A qualified trust service provider (QTSP) is a trust service provider that has been granted qualified status by a supervisory body in an EU Member State, following a conformity assessment against the requirements set out in the eIDAS regulation. Qualified status is the highest level of recognition a trust service provider can achieve under EU law, and it signals that the provider meets strict technical, security, and organisational standards. This article answers the most common questions about QTSPs, what they do, how they differ from regular providers, and why their status matters for your organisation.
What qualifies a trust service provider under eIDAS 2.0?
A trust service provider becomes a qualified trust service provider under eIDAS 2.0 by successfully completing a conformity assessment carried out by an accredited conformity assessment body and by being granted qualified status by the national supervisory authority in its Member State. Once granted, the provider is listed on the national Trusted List, which is published and recognised across the EU.
The requirements for qualified status are detailed and demanding. Under eIDAS 2.0, providers must demonstrate that they meet specific standards covering security management, personnel reliability, technical infrastructure, and service continuity. The updated regulation, Regulation (EU) 2024/1183, amends Regulation (EU) 910/2014 and has introduced additional implementing acts that set out legally binding requirements in areas such as protocols and interfaces, certification of wallet solutions, and the management of remote qualified signature creation devices. The Architecture and Reference Framework (ARF) provides the technical elaboration of those requirements, but it is the implementing acts that carry legal force. These requirements reflect the broader scope of eIDAS 2.0 compared to the original regulation.
Importantly, qualified status is not a one-time achievement. Providers must undergo regular audits to maintain their status and must notify their supervisory body before initiating new qualified trust services. This ongoing accountability is what makes the QTSP designation meaningful and trustworthy.
What services can a qualified trust service provider offer?
A qualified trust service provider can offer a defined set of qualified trust services under eIDAS 2.0. These services carry the highest legal weight within the EU framework and are accepted across Member States without additional verification.
The range of qualified trust services includes:
- Qualified electronic signatures (QES): The digital equivalent of a handwritten signature, with the highest legal standing under EU law. A QES requires a qualified signature creation device (QSCD) and a qualified certificate.
- Qualified electronic seals: Used by organisations to guarantee the origin and integrity of a document or dataset. A qualified electronic seal has a distinct legal effect and is not equivalent to a handwritten signature.
- Qualified electronic time stamps: Binding a precise date and time to data in a legally recognised way.
- Qualified certificates for website authentication: Confirming the identity of a website operator to users.
- Qualified electronic registered delivery services: Providing legally recognised proof of sending and receiving data.
- Qualified preservation services: The long-term preservation of qualified electronic signatures and seals.
- Qualified electronic ledgers: A newer service type introduced under eIDAS 2.0, providing tamper-evident records.
- Qualified electronic archiving services: Ensuring the long-term integrity and accessibility of electronic documents.
- Remote qualified signature creation device management: A category introduced in eIDAS 2.0, enabling remote signing without compromising security. It is worth noting that remote signing as a concept already existed under the original eIDAS regulation.
This expanded list under eIDAS 2.0 reflects how digital interactions have evolved. The original eIDAS regulation covered a smaller set of services, but the updated framework recognises that organisations need trusted infrastructure for a much wider range of digital processes.
How does a QTSP differ from a regular trust service provider?
The key difference between a qualified trust service provider and a non-qualified (regular) trust service provider is the level of legal recognition and the rigour of oversight they are subject to. A regular trust service provider can offer trust services without a conformity assessment, while a QTSP has been independently audited and formally recognised by a national supervisory authority.
In practical terms, this distinction has significant consequences:
- Legal presumption: Services provided by a QTSP carry a legal presumption of validity across the EU. A qualified electronic signature, for example, is presumed to have the same legal effect as a handwritten signature, subject to applicable national formal requirements. Non-qualified signatures do not carry this presumption automatically.
- Cross-border recognition: Qualified trust services are automatically recognised in all EU Member States. Non-qualified services may not be accepted in other jurisdictions without additional verification.
- Trusted List inclusion: Only QTSPs appear on the national Trusted Lists, which are published by Member States and brought together in the EU List of Trusted Lists (LOTL). This makes it straightforward for organisations and individuals to verify a provider’s status.
- Audit and accountability: QTSPs are subject to regular conformity assessments and must report security breaches to their supervisory body. Non-qualified providers operate under lighter requirements.
For organisations in regulated sectors such as finance, healthcare, or government, the distinction is not merely technical. Working with a QTSP means relying on services that will hold up legally, be accepted across borders, and meet the compliance expectations of regulators.
Who oversees and supervises qualified trust service providers?
Qualified trust service providers are supervised by a national supervisory body in each EU Member State. Each country designates its own authority responsible for overseeing trust service providers, granting qualified status, maintaining the national Trusted List, and responding to security incidents or non-compliance.
Under eIDAS 2.0, the supervisory framework has been strengthened. Supervisory bodies now operate under clearer obligations and timelines, and the regulation introduces formal requirements for how they handle notifications, conduct peer reviews of eID schemes, and publish information on qualified providers. The implementing acts that accompany eIDAS 2.0 also set out specific formats and procedures for annual reporting by supervisory bodies, adding further transparency to the oversight process.
Governance under eIDAS 2.0 is a shared responsibility across multiple actors. The European Commission manages the legal framework and adopts implementing acts, but does not operationally manage national trust services or wallet solutions. EU Member States supervise actors within their own jurisdictions, certify and notify wallet solutions, and maintain their national Trusted Lists. The European Digital Identity Cooperation Group supports cooperation and cross-border alignment between Member States. At the EU level, the European Commission publishes the aggregated EU List of Trusted Lists (LOTL) that brings together national lists, creating a layered system of accountability in which national authorities handle day-to-day supervision while the EU framework ensures consistency and cross-border recognition.
For organisations choosing a QTSP, this supervisory structure is a practical reassurance. It means the provider’s qualified status has been independently verified, is publicly visible, and is subject to ongoing scrutiny.
Why does QTSP status matter for organisations using digital identity services?
QTSP status matters because it directly affects the legal validity, cross-border acceptance, and regulatory compliance of the digital identity and signing services your organisation relies on. If your processes depend on electronic signatures, identity verification, or trusted data exchange, the qualified status of your provider determines whether those interactions will hold up legally and be accepted by counterparties, regulators, and public authorities across the EU.
For organisations in sectors such as financial services or healthcare, this is especially relevant. Regulations such as AML, KYC, and PSD2 require verifiable and auditable identity processes. eIDAS 2.0 adds further requirements on top of those, particularly around the use of the European Digital Identity Wallet and the qualified trust services that support it. Relying on a QTSP ensures your organisation is working within a framework that regulators recognise and accept.
There is also a practical dimension. When your customers or partners have already verified their identity through a trusted source, a QTSP-backed infrastructure allows that verified identity to be reused securely, reducing friction and avoiding repeated verification steps. This is one of the core aims of the EUDI Wallet ecosystem: that a person or organisation verified once can be trusted in other contexts, provided the underlying trust services meet the qualified standard. Cross-border use cases operate at the level of certified wallets and registered relying parties. Under CIR (EU) 2025/848, adopted on 6 May 2025, relying parties must register with the national authority of their Member State of establishment before requesting wallet data, and must specify per intended use which attributes and attestations they will request. National registration requirements and sector-specific legislation continue to apply, and not every credential will automatically carry the same legal consequence in every Member State.
As eIDAS 2.0 continues to reshape the digital identity landscape across Europe, the legal deadline for Member States’ wallet obligations is 24 December 2026, by which date public sector bodies must accept notified wallets for online services requiring electronic identification. For relevant regulated private sectors, the acceptance obligation under Article 5f applies from 24 December 2027. Organisations that build their processes on qualified trust infrastructure are better positioned to adapt as new requirements come into force. Practical interoperability and national rollout are likely to develop in phases, so building on a qualified framework now is the foundation for scalable, future-ready digital interactions.
How TrustTech helps with qualified trust service providers and eIDAS 2.0
TrustTech’s ID Connector is built specifically to connect organisations to qualified trust infrastructure without having to rebuild their existing systems from scratch. The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
Working with TrustTech means your organisation gets:
- A platform that connects identity verification, reusable credentials, and qualified electronic signing in one trusted flow, including verification against national Trusted Lists, revocation checks, and validation of wallet unit attestations
- Support for regulated sectors including financial services, government, healthcare, and pharmaceuticals, where compliance requirements are most demanding
- Wallet-ready digital identity infrastructure aligned with the EUDI Wallet and eIDAS 2.0 by design
- Faster onboarding and fewer drop-offs, with verified identity that can be reused across organisations and processes
- A production-ready setup, typically live within five months, built on European digital identity standards
Get in touch with TrustTech to find out how the ID Connector can help your organisation build on trusted, qualified digital identity infrastructure.