QSCD Certificate eIDAS: Everything You Need to Know to Obtain One in France in 2026

The growing shift towards digital processes compels businesses and public administrations to master specific technical concepts. Among them, the QSCD certificate (Qualified Signature Creation Device) holds a central place within the eIDAS framework. Without it, no qualified electronic signature — the only level with a legal presumption of value equivalent to a handwritten signature — can be issued. Yet the vast majority of French organisations still do not understand what a QSCD is, how it differs from a simple digital certificate, or what steps are needed to obtain one. This article provides you with a complete answer: technical definition, regulatory foundations, a list of accredited actors in France, and a step-by-step acquisition process.

What is a QSCD Certificate? Definition and Regulatory Scope

The term QSCD is an English acronym for Qualified Signature Creation Device, translatable into French as dispositif qualifié de création de signature. It refers to a hardware or software tool that generates and stores the cryptographic keys used for electronic signing, whilst guaranteeing a maximum level of security as defined by the eIDAS Regulation No. 910/2014.

Distinction between qualified certificate and QSCD

It is important to distinguish between two concepts often confused:

• The qualified certificate (Qualified Certificate for Electronic Signature, QCert) is a digital certificate issued by a qualified trust service provider (QTSP). It attests to the signer's identity and contains their public key.
• The QSCD is the secure support on which the private key associated with the certificate is generated and stored. It can be a cryptographic USB token, a smart card, an HSM (Hardware Security Module), or a remote QSCD (remote QSCD) hosted by the service provider.

For a signature to be qualified under eIDAS, both elements must be present: a qualified certificate AND a QSCD. Annex II of the regulation sets out the requirements that the device must meet (uniqueness of signature creation data, impossibility of deriving the private key, protection against falsification, etc.).

Electronic signature levels and the role of QSCD

The eIDAS regulation defines three levels of signature:

1. Simple Electronic Signature (SES): no specific technical requirement.
2. Advanced Electronic Signature (AdES): uniquely linked to the signer, created using data under their exclusive control, but without requiring a QSCD.
3. Qualified Electronic Signature (QES): imperatively requires a qualified certificate stored on a QSCD. This is the only level enjoying a legal presumption of equivalence to a handwritten signature in all Member States.

To deepen your understanding of the differences between these three levels, Certyneo's comparative guide to electronic signature solutions offers detailed analysis.

Qualified Providers (QTSP) in France: Who Can Issue a QSCD?

In France, the issuance of qualified certificates and the provision of QSCD devices fall exclusively to qualified trust service providers (QTSP) listed on the national trust list (Trust Service List, TSL), published and maintained by the ANSSI (National Agency for Information Systems Security).

The ANSSI as French Supervisory Authority

The ANSSI plays the role in France of supervisory body (supervisory body) provided for in Article 17 of eIDAS. It audits QTSP candidates according to strict criteria aligned with the standards ETSI EN 319 401 (general requirements for TSP) and ETSI EN 319 411 (qualified certificates). A service provider cannot claim to be "qualified" without appearing on the French trust list published in signed XML format.

Among the accredited French QTSP are notably players such as Certigna, CertEurope, Docaposte, Keynectis and Thales (formerly Gemalto). Each offers qualified certificate packages stored on hardware QSCD (smart cards, USB tokens) or remote QSCD, with the latter seeing strong growth since 2022.

Remote QSCD (remote QSCD): The New Business Standard

The remote QSCD represents a major evolution: the signer's private key is no longer stored on a physical device handed to the user, but rather in a certified HSM hosted within the QTSP's secure infrastructure. The signer accesses their device via strong authentication (OTP, biometrics, mobile application). This approach, governed by the ETSI EN 319 432 standard and validated by ANSSI, is now integrated into most SaaS qualified signature platforms, including Certyneo.

The legal value of electronic signatures does not depend on whether the QSCD is physical or remote, provided that eIDAS compliance is attested by ANSSI qualification.

How to Obtain a QSCD Certificate in France: A Step-by-Step Process

Obtaining a qualified certificate on QSCD follows a formalised process, more demanding than that for a simple or advanced certificate. Here are the essential steps.

Step 1: Choose Your QTSP and Type of QSCD

The first decision concerns the type of QSCD desired:

• Physical QSCD (smart card or USB token): suited to occasional use, self-employed professionals or executives. Involves physical delivery of the device.
• Remote QSCD: ideal for organisations with high signing volumes or operating entirely digitally. No physical device to manage.

The choice of provider also depends on available integrations (REST API, webhooks, HR system connectors) and the level of support offered. It is advisable to consult the official list of QTSP on the ANSSI portal before making any decision.

Step 2: Identity Verification Process (KYC)

The eIDAS regulation imposes rigorous identity verification before issuing a qualified certificate. Two methods are accepted:

• In-person verification (in-person): the applicant presents themselves at a QTSP registration point or to a mandated verification operator, with their official identity documents.
• Remote verification via video (remote identity proofing): since 2021, some QTSP offer verification by real-time videoconference with an agent, governed by ETSI EN 319 461 requirements. Automated AI-based verification (eKYC) is not yet accepted for qualified certificates in France as of mid-2026, with ANSSI still requiring human intervention.

Required documents typically include: valid identity document (national identity card, passport), proof of attachment to the professional entity (Kbis, extract from the Trade and Companies Register), and sometimes a letter of instruction for signers acting on behalf of a legal entity.

Step 3: Key Generation and QSCD Delivery

Once identity is verified, the QTSP proceeds with generation of the cryptographic key pair in the QSCD's secure environment. For a physical QSCD, the device is initialised and then delivered or sent to the holder with a secure PIN code. For a remote QSCD, the holder activates their device via the provider's mobile application and configures their strong authentication mechanism.

The qualified certificate is then associated with the public key and published in the QTSP's directory. Its validity period is generally 1 to 3 years, depending on the subscription package. Renewal should be anticipated before expiry to maintain continuous signing capacity.

Cost, Timescales and Renewal: What You Need to Plan For

Indicative Pricing Schedule for 2026

The prices of qualified certificates on QSCD vary significantly depending on the provider and type of device:

• Physical QSCD (USB token or card): between €80 and €250 excluding VAT for the initial issue (including hardware device), then €50 to €150 excluding VAT for annual renewal.
• Remote QSCD: often integrated into SaaS subscription offers from €15 to €40 excluding VAT per user per month, or pay-per-use packages for low volumes.

These costs should be weighed against time savings and reduced legal risks. Certyneo's ROI calculator allows you to precisely estimate return on investment based on your document signing volume.

Acquisition Timescales

The time between application and effective availability of the qualified certificate is generally 3 to 10 working days for physical solutions (including postal delivery) and a few hours to 48 hours for remote QSCD, provided the KYC file is complete. Organisations anticipating activity peaks (contract renewals at year-end, calls for tender, financial year-ends) should plan accordingly.

Revocation and Certificate Lifecycle

A qualified certificate may be revoked before its term expires in the event of private key compromise, departure of the holder or change of certified information. Revocation is published in the Certificate Revocation List (CRL) or via the QTSP's OCSP protocol (Online Certificate Status Protocol). Any signature affixed after revocation is deemed invalid; those affixed before retain their value, provided they are time-stamped. Qualified electronic time-stamping plays a crucial role here in proving the prior date of a signature.

Applicable Legal Framework for QSCD Certificates

The regulation governing qualified signature creation devices is extensive and coordinated across several European and national texts.

eIDAS Regulation No. 910/2014 (EU) — This founding text constitutes the cornerstone of the framework. Article 3(12) defines the qualified signature creation device. Article 26 sets out the requirements for advanced signatures, whilst Article 29 and Annex II detail the technical requirements applicable to QSCD (uniqueness of signature creation data, confidentiality of the private key, non-falsifiability). Article 25(2) gives qualified signatures a presumption of equivalence with handwritten signatures. eIDAS Regulation 2.0 (Regulation 2024/1183, progressively entering into force since 2024) strengthens these requirements and extends the scope to European digital identity wallets (EUDIW).

French Civil Code, Articles 1366 and 1367 — Article 1366 establishes that electronic writing has the same probative force as paper writing subject to reliable identification of the author and document integrity. Article 1367 specifies that electronic signatures consist of the use of a reliable identification process guaranteeing the link with the signed deed. Decree No. 2017-1416 of 28 September 2017 establishes the presumption of reliability for qualified signatures conforming to eIDAS.

ETSI Standards — The standards ETSI EN 319 132 (XAdES format for XML signatures), ETSI EN 319 122 (CAdES), ETSI EN 319 162 (ASiC) and ETSI EN 319 401/411 (requirements for TSP and qualified certificates) constitute the technical reference binding on service providers. Failure to comply with these standards may result in suspension of QTSP qualification by ANSSI.

GDPR No. 2016/679 — The identity verification process (KYC) involves the processing of biometric data and personal data. The data controller (QTSP and, where applicable, the client company) must comply with the principles of minimisation, limited purpose and provide for a retention period proportionate to needs. A Data Protection Impact Assessment (DPIA) is recommended for large-scale deployments.

Liability in Case of Non-Compliance — Using a non-qualified certificate to sign deeds requiring a qualified signature (certain public procurement, electronic notarial deeds, dematerialised tax returns) exposes the organisation to challenge of the deed's probative value, or even to its nullity. Article 13 of eIDAS provides a liability regime for QTSP in case of breach of their obligations, but this regime does not relieve users of their duty of care in choosing and maintaining their device.

QSCD Certificate Use Cases in Business

Scenario 1: A Law Firm Digitising its Legal Proceedings

A law firm with around fifteen lawyers handles several hundred legal procedural deeds, powers of attorney and fee agreements each year. Before deploying a remote QSCD-based solution, each document required printing, handwritten signature and postal dispatch or scanning. The firm opted for qualified certificates on remote QSCD integrated into a SaaS platform, allowing each partner to sign from their desk or mobile with qualified level. Observed result: approximately 70% reduction in signature time for amicable termination agreements (from 4 days to less than 24 hours on average), elimination of postage costs and automatic filing of signed deeds in the firm's document management system.

Scenario 2: An SME Managing its Supplier Contracts

An SME in the manufacturing sector handling approximately 300 supplier contracts per year faced recurring legal risks from simple or scanned signatures, easily contestable. After audit, it emerged that several contracts valued above €100,000 had been signed without reliable identification procedures. Migration to qualified signatures on remote QSCD for high-stakes contracts (strategic suppliers, confidentiality agreements, framework orders) secured the contractual portfolio. Contract validation times fell by approximately 60%, with foreign counterparties appreciating the immediate cross-border recognition offered by eIDAS.

Scenario 3: A Hospital Group Deploying Qualified Signatures for Public Procurement

A hospital group with approximately 900 beds had to meet the obligation, from Decree No. 2016-360 on public procurement, to electronically sign commitment deeds above certain thresholds. The IT department deployed certified USB tokens with QSCD for directors authorised to commit the establishment. User training, integration into the public procurement dematerialisation platform and the annual renewal procedure were documented in an internal signature policy (Signature Policy). The estimated operational benefit is of the order of 3 to 4 days per procurement procedure, thanks to elimination of registered mail and physical file routing.

Frequently Asked Questions

What differentiates a QSCD from a standard HSM?

An HSM (Hardware Security Module) is a generic security hardware module used to store and manage cryptographic keys. A QSCD is an HSM — or any other secure device — that has been evaluated and certified as compliant with the requirements of Annex II of eIDAS Regulation by an accredited laboratory recognised by a national supervisory authority. QSCD qualification attests that the device meets strict criteria for key uniqueness, non-exportability and resistance to physical and logical attacks.

Is a QSCD certificate obtained in France valid throughout the European Union?

Yes. Article 25(2) of eIDAS establishes mandatory mutual recognition of qualified signatures between all Member States. A qualified certificate issued by a French QTSP listed on the national trust list produces the same legal effects in Germany, Spain or Italy as in its country of issue. This automatic recognition is one of the major advantages of the framework for businesses with cross-border contracting activities.

What is the validity period of a QSCD certificate and can it be renewed remotely?

The validity period of a qualified certificate is generally set at 1, 2 or 3 years depending on the QTSP's offer. Renewal can be carried out remotely for remote QSCD, provided that the holder's identity has already been verified in person or by video at initial issuance. Most QTSP send expiry alerts 60 and 30 days before the deadline. Ignoring these alerts risks interruption of your qualified signature capacity.

Is a QSCD certificate mandatory for all electronically signed deeds?

No. The required signature level depends on the nature of the deed and the applicable regulatory framework. Qualified signature on QSCD is mandatory for certain specific deeds (electronic notarial deeds, certain public procurement, dematerialised tax returns). For the majority of routine commercial contracts, an advanced signature is sufficient. It is recommended to consult the glossary of electronic signatures or seek legal advice to determine the required level on a deed-by-deed basis.

How do you verify that a signature is based on a valid QSCD certificate?

Verification is carried out by consulting the metadata of the signed document using a validation tool compliant with ETSI specifications, such as the Commission's free DSS (Digital Signature Service), accessible online. This tool verifies the certificate's chain of trust, its status (not revoked), its compliance with the qualified profile and the presence of a qualified time-stamp. Some SaaS platforms such as Certyneo integrate this validation report directly into the document management interface.

Conclusion

The QSCD certificate is far more than a technical formality: it is the legal and cryptographic foundation of qualified electronic signatures, the only level offering a legal presumption of equivalence to handwritten signatures throughout the European Union. In France, obtaining one involves a QTSP accredited by ANSSI, a rigorous identity verification process, and an informed choice between physical QSCD and remote QSCD — with the latter establishing itself as the standard for organisations seeking agility and scalability.

Certyneo natively integrates certified remote QSCD into its SaaS platform, allowing your teams to sign at qualified level without any physical device to manage. Whether you are starting from scratch or migrating from another solution, our experts guide you at every step. Discover Certyneo pricing or contact our team for an audit of your qualified signature needs.