EIDAS 2014/0910 EN

1. Trust services provided by trust_service providers established in a third country shall be recognised as legally equivalent to qualified trust_services provided by qualified trust_service providers established in the Union where the trust_services originating from the third country are recognised under an agreement concluded between the Union and the third country in question or an international organisation in accordance with Article 218 TFEU.

2. Agreements referred to in paragraph 1 shall ensure, in particular, that:

(a)

the requirements applicable to qualified trust_service providers established in the Union and the qualified trust_services they provide are met by the trust_service providers in the third country or international organisations with which the agreement is concluded, and by the trust_services they provide;

(b)	the qualified trust_services provided by qualified trust_service providers established in the Union are recognised as legally equivalent to trust_services provided by trust_service providers in the third country or international organisation with which the agreement is concluded.

Article 21

Initiation of a qualified trust_service

1. Where trust_service providers, without qualified status, intend to start providing qualified trust_services, they shall submit to the supervisory body a notification of their intention together with a conformity assessment report issued by a conformity_assessment_body.

2. The supervisory body shall verify whether the trust_service provider and the trust_services provided by it comply with the requirements laid down in this Regulation, and in particular, with the requirements for qualified trust_service providers and for the qualified trust_services they provide.

If the supervisory body concludes that the trust_service provider and the trust_services provided by it comply with the requirements referred to in the first subparagraph, the supervisory body shall grant qualified status to the trust_service provider and the trust_services it provides and inform the body referred to in Article 22(3) for the purposes of updating the trusted lists referred to in Article 22(1), not later than three months after notification in accordance with paragraph 1 of this Article.

If the verification is not concluded within three months of notification, the supervisory body shall inform the trust_service provider specifying the reasons for the delay and the period within which the verification is to be concluded.

3. Qualified trust_service providers may begin to provide the qualified trust_service after the qualified status has been indicated in the trusted lists referred to in Article 22(1).

4. The Commission may, by means of implementing acts, define the formats and procedures for the purpose of paragraphs 1 and 2. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Article 31

Publication of a list of certified qualified electronic_signature creation devices

1. Member States shall notify to the Commission without undue delay and no later than one month after the certification is concluded, information on qualified electronic_signature creation devices that have been certified by the bodies referred to in Article 30(1). They shall also notify to the Commission, without undue delay and no later than one month after the certification is cancelled, information on electronic_signature creation devices that are no longer certified.

2. On the basis of the information received, the Commission shall establish, publish and maintain a list of certified qualified electronic_signature creation devices.

3. The Commission may, by means of implementing acts, define formats and procedures applicable for the purpose of paragraph 1. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

whereas

(67) Website authentication services provide a means by which a visitor to a website can be assured that there is a genuine and legitimate entity standing behind the website.
Those services contribute to the building of trust and confidence in conducting business online, as users will have confidence in a website that has been authenticated.
The provision and the use of website authentication services are entirely voluntary.
However, in order for website authentication to become a means to boosting trust, providing a better experience for the user and furthering growth in the internal market, this Regulation should lay down minimal security and liability obligations for the providers and their services.
To that end, the results of existing industry-led initiatives, for example the Certification Authorities/Browsers Forum — CA/B Forum, have been taken into account.
In addition, this Regulation should not impede the use of other means or methods to authenticate a website not falling under this Regulation nor should it prevent third country providers of website authentication services from providing their services to customers in the Union.
However, a third country provider should only have its website authentication services recognised as qualified in accordance with this Regulation, if an international agreement between the Union and the country of establishment of the provider has been concluded.

- = -

keyboard_tab EIDAS 2014/0910 EN

EIDAS 2014/0910 EN