eIDAS Certification - Electronic Identification and Trust Services

The European eIDAS v2 regulation aims to secure all our online procedures. To achieve this, it defines a list of trust services. If a provider is certified, its services receive a "qualified" status, giving them true legal value throughout Europe.

Maintained and Enhanced eIDAS Services

These services already existed under the first version of eIDAS but remain indispensable:

• Electronic Signature (for individuals): The digital equivalent of your handwritten signature. It allows an individual to sign a contract online while proving their identity and guaranteeing that the contract has not been modified after signing.
• Electronic Seal (for corporate entities): The digital equivalent of a company stamp. It allows a company or public administration to automatically sign thousands of documents (such as invoices or payslips) to prove their origin.
• Electronic Time Stamp: A digital "talking clock". This service associates an official, tamper-proof date and time with a document or an online action, providing indisputable proof that a document existed at a specific moment.
• Website Authentication (QWAC Certificates): A high-end version of the secure connection indicator in your browser's address bar. This certificate indisputably proves the real identity of the company owning the website (to prevent phishing, hacking, and fake banking or administrative sites).
• Electronic Registered Delivery Service (ERDS): The digital equivalent of paper registered mail with acknowledgement of receipt. It provides legal proof of the date and time an email was sent, its successful receipt by the recipient, and guarantees that the message content has not been intercepted or altered.
• Validation and Preservation: These services make it possible to instantly verify whether an old electronic signature was valid at the time it was made, and to extend its legal validity over time by adding new cryptographic protections.

New eIDAS v2 Services

These services were created to adapt to new digital and mobile use cases:

• European Digital Identity Wallet (EUDI Wallet): A secure smartphone application (an official, European digital wallet). It allows every citizen to store their identity card, driving license, or diplomas to share them securely in a single click.
• Qualified Electronic Attestation of Attributes (QEAA): This service digitizes official supporting documents (a university diploma, an insurance certificate, a commercial register extract). These credentials are electronically signed by the issuing body to prove their authenticity.
• Qualified Electronic Archiving Service (EATS): This service guarantees that a digital document (such as a contract or an invoice) will be kept in a safe place for many years (10, 30 years or more) without risk of modification, loss, or becoming unreadable due to technological evolution.
• Electronic Ledgers (Ledgers): This service allows data or transactions to be recorded in a decentralized, shared digital ledger. It guarantees that no one can modify or delete the history of what has been recorded (highly useful for tracing the origin of products or financial transactions).
• Remote QSCD Management (Remote Qualified Signature/Seal Creation Devices): This service allows a user to sign a document in a highly secure manner from their smartphone or computer, without needing a physical USB token or a special smart card. The signature keys are protected remotely in ultra-secure servers.

The major challenges of eIDAS certification for customers (Trusted Service Providers) are :

• Increased confidence and credibility : Obtaining qualification strengthens the confidence of users and partners in your digital services.
• Pan-European recognition: Ensure the legal validity of your services (signatures, stamps, etc.) in all European Union member states.
• Regulatory compliance: Meet the strict requirements of European regulations to avoid legal challenges.
• Access to public procurement: eIDAS qualification is often required for transactions with European administrations and public bodies.
• Secure transactions : guarantee the highest level of security for the identification and integrity of exchanged data.
• Process optimization: Facilitate the complete dematerialization of contractual and administrative exchanges.

eIDAS certification is aimed at an expanding ecosystem of stakeholders, encompassing all structures—both public and private—that issue, manage, or integrate digital data with high legal and security value.

It primarily concerns traditional or emerging Trust Service Providers (TSPs) (software vendors, trusted third parties, certification authorities) wishing to validate the compliance of their signature, seal, time-stamping, or electronic archiving solutions. It is also of crucial relevance to Public Administrations and State Services (ministries, prefectures, social protection agencies, universities, professional bodies) responsible for managing authentic sources of data.

By obtaining this certification, these public and private entities position themselves as pivotal hubs of modern digital identity, qualifying them to issue certified attributes and Qualified Electronic Attestations of Attributes (QEAA) that are natively compatible and interoperable with the future European Digital Identity Wallet (EUDI Wallet).

LSTI is listed on the European Commission's official list as an accredited Conformity Assessment Body (CAB) authorized to perform eIDAS certification audits.

The initial assessment is rigorously carried out in two major, time-bound steps:

• Step 1: Remote Document Review An in-depth analysis of the Provider's documentation (Information Security Policy, risk assessments, service policies) to evaluate readiness and validate the contractual scope. This phase determines progression to the next step; the maximum delay between Step 1 and Step 2 cannot exceed 6 months.
• Step 2: On-site Audit (Processes, Premises, and Information Systems) On-site investigations by our expert auditor teams to gather factual evidence of the implementation of operating procedures: logical and physical security, cryptographic reliability, subscriber registration mechanisms, and infrastructure compliance.
• The Surveillance Cycle: Once certification is granted (valid for 2 years), a surveillance audit is systematically carried out at 12 months to ensure continuous compliance maintenance. A full renewal audit takes place before the certificate expires.

The qualification of providers is granted by the supervisory bodies of the EU Member States. Qualification is pronounced based on a certificate and a report drawn up by an accredited conformity assessment body authorized to carry out these assessments.

The list of our eIDAS-certified clients is available via our search engine under the TSP register.

List of references to the eIDAS regulation, technical standards, and links to implementing acts: