EIDAS 2014/0910 EN

1. Conformity of qualified electronic_signature creation devices with the requirements laid down in Annex II shall be certified by appropriate public or private bodies designated by Member States.

2. Member States shall notify to the Commission the names and addresses of the public or private body referred to in paragraph 1. The Commission shall make that information available to Member States.

3. The certification referred to in paragraph 1 shall be based on one of the following:

(a)	a security evaluation process carried out in accordance with one of the standards for the security assessment of information technology products included in the list established in accordance with the second subparagraph; or

(b)

a process other than the process referred to in point (a), provided that it uses comparable security levels and provided that the public or private body referred to in paragraph 1 notifies that process to the Commission. That process may be used only in the absence of standards referred to in point (a) or when a security evaluation process referred to in point (a) is ongoing.

The Commission shall, by means of implementing acts, establish a list of standards for the security assessment of information technology products referred to in point (a). Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

4. The Commission shall be empowered to adopt delegated acts in accordance with Article 47 concerning the establishment of specific criteria to be met by the designated bodies referred to in paragraph 1 of this Article.

Article 31

Publication of a list of certified qualified electronic_signature creation devices

1. Member States shall notify to the Commission without undue delay and no later than one month after the certification is concluded, information on qualified electronic_signature creation devices that have been certified by the bodies referred to in Article 30(1). They shall also notify to the Commission, without undue delay and no later than one month after the certification is cancelled, information on electronic_signature creation devices that are no longer certified.

2. On the basis of the information received, the Commission shall establish, publish and maintain a list of certified qualified electronic_signature creation devices.

3. The Commission may, by means of implementing acts, define formats and procedures applicable for the purpose of paragraph 1. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Article 39

Qualified electronic_seal creation devices

1. Article 29 shall apply mutatis mutandis to requirements for qualified electronic_seal creation devices.

2. Article 30 shall apply mutatis mutandis to the certification of qualified electronic_seal creation devices.

3. Article 31 shall apply mutatis mutandis to the publication of a list of certified qualified electronic_seal creation devices.

Article 51

Transitional measures

1. Secure signature creation devices of which the conformity has been determined in accordance with Article 3(4) of Directive 1999/93/EC shall be considered as qualified electronic_signature creation devices under this Regulation.

2. Qualified certificates issued to natural persons under Directive 1999/93/EC shall be considered as qualified certificates for electronic_signatures under this Regulation until they expire.

3. A certification-service-provider issuing qualified certificates under Directive 1999/93/EC shall submit a conformity assessment report to the supervisory body as soon as possible but not later than 1 July 2017. Until the submission of such a conformity assessment report and the completion of its assessment by the supervisory body, that certification-service-provider shall be considered as qualified trust_service provider under this Regulation.

4. If a certification-service-provider issuing qualified certificates under Directive 1999/93/EC does not submit a conformity assessment report to the supervisory body within the time limit referred to in paragraph 3, that certification-service-provider shall not be considered as qualified trust_service provider under this Regulation from 2 July 2017.

whereas

(55) IT security certification based on international standards such as ISO 15408 and related evaluation methods and mutual recognition arrangements is an important tool for verifying the security of qualified electronic_signature creation devices and should be promoted.
However, innovative solutions and services such as mobile signing and cloud signing rely on technical and organisational solutions for qualified electronic_signature creation devices for which security standards may not yet be available or for which the first IT security certification is ongoing.
The level of security of such qualified electronic_signature creation devices could be evaluated by using alternative processes only where such security standards are not available or where the first IT security certification is ongoing.
Those processes should be comparable to the standards for IT security certification insofar as their security levels are equivalent.
Those processes could be facilitated by a peer review.

- = -

(56) This Regulation should lay down requirements for qualified electronic_signature creation devices to ensure the functionality of advanced electronic_signatures.
This Regulation should not cover the entire system environment in which such devices operate.
Therefore, the scope of the certification of qualified signature creation devices should be limited to the hardware and system software used to manage and protect the signature creation data created, stored or processed in the signature creation device.
As detailed in relevant standards, the scope of the certification obligation should exclude signature creation applications.

- = -

(67) Website authentication services provide a means by which a visitor to a website can be assured that there is a genuine and legitimate entity standing behind the website.
Those services contribute to the building of trust and confidence in conducting business online, as users will have confidence in a website that has been authenticated.
The provision and the use of website authentication services are entirely voluntary.
However, in order for website authentication to become a means to boosting trust, providing a better experience for the user and furthering growth in the internal market, this Regulation should lay down minimal security and liability obligations for the providers and their services.
To that end, the results of existing industry-led initiatives, for example the certification Authorities/Browsers Forum — CA/B Forum, have been taken into account.
In addition, this Regulation should not impede the use of other means or methods to authenticate a website not falling under this Regulation nor should it prevent third country providers of website authentication services from providing their services to customers in the Union.
However, a third country provider should only have its website authentication services recognised as qualified in accordance with this Regulation, if an international agreement between the Union and the country of establishment of the provider has been concluded.

- = -

(70) In order to complement certain detailed technical aspects of this Regulation in a flexible and rapid manner, the power to adopt acts in accordance with Article 290 TFEU should be delegated to the Commission in respect of criteria to be met by the bodies responsible for the certification of qualified electronic_signature creation devices.
It is of particular importance that the Commission carry out appropriate consultations during its preparatory work, including at expert level.
The Commission, when preparing and drawing up delegated acts, should ensure a simultaneous, timely and appropriate transmission of relevant documents to the European Parliament and to the Council.

- = -

(74) To ensure legal certainty for market operators already using qualified certificates issued to natural persons in compliance with Directive 1999/93/EC, it is necessary to provide for a sufficient period of time for transitional purposes.
Similarly, transitional measures should be established for secure signature creation devices, the conformity of which has been determined in accordance with Directive 1999/93/EC, as well as for certification service providers issuing qualified certificates before 1 July 2016.
Finally, it is also necessary to provide the Commission with the means to adopt the implementing acts and delegated acts before that date.

- = -

keyboard_tab EIDAS 2014/0910 EN

EIDAS 2014/0910 EN