EIDAS 2014/0910 EN

1. An electronic_identification scheme notified pursuant to Article 9(1) shall specify assurance levels low, substantial and/or high for electronic_identification means issued under that scheme.

2. The assurance levels low, substantial and high shall meet respectively the following criteria:

(a)

assurance level low shall refer to an electronic_identification means in the context of an electronic_identification scheme, which provides a limited degree of confidence in the claimed or asserted identity of a person, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to decrease the risk of misuse or alteration of the identity;

(b)

assurance level substantial shall refer to an electronic_identification means in the context of an electronic_identification scheme, which provides a substantial degree of confidence in the claimed or asserted identity of a person, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to decrease substantially the risk of misuse or alteration of the identity;

(c)

assurance level high shall refer to an electronic_identification means in the context of an electronic_identification scheme, which provides a higher degree of confidence in the claimed or asserted identity of a person than electronic_identification means with the assurance level substantial, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to prevent misuse or alteration of the identity.

3. By 18 September 2015, taking into account relevant international standards and subject to paragraph 2, the Commission shall, by means of implementing acts, set out minimum technical specifications, standards and procedures with reference to which assurance levels low, substantial and high are specified for electronic_identification means for the purposes of paragraph 1.

Those minimum technical specifications, standards and procedures shall be set out by reference to the reliability and quality of the following elements:

(a)	the procedure to prove and verify the identity of natural or legal persons applying for the issuance of electronic_identification means;

(b)	the procedure for the issuance of the requested electronic_identification means;

(c)	the authentication mechanism, through which the natural or legal person uses the electronic_identification means to confirm its identity to a relying_party;

(d)	the entity issuing the electronic_identification means;

(e)	any other body involved in the application for the issuance of the electronic_identification means; and

(f)	the technical and security specifications of the issued electronic_identification means.

Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Article 19

Security requirements applicable to trust_service providers

1. Qualified and non-qualified trust_service providers shall take appropriate technical and organisational measures to manage the risks posed to the security of the trust_services they provide. Having regard to the latest technological developments, those measures shall ensure that the level of security is commensurate to the degree of risk. In particular, measures shall be taken to prevent and minimise the impact of security incidents and inform stakeholders of the adverse effects of any such incidents.

2. Qualified and non-qualified trust_service providers shall, without undue delay but in any event within 24 hours after having become aware of it, notify the supervisory body and, where applicable, other relevant bodies, such as the competent national body for information security or the data protection authority, of any breach of security or loss of integrity that has a significant impact on the trust_service provided or on the personal data maintained therein.

Where the breach of security or loss of integrity is likely to adversely affect a natural or legal person to whom the trusted service has been provided, the trust_service provider shall also notify the natural or legal person of the breach of security or loss of integrity without undue delay.

Where appropriate, in particular if a breach of security or loss of integrity concerns two or more Member States, the notified supervisory body shall inform the supervisory bodies in other Member States concerned and ENISA.

The notified supervisory body shall inform the public or require the trust_service provider to do so, where it determines that disclosure of the breach of security or loss of integrity is in the public interest.

3. The supervisory body shall provide ENISA once a year with a summary of notifications of breach of security and loss of integrity received from trust_service providers.

4. The Commission may, by means of implementing acts,:

(a)	further specify the measures referred to in paragraph 1; and

(b)	define the formats and procedures, including deadlines, applicable for the purpose of paragraph 2.

Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

SECTION 3

Qualified trust_services

Article 21

Initiation of a qualified trust_service

1. Where trust_service providers, without qualified status, intend to start providing qualified trust_services, they shall submit to the supervisory body a notification of their intention together with a conformity assessment report issued by a conformity_assessment_body.

2. The supervisory body shall verify whether the trust_service provider and the trust_services provided by it comply with the requirements laid down in this Regulation, and in particular, with the requirements for qualified trust_service providers and for the qualified trust_services they provide.

If the supervisory body concludes that the trust_service provider and the trust_services provided by it comply with the requirements referred to in the first subparagraph, the supervisory body shall grant qualified status to the trust_service provider and the trust_services it provides and inform the body referred to in Article 22(3) for the purposes of updating the trusted lists referred to in Article 22(1), not later than three months after notification in accordance with paragraph 1 of this Article.

If the verification is not concluded within three months of notification, the supervisory body shall inform the trust_service provider specifying the reasons for the delay and the period within which the verification is to be concluded.

3. Qualified trust_service providers may begin to provide the qualified trust_service after the qualified status has been indicated in the trusted lists referred to in Article 22(1).

4. The Commission may, by means of implementing acts, define the formats and procedures for the purpose of paragraphs 1 and 2. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Article 22

Trusted lists

1. Each Member State shall establish, maintain and publish trusted lists, including information related to the qualified trust_service providers for which it is responsible, together with information related to the qualified trust_services provided by them.

2. Member States shall establish, maintain and publish, in a secured manner, the electronically signed or sealed trusted lists referred to in paragraph 1 in a form suitable for automated processing.

3. Member States shall notify to the Commission, without undue delay, information on the body responsible for establishing, maintaining and publishing national trusted lists, and details of where such lists are published, the certificates used to sign or seal the trusted lists and any changes thereto.

4. The Commission shall make available to the public, through a secure channel, the information referred to in paragraph 3 in electronically signed or sealed form suitable for automated processing.

5. By 18 September 2015 the Commission shall, by means of implementing acts, specify the information referred to in paragraph 1 and define the technical specifications and formats for trusted lists applicable for the purposes of paragraphs 1 to 4. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

whereas

(57) To ensure legal certainty as regards the validity of the signature, it is essential to specify the components of a qualified electronic_signature, which should be assessed by the relying_party carrying out the validation.
Moreover, specifying the requirements for qualified trust_service providers that can provide a qualified validation service to relying parties unwilling or unable to carry out the validation of qualified electronic_signatures themselves, should stimulate the private and public sector to invest in such services.
Both elements should make qualified electronic_signature validation easy and convenient for all parties at Union level.

- = -

(71) In order to ensure uniform conditions for the implementation of this Regulation, implementing powers should be conferred on the Commission, in particular for specifying reference numbers of standards the use of which would raise a presumption of compliance with certain requirements laid down in this Regulation.
Those powers should be exercised in accordance with Regulation (EU) No 182/2011 of the European Parliament and of the Council (12).

- = -

keyboard_tab EIDAS 2014/0910 EN

EIDAS 2014/0910 EN