the Common Criteria (criteria for the security evaluation of information technology) and the Common Evaluation Methodology Art. 3(1), that is, the standards ISO/IEC 15408 (parts 1 to 5) and ISO/IEC 18045 in their 2022 edition, or their equivalents CC:2022 and CEM:2022 Art. 2(1) Art. 2(2). Until 31 December 2027, a certificate may still be issued under the earlier editions (ISO/IEC 15408:2008/2009, ISO/IEC 18045:2008, Common Criteria and Common Methodology 3.1 revision 5) Art. 3(2).
• Protection profiles. A protection profile defines the security requirements of a category of products Art. 2(5). A product is certified against its security target, that is, the statement of the security requirements specific to that product Art. 2(4); it is defined by the applicant or declared conformant to a certified profile Art. 5(1). A certificate issued under the 2022 standards may also attest conformity to a profile established under Common Criteria 3.1, revisions 1 to 4, where the use of that profile is required in particular by Regulation 910/2014 or by Decision 2016/650 Art. 3(4).
• Two assurance levels. “Substantial” (vulnerability analysis levels AVA_VAN 1 or 2) and “high” (AVA_VAN 3, 4 or 5) Art. 4. The AVA_VAN level indicates the degree of evaluation activities carried out to determine the target’s resistance to the exploitation of its flaws Art. 2(8).
• No self-assessment: the conformity self-assessment provided for by Regulation 2019/881 is not permitted Art. 6.
• Five years at most, unless a derogation is approved in advance by the national cybersecurity certification authority Art. 12(2) Art. 12(3).

Wallet certification: the national schemes

Implementing Regulation 2024/2981 details the framework presented in step 3. Each national scheme has an owner, designated by the Member State Art. 3(1). Certification covers the software components, the hardware components and platforms on which they rely (in the cases provided for by the text), and the provision and operation processes, including user enrolment Art. 3(3).

• National schemes use, where available and applicable, the European cybersecurity schemes, in particular EUCC Art. 4(1).
• They require solutions to resist attackers with high attack potential Art. 8(2), against the risks listed in a risk register annexed to the Regulation Art. 8(1) Annex I.
• For the wallet secure cryptographic device (WSCD), where it falls within the scope of certification under the conditions provided for by the text, the evaluation includes a vulnerability analysis at level AVA_VAN.5. A lower level is only possible if the applicant duly justifies, to the certification body, that the security features of the wallet secure cryptographic application (WSCA) maintain the high assurance level overall § 2. Evaluation activities related to the wallet secure cryptographic device.
• Certification bodies are accredited by a national accreditation body under the EN ISO/IEC 17065:2012 standard, provided that they meet the requirements set out in the national schemes Art. 9(1).
• Recertification includes a full evaluation, including of vulnerabilities Art. 18(2).

The Regulation will be reviewed upon the adoption of the first European cybersecurity certification scheme specific to wallets Art. 21.

Auditing qualified trust service providers

To be able to certify a qualified trust service provider, a conformity assessment body is accredited under the EN ISO/IEC 17065:2012 standard, supplemented by the ETSI EN 319 403-1 v2.3.1 standard; the national accreditation body applies the EN ISO/IEC 17011:2017 standard Art. 2(1) Art. 2(2) ETSI EN 319 403-1 V2.3.1. The accreditation certificate specifies the qualified services for which the body is competent and the assessment scheme, where applicable in its specific version Art. 3(1)(e) Art. 3(1)(f). The certification decision covers both the requirements of Regulation 910/2014 and the cybersecurity risk-management measures of the NIS2 Directive Art. 1(2) Art. 21. For their part, supervisory bodies establish a method to verify providers that wish to start a qualified service, involving the competent authorities under NIS2; this Implementing Regulation 2025/1572 applies from 19 August 2026 Art. 1 Art. 5.

In Belgium

Key points

• Trusted lists follow a common template based on ETSI TS 119 612 v2.4.1, whose clauses 5 and 6 apply where the Decision sets no requirement; they are used to validate what qualified services produce Annex I.
• A trusted list may also include non-qualified services, clearly indicated as such Art. 2.
• The certification of a qualified device is valid for five years at most and is cancelled if vulnerabilities are not remedied Art. 30(3).
• EUCC certifies ICT products at the “substantial” or “high” level, without self-assessment Art. 4 Art. 6.
• National certification schemes for wallets require resistance to attackers with high attack potential Art. 8(2).

Written by Asphalia.