Ares(2025)3080000

COMMISSION IMPLEMENTING REGULATION (EU) …/...

of XXX

laying down rules for the application of Regulation (EU) No 910/2014 of the European Parliament and of the Council as regards the validation of qualified electronic signatures and of qualified electronic seals and the validation of advanced electronic signatures based on qualified certificates and of advanced electronic seals based on qualified certificates

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 910/2014 of the European Parliament and of the Council on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC 1 , and in particular Article 32(3), Article 32a(3), Article 40 and Article 40a thereof,

Whereas:

(1)Qualified electronic signatures, qualified electronic seals, advanced electronic signatures based on qualified certificates for electronic signatures and advanced electronic seals based on qualified certificates for electronic seals, provided their validity can be confirmed, ensure to relying parties the integrity and authenticity of the signed or sealed data, and enhance the certainty regarding the identity of the signatory or the seal creator. Those electronic signatures and seals play a crucial role in the digital business environment by promoting the transition from traditional paper-based processes to electronic equivalent ones.

(2)The presumption of compliance laid down in Article 32(1), Article 40, Article 32a(3) and Article 40a of Regulation (EU) No 910/2014 should only apply where the processes for the validation of qualified electronic signatures, of qualified electronic seals, of advanced electronic signatures based on qualified certificates for electronic signatures and of advanced electronic seals based on qualified certificates for electronic seals comply with the technical standards set out in this Regulation. These standards should reflect established practices and be widely recognised within the relevant sectors. They should be adapted to include additional controls ensuring the ability to verify the technical validity of those signatures and seals, and, where applicable, their qualified status.

(3)Regulation (EU) 2016/679 of the European Parliament and of the Council 2 and, where relevant, Directive 2002/58/EC of the European Parliament and of the Council 3 apply to all personal data processing activities under this Regulation.

(4)The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 of the European Parliament and of the Council5 and delivered its opinion on [XX.XX.2025].

(5)The measures provided for in this Regulation are in accordance with the opinion of the committee established by Article 48 of Regulation (EU) No 910/2014,

HAS ADOPTED THIS REGULATION:

Article 1

Subject matter

This Regulation sets out reference standards and specifications for establishing a presumption of compliance with the requirements for the validation of qualified electronic signatures and qualified electronic seals and the validation of advanced electronic signatures based on qualified certificates and of advanced electronic seals based on qualified certificates.

Article 2

Reference standards and specifications

The reference standards and specifications referred to in Article 32(3), Article 32a(3), Article 40 and Article 40a of Regulation (EU) No 910/2014 are set out in the Annexes to this Regulation.

Article 3

Entry into force

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at Brussels,

For the Commission

The President
Ursula VON DER LEYEN

Top

ANNEX I

List of reference standards and specifications for the validation of qualified electronic signatures and of qualified electronic seals

The standards ETSI TS 119 172-4 V1.1.1 (2021-05) 1 (‘ETSI TS 119 172-4’), and ETSI TS 119 102-2 V1.4.1 (2023-06) 2 (‘ETSI TS 119 102-2’) apply with the following adaptations:

1.For ETSI TS 119 172-4:

(1)2.1 Normative references:

–[1] ETSI EN 319 102-1 V1.4.1 (2024-06): "Electronic Signatures and Trust Infrastructures (ESI); Procedures for Creation and Validation of AdES Digital Signatures; Part 1: Creation and Validation".

–[2] ETSI TS 119 612 (V2.3.1): "Electronic Signatures and Infrastructures (ESI); Trusted Lists".

–[13] ETSI TS 119 101 V1.1.1 (2016-03): "Electronic Signatures and Infrastructures (ESI); Policy and security requirements for applications for signature creation and signature validation".

(2)2.2 Informative references;

–[i.7] void.

(3)4.2 Validation constraints and validation procedures, requirement REQ-4.2-03, section ‘X.509 validation constraints’, point c):

–(i): If an end-entity certificate represents a trust anchor, the RevocationCheckingConstraints shall either not be used or it shall be set to ‘eitherCheck’ as defined in ETSI TS 119 172-1 [3], clause A.4.2.1, table A.2 rows (m)2.1.

–(ii): If an end-entity certificate represents a trust anchor, the RevocationFreshnessConstraints defined in ETSI TS 119 172-1 [3], clause A.4.2.1, table A.2 rows (m)2.2 shall either not be used or it shall be used with a maximum value of 0, ensuring that the revocation information is only accepted if it has been issued after the best signature time.

(4)4.3 Requirements on signature validation and applicability rules checking practices

–REQ-4.3-02: Signature validation applications shall be compliant with ETSI TS 119 101 [13].

(5)4.4 Technical applicability (rules) checking process

–REQ-4.4.2-03: If any of the checks specified in REQ-4.4.2-01 fails, then:

(a)the process stops;

(b)the signature shall be technically determined as indeterminate, i.e. as neither an EU qualified electronic signature, nor as an EU qualified electronic seal; and

(c)the above result and the results of processes of all the intermediate processes shall be reflected in the signature applicability rules checking report.

ANNEX II

List of reference standards and specifications for the validation of advanced electronic signatures based on qualified certificates and of advanced electronic seals based on qualified certificates

The standards ETSI TS 119 172-4 V1.1.1 (2021-5) 3 (‘ETSI TS 119 172-4’), and ETSI TS 119 102-2 V1.4.1 (2023- 4 (‘ETSI TS 119 102-2’) apply with the following adaptations:

1.For ETSI TS 119 172-4:

(1)2.1 Normative references:

–[1] ETSI EN 319 102-1 V1.4.1 (2024-06): "Electronic Signatures and Trust Infrastructures (ESI); Procedures for Creation and Validation of AdES Digital Signatures; Part 1: Creation and Validation".

–[2] ETSI TS 119 612 (V2.3.1): "Electronic Signatures and Infrastructures (ESI); Trusted Lists".

–[13] ETSI TS 119 101 V1.1.1 (2016-03): "Electronic Signatures and Infrastructures (ESI); Policy and security requirements for applications for signature creation and signature validation".

(2)2.2 Informative references

–[i.7] void.

(3)4.2 Validation constraints and validation procedures, requirement REQ-4.2-03, section ‘X.509 validation constraints’, point c):

(1)4.3 Requirements on signature validation and applicability rules checking practices

–REQ-4.3-02: Signature validation applications shall be compliant with ETSI TS 119 101 [13].

(1)4.4 Technical applicability (rules) checking process

–REQ-4.4.2-03: If any of the checks specified in REQ-4.4.2-01 fails, then:

(a)the process stops;

(b)the signature shall be technically determined as indeterminate, i.e. as neither an EU qualified electronic signature, nor as an EU qualified electronic seal; and

(c)the above result and the results of processes of all the intermediate processes shall be reflected in the signature applicability rules checking report.

–REQ-4.4.2-04: void.

–REQ-4.4.2-05: void.

–REQ-4.4.2-06: At that point of the TARC process, if the following conditions are met:

(a)the signing certificate is determined, at the best signature time, as an EU qualified certificate for electronic signatures (respectively for electronic seals), as specified in REQ-4.4.2-02 a); and

(b)the result of the process performed as specified in clause 4.2 of the present document is TOTAL-PASSED,

–then the digital signature shall be determined as technically suitable to implement an EU advanced electronic signature based on a qualified certificate (respectively an EU advanced electronic seal based on a qualified certificate), otherwise the signature shall not be determined technically either as an EU advanced electronic signature based on a qualified certificate, or as an EU advanced electronic seal based on a qualified certificate.

(1) ETSI TS 119 172-4 - Electronic Signatures and Infrastructures (ESI); Signature Policies; Part 4: Signature applicability rules (validation policy) for European qualified electronic signatures/seals using trusted lists, V1.1.1 (2021-05).

(2) TS 119 102-2 - Electronic Signatures and Infrastructures (ESI); Procedures for Creation and Validation of AdES Digital Signatures; Part 2: Signature Validation Report, V1.4.1 (2023-06).

(3) TS 119 172-4 - Electronic Signatures and Infrastructures (ESI); Signature Policies; Part 4: Signature applicability rules (validation policy) for European qualified electronic signatures/seals using trusted lists, V1.1.1 (2021-05).

(4) 3 TS 119 102-2 - Electronic Signatures and Infrastructures (ESI); Procedures for Creation and Validation of AdES Digital Signatures; Part 2: Signature Validation Report, V1.4.1 (2023-06).

Top

Choose the experimental features you want to try