EIDAS 2014/0910 EN

1. qualified and non-qualified trust_service providers shall take appropriate technical and organisational measures to manage the risks posed to the security of the trust_services they provide. Having regard to the latest technological developments, those measures shall ensure that the level of security is commensurate to the degree of risk. In particular, measures shall be taken to prevent and minimise the impact of security incidents and inform stakeholders of the adverse effects of any such incidents.

2. qualified and non-qualified trust_service providers shall, without undue delay but in any event within 24 hours after having become aware of it, notify the supervisory body and, where applicable, other relevant bodies, such as the competent national body for information security or the data protection authority, of any breach of security or loss of integrity that has a significant impact on the trust_service provided or on the personal data maintained therein.

Where the breach of security or loss of integrity is likely to adversely affect a natural or legal person to whom the trusted service has been provided, the trust_service provider shall also notify the natural or legal person of the breach of security or loss of integrity without undue delay.

Where appropriate, in particular if a breach of security or loss of integrity concerns two or more Member States, the notified supervisory body shall inform the supervisory bodies in other Member States concerned and ENISA.

The notified supervisory body shall inform the public or require the trust_service provider to do so, where it determines that disclosure of the breach of security or loss of integrity is in the public interest.

3. The supervisory body shall provide ENISA once a year with a summary of notifications of breach of security and loss of integrity received from trust_service providers.

4. The Commission may, by means of implementing acts,:

(a)	further specify the measures referred to in paragraph 1; and

(b)	define the formats and procedures, including deadlines, applicable for the purpose of paragraph 2.

Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

SECTION 3

Qualified trust_services

Article 20

Supervision of qualified trust_service providers

1. qualified trust_service providers shall be audited at their own expense at least every 24 months by a conformity_assessment_body. The purpose of the audit shall be to confirm that the qualified trust_service providers and the qualified trust_services provided by them fulfil the requirements laid down in this Regulation. The qualified trust_service providers shall submit the resulting conformity assessment report to the supervisory body within the period of three working days after receiving it.

2. Without prejudice to paragraph 1, the supervisory body may at any time audit or request a conformity_assessment_body to perform a conformity assessment of the qualified trust_service providers, at the expense of those trust_service providers, to confirm that they and the qualified trust_services provided by them fulfil the requirements laid down in this Regulation. Where personal data protection rules appear to have been breached, the supervisory body shall inform the data protection authorities of the results of its audits.

3. Where the supervisory body requires the qualified trust_service provider to remedy any failure to fulfil requirements under this Regulation and where that provider does not act accordingly, and if applicable within a time limit set by the supervisory body, the supervisory body, taking into account, in particular, the extent, duration and consequences of that failure, may withdraw the qualified status of that provider or of the affected service it provides and inform the body referred to in Article 22(3) for the purposes of updating the trusted lists referred to in Article 22(1). The supervisory body shall inform the qualified trust_service provider of the withdrawal of its qualified status or of the qualified status of the service concerned.

4. The Commission may, by means of implementing acts, establish reference number of the following standards:

(a)	accreditation of the conformity assessment bodies and for the conformity assessment report referred to in paragraph 1;

(b)	auditing rules under which conformity assessment bodies will carry out their conformity assessment of the qualified trust_service providers as referred to in paragraph 1.

Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Article 21

Initiation of a qualified trust_service

1. Where trust_service providers, without qualified status, intend to start providing qualified trust_services, they shall submit to the supervisory body a notification of their intention together with a conformity assessment report issued by a conformity_assessment_body.

2. The supervisory body shall verify whether the trust_service provider and the trust_services provided by it comply with the requirements laid down in this Regulation, and in particular, with the requirements for qualified trust_service providers and for the qualified trust_services they provide.

If the supervisory body concludes that the trust_service provider and the trust_services provided by it comply with the requirements referred to in the first subparagraph, the supervisory body shall grant qualified status to the trust_service provider and the trust_services it provides and inform the body referred to in Article 22(3) for the purposes of updating the trusted lists referred to in Article 22(1), not later than three months after notification in accordance with paragraph 1 of this Article.

If the verification is not concluded within three months of notification, the supervisory body shall inform the trust_service provider specifying the reasons for the delay and the period within which the verification is to be concluded.

3. qualified trust_service providers may begin to provide the qualified trust_service after the qualified status has been indicated in the trusted lists referred to in Article 22(1).

4. The Commission may, by means of implementing acts, define the formats and procedures for the purpose of paragraphs 1 and 2. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Article 28

Qualified certificates for electronic_signatures

1. qualified certificates for electronic_signatures shall meet the requirements laid down in Annex I.

2. qualified certificates for electronic_signatures shall not be subject to any mandatory requirement exceeding the requirements laid down in Annex I.

3. qualified certificates for electronic_signatures may include non-mandatory additional specific attributes. Those attributes shall not affect the interoperability and recognition of qualified electronic_signatures.

4. If a qualified certificate for electronic_signatures has been revoked after initial activation, it shall lose its validity from the moment of its revocation, and its status shall not in any circumstances be reverted.

5. Subject to the following conditions, Member States may lay down national rules on temporary suspension of a qualified certificate for electronic_signature:

(a)	if a qualified certificate for electronic_signature has been temporarily suspended that certificate shall lose its validity for the period of suspension;

(b)	the period of suspension shall be clearly indicated in the certificate database and the suspension status shall be visible, during the period of suspension, from the service providing information on the status of the certificate.

6. The Commission may, by means of implementing acts, establish reference numbers of standards for qualified certificates for electronic_signature. Compliance with the requirements laid down in Annex I shall be presumed where a qualified certificate for electronic_signature meets those standards. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Article 29

Requirements for qualified electronic_signature creation devices

1. qualified electronic_signature creation devices shall meet the requirements laid down in Annex II.

2. The Commission may, by means of implementing acts, establish reference numbers of standards for qualified electronic_signature creation devices. Compliance with the requirements laid down in Annex II shall be presumed where a qualified electronic_signature creation device meets those standards. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Article 38

Qualified certificates for electronic_seals

1. qualified certificates for electronic_seals shall meet the requirements laid down in Annex III.

2. qualified certificates for electronic_seals shall not be subject to any mandatory requirements exceeding the requirements laid down in Annex III.

3. qualified certificates for electronic_seals may include non-mandatory additional specific attributes. Those attributes shall not affect the interoperability and recognition of qualified electronic_seals.

4. If a qualified certificate for an electronic_seal has been revoked after initial activation, it shall lose its validity from the moment of its revocation, and its status shall not in any circumstances be reverted.

5. Subject to the following conditions, Member States may lay down national rules on temporary suspension of qualified certificates for electronic_seals:

(a)	if a qualified certificate for electronic_seal has been temporarily suspended, that certificate shall lose its validity for the period of suspension;

(b)	the period of suspension shall be clearly indicated in the certificate database and the suspension status shall be visible, during the period of suspension, from the service providing information on the status of the certificate.

6. The Commission may, by means of implementing acts, establish reference numbers of standards for qualified certificates for electronic_seals. Compliance with the requirements laid down in Annex III shall be presumed where a qualified certificate for electronic_seal meets those standards. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Article 44

Requirements for qualified electronic_registered_delivery_services

1. qualified electronic_registered_delivery_services shall meet the following requirements:

(a)	they are provided by one or more qualified trust_service provider(s);

(b)	they ensure with a high level of confidence the identification of the sender;

(c)	they ensure the identification of the addressee before the delivery of the data;

(d)	the sending and receiving of data is secured by an advanced electronic_signature or an advanced electronic_seal of a qualified trust_service provider in such a manner as to preclude the possibility of the data being changed undetectably;

(e)	any change of the data needed for the purpose of sending or receiving the data is clearly indicated to the sender and addressee of the data;

(f)	the date and time of sending, receiving and any change of data are indicated by a qualified electronic_time_stamp.

In the event of the data being transferred between two or more qualified trust_service providers, the requirements in points (a) to (f) shall apply to all the qualified trust_service providers.

2. The Commission may, by means of implementing acts, establish reference numbers of standards for processes for sending and receiving data. Compliance with the requirements laid down in paragraph 1 shall be presumed where the process for sending and receiving data meets those standards. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

SECTION 8

Website authentication

Article 45

Requirements for qualified certificates for website authentication

1. qualified certificates for website authentication shall meet the requirements laid down in Annex IV.

2. The Commission may, by means of implementing acts, establish reference numbers of standards for qualified certificates for website authentication. Compliance with the requirements laid down in Annex IV shall be presumed where a qualified certificate for website authentication meets those standards. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

CHAPTER IV

ELECTRONIC DOCUMENTS

Article 51

Transitional measures

1. Secure signature creation devices of which the conformity has been determined in accordance with Article 3(4) of Directive 1999/93/EC shall be considered as qualified electronic_signature creation devices under this Regulation.

2. qualified certificates issued to natural persons under Directive 1999/93/EC shall be considered as qualified certificates for electronic_signatures under this Regulation until they expire.

3. A certification-service-provider issuing qualified certificates under Directive 1999/93/EC shall submit a conformity assessment report to the supervisory body as soon as possible but not later than 1 July 2017. Until the submission of such a conformity assessment report and the completion of its assessment by the supervisory body, that certification-service-provider shall be considered as qualified trust_service provider under this Regulation.

4. If a certification-service-provider issuing qualified certificates under Directive 1999/93/EC does not submit a conformity assessment report to the supervisory body within the time limit referred to in paragraph 3, that certification-service-provider shall not be considered as qualified trust_service provider under this Regulation from 2 July 2017.

whereas

keyboard_tab EIDAS 2014/0910 EN

EIDAS 2014/0910 EN