Existing eIDAS 1.0 trust services do not simply stop working after 2026. Qualified trust service providers that were already recognized under eIDAS 1.0 retain their legal standing, but they must upgrade their practices, technical standards, and documentation to comply with the stricter requirements introduced by eIDAS 2.0, which amends Regulation (EU) 910/2014 through Regulation (EU) 2024/1183. For organizations that rely on qualified certificates, electronic signatures, or other trust services, this is primarily a compliance and transition challenge. This article walks through the most important questions your organization likely has about what changes, what stays the same, and what to do next.
Will eIDAS 1.0 trust services stop working after 2026?
No, eIDAS 1.0 trust services will not simply stop working after 2026. The transition to eIDAS 2.0 is a regulatory upgrade. Trust services that were qualified under eIDAS 1.0 remain legally recognized during the transition period, but providers are expected to align with the new requirements within the timeframes set by the European Commission’s implementing acts.
Think of it as a rolling migration. eIDAS 2.0 introduces new trust service categories, updated technical standards, and expanded supervision requirements. Existing qualified trust service providers must demonstrate conformity with these updated rules to retain their qualified status on the national trusted lists, which together form the EU List of Trusted Lists (LOTL). Until they do, their current services continue to operate, but without proactive action, organizations risk falling out of compliance as supervisory bodies begin enforcing the new framework.
The practical impact depends heavily on the type of trust service involved. Qualified electronic signatures, seals, timestamps, and registered delivery services each have their own updated reference standards. Providers that offer these services need to assess which implementing acts apply to them and plan accordingly.
What changes for qualified trust service providers under eIDAS 2.0?
Under eIDAS 2.0, qualified trust service providers face a significantly expanded compliance landscape. The regulation introduces new categories of qualified trust services, raises the bar for conformity assessment, and requires alignment with a large set of new implementing acts covering everything from technical protocols to annual reporting formats.
Some of the most significant changes include:
- New qualified trust service categories: eIDAS 2.0 adds qualified electronic ledgers and qualified electronic archiving services as recognized trust service types, which did not exist under the original framework.
- Remote qualified signature creation devices (QSCDs): Managing remote QSCDs is now recognized as a qualified trust service in its own right, with dedicated implementing acts. Note that remote signing already existed under eIDAS 1.0; what changes is the formal recognition of QSCD management as a separate qualified trust service category.
- Stricter conformity assessment: The accreditation process for conformity assessment bodies has been tightened, and the conformity assessment scheme itself has been updated.
- Expanded notification and reporting obligations: Providers must follow updated formats and procedures for notifying supervisory bodies, reporting security breaches, and submitting annual reports.
- Interoperability requirements: New standards apply to qualified electronic registered delivery services and validation services to ensure cross-border interoperability across EU Member States.
For organizations in regulated sectors such as financial services or healthcare, these changes are particularly relevant because trust services underpin critical processes like digital onboarding, consent management, and legally binding document signing.
How long do trust service providers have to comply with eIDAS 2.0?
The transition timelines under eIDAS 2.0 are staggered. Different implementing acts carry different deadlines, and the European Commission has been rolling out these acts progressively. The first five core implementing acts were adopted at the end of 2024, starting the relevant 24-month compliance periods. This makes the period leading up to 24 December 2026 a critical window for action on several of those obligations.
Providers that were qualified under eIDAS 1.0 generally benefit from a grace period that allows them to continue operating while they update their systems and documentation. However, this grace period is not indefinite. National supervisory bodies are responsible for monitoring compliance within their jurisdiction, and providers that fail to demonstrate conformity within the applicable timeframes risk losing their qualified status.
The Architecture and Reference Framework (ARF) developed by the eIDAS Expert Group provides technical elaboration of the requirements set out in the implementing acts, particularly for providers that also need to interact with the European Digital Identity Wallet ecosystem. The ARF contains the technical specifications; the implementing acts are legally binding. The large-scale pilots that ran from April 2023 to 2025 generated significant feedback on interoperability and security requirements, and that feedback has shaped the technical specifications that trust service providers must now meet.
For organizations that plan their compliance approach now, the transition is entirely manageable. The risk lies in assuming that existing qualified status automatically transfers without any action.
Do existing qualified certificates and signatures remain legally valid?
Yes, qualified certificates and electronic signatures issued under eIDAS 1.0 remain legally valid after 2026. The legal effect of a qualified electronic signature, seal, or certificate does not expire simply because the regulatory framework has been updated. Documents signed with a qualified certificate issued under eIDAS 1.0 retain their legal standing under EU law.
This is an important distinction for organizations that have built workflows around existing certificates or that hold archives of signed documents. The validity of those signatures is not retroactively affected by the transition to eIDAS 2.0.
There is, however, a practical consideration around long-term validation. eIDAS 2.0 introduces updated reference standards for qualified preservation services and qualified validation services. Organizations that need to validate signatures over extended time periods, particularly in sectors like government or pharmaceuticals, should review whether their current validation and archiving infrastructure aligns with the new standards. Relying on outdated validation methods could create legal uncertainty in the future, even if the original signature itself remains valid.
It is also worth noting that eIDAS determines the legal effect of electronic signatures, but national form requirements continue to apply. A qualified electronic signature (QES) carries the same legal effect as a handwritten signature under EU law, provided the applicable national rules do not impose additional form requirements. A qualified electronic seal has a different legal effect and should not be described as equivalent to a signature.
For new certificates issued after the transition, providers must issue them in accordance with eIDAS 2.0 reference standards for qualified certificates for electronic signatures and electronic seals. Organizations procuring new certificates should verify that their trust service provider has already updated their offering.
What should organizations relying on eIDAS 1.0 services do now?
Organizations that currently rely on eIDAS 1.0 trust services should take a structured approach to assessing their exposure and planning their transition. Waiting for providers to notify them of changes is not a reliable strategy, particularly in regulated sectors where compliance gaps carry real legal and operational risk.
A practical starting point involves four steps:
- Inventory your current trust service dependencies: Identify every process in your organization that relies on qualified certificates, electronic signatures, seals, timestamps, or registered delivery services. This includes onboarding flows, contract signing, regulatory reporting, and any cross-border identity verification.
- Check your providers’ eIDAS 2.0 status: Verify whether your current trust service providers appear on the national trusted lists, which together form the EU List of Trusted Lists (LOTL), and whether they have communicated a roadmap for eIDAS 2.0 compliance. Providers that have not yet published a clear transition plan are a risk factor.
- Review your internal compliance framework: eIDAS 2.0 is a technical update for providers, and organizations that rely on these services also need to ensure their own policies, audit trails, and contractual arrangements reflect the updated requirements.
- Assess readiness for the EUDI Wallet ecosystem: If your organization operates in a sector where the European Digital Identity Wallet will become a standard method of identity verification, now is the time to understand how wallet-based interactions connect to your existing trust service infrastructure. Governance of the EUDI Wallet is a shared responsibility: the European Commission adopts the legally binding implementing acts, EU Member States provide or mandate wallet solutions and supervise actors within their jurisdiction, and the European Digital Identity Cooperation Group supports cross-border alignment. Public bodies must accept notified wallets for online services requiring electronic identification by 24 December 2026. For relevant regulated private sectors, the obligation under Article 5f applies from 24 December 2027. Practical interoperability and national rollout will develop in phases, and organizations should plan accordingly.
Organizations in science and research, for example, face specific considerations around qualified credentials and cross-border data sharing that benefit from early preparation. Reviewing your available resources on eIDAS 2.0 implementation is a good first step toward building a clear action plan.
How TrustTech helps with eIDAS 2.0 trust service transitions
Navigating the shift from eIDAS 1.0 to eIDAS 2.0 requires translating complex implementing acts into practical changes across your systems, contracts, and compliance processes. That is where the ID Connector from TrustTech comes in.
The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
For organizations managing the eIDAS 2.0 transition, the ID Connector handles:
- Wallet acceptance and trust management: verification of attestations against national trusted lists and the EU List of Trusted Lists, revocation checking, and validation of wallet unit attestations to confirm that a presenting wallet runs on a certified wallet solution
- Registered attribute scope enforcement: ensuring that data requests stay within the scope registered with the national authority under CIR (EU) 2025/848, so that every relying party interaction is backed by a valid registration
- Qualified signing via a connected QTSP: enabling qualified electronic signatures for document workflows in financial services, healthcare, pharma, and government without requiring organizations to build separate signing infrastructure
- Reuse of verified identity data: connecting identity proofing, authentication, and signing in a single compliant platform so that verified data does not need to be re-collected across different processes
Whether you are assessing your current trust service dependencies, planning a migration to eIDAS 2.0 compliant services, or preparing your organization for wallet-based identity interactions, the ID Connector provides the technical foundation to do so. Contact TrustTech to discuss your eIDAS 2.0 transition.