In short
Qualified status has to be applied for: the provider notifies its intention to the supervisory body, with a conformity assessment report that covers the Regulation and the cybersecurity measures of the NIS2 Directive Art. 21(1). It starts only once the status is indicated in the trusted list Art. 21(3), and is then audited at least every 24 months Art. 20(1). The content of the notification is set by Implementing Regulation 2025/1572, applicable from 19 August 2026 Art. 3 Art. 5.
This guide is part of step 7. What “qualified” changes is explained in step 4; the audit, conformity assessment bodies and trusted lists in step 5. If your qualified service is the issuance of attestations, also read the attestation issuer guide.
Your obligations
Before starting the service
| Obligation | Legal basis | Deadline |
|---|---|---|
| Have your organisation and your service assessed by a conformity assessment body accredited for that purpose | Art. 21(1) Art. 3(18) | — |
| Notify your intention to the supervisory body, with the conformity assessment report confirming compliance with the Regulation and with Article 21 of the NIS2 Directive | Art. 21(1) | — |
| Attach at least the information required by the implementing act: identity, contact details, links to policies and terms, risk analyses, services concerned, identifiers and certificates for the trusted list, planned start date, assessment reports, termination plan | Art. 3 | Implementing Regulation 2025/1572 applicable from 19 August 2026 Art. 5 |
| Start providing the qualified service only once the qualified status is indicated in the trusted list | Art. 21(3) | — |
For its part, the supervisory body verifies your file and asks the competent authorities under NIS2 to verify the cybersecurity measures; if it concludes that the requirements are met, it grants the status and informs the body responsible for the trusted list no later than three months after the notification. If the verification is not concluded within that period, it informs you of the reasons and the period needed Art. 21(2). It may carry out on-site verifications and interviews Art. 4.
Once qualified
| Obligation | Legal basis | Deadline |
|---|---|---|
| Be audited, at your own expense, by a conformity assessment body, and submit the report to the supervisory body | Art. 20(1) | audit at least every 24 months; report submitted within three working days of its receipt Art. 20(1) |
| Inform the supervisory body of any planned audit and allow it to attend as an observer, upon request | Art. 20(1a) | no later than one month before the audit Art. 20(1a) |
| Inform the supervisory body of any change in the provision of your qualified services, or of your intention to cease those activities; the notifications cover at least the significant changes listed by the implementing act (policies, architecture, hosting, cryptography, registration, governance, subcontractors…) | Art. 24(2)(a) Art. 1 | at least one month before a change; at least three months before cessation Art. 24(2)(a) |
| Employ staff, and where applicable subcontractors, who have the necessary expertise, reliability and training | Art. 24(2)(b) | — |
| Maintain sufficient financial resources and/or obtain appropriate liability insurance | Art. 24(2)(c) | — |
| Inform each customer, before entering into a contract, of the precise terms and conditions for the use of the service | Art. 24(2)(d) | — |
| Use trustworthy systems and products that are protected against modification, and trustworthy systems to store data | Art. 24(2)(e) Art. 24(2)(f) | — |
| Manage the legal, business, operational and other risks related to the service, at least for registration and onboarding, verification and the management of services; the provisions of Implementing Regulation 2025/2160 on risk management Art. 2 to Art. 4 apply by analogy | Art. 24(2)(fa) Art. 2 | — |
| Notify the supervisory body, the identifiable affected individuals and, where applicable, other bodies, of any security breach or disruption that has a significant impact on the trust service provided or on the personal data maintained therein | Art. 24(2)(fb) | without undue delay and in any event within 24 hours of the incident |
| Take measures against forgery, theft or misappropriation of data | Art. 24(2)(g) | — |
| Record and keep accessible the information on the data issued and received, including after the cessation of activities | Art. 24(2)(h) | for as long as necessary |
| Keep an up-to-date termination plan for each qualified service, covered by sufficient financial resources or insurance | Art. 24(2)(i) Art. 3(1) Art. 3(6) | review at least every two years and with each change Art. 3(4) |
| If you issue qualified certificates or qualified attestations: verify the identity and, where applicable, the attributes of the person, using the methods provided for | Art. 24(1) Art. 24(1a) Art. 24(1b) | standards of Implementing Regulation 2025/1566 applicable from 19 August 2027 Art. 2 |
| If you issue qualified certificates: maintain a certificate database, publish a revocation in a timely manner, and provide validity information free of charge to any relying party | Art. 24(2)(k) Art. 24(3) Art. 24(4) | revocation published within 24 hours after receipt of the request Art. 24(3) |
A dash indicates that the cited provision sets no deadline of its own.
If you do not meet a requirement, the supervisory body requires you to remedy the failure, where applicable within a time limit that it sets. If you do not remedy it, it withdraws the qualified status from you or from the service concerned, where justified in particular by the extent, duration and consequences of the failure Art. 20(3).
The NIS2 side
The NIS2 Directive classifies qualified trust service providers among the essential entities, regardless of their size Art. 3(1)(b). The conformity assessment and the audit also cover its cybersecurity risk-management measures Art. 21(1) Art. 20(1) Art. 21. For significant incidents that have an impact on its trust services, a trust service provider notifies the CSIRT or the competent authority within 24 hours of becoming aware of them; the Directive provides for this in the derogating subparagraph that follows point (e) of its paragraph on notification Art. 23(4).
Reference standards
The reference standards and specifications provided for by the Regulation for the requirements applicable to qualified providers are set out in the annex to Implementing Regulation 2025/2530; in the event of divergence, the provisions of that Regulation Art. 1 to Art. 3 prevail Art. 4(1) Art. 4(2) Art. 24(5). Each service also has its own implementing regulation:
| Qualified service | Implementing regulation |
|---|---|
| Qualified certificates for electronic signatures and seals | 2025/1943 Art. 1 |
| Qualified certificates for website authentication | 2025/2527, applicable from 6 January 2027 Art. 1 Art. 2 |
| Qualified validation of qualified signatures and seals | 2025/1942 Art. 1 |
| Qualified preservation of qualified signatures and seals | 2025/1946 Art. 1 |
| Qualified electronic time stamps | 2025/1929 Art. 1 |
| Qualified electronic registered delivery | 2025/1944 Art. 1 |
| Qualified electronic archiving | 2025/2532 Implementing Regulation (EU) 2025/2532 |
| Qualified electronic ledgers | 2025/2531 Art. 1 |
| Remote management of qualified signature or seal creation devices | 2025/1567, applicable from 19 August 2027 Art. 1 Art. 2 |
| Qualified electronic attestations of attributes | 2025/1569 Art. 1 |
For identity verification, the annex to Implementing Regulation 2025/1566 makes the ETSI TS 119 461 V2.1.1 specification applicable, for the purpose of conformity with its clause C.3, with adaptations Reference standard for the verification of the identity and attributes of persons to whom a qualified certificate or qualified electronic attestation of attributes is to be issued ETSI TS 119 461 V2.1.1. How to read these references (clauses targeted, adaptations) is explained in step 5.
The texts to read, in order
- Consolidated Regulation 910/2014: initiation of a qualified service, supervision and requirements for qualified trust service providers Art. 21 Art. 20 Art. 24, then the section on your service. Library page for the Regulation.
- Implementing Regulation 2025/1572 on the notification of intention Art. 3. Library page.
- Implementing Regulation 2025/2530 on the requirements for qualified providers Art. 1. Library page.
- Implementing Regulation 2025/2160 on risk management, certain provisions of which Art. 2 to Art. 4 apply by analogy Art. 2. Library page.
- The implementing regulation specific to your service (table above) and the standards it makes applicable.
- The consolidated NIS2 Directive, risk-management measures and incident notification Art. 21 Art. 23. Library page.
- Implementing Regulation 2025/2162, to choose the assessment body: to take certification decisions, it is accredited under the EN ISO/IEC 17065:2012 standard supplemented by ETSI EN 319 403-1 v2.3.1, and its accreditation certificate specifies the qualified services for which it is competent Art. 2(1) Art. 3(1)(e) ETSI EN 319 403-1 V2.3.1. Bodies accredited before 17 November 2025 under ETSI EN 319 403 version 2.2.2, or an earlier version, are considered to meet this requirement until 17 May 2027 Art. 9. Library page.
- Implementing Regulation 2025/1566 and the ETSI TS 119 461 specification, if you issue qualified certificates or attestations Art. 1. Library page for 2025/1566, library page for TS 119 461.
Checklist
- We have chosen a conformity assessment body accredited for our qualified service, under the standards in force or, until 17 May 2027, under the grandfathering provision Art. 3(18) Art. 3(1)(e) Art. 9.
- Our gap analysis covers the Regulation and Article 21 of the NIS2 Directive Art. 21(1).
- Our risk analyses (Regulation and NIS2) are ready for the notification Art. 3.
- Our termination plan exists for each service, with its financial coverage Art. 3(1) Art. 3(6).
- Financial resources or liability insurance are in place Art. 24(2)(c).
- Our terms of use are published and communicated before any contract Art. 24(2)(d).
- The commercial launch is planned after inclusion in the trusted list Art. 21(3).
- Our change management provides for notification to the supervisory body one month before any change Art. 24(2)(a) Art. 1.
- Our incident procedure allows notification within 24 hours Art. 24(2)(fb) Art. 23(4).
- The next audit is scheduled within 24 months and announced one month in advance Art. 20(1) Art. 20(1a).
- If we issue qualified certificates or attestations, our verification of identity and attributes follows the methods provided for Art. 24(1a) Art. 24(1b) Art. 2.
Advice
Asphalia advice
The path to qualified status. Count in stages, not in weeks.
- Gap analysis against the Regulation, Implementing Regulation 2025/2530, the act specific to your service and Article 21 of NIS2.
- Choice of the assessment body, early: check that its accreditation covers your service Art. 3(1)(e) and book its dates. A body accredited under the old version of the ETSI EN 319 403 standard is considered compliant only until 17 May 2027 Art. 9: check that it will also cover your subsequent audits.
- Remediation, then possibly a pre-audit.
- Conformity assessment and report.
- Notification to the supervisory body, with a complete file the first time Art. 3.
- Verification by the supervisory body, which may take up to three months, or even longer if it gives the reasons Art. 21(2).
- Inclusion in the trusted list, then launch Art. 21(3).
Do not announce a launch date to your customers before stage 7. The planned date that you indicate in the notification is addressed to the supervisory body Art. 3; it is not a commercial commitment.
Asphalia advice
The pitfalls.
- Underestimating the NIS2 side. It is part of the assessment report and of the audit Art. 21(1) Art. 20(1). An existing information security management system helps, but is not always enough: compare it measure by measure.
- Treating the termination plan as a formality. It must cover planned, unplanned, partial and complete termination, and be funded Art. 3(7)(f) Art. 3(6). It is often the document that takes longest to stabilise.
- Forgetting that hosting and subcontractors are “changes”. Any change in your qualified services is notified at least one month in advance Art. 24(2)(a), and the notification covers at least significant changes in hosting, in cryptographic techniques or equipment and in the third parties involved in the service Art. 1(1)(c) Art. 1(1)(d) Art. 1(1)(j). Include the supervisory body in your change management.
- Having two incident procedures. The Regulation and NIS2 each provide for a notification within 24 hours, counted from the incident for the Regulation and from becoming aware of it for NIS2: on the one hand to the supervisory body, on the other hand to the CSIRT or the competent authority Art. 24(2)(fb) Art. 23(4). A single procedure that feeds both channels avoids omissions.
- Postponing identity verification. The standards of 2025/1566 apply from 19 August 2027 Art. 2: a new onboarding process is prepared well in advance.
Consolidation without official value
This page cites the consolidated versions, published on EUR-Lex, of Regulation 910/2014, Implementing Regulation 2025/1569 and Directive (EU) 2022/2555 Regulation (EU) No 910/2014 — consolidated version of 18/10/2024 Implementing Regulation (EU) 2025/1569 — consolidated version of 11/08/2026 Directive (EU) 2022/2555 (NIS2) — consolidated version of 27/12/2022. These consolidations are documentation tools: only the Official Journal of the European Union is authentic.
Key points
- Qualified status is obtained by notification to the supervisory body, with a conformity assessment report Art. 21(1).
- No qualified service before inclusion in the trusted list Art. 21(3).
- Audit at least every 24 months, at your own expense Art. 20(1).
- Changes notified one month in advance, cessation three months in advance, incidents within 24 hours Art. 24(2)(a) Art. 24(2)(fb).
- The cybersecurity side of NIS2 is part of the assessment Art. 21(1) Art. 21.
Written by Asphalia.