Gospodarska zbornica Slovenije

The Green transition is a key development priority for Europe. Thus, according to the latest guidelines, emissions are to be reduced by 90% by 2040 and climate neutrality is to be achieved by 2050 compared to 1990 levels. The fact is that the starting points for decarbonisation were set under fundamentally different circumstances than those we are witnessing today, six years later and after three crises.

On behalf of the members of the ICT Association at the Chamber of Commerce and Industry of Slovenia, we fully endorse the comment submitted by Associazione Nazionale Archivistica Italiana and express our strong support for their position (https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/14751-Qualified-electronic-archiving-services/F33069918_en)

Versions of ETSI standards and their compliance with the eIDAS Regulation The proposals for implementing acts reference ETSI standards that are relevant to individual trust services, while also amending the provisions outlined in those reference ETSI standards.

Revised Requirements for HSMs used by Trust Service Providers (TSPs) The eIDAS Regulation does not specify particular requirements for Hardware Security Modules (HSMs) that Trust Service Providers (TSPs) must use, unlike the requirements for Qualified Signature Creation Devices (QSCDs). There is no doubt that the private cryptographic keys used by TSPs are protected with the highest level of security.

Loosely defined standards for Key activation on HSMs certified under EUCC or EN 419221-5:2018 Protection profiles for Trust Service Provider cryptographic modules Part 5: Cryptographic module for Trust services Use of Private Keys Requires Authentication via HSM Mechanisms The use of private keys requires prior authentication through mechanisms provided by the Hardware Security Module (HSM).

Qualified electronic seal creation devices: When held by a legal entity that is not a TSP The eIDAS Regulation and the published draft implementing acts do not clarify the requirements for QSCD when such a device is used by a legal entity that is not a Trust Service Provider (TSP), and where the device is not operated as a remote QSCD.

EPRELs new Legal entity identifier format vs ETSI EN 319 412-1 V1.5.1 As of 22 April 2025, the EPREL (European Product Registry for Energy Labelling) requires that identifiers for legal entities be provided in a different format than the one currently defined in ETSI EN 319 412-1 V1.5.1. The basis for the new format is the Regulation L_202400994SL.000101.fmx.xml.

Versioning of standards ETSI standards should consistently include version numbers. Currently, some are versioned while others are not. In the absence of a version, the latest valid version is assumed during implementation.

Transition periods in standards implementation/Lifecycle of standards: Implementing acts enter into force 20 days after publication. Existing systems cannot adapt that quickly. Therefore, whenever a change occurs, there must be a longer transition period to allow for proper implementation.

On behalf of the members of the ICT Association at the Chamber of Commerce and Industry of Slovenia, we would like to comment on REQ-7.5-06. The provision defines security requirements only for cases where digital signature mechanisms are used, requiring certified secure cryptographic devices for private keys. However, no comparable requirements are set for other mechanisms.