EIDAS 2014/0910 EN

Member States shall lay down the rules on penalties applicable to infringements of this Regulation. The penalties provided for shall be effective, proportionate and dissuasive.

SECTION 2

supervision

Article 20

supervision of qualified trust_service providers

1. Qualified trust_service providers shall be audited at their own expense at least every 24 months by a conformity_assessment_body. The purpose of the audit shall be to confirm that the qualified trust_service providers and the qualified trust_services provided by them fulfil the requirements laid down in this Regulation. The qualified trust_service providers shall submit the resulting conformity assessment report to the supervisory body within the period of three working days after receiving it.

2. Without prejudice to paragraph 1, the supervisory body may at any time audit or request a conformity_assessment_body to perform a conformity assessment of the qualified trust_service providers, at the expense of those trust_service providers, to confirm that they and the qualified trust_services provided by them fulfil the requirements laid down in this Regulation. Where personal data protection rules appear to have been breached, the supervisory body shall inform the data protection authorities of the results of its audits.

3. Where the supervisory body requires the qualified trust_service provider to remedy any failure to fulfil requirements under this Regulation and where that provider does not act accordingly, and if applicable within a time limit set by the supervisory body, the supervisory body, taking into account, in particular, the extent, duration and consequences of that failure, may withdraw the qualified status of that provider or of the affected service it provides and inform the body referred to in Article 22(3) for the purposes of updating the trusted lists referred to in Article 22(1). The supervisory body shall inform the qualified trust_service provider of the withdrawal of its qualified status or of the qualified status of the service concerned.

4. The Commission may, by means of implementing acts, establish reference number of the following standards:

(a)	accreditation of the conformity assessment bodies and for the conformity assessment report referred to in paragraph 1;

(b)	auditing rules under which conformity assessment bodies will carry out their conformity assessment of the qualified trust_service providers as referred to in paragraph 1.

Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

whereas

(34) All Member States should follow common essential supervision requirements to ensure a comparable security level of qualified trust_services.
To ease the consistent application of those requirements across the Union, Member States should adopt comparable procedures and should exchange information on their supervision activities and best practices in the field.

- = -

(40) To enable the Commission and the Member States to assess the effectiveness of the enhanced supervision mechanism introduced by this Regulation, supervisory bodies should be requested to report on their activities.
This would be instrumental in facilitating the exchange of good practice between supervisory bodies and would ensure the verification of the consistent and efficient implementation of the essential supervision requirements in all Member States.

- = -

(42) To facilitate the supervision of qualified trust_service providers, for example, when a provider is providing its services in the territory of another Member State and is not subject to supervision there, or when the computers of a provider are located in the territory of a Member State other than the one where it is established, a mutual assistance system between supervisory bodies in the Member States should be established.

- = -

(46) Trusted lists are essential elements in the building of trust among market operators as they indicate the qualified status of the service provider at the time of supervision.

- = -

keyboard_tab EIDAS 2014/0910 EN

EIDAS 2014/0910 EN