Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC

• (a) to supervise qualified trust service providers established in the territory of the designating Member State and to ensure, by means of ex ante and ex post supervisory activities, that those qualified trust service providers and the qualified trust services that they provide meet the requirements laid down in this Regulation;

• (b) to take action, if necessary, in relation to non-qualified trust service providers established in the territory of the designating Member State, by means of ex post supervisory activities, when informed that those non-qualified trust service providers or the trust services they provide allegedly do not meet the requirements laid down in this Regulation.

• (a) to inform the relevant competent authorities designated or established pursuant to Article 8(1) of Directive (EU) 2022/2555 of the Member States concerned of any significant security breach or loss of integrity of which it becomes aware in the performance of its tasks and, in the case of a significant security breach or loss of integrity which concerns other Member States, to inform the single point of contact designated or established pursuant to Article 8(3) Directive (EU) 2022/2555 of the Member State concerned and the single points of contact designated pursuant to Article 46c(1) of this Regulation in the other Member States concerned, and to inform the public or require the trust service provider to do so where the supervisory body determines that disclosure of the breach of security or loss of integrity would be in the public interest;

• (b) to cooperate with other supervisory bodies and to provide them with assistance in accordance with Articles 46c and 46e;

• (c) to analyse the conformity assessment reports referred to in Article 20(1) and Article 21(1);

• (d) to report to the Commission about its main activities in accordance with paragraph 6 of this Article;

• (e) to carry out audits or request a conformity assessment body to perform a conformity assessment of the qualified trust service providers in accordance with Article 20(2);

• (f) to cooperate with competent supervisory authorities established pursuant to Article 51 of Regulation (EU) 2016/679, in particular, by informing them, without undue delay, where personal data protection rules appear to have been breached and about security breaches which appear to constitute personal data breaches;

• (g) to grant qualified status to trust service providers and to the services they provide, and to withdraw that status in accordance with Articles 20 and 21;

• (h) to inform the body responsible for the national trusted list referred to in Article 22(3) of its decisions to grant or withdraw qualified status, unless that body is also the supervisory body designated pursuant to paragraph 1 of this Article;

• (i) to verify the existence and correct application of provisions on termination plans where the qualified trust service provider ceases its activities, including how information is kept accessible in accordance with Article 24(2), point (h);

• (j) to require that trust service providers remedy any failure to fulfil the requirements laid down in this Regulation;

• (k) to investigate claims made by providers of web-browsers pursuant to Article 45a and to take action if necessary.

Article 46c

Single points of contact

Article 46d

Mutual assistance

• (a) the supervisory body applying supervisory and enforcement measures in one Member State shall inform and consult the supervisory body from the other Member State concerned;

• (b) a supervisory body may request the supervisory body of another Member State concerned to take supervisory or enforcement measures, including, for instance, requests to carry out inspections related to the conformity assessment reports as referred to in Articles 20 and 21 regarding the provision of trust services;

• (c) where appropriate, supervisory bodies may carry out joint investigations with the supervisory bodies of other Member States.

The arrangements and procedures for joint actions under the first subparagraph shall be agreed upon and established by the Member States concerned in accordance with their national law.

• (a) the assistance requested is not proportionate to the supervisory activities of the supervisory body carried out in accordance with Articles 46a and 46b;

• (b) the supervisory body is not competent to provide the requested assistance;

• (c) providing the requested assistance would be incompatible with this Regulation.

Article 46e

The European Digital Identity Cooperation Group

• (a) exchange advice and cooperate with the Commission on emerging policy initiatives in the field of digital identity wallets, electronic identification means and trust services;

• (b) advise the Commission, as appropriate, in the early preparation of draft implementing and delegated acts to be adopted pursuant to this Regulation;

• (c) in order to support the supervisory bodies in the implementation of the provisions of this Regulation:
• (i) exchange best practices and information regarding the implementation of the provisions of this Regulation;
• (ii) assess the relevant developments in the digital identity wallet, electronic identification and trust services sectors;
• (iii) organise joint meetings with relevant interested parties from across the Union to discuss activities carried out by the cooperation group and gather input on emerging policy challenges;
• (iv) with the support of ENISA, exchange views, best practices and information on relevant cybersecurity aspects concerning European Digital Identity Wallets, electronic identification schemes and trust services;
• (v) exchange best practices in relation to the development and implementation of policies on the notification of security breaches, and common measures as referred to in Articles 5e and 10;
• (vi) organise joint meetings with the NIS Cooperation Group established pursuant to Article 14(1) of Directive (EU) 2022/2555 to exchange relevant information in relation to trust services and electronic identification related cyber threats, incidents, vulnerabilities, awareness raising initiatives, trainings, exercises and skills, capacity building, standards and technical specifications capacity as well as standards and technical specifications;
• (vii) discuss, upon a request of a supervisory body, specific requests for mutual assistance as referred to in Article 46d;
• (viii) facilitate the exchange of information between the supervisory bodies by providing guidance on the organisational aspects and procedures for the mutual assistance referred to in Article 46d;

• (d) organise peer reviews of electronic identification schemes to be notified under this Regulation.

CHAPTER V DELEGATIONS OF POWER AND IMPLEMENTING PROVISIONS

Article 47

Exercise of the delegation

Article 48

Committee procedure

CHAPTER VI FINAL PROVISIONS

Article 48a

Reporting requirements

• (a) the number of natural and legal persons having a valid European Digital Identity Wallet;

• (b) the type and number of services accepting the use of the European Digital Identity Wallet;

• (c) the number of user complaints and consumer protection or data protection incidents relating to relying parties and qualified trust services;

• (d) a summary report including data on incidents preventing the use of the European Digital Identity Wallet;

• (e) a summary of significant security incidents, data breaches and affected users of European Digital Identity Wallets or of qualified trust services.

Article 49

Review

Article 50

Repeal

Article 51

Transitional measures

Article 52

Entry into force

• (a) Articles 8(3), 9(5), 12(2) to (9), 17(8), 19(4), 20(4), 21(4), 22(5), 23(3), 24(5), 27(4) and (5), 28(6), 29(2), 30(3) and (4), 31(3), 32(3), 33(2), 34(2), 37(4) and (5), 38(6), 42(2), 44(2), 45(2), and Articles 47 and 48 shall apply from 17 September 2014;

• (b) Article 7, Article 8(1) and (2), Articles 9, 10, 11 and Article 12(1) shall apply from the date of application of the implementing acts referred to in Articles 8(3) and 12(8);

• (c) Article 6 shall apply from three years as from the date of application of the implementing acts referred to in Articles 8(3) and 12(8).

This Regulation shall be binding in its entirety and directly applicable in all Member States.

ANNEX I

REQUIREMENTS FOR QUALIFIED CERTIFICATES FOR ELECTRONIC SIGNATURES

Qualified certificates for electronic signatures shall contain:

• (a) an indication, at least in a form suitable for automated processing, that the certificate has been issued as a qualified certificate for electronic signature;

• (b) a set of data unambiguously representing the qualified trust service provider issuing the qualified certificates including at least, the Member State in which that provider is established and:
• — for a legal person: the name and, where applicable, registration number as stated in the official records,
• — for a natural person: the person’s name;

• (c) at least the name of the signatory, or a pseudonym; if a pseudonym is used, it shall be clearly indicated;

• (d) electronic signature validation data that corresponds to the electronic signature creation data;

• (e) details of the beginning and end of the certificate’s period of validity;

• (f) the certificate identity code, which must be unique for the qualified trust service provider;

• (g) the advanced electronic signature or advanced electronic seal of the issuing qualified trust service provider;

• (h) the location where the certificate supporting the advanced electronic signature or advanced electronic seal referred to in point (g) is available free of charge;

• (i) the information or the location of the services that can be used to enquire about the validity status of the qualified certificate;

• (j) where the electronic signature creation data related to the electronic signature validation data is located in a qualified electronic signature creation device, an appropriate indication of this, at least in a form suitable for automated processing.

ANNEX II

REQUIREMENTS FOR QUALIFIED ELECTRONIC SIGNATURE CREATION DEVICES

• 1.Qualified electronic signature creation devices shall ensure, by appropriate technical and procedural means, that at least:

• (a) the confidentiality of the electronic signature creation data used for electronic signature creation is reasonably assured;

• (b) the electronic signature creation data used for electronic signature creation can practically occur only once;

• (c) the electronic signature creation data used for electronic signature creation cannot, with reasonable assurance, be derived and the electronic signature is reliably protected against forgery using currently available technology;

• (d) the electronic signature creation data used for electronic signature creation can be reliably protected by the legitimate signatory against use by others.

• 2.Qualified electronic signature creation devices shall not alter the data to be signed or prevent such data from being presented to the signatory prior to signing.

ANNEX III

REQUIREMENTS FOR QUALIFIED CERTIFICATES FOR ELECTRONIC SEALS

Qualified certificates for electronic seals shall contain:

• (a) an indication, at least in a form suitable for automated processing, that the certificate has been issued as a qualified certificate for electronic seal;

• (b) a set of data unambiguously representing the qualified trust service provider issuing the qualified certificates including at least the Member State in which that provider is established and:
• — for a legal person: the name and, where applicable, registration number as stated in the official records,
• — for a natural person: the person’s name;

• (c) at least the name of the creator of the seal and, where applicable, registration number as stated in the official records;

• (d) electronic seal validation data, which corresponds to the electronic seal creation data;

• (e) details of the beginning and end of the certificate’s period of validity;

• (f) the certificate identity code, which must be unique for the qualified trust service provider;

• (g) the advanced electronic signature or advanced electronic seal of the issuing qualified trust service provider;

• (h) the location where the certificate supporting the advanced electronic signature or advanced electronic seal referred to in point (g) is available free of charge;

• (i) the information or the location of the services that can be used to enquire about the validity status of the qualified certificate;

• (j) where the electronic seal creation data related to the electronic seal validation data is located in a qualified electronic seal creation device, an appropriate indication of this, at least in a form suitable for automated processing.

ANNEX IV

REQUIREMENTS FOR QUALIFIED CERTIFICATES FOR WEBSITE AUTHENTICATION

Qualified certificates for website authentication shall contain:

• (a) an indication, at least in a form suitable for automated processing, that the certificate has been issued as a qualified certificate for website authentication;

• (b) a set of data unambiguously representing the qualified trust service provider issuing the qualified certificates including at least the Member State in which that provider is established and:
• — for a legal person: the name and, where applicable, registration number as stated in the official records,
• — for a natural person: the person’s name;

• (c) for natural persons: at least the name of the person to whom the certificate has been issued, or a pseudonym; if a pseudonym is used, it shall be clearly indicated;

• (ca) for legal persons: a unique set of data unambiguously representing the legal person to whom the certificate is issued, with at least the name of the legal person to whom the certificate is issued and, where applicable, the registration number as stated in the official records;

• (d) elements of the address, including at least city and State, of the natural or legal person to whom the certificate is issued and, where applicable, as stated in the official records;

• (e) the domain name(s) operated by the natural or legal person to whom the certificate is issued;

• (f) details of the beginning and end of the certificate’s period of validity;

• (g) the certificate identity code, which must be unique for the qualified trust service provider;

• (h) the advanced electronic signature or advanced electronic seal of the issuing qualified trust service provider;

• (i) the location where the certificate supporting the advanced electronic signature or advanced electronic seal referred to in point (h) is available free of charge;

• (j) the information or the location of the certificate validity status services that can be used to enquire about the validity status of the qualified certificate.

ANNEX V

REQUIREMENTS FOR QUALIFIED ELECTRONIC ATTESTATION OF ATTRIBUTES

Qualified electronic attestation of attributes shall contain:

• (a) an indication, at least in a form suitable for automated processing, that the attestation has been issued as a qualified electronic attestation of attributes;

• (b) a set of data unambiguously representing the qualified trust service provider issuing the qualified electronic attestation of attributes including at least, the Member State in which that provider is established and:
• (i) for a legal person: the name and, where applicable, registration number as stated in the official records;
• (ii) for a natural person: the person’s name;

• (c) a set of data unambiguously representing the entity to which the attested attributes refer; if a pseudonym is used, it shall be clearly indicated;

• (d) the attested attribute or attributes, including, where applicable, the information necessary to identify the scope of those attributes;

• (e) details of the beginning and end of the attestation’s period of validity;

• (f) the attestation identity code, which must be unique for the qualified trust service provider and, if applicable, the indication of the scheme of attestations that the attestation of attributes is part of;

• (g) the qualified electronic signature or qualified electronic seal of the issuing qualified trust service provider;

• (h) the location where the certificate supporting the qualified electronic signature or qualified electronic seal referred to in point (g) is available free of charge;

• (i) the information or location of the services that can be used to enquire about the validity status of the qualified attestation..

ANNEX VI

MINIMUM LIST OF ATTRIBUTES

Pursuant to Article 45e, Member States shall ensure that measures are taken to allow qualified trust service providers of electronic attestations of attributes to verify by electronic means at the request of the user, the authenticity of the following attributes against the relevant authentic source at national level or via designated intermediaries recognised at national level, in accordance with Union or national law and where these attributes rely on authentic sources within the public sector:

• 1. Address;

• 1. Age;

• 1. Gender;

• 1. Civil status;

• 1. Family composition;

• 1. Nationality or citizenship;

• 1. Educational qualifications, titles and licences;

• 1. Professional qualifications, titles and licences;

• 1. Powers and mandates to represent natural or legal persons;

• 1. Public permits and licences;

• 1. For legal persons, financial and company data.

ANNEX VII

REQUIREMENTS FOR ELECTRONIC ATTESTATION OF ATTRIBUTES ISSUED BY OR ON BEHALF OF A PUBLIC BODY RESPONSIBLE FOR AN AUTHENTIC SOURCE

An electronic attestation of attributes issued by or on behalf of a public body responsible for an authentic source shall contain:

• (a) an indication, at least in a form suitable for automated processing, that the attestation has been issued as an electronic attestation of attributes issued by or on behalf of a public body responsible for an authentic source;

• (b) a set of data unambiguously representing the public body issuing the electronic attestation of attributes, including at least, the Member State in which that public body is established and its name and, where applicable, its registration number as stated in the official records;

• (c) a set of data unambiguously representing the entity to which the attested attributes refer; if a pseudonym is used, it shall be clearly indicated;

• (d) the attested attribute or attributes, including, where applicable, the information necessary to identify the scope of those attributes;

• (e) details of the beginning and end of the attestation’s period of validity;

• (f) the attestation identity code, which must be unique for the issuing public body and, if applicable, an indication of the scheme of attestations that the attestation of attributes is part of;

• (g) the qualified electronic signature or qualified electronic seal of the issuing body;

• (h) the location where the certificate supporting the qualified electronic signature or qualified electronic seal referred to in point (g) is available free of charge;

• (i) the information or location of the services that can be used to enquire about the validity status of the attestation.

[^E0001]: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1).

[^E0002]: Directive 2014/24/EU of the European Parliament and of the Council of 26 February 2014 on public procurement and repealing Directive 2004/18/EC (OJ L 94, 28.3.2014, p. 65).

[^E0003]: Directive (EU) 2019/882 of the European Parliament and of the Council of 17 April 2019on the accessibility requirements for products and services (OJ L 151, 7.6.2019, p. 70).

[^E0004]: Regulation (EU) 2019/881 of the European Parliament and of the Council of 17 April 2019on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification and repealing Regulation (EU) No 526/2013 (Cybersecurity Act) (OJ L 151, 7.6.2019, p. 15).

[^E0005]: Commission Recommendation 2003/361/EC of 6 May 2003concerning the definition of micro, small and medium-sized enterprises (OJ L 124, 20.5.2003, p. 36).

[^E0006]: Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022on a Single Market For Digital Services and amending Directive 2000/31/EC (Digital Services Act) (OJ L 277, 27.10.2022, p. 1).

[^E0007]: Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14 September 2022on contestable and fair markets in the digital sector and amending Directives (EU) 2019/1937 and (EU) 2020/1828 (Digital Markets Act) (OJ L 265, 12.10.2022, p. 1).

[^E0008]: Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive) (OJ L 333, 27.12.2022, p. 80).