Qualified TSP Provider eIDAS: Understanding the Role of Trust Services
Trust Service Providers (TSPs) are at the heart of the eIDAS Regulation. Discover their obligations, qualification process and impact on the legal value of your signatures.
8 min
Regulation (EU) No 910/2014 · Updated 2026
eIDAS Regulation: everything you need to know about electronic signature in Europe
Last updated
eIDAS regulation is the founding text of electronic signature in Europe. It defines three levels of signature (simple, advanced, qualified), establishes the legal value of electronic documents and governs trust service providers. This guide explains everything you need to know to be compliant in 2026.
What is eIDAS and why was it created?
Before eIDAS, each EU Member State had its own regulation on electronic signatures, creating legal fragmentation that hindered cross-border exchanges. An electronic signature valid in France was not necessarily recognised in Germany or Spain.
The Regulation (EU) No 910/2014, known as eIDAS (Electronic IDentification, Authentication and trust Services), was adopted on 23 July 2014 and came into force on 1 July 2016. As a regulation (not a directive), it applies directly and uniformly in all 27 Member States, without the need for national transposition.
eIDAS pursues three main objectives: to create a single digital market in Europe through mutual recognition of electronic identities, to guarantee legal certainty of cross-border electronic transactions, and to establish a trust framework for digital services through qualified trust service providers (QTSP — Qualified Trust Service Provider).
The 3 levels of signature defined by eIDAS
eIDAS establishes a pyramid of three levels of electronic signature, each with its own technical requirements and probative value.
Level 1 — SESArticle 3(10) eIDAS
Simple Electronic Signature
Available on Certyneo
eIDAS requirements
- Data in electronic form linked to other data
- Used for signing (no specific technical requirement)
- Can be a simple click, a ticked box, or a name entered
Usage examples
- Terms and conditions acceptance
- Online form
- Confirmation email
Legal value
Basic contractual value, no legal presumption
Level 2 — AESArticle 26 eIDAS
Advanced Electronic Signature
Available on Certyneo
eIDAS requirements
- Uniquely linked to the signatory
- Allows the signatory to be identified
- Created using data under the exclusive control of the signatory
- Any subsequent modification of the document is detectable
Usage examples
- Employment Contracts
- NDAs
- Commercial Contracts
- Powers of Attorney
Legal value
Strong probative value — recommended for important contracts
Level 3 — QESArticle 25(2) + Annex I eIDAS
Qualified Electronic Signature
Available on Certyneo
eIDAS requirements
- Meets all AES requirements
- Created by a qualified signature creation device (QSCD)
- Based on a qualified certificate issued by a QTSP (EU trust list)
Usage examples
- Digital authentic acts
- Demanding public procurement
- Regulated acts
Legal value
Legal presumption equivalent to handwritten signature (art. 25 eIDAS)
eIDAS 2.0: What's New in 2024
The eIDAS regulation has been revised by Regulation (EU) 2024/1183, published in the EU Official Journal on 30 April 2024 and entered into force on 20 May 2024. This revision modernises the initial framework to address contemporary digital challenges: digital identity for citizens, sovereign cloud, and resilience of trust service providers.
The flagship measure of eIDAS 2.0 is the European Digital Identity Wallet (EUDIW). By the end of 2026, each Member State must offer its citizens and residents an application to store and present certified identity credentials — the digital equivalent of an ID card, driving licence, diplomas. This development will have a direct impact on qualified signature processes.
Digital Identity Wallet (EUDIW)
eIDAS 2.0 introduces the European Digital Identity Wallet: every European citizen will be able to store their certified identity attestations (identity card, driving licence, diplomas) in a mobile application that is interoperable throughout the EU.
Strengthened QTSP Requirements
Requirements for qualified trust service providers (QTSP) have been strengthened, notably in cybersecurity, auditing, and business continuity.
New Trusted Services
eIDAS 2.0 adds new qualified services: qualified electronic archiving, qualified attribution data management, qualified electronic registry (certified blockchain).
Enhanced Interoperability
Better mutual recognition of digital identities between Member States. Qualified signatures issued in any EU country are recognised everywhere.
How to Be eIDAS Compliant in Practice?
eIDAS compliance is not limited to choosing a signature level. It implies reflection on the entire process: risk identification, tool selection, evidence preservation and records management.
Here is a practical checklist for companies wishing to secure their electronic signature processes in compliance with eIDAS:
Identify the appropriate signature level for each document type
Use a solution whose provider hosts data within the EU
Retain the timestamped audit trail with each signed document
Ensure the signatory is identified appropriately for the chosen level
Have a documented retention policy (duration, access, deletion)
Verify that the provider has a GDPR Data Processing Agreement (DPA)
For AES: implement an OTP mechanism or strong authentication
For QES: use a QTSP listed on a national trust list
Certyneo's eIDAS Compliance Approach
Certyneo natively implements the three levels of the eIDAS regulation: SES (Simple Electronic Signature), AES (Advanced Electronic Signature) and QES (Qualified Electronic Signature). Advanced signature is based on dual-factor authentication: a single-use link sent by email and an OTP code sent by SMS via our OTP SMS provider, in accordance with the four criteria of article 26 of eIDAS. Qualified signature (QES) is delivered per act at €14.90/signature on all plans, including Free, via a qualified provider (QTSP) listed on the European trust list — legal equivalent of a handwritten signature throughout the EU under article 25(2) of eIDAS.
Each envelope generates a complete audit trail: timestamping of every action (sending, link opening, OTP validation, signature application, refusal if any), signatory IP address, and browser user-agent. This audit trail is embedded at the bottom of each PDF page (audit footer) and retained for 10 years.
Data is hosted (EU) (IONOS infrastructure), within the European Union, in compliance with digital sovereignty requirements and GDPR. Please visit our security and compliance page for all technical details.
Frequently Asked Questions about eIDAS
What is the eIDAS regulation?
eIDAS (Electronic Identification, Authentication and Trust Services) is the European Regulation (EU) No 910/2014 that establishes a common legal framework for electronic signatures, electronic seals, time stamps, electronic registered delivery services, and website authentication services in the European Union. It came into force on 1 July 2016 and applies directly in all 27 Member States.
What is the difference between eIDAS and eIDAS 2.0?
eIDAS 2.0 (regulation (EU) 2024/1183, which entered into force on 20 May 2024) modernises eIDAS 1.0 by introducing in particular the European Digital Identity Wallet (EUDIW — European Digital Identity Wallet), which will allow European citizens to store certified digital identity credentials. For businesses, eIDAS 2.0 strengthens requirements for qualified trust service providers (QTSP) and improves cross-border interoperability.
Does a simple electronic signature have legal value under eIDAS?
Yes. Article 25 of eIDAS explicitly prohibits refusing legal effect to an electronic signature solely on the ground that it is in electronic form. A simple signature (SES) therefore has legal value, but it does not benefit from the legal presumption reserved for qualified signatures (QES). In the event of dispute, it is for whoever invokes the signature to prove its authenticity.
How do I know which eIDAS level to choose for my contracts?
The general rule is to calibrate the level to the legal and commercial risk of the document. For standard documents with low stakes (quotations, internal orders), simple signature is sufficient. For significant commercial contracts, employment contracts, NDA or mandates, advanced signature (AES) is recommended. Qualified signature (QES) is reserved for situations where law explicitly requires it (certain administrative acts, large public procurement) or when the risk of challenge is highest.
How is Certyneo compliant with eIDAS?
Certyneo natively implements all three eIDAS levels: simple signature (SES), advanced signature (AES) with SMS OTP, and qualified signature (QES) at €14.90 per signature on every plan, including Free, via a qualified QTSP from the EU trust list. Every envelope generates a timestamped audit trail embedded in the final PDF. Data is hosted in the European Union, in line with digital sovereignty requirements.
Does eIDAS apply to businesses outside the European Union?
eIDAS applies to trust services provided in the EU. A company established outside the EU wishing its signatures to be recognised in the EU must use an eIDAS-compliant solution or a recognised qualified trust service provider (QTSP) on the trust list of a Member State. For international B2B exchanges, mutual recognition agreements exist with certain third countries.
Related guides
Certyneo Community
A question about electronic signatures?
Join the Certyneo community: ask your questions, share your answers and connect with thousands of users and our team.
