In short
The Regulation recognises three kinds of electronic attestations of attributes: non-qualified (EAA), qualified (QEAA) and issued by or on behalf of a public sector body responsible for an authentic source (PuB-EAA) Art. 3(16)(g) Art. 3(45) Art. 3(46). A few rules apply to all providers, in particular for issuance to wallets Art. 45g(1) Art. 4. The others depend on the kind of attestation: risk management for the non-qualified issuer Art. 19a, qualified status and Annex V for the QEAA Art. 45d(1), Annex VII and notification by the Member State for the PuB-EAA Art. 45f.
This guide is part of step 7. The three kinds of attestations and their legal effects are presented in step 2, the rules for providers in step 4. Start by knowing which one you issue: the tables below do not mix.
Your obligations
For any attestation provider
| Obligation | Legal basis | Deadline |
|---|---|---|
| Enable wallet users to request, obtain, store and manage your attestations, irrespective of the Member State that provides their wallet | Art. 45g(1) | — |
| Issue to wallet units attestations that comply with at least one of the standards in Annex II to Implementing Regulation 2024/2979, and that contain the information necessary for their authentication and validation | Art. 4(1) Art. 4(3) Annex II | — |
| Identify yourself to wallet units with your wallet-relying party access certificate; this certificate is issued only to registered relying parties | Art. 4(2) Art. 7(2) | Implementing Regulation 2025/848 applicable from 24 December 2026 Art. 11 |
| Keep the personal data relating to this service logically separate from your other data | Art. 45h(2) | — |
Registration as a relying party provides for an entitlement for each kind of provider: “QEAA_Provider”, “Non_Q_EAA_Provider” or “PUB_EAA_Provider” Annex I. The relying party guide details registration.
Providers, whether qualified or not, also do not combine the personal data relating to this service with personal data from their other services or from those of their commercial partners Art. 45h(1).
Non-qualified attestation (EAA)
The provider is a non-qualified trust service provider Art. 3(16)(g) Art. 19a(1).
| Obligation | Legal basis | Deadline |
|---|---|---|
| Have procedures and measures in place to manage the risks related to the service, at least for registration and onboarding, verification and the management of the service | Art. 19a(1)(a) | — |
| Have these procedures approved by the management body, and review the risk assessment and the treatment plan | Art. 2(1) Art. 4(6) | review at least once a year, and in the event of significant changes or incidents Art. 4(6) |
| Notify the supervisory body, the identifiable affected individuals, the public if it is of public interest and, where applicable, other relevant competent authorities, of any security breach or disruption that has a significant impact on the trust service provided or on the personal data maintained therein | Art. 19a(1)(b) | no later than 24 hours after becoming aware of it |
Implementing Regulation 2025/2160 sets the reference standards, specifications and procedures provided for risk management Art. 1 Art. 2 Art. 4. The article of the Regulation that sets the obligations of the non-qualified provider draws this consequence from it:
Compliance with the requirements laid down in this Article shall be presumed where those
standards, specifications and procedures are met.
The NIS2 Directive also applies to trust service providers, regardless of their size Art. 2(2).
Qualified attestation (QEAA)
The provider is a qualified trust service provider: the whole qualified provider guide applies Art. 3(45) Art. 21(1). In addition:
| Obligation | Legal basis | Deadline |
|---|---|---|
| Issue attestations that meet the requirements of Annex V; the attestation itself is not subject to any mandatory requirement in addition to Annex V (the provider’s obligations follow) | Art. 45d(1) Art. 45d(3) Annex V | — |
| Comply with the standards and specifications of Annex I to Implementing Regulation 2025/1569, and issue in accordance with the specifications of its Annex II | Art. 3(1) | — |
| Comply with the corresponding attestation scheme where the attestation falls under a scheme registered in the catalogue | Art. 3(2) | — |
| Verify the identity and, where applicable, the attributes of the person before issuance | Art. 24(1) Art. 24(1b) | standards of Implementing Regulation 2025/1566 applicable from 19 August 2027 Art. 2 |
| Provide an interface with wallets | Art. 45g(2) | — |
| Provide this service in a way that is functionally separate from your other services | Art. 45h(3) | — |
| Revoke at least in the cases provided for where validity exceeds 24 hours, using privacy-preserving techniques, and inform relying parties of the validity status | Art. 4(3) Art. 4(4) Art. 4(5) Art. 24(4a) | revocation status published within 24 hours after receipt of the request Art. 24(3) Art. 24(4a) |
A revoked qualified attestation loses its validity and may not in any circumstances regain its previous status Art. 45d(4). Annex I to Implementing Regulation 2025/1569 makes the ETSI TS 119 471 V1.1.1 specification applicable, with adaptations; its Annex II refers to the standards in Annex II to Implementing Regulation 2024/2979 Annex I Annex II ETSI TS 119 471 V1.1.1. At least for the attributes listed in Annex VI, where they rely on authentic sources within the public sector, Member States ensure that measures allow you to verify them by electronic means, at the request of the user and in accordance with Union or national law. They have 24 months from the entry into force of the implementing acts on the wallet and its certification to do so Art. 45e(1). The verification mechanisms are provided for by Implementing Regulation 2025/1569, whose corresponding article applies from 19 August 2026 Art. 9(1) Art. 11. Implementing Regulation 2026/1735 amends that article from 1 January 2027: the verification mechanism will have to comply with a new Annex IV, and the result of the verification will be signed or sealed by the public body or the designated intermediary Art. 1(3) Art. 2.
Public attestation (PuB-EAA)
The provider is a public sector body responsible for an authentic source, or a public body designated by the Member State to act on its behalf Art. 3(46).
| Obligation | Legal basis | Deadline |
|---|---|---|
| Issue attestations that meet the requirements of Annex VII | Art. 45f(1)(a) Annex VII | — |
| Sign or seal with a qualified signature or seal whose qualified certificate indicates that the body is responsible for the authentic source (or designated to act on its behalf), unambiguously represents that source and identifies the law that establishes it | Art. 45f(1)(b) | — |
| Have a level of reliability equivalent to that of qualified trust service providers (the Member State ensures this) | Art. 45f(2) | — |
| Appear on the list that the Member State notifies to the Commission, with a conformity assessment report (obligation of the Member State) | Art. 45f(3) Art. 5(1) | — |
| Provide an interface with wallets | Art. 45f(8) | — |
| Comply with the standards and specifications of Annexes I and II to Implementing Regulation 2025/1569, and with the registered attestation scheme where applicable | Art. 3(1) Art. 3(2) | — |
| Apply the revocation and validity status rules of Implementing Regulation 2025/1569 | Art. 4 | — |
A public attestation is “deemed” to be compliant with the requirements of the first paragraph of that article (Annex VII and the issuer’s qualified certificate) where it complies with the reference standards, specifications and procedures Art. 45f(5). Once revoked, it loses its validity and may not regain its previous status Art. 45f(4). The Commission publishes the list of providers of public attestations; this article applies from 19 August 2026 Art. 6(1) Art. 11.
Catalogues of attributes and of attestation schemes
The Commission publishes a catalogue of attributes and a catalogue of schemes for the attestation of attributes Art. 7(1) Art. 8(1). An attestation scheme is a set of rules applicable to one or more types of attestations Art. 2(4). Its owner may request its addition to the catalogue; the request is signed or sealed by means of a qualified signature or seal, or an advanced one based on a qualified certificate Art. 8(3) Art. 8(4). The articles on these catalogues apply from 19 August 2026 Art. 11.
The texts to read, in order
- Consolidated Regulation 910/2014: legal effects and rules for attestations Art. 45b Art. 45d Art. 45f Art. 45g Art. 45h, with Annexes V and VII. Library page for the Regulation.
- Implementing Regulation 2024/2977, for issuance to wallets Art. 4. Library page.
- Implementing Regulation 2025/1569 (QEAA and PuB-EAA) Art. 1. Library page.
- The ETSI TS 119 471 specification (QEAA and PuB-EAA), with the adaptations of Annex I to 2025/1569 ETSI TS 119 471 V1.1.1. Library page.
- The ETSI TS 119 472-1 specification, cited in Annex II to Implementing Regulation 2024/2979 for attestation profiles Annex II ETSI TS 119 472-1 V1.2.1. Library page.
- Implementing Regulation 2025/848, for registration and the access certificate Art. 1. Library page.
- Depending on your kind of attestation: Implementing Regulation 2025/2160 (EAA) Art. 1, or the texts of the qualified provider guide (QEAA), including Implementing Regulation 2025/1566 Art. 1. Library page for 2025/2160.
Checklist
- We know which kind of attestation we issue: EAA, QEAA or PuB-EAA Art. 3(45) Art. 3(46).
- Our attestations intended for wallets follow at least one standard of Annex II to Implementing Regulation 2024/2979 Art. 4(1).
- We are registered as a relying party and have an access certificate Art. 4(2) Art. 7(2).
- The personal data of the service are logically separate from our other data and are not combined with them Art. 45h(1) Art. 45h(2).
- EAA: our risk-management procedures are approved by management and reviewed at least once a year Art. 2(1) Art. 4(6).
- EAA: we know how to notify a significant incident within 24 hours Art. 19a(1)(b).
- QEAA: we have qualified status for this service, or are following the qualified provider guide Art. 21.
- QEAA and PuB-EAA: we have checked whether an attestation scheme in the catalogue covers our attestations Art. 3(2).
- QEAA and PuB-EAA: our revocation mechanism preserves privacy and publishes the validity status Art. 4(4) Art. 4(5).
- QEAA and PuB-EAA: our interface with wallets is ready Art. 45g(2) Art. 45f(8).
- PuB-EAA: our qualified certificate bears the required attributes and our Member State has included us in its notification Art. 45f(1)(b) Art. 45f(3).
Advice
Asphalia advice
Choosing the right kind of attestation. The question is not technical, it is legal: what effect do you want to give the attestation? A qualified or public attestation has the same effect as a lawfully issued paper attestation; a non-qualified attestation simply cannot be denied effect solely on the grounds that it is electronic or non-qualified Art. 45b(1) Art. 45b(2). If your customers need a legal effect equivalent to that of a paper attestation, aim for the QEAA, with the cost of qualified status. If you are a public body responsible for an authentic source, the PuB-EAA goes through your Member State: contact it early.
Asphalia advice
The pitfalls.
- Inventing your own format. Before defining your attributes, search the Commission’s catalogues for an existing attribute or scheme Art. 7 Art. 8. Reuse makes acceptance by relying parties easier.
- Forgetting that the issuer is also a relying party. Without registration, no access certificate, and therefore no issuance to the wallet Art. 4(2) Art. 7(2). Start registration at the same time as development.
- Designing revocation too late. For QEAAs and PuB-EAAs, it must hinder linkability and traceability Art. 4(4); it is an architecture choice, not a last-minute addition.
- Pooling databases. The logical separation of data, and for the QEAA the functional separation of the service Art. 45h(2) Art. 45h(3), are decided at the design stage of your information system.
Consolidation without official value
This page cites the consolidated versions, published on EUR-Lex, of Regulation 910/2014, Implementing Regulations 2024/2977, 2024/2979, 2025/848 and 2025/1569 and Directive (EU) 2022/2555 Regulation (EU) No 910/2014 — consolidated version of 18/10/2024 Implementing Regulation (EU) 2024/2977 — consolidated version of 11/08/2026 Implementing Regulation (EU) 2024/2979 — consolidated version of 11/08/2026 Implementing Regulation (EU) 2025/848 — consolidated version of 11/08/2026 Implementing Regulation (EU) 2025/1569 — consolidated version of 11/08/2026 Directive (EU) 2022/2555 (NIS2) — consolidated version of 27/12/2022. These consolidations are documentation tools: only the Official Journal of the European Union is authentic.
Key points
- First identify your kind of attestation: EAA, QEAA or PuB-EAA Art. 3(45) Art. 3(46).
- To issue to the wallet, follow the standards of Annex II to Implementing Regulation 2024/2979 and identify yourself with an access certificate Art. 4(1) Art. 4(2).
- Do not combine the service’s data with your other data Art. 45h.
- The QEAA requires qualified status and Annex V; the PuB-EAA, Annex VII and notification by the Member State Art. 45d(1) Art. 45f.
- The standards for QEAAs and PuB-EAAs are set out in Implementing Regulation 2025/1569 Art. 3.
Written by Asphalia.