To become a qualified trust service provider (QTSP) in 2026, an organization must meet a defined set of technical, legal, and security requirements under eIDAS 2.0, pass an independent conformity assessment, and receive formal recognition from the national supervisory body in its EU member state. The path is structured and rigorous, but it is achievable with the right preparation. This article walks through the key questions organizations typically ask when starting that journey.
What requirements must an organization meet to become a QTSP?
To become a qualified trust service provider, an organization must demonstrate that it meets the requirements set out in eIDAS 2.0, which amends Regulation (EU) 910/2014, and the associated Commission Implementing Regulations. These cover technical security, organizational reliability, staff competence, and the ability to deliver trust services in a consistent and auditable way. Meeting these requirements is a prerequisite before any formal application can begin.
The core requirements span several areas:
- Technical security: Systems must meet high assurance standards, including the use of certified hardware and software for generating and managing keys, and robust protection against breaches.
- Organizational measures: The organization must have clear policies, procedures, and governance structures for delivering trust services reliably.
- Staff and expertise: Personnel involved in trust service delivery must have the appropriate technical knowledge and be vetted for trustworthiness.
- Business continuity: There must be documented plans to ensure service continuity in the event of disruption, including termination planning to protect relying parties and end users.
- Incident and breach management: The organization must have processes in place to detect, report, and respond to security incidents, in line with the implementing regulations on security breaches.
- Compliance documentation: Policies and practice statements, such as a Certificate Policy or Trust Service Practice Statement, must be publicly available and aligned with relevant standards.
The specific technical standards that apply depend on the type of qualified trust service the organization intends to offer. Qualified electronic signatures, seals, timestamps, registered delivery services, and website authentication certificates each have their own reference standards defined in the implementing regulations.
How does the conformity assessment and audit process work?
The conformity assessment is an independent audit carried out by an accredited conformity assessment body (CAB). It evaluates whether the organization and its trust services meet all applicable eIDAS 2.0 requirements. The assessment results in a conformity assessment report, which is then submitted to the national supervisory body as part of the application for qualified status.
The CAB must itself be accredited under the national accreditation framework, in line with the implementing regulation on the accreditation of conformity assessment bodies. The assessment typically covers the organization’s security practices, technical infrastructure, documentation, staff competence, and governance. It is not a one-time check; QTSPs are subject to ongoing supervision and periodic reassessment to maintain their qualified status.
Preparing thoroughly for the conformity assessment is one of the most time-intensive parts of the process. Organizations that have their policies, technical architecture, and documentation well structured before engaging a CAB tend to move through the process significantly faster.
Which national supervisory body grants qualified status?
Qualified trust service provider status is granted by the national supervisory body of the EU member state in which the organization is established. Each member state designates its own supervisory body under eIDAS 2.0, and that body is responsible for maintaining the national trusted list, overseeing QTSPs, and handling notifications of intention to provide qualified trust services.
The process begins with the organization notifying the supervisory body of its intention to start providing qualified trust services, following the procedures set out in the relevant implementing regulation. The supervisory body then reviews the conformity assessment report submitted by the accredited CAB. If the requirements are met, the organization is granted qualified status and added to the national trusted list, which feeds into the EU-wide framework of trusted lists, known as the EU List of Trusted Lists (LOTL).
Supervisory bodies across member states differ in their processes, timelines, and communication styles. Organizations should engage with their relevant supervisory body early to understand country-specific expectations and any additional documentation requirements.
What is the difference between a trust service provider and a qualified trust service provider?
A trust service provider (TSP) is any organization that provides electronic trust services such as digital signatures, certificates, or authentication. A qualified trust service provider (QTSP) is a TSP that has been formally assessed, approved, and listed on a national trusted list under eIDAS 2.0. The qualified designation carries legal weight and enables the QTSP to issue services with a higher level of legal recognition across the EU.
The practical difference matters significantly for the organizations relying on those services. Trust services provided by a QTSP benefit from a legal presumption of validity under eIDAS, meaning that qualified electronic signatures have the same legal effect as handwritten signatures across all EU member states. A qualified electronic seal carries a different legal effect and should not be treated as equivalent to a signature. Services from a non-qualified TSP do not carry this presumption automatically.
For organizations in regulated sectors such as finance, healthcare, or government, working with a QTSP is often required. Many regulatory frameworks and procurement rules explicitly mandate the use of qualified trust services for high-assurance transactions. Financial services organizations in particular face increasing expectations around the use of qualified signatures and seals in customer-facing and inter-organizational processes.
How does eIDAS 2.0 change the path to becoming a QTSP?
eIDAS 2.0, formally Regulation (EU) 2024/1183, amends Regulation (EU) 910/2014 and expands the scope of what qualifies as a trust service. It introduces new categories that did not exist under the original regulation. This means the path to becoming a QTSP is now broader in terms of the services it can cover, but also more detailed in terms of the standards and implementing regulations that apply. Organizations pursuing qualified status in 2026 are working within this updated framework.
The most significant additions under eIDAS 2.0 include qualified electronic ledgers, qualified electronic archiving services, and the management of remote qualified signature creation devices (QSCDs) as a qualified trust service. Each of these comes with its own reference standards and implementing regulations, meaning organizations entering these new categories face a well-defined but newly established compliance path.
eIDAS 2.0 also tightens requirements around interoperability, reporting, and supervision. The implementing regulations on annual reports by supervisory bodies and on peer reviews of eID schemes reflect a broader push toward consistent, transparent oversight across the EU. For organizations already operating as trust service providers under the original eIDAS, the transition to qualified status under eIDAS 2.0 requires a careful gap analysis against the updated requirements.
The introduction of the EUDI Wallet ecosystem also creates new touchpoints for QTSPs, particularly around the issuance and verification of qualified electronic attestations of attributes (QEAAs). Governance of the EUDI Wallet is a shared responsibility: the European Commission manages the legal framework and adopts implementing acts, while EU member states provide or mandate wallet solutions, certify and notify them, and supervise actors within their jurisdiction. The European Digital Identity Cooperation Group supports cooperation and cross-border alignment, and national competent authorities, wallet providers, issuers, QTSPs, and relying parties each carry distinct roles within this structure. Organizations that want to play a role in the wallet ecosystem may find that pursuing QTSP status opens up opportunities they would otherwise be excluded from.
How long does it take to achieve qualified trust service provider status?
Achieving qualified trust service provider status typically takes between six months and two years, depending on the organization’s starting point, the type of trust services it intends to offer, and the responsiveness of the national supervisory body. Organizations that begin with a solid compliance foundation and well-documented processes tend to move through the process more efficiently.
The timeline breaks down roughly into these phases:
- Gap analysis and preparation: Assessing current capabilities against eIDAS 2.0 requirements and the relevant implementing regulations. This phase can take several months, especially for organizations new to trust services.
- Policy and technical implementation: Developing or updating practice statements, security architecture, key management procedures, and governance documentation.
- Conformity assessment: Engaging an accredited CAB and completing the audit. Depending on the CAB’s availability and the complexity of the services being assessed, this phase typically takes two to six months.
- Supervisory review and notification: Submitting the conformity assessment report and notifying the supervisory body. The supervisory body has a defined period to review the application and either grant or deny qualified status.
Organizations that underestimate the documentation and preparation phases often experience delays. Starting with a clear understanding of which implementing regulations apply to the specific trust services being offered is one of the most effective ways to keep the process on track. Early engagement with both the CAB and the supervisory body is strongly recommended.
How TrustTech helps organizations become a QTSP
Navigating the requirements for qualified trust service provider status is complex, particularly with the expanded scope and new implementing regulations introduced under eIDAS 2.0. TrustTech supports organizations through every stage of this process, from initial gap analysis to production-ready trust infrastructure.
The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
Working with TrustTech gives organizations access to:
- A clear compliance path through eIDAS 2.0 requirements, including the specific implementing regulations that apply to the trust services you intend to offer
- Technical infrastructure built on European digital identity standards, designed to meet the security and interoperability requirements for qualified status
- Coverage across regulated sectors, including government and healthcare, where QTSP requirements intersect with sector-specific compliance obligations
- Reusable compliance components that reduce the time and cost of meeting conformity assessment requirements
- Proven implementation track record, with organizations already in production within five months across finance, government, health, and pharma
Whether you are starting from scratch or evolving an existing trust service toward qualified status, TrustTech brings the technical depth and regulatory knowledge to make the process manageable. Get in touch with TrustTech to discuss your path to QTSP status and find out what it takes to get there in your specific context.