Qualified certificates for electronic signatures and electronic seals

Enclosed, please find the detailed feedback from In.Te.S.A. SpA a Kyndryl Company, regarding the third set of draft Implementing Acts pertaining to the eIDAS 2 Regulation. We appreciate the opportunity to provide our input during this significant stage of regulatory advancement and remain available for any subsequent questions or dialogue.

The German Banking Industry Committee (GBIC) fully supports the attached comments of the European Credit Sector Associations (European Association of Co-operative Banks, European Banking Federation, and European Savings and Retail Banking Group ECSAs) on the draft implementing regulation concerning reference standards for qualified certificates for electronic signatures and qualified certificates for electronic…

Cleverbase is a Dutch qualified trust service provider, offering identification and qualified trust services. We appreciate the opportunity to provide feedback on the third batch of eIDAS 2 implementing acts, as Cleverbase is closely involved in discussions around the eIDAS regulation and related standards.

AssoCertificatori is the Association of Italian Qualified Trust Service Providers and Certified Service Providers. Assocertificatori is a non-profit organization that brings together the vast majority of providers pursuant to EU Regulation 910/2014 eIDAS such as digital signatures, digital identities, electronic delivery, electronic timestamps and digital preservation of documents.

Annex Nr. 1 (3) und Nr. 2 (3) OVR-5.3-01: If any changes are made to a CP as described in clause 4.2.2 which affects the applicability, then the policy identifier shall be changed. Policy identifiers are not the same as document identifiers. Policy identifiers should never change. The requirement must be changed accordingly.

The European Credit Sector Associations (European Association of Co-operative Banks, European Banking Federation, and European Savings and Retail Banking Group, ECSAs) are supportive of the ambition to establish a coherent Europe-wide framework for digital identity (eIDAS 2.0).

Signicat's has not had time to provide detailed feedback to this implementing act and its annex, but a look reveals the same problems as the other implementing acts in this batch. Most important: - Add a provision to update to accommodate new versions of standards - Do not overrule standards' requirements unless absolutely necessary and justified - Several proposals are highly problematic to existing providers -…

In general, it should be noted that additional requirements that deviate from the referenced standards should be viewed critically because they interfere with professional discussions and autonomy. Technical standards are written and approved by a large group of experts after thorough discussions and scrutinization.

Standards versioning Definition of a specific version of the standards prohibits or at least significantly delays benefitting from future developments of the standard. After adoption of a new standard version, the time-consuming process of adapting the implementing act would be necessary. Hence we suggest adding "or later" to the definition of norm versions to include future releases of the standards.

Versions of ETSI standards and their compliance with the eIDAS Regulation The proposals for implementing acts reference ETSI standards that are relevant to individual trust services, while also amending the provisions outlined in those reference ETSI standards.

Revised Requirements for HSMs used by Trust Service Providers (TSPs) The eIDAS Regulation does not specify particular requirements for Hardware Security Modules (HSMs) that Trust Service Providers (TSPs) must use, unlike the requirements for Qualified Signature Creation Devices (QSCDs). There is no doubt that the private cryptographic keys used by TSPs are protected with the highest level of security.

Loosely defined standards for Key activation on HSMs certified under EUCC or EN 419221-5:2018 Protection profiles for Trust Service Provider cryptographic modules Part 5: Cryptographic module for Trust services Use of Private Keys Requires Authentication via HSM Mechanisms The use of private keys requires prior authentication through mechanisms provided by the Hardware Security Module (HSM).

Qualified electronic seal creation devices: When held by a legal entity that is not a TSP The eIDAS Regulation and the published draft implementing acts do not clarify the requirements for QSCD when such a device is used by a legal entity that is not a Trust Service Provider (TSP), and where the device is not operated as a remote QSCD.

EPRELs new Legal entity identifier format vs ETSI EN 319 412-1 V1.5.1 As of 22 April 2025, the EPREL (European Product Registry for Energy Labelling) requires that identifiers for legal entities be provided in a different format than the one currently defined in ETSI EN 319 412-1 V1.5.1. The basis for the new format is the Regulation L_202400994SL.000101.fmx.xml.

Versioning of standards ETSI standards should consistently include version numbers. Currently, some are versioned while others are not. In the absence of a version, the latest valid version is assumed during implementation.

Transition periods in standards implementation/Lifecycle of standards: Implementing acts enter into force 20 days after publication. Existing systems cannot adapt that quickly. Therefore, whenever a change occurs, there must be a longer transition period to allow for proper implementation.

Intesi Group, an Italian Qualified Trust Service Provider, expresses its gratitude for the opportunity to provide feedback on the draft of the Implementing Act included in the attached document. We hope our proposals will be carefully considered by policymakers.

1) Please take into account the existing eIDAS ecosystem and the need of all stakeholders for continuity and stability. 2) Please define and clarify the meaning of "presumption of compliance" and how and when this IR is to be adhered to by QTSPs, CABs and Supervisory Bodies. 3) Allow for continuity for commonly accepted and previously approved standards, policies and practices.

ClubPSCo members thank the European Commission for the excellent work carried out on the new regulations. These implementing acts will be very effective in improving safety and interoperability and developing the internal market on a fair and competitive basis. ClubPSCo members nevertheless propose the following few modifications.

Comment to Annex I, article 1, 13 covering GEN-6.5.2-02 and Annex II, article 1, 13, covering GEN-6.5.2-02. Existing QTSP may use cryptographic modules which are not CC or EUCC certified but according to one of the schemes ISO/IEC 19790 [3], FIPS PUB 140-2 [13] level 3 or FIPS PUB 140-3 [16] level 3.

Since itsme is committed towards user friendly and secure identity and trust services, we would like eIDAS 2 to be a big success. We are very glad about the new possibilities that eIDAS 2 brings, however, we see a few potential issues with the current drafts. So, we are very happy we are given the opportunity to deliver the feedback in the joint PDF, hoping that those issues can be avoided.

Setigo believes that some of the new requirements are very difficult to meet unless there´s a transition period of some years, for example, those related to the HSMs. Also consider that changing some of the "should" with "shall" it will go against usability and manageability of the different systems and solutions, for example, the use of the "algo paper", TS 119 312.

Based on our experience with HSM devices, we do not consider it reasonable to completely eliminate the recognition of HSM certification according to FIPS, because the main HSM manufacturers (Entrust, Safenet, DocuSign, etc.) come from the USA, and if they decide for any reason not to perform certification or recertification according to ISO/IEC15408 and EUCC, their QTSP users will be forced to replace all relevant…

We have two comments: 1st: (8) 6.3.10 Certificate Status Services In our opinion, there will be an enormous increase the size of the CRL which will result in a higher load on the systems on the TSP side and also an increase in the size of electronically signed documents where the CRL will be stored for verification purposes.

There are 2 observations to the Annex: =====Observation 1=========== COMMISSION IMPLEMENTING REGULATION (EU) .../... laying down rules for the application of Regulation (EU) No 910/2014 of the European Parliament and of the Council as regards reference standards for qualified certificates for electronic signatures and qualified certificates for electronic seals (thus the "general" Implementing Act) As well as in the…