Electronic Signature Provider Obligations in France

Introduction

Deploying an electronic signature solution in France requires careful planning. Behind every qualified or advanced signature lie dozens of legal obligations incumbent upon the trust service provider (TSP). The eIDAS Regulation, RGPD, general security framework, ETSI standards... the regulatory environment is both dense and evolving. For using businesses, understanding these legal obligations for electronic signature providers in France eIDAS RGPD is essential to choosing a compliant partner and avoiding any legal risk. This article details, section by section, all the requirements applicable to TSPs operating on French territory.

---

The Status of Qualified Trust Service Provider

What is a TSP under eIDAS?

Regulation eIDAS No. 910/2014 distinguishes between two categories of providers: non-qualified trust service providers and qualified providers (QTSP). The first may offer simple or advanced electronic signature services without mandatory third-party audit. The second — authorized only to deliver qualified signatures as defined in article 3(15) of eIDAS — must meet considerably stricter requirements.

In France, the National Agency for the Security of Information Systems (ANSSI) fulfills the role of supervisory authority (« Supervisory Body ») provided for in article 17 of eIDAS. It publishes and maintains the French trust list (TSL — Trust Service List), accessible on its official website, listing qualified providers and their services.

The Qualification Procedure: Audit and Compliance

To obtain qualified status, a TSP must mandatorily:

• Have its services audited by a conformity assessment body (CAB) accredited by COFRAC according to the EN ISO/IEC 17065 standard.

• Submit the audit report to ANSSI, which rules on the granting of qualified status. This status is re-evaluated at least every 24 months (article 20 §1 eIDAS).

• Notify ANSSI of any substantial change in its services within 3 months prior to the planned modification (article 21 eIDAS).

Failure to comply with these steps exposes the provider to removal from the TSL and loss of the legal presumptions attached to qualified signature. For customer businesses, using a TSP not listed on the TSL amounts to benefiting from no legal presumption of reliability.

> To learn more about the different signature levels and their legal effects, consult our comprehensive guide to eIDAS 2.0 regulation.

---

Technical and Security Obligations Imposed on TSPs

Compliance with ETSI Standards

Qualified providers must comply with a set of European standards published by the European Telecommunications Standards Institute (ETSI). The main ones are:

• ETSI EN 319 401: general security requirements applicable to all TSPs.

• ETSI EN 319 411-1 and 411-2: policies and practices of certification authorities issuing qualified signature certificates.

• ETSI EN 319 132: advanced electronic signature formats (XAdES for XML, PAdES for PDF, CAdES for CMS).

• ETSI EN 319 122: CAdES format for qualified signatures.

• ETSI TS 119 431: requirements for remote signature creation services (remote QSCD).

These standards are not optional: the eIDAS Regulation (Annexes II, III and IV) explicitly refers to them to define the minimum requirements for qualified certificates and signature creation devices.

Management of Qualified Signature Creation Devices (QSCD)

One of the pillars of qualified signature is the use of a Qualified Signature Creation Device (QSCD) compliant with Annex II of eIDAS. The provider must guarantee that:

• The signer's private key cannot be generated, stored or copied outside the QSCD.

• Key generation occurs exclusively in a certified environment (Common Criteria EAL 4+ certification or equivalent).

• Signer authentication preceding any signing act relies on at least two authentication factors.

In a remote signature context — increasingly common in SaaS environments — these requirements apply to the HSM (Hardware Security Module) server hosting the keys. ANSSI has published specific protection profiles (PP-0075, PP-0076) defining the security criteria to be met.

Policy on Continuity and Incident Notification

Article 19 of eIDAS requires every trust service provider (qualified or not) to:

• Notify the supervisory authority (ANSSI) and, where applicable, the data protection authority (CNIL), within 24 hours of detecting a security breach likely to impact the reliability of the service.

• Maintain a documented and regularly tested business continuity plan.

• Have a formalized information security policy, covering in particular risk management, incident management and backup policy.

These requirements partially overlap with those of the NIS2 Directive (2022/2555/EU), transposed into French law by Law No. 2023-703 of August 1, 2023, which classifies TSPs of significant size among the important or essential entities subject to enhanced cybersecurity obligations.

> Discover how electronic signature for law firms must integrate these constraints into their documentary workflows.

---

RGPD Obligations Specific to TSPs

Is the TSP a Data Controller or Processor?

The RGPD qualification of the provider depends on the nature of the service rendered:

• When the TSP directly delivers qualified certificates on behalf of the signer and determines the purposes of personal data processing (identity, authentication biometric data), it acts as a data controller as defined in article 4(7) RGPD.

• When it integrates its API into a B2B client's platform and processes personal data solely according to that client's instructions, it assumes the status of data processor (article 4(8) RGPD) and must obligatorily conclude a DPA (Data Processing Agreement) compliant with article 28 RGPD.

In practice, most SaaS TSPs cumulate both statuses: controller for managing their own certification infrastructure, processor for processing signatories' documents and metadata.

Specific Obligations Related to Biometric Data and Identity

Signer identification and authentication — a mandatory step to deliver a qualified certificate — often involves processing sensitive data: identity document scan, video selfie, facial recognition biometric data. This data constitutes personal data subject to RGPD, or even biometric data falling under article 9 RGPD (special categories).

The TSP's obligations include:

• Legal basis: explicit consent (article 9§2a) or, in certain cases, legal obligation (article 9§2b) for biometric data processing.

• Limited retention period: according to CNIL guidelines, identification data must be retained for the strictly necessary time, generally aligned with the duration of certificate validity + legal duration of proof (often 10 years for acts under private seal, article 2224 of the Civil Code).

• Impact assessment (DPIA) mandatory (article 35 RGPD) whenever the processing is likely to present a high risk — which is systematically the case for biometrics.

• Processing register (article 30 RGPD) kept up to date and documenting each category of processing.

International Data Transfers

Many TSPs host all or part of their infrastructure outside the European Economic Area (EEA). In this case, the appropriate safeguards required by RGPD chapter V apply: adequacy decision, standard contractual clauses (SCCs) from the European Commission or binding corporate rules (BCR). The Schrems II ruling (CJEU, C-311/18, July 16, 2020) recalled that transfers to the United States require a prior country risk analysis.

> To understand the impact of these rules on your organization, consult our guide on electronic signature in enterprise.

---

Transparency and User Information Obligations

Certification Policy (CP) and Certification Practice Statement (CPS)

Every TSP issuing certificates is required to publish a Certification Policy (CP) and a Certification Practice Statement (CPS), in accordance with the ETSI EN 319 411 standard. These documents, freely accessible, detail:

• Procedures for identifying and registering signatories.

• Physical and logical security measures deployed.

• Conditions for certificate revocation and associated timelines.

• TSP responsibilities and warranty limitations.

The absence or incompleteness of these documents constitutes a non-compliance that may be flagged during requalification audit by the accredited body.

Pre-contractual and Contractual Information for Clients

Beyond purely technical obligations, article 13 RGPD requires the TSP to provide to each person whose data is collected clear and accessible information on:

• The identity of the data controller and the contact details of the DPO (mandatory for TSPs that process sensitive data at scale, article 37 RGPD).

• The purposes and legal bases of each processing.

• The rights of individuals (access, rectification, erasure, portability, objection).

• Possible recipients of the data (sub-processors, authorities).

This information must appear in the service's privacy policy, in the terms and conditions and, where applicable, in the DPA concluded with professional clients.

Qualified Timestamping and Audit Trail

To guarantee the long-term evidentiary value of signatures, responsible TSPs systematically associate a qualified electronic timestamp (article 42 eIDAS) with each signed act. This timestamp constitutes legally presumed evidence of the existence of the data on the stated date. Preservation of the audit trail (identification logs, document fingerprint, signature data) is a de facto obligation to allow any future judicial verification.

> Compare market solutions according to these criteria in our comparison of electronic signature solutions.

---

eIDAS 2.0: New Obligations on the Horizon 2026-2027

Regulation eIDAS 2.0 (EU) 2024/1183

Published in the EU Official Journal on April 30, 2024, Regulation (EU) 2024/1183 known as "eIDAS 2.0" significantly strengthens TSP obligations around three axes:

• The European Digital Identity Wallet (EUDI Wallet): member states must make available a certified digital identity wallet by November 2, 2026. TSPs will need to integrate their service with this wallet to offer qualified signatures via eIDAS 2.0 identity.

• Management of attribute attestations: eIDAS 2.0 introduces qualified attribute attestations (QEAAs), issued by qualified attestation providers. New audit and qualification procedures will apply.

• Strengthened supervision: national supervisory authorities (ANSSI for France) see their powers expanded, notably the ability to conduct unannounced audits and to impose binding corrective measures on shortened timelines.

Practical Implications for Current Providers

TSPs already qualified under eIDAS 1.0 will need to proceed with progressive compliance before the deadlines set by Commission implementing acts (published or underway). The main adaptations concern:

• The overhaul of identification infrastructure to support EUDI Wallet as an authentication method.

• The updating of CP/CPS to integrate new certificate and attestation types.

• The strengthening of security requirements for remote QSCDs, with new protection profiles to come.

For client businesses, this means verifying from today that their provider has a documented and verifiable eIDAS 2.0 compliance roadmap.

Legal Framework Applicable to Electronic Signature Provider Obligations

The normative chain applicable to electronic signature providers operating in France is articulated across several complementary hierarchical levels.

French Civil Code — Articles 1366 and 1367

Article 1366 of the Civil Code recognizes electronic writing as a mode of proof equivalent to paper writing, provided that « the person from whom it emanates can be duly identified and it is drawn up and preserved under conditions such as to guarantee its integrity ». Article 1367 specifies that electronic signature « consists in the use of a reliable identification process guaranteeing its link with the act to which it is attached ». The presumption of reliability benefits qualified signatures under eIDAS, reversing the burden of proof in the signer's favor.

Regulation eIDAS No. 910/2014/EU

This regulation, directly applicable in all member states, establishes the legal framework for trust services. Its article 26 defines conditions for advanced electronic signature; article 28 requirements for qualified certificates; its Annex I details mandatory content of these certificates. Qualified TSPs benefit from a presumption of compliance with the technical and legal requirements of the regulation (article 19§2), which constitutes a major advantage in case of dispute.

Regulation eIDAS 2.0 — (EU) 2024/1183

Published on April 30, 2024, this amending regulation introduces new categories of trust services (qualified attribute attestations, qualified archival services) and strengthens supervision obligations. It repeals and partially replaces Regulation 910/2014, with progressive applicability according to European Commission implementing acts.

RGPD — Regulation (EU) 2016/679

RGPD applies to any processing of personal data carried out in the context of an electronic signature service. Articles 5 (principles of lawfulness), 6 (legal basis), 9 (sensitive data), 13-14 (information), 28 (sub-processing), 32 (security), 33-34 (breach notification), 35 (DPIA) and 37 (DPO) constitute the most frequently applicable provisions. CNIL is the competent supervisory authority in France and may impose fines of up to 20 million euros or 4% of global annual turnover (article 83§5 RGPD).

NIS2 Directive — (EU) 2022/2555

Transposed into French law by Law No. 2023-703 of August 1, 2023, NIS2 classifies significant TSPs among important or essential entities subject to cyber risk management obligations and incident notification to ANSSI within 24 hours (early warning) then 72 hours (full notification).

ETSI Standards

All standards EN 319 401, EN 319 411-1/2, EN 319 132, EN 319 122 and TS 119 431 constitute the mandatory technical reference for qualification audit. Non-compliance prevents obtaining or maintaining qualified status.

Legal Risks from Non-Compliance

A non-compliant provider faces: removal from the French TSL, engagement of its contractual and extra-contractual liability, CNIL administrative sanctions, NIS2 fines reaching 10 million euros or 2% of global CA for important entities and 20 million or 4% of CA for essential entities, as well as legal proceedings from clients who suffered loss due to legally invalid signatures.

Usage Scenarios: How Companies Verify Their TSP's Compliance

Scenario 1 — An Industrial Group Managing 3,000 Supplier Contracts Per Year

An industrial group of intermediate size (ETI), active in manufacturing mechanical equipment, dematerializes all its supplier contracts via a SaaS electronic signature platform. During an internal audit triggered by regulatory changes, the legal department discovers that the selected provider — initially chosen on price criteria — is listed neither on the French TSL nor on any European TSL. The delivered signatures are of "simple" type without robust signer identification mechanism.

Facing legal risk — the entire set of signed contracts could see their evidentiary value contested in case of dispute — the company initiates migration to a qualified ANSSI TSP. The new solution integrates advanced signature with qualified certificate, qualified timestamping and exportable audit trail. The migration project, completed in less than 8 weeks, allows retrospective securing of new acts and establishing compliant documentary policy. Legal teams estimate the litigation risk linked to old contracts remains marginal due to their execution without challenge, but all new signatures are now covered.

Observed gains: 60% reduction in potential disputes related to signature authenticity, and gain of 3.5 average days of signature delay on complex contracts thanks to workflow validation automation.

Scenario 2 — A Law Firm of 25 Collaborators Specializing in Business Law

A law firm wishing to digitalize the signature of mandates, consultations and procedural acts evaluates several providers. Its evaluation grid incorporates the following criteria: presence on the TSL, publication of accessible CP/CPS, existence of RGPD-compliant DPA, availability of reachable DPO and certification of remote QSCDs.

Of five providers evaluated, only two satisfy all criteria. The firm ultimately selects a TSP offering natively a qualified signature via remote QSCD, guaranteeing the presumption of reliability of article 1367 of the Civil Code. Implementation takes 3 weeks, training included. Result: 75% of mandates are now signed within 24 hours versus 5 to 7 days previously (postal shipment), and the firm can justify to its clients the level of legal security offered by the solution — a differentiating argument in its commercial proposals.

Scenario 3 — A Hospital Group of Approximately 1,200 Beds

A public hospital group wishes to dematerialize employment contracts, internship agreements and partnership agreements with partner healthcare facilities. The sensitivity of processed data (healthcare data of healthcare personnel, HR data) imposes particular vigilance regarding the TSP's RGPD obligations.

The IT department and establishment DPO require: data hosting in France with a healthcare data host certified HDS (Healthcare Data Host, certification provided for in article L.1111-8 of the Public Health Code), no transfer outside EEA, documented DPIA for signer identification processing, and signed DPA before any production deployment.

After selecting a TSP meeting these criteria, deployment covers HR contracts in priority (approximately 800 acts per year). The average signature delay for fixed-term contracts drops from 9 days to less than 48 hours, freeing significant capacity for human resources teams. The establishment has moreover complete traceability of collected consents, audited annually by its DPO.

Conclusion

The legal obligations weighing on electronic signature providers in France form a demanding normative corpus: eIDAS qualification, RGPD compliance, respect for ETSI standards, NIS2 obligations and imminent adaptation to eIDAS 2.0. For using businesses, ensuring the compliance of their TSP is not an optional undertaking — it is a sine qua non condition for the evidentiary value of signed acts and the protection of personal data of signatories.

Certyneo is an electronic signature provider designed to meet all these requirements: eIDAS compliance, RGPD by design, sovereign hosting and documented eIDAS 2.0 roadmap. Ready to secure your signatures in full compliance? Request a demonstration or create your account on Certyneo and benefit from personalized support from day one.