A QTSP is a central building block for trustworthy digital processes in Europe. Anyone who wants to use digital signatures, organizational seals, certificate data, time evidence, or other documents in a legally secure manner will eventually come across this term. This is particularly relevant for companies, authorities, and digital platforms when transactions need to be not only efficient but also legally robust and eIDAS-compliant.
The abbreviation QTSP stands for Qualified Trust Service Provider. Such a provider offers regulated trust services under the European eIDAS Regulation. These include, among others, qualified electronic signatures (QES), digital organizational seals, and authority seals, timestamps, or preservation services.
Importantly, a QTSP is not just any provider of digital signatures. It is a regulated trust service provider that must meet special requirements for security, processes, evidence, certificates, and supervision.
A Qualified Trust Service Provider is a trust service provider that has received qualified status from a competent supervisory authority in an EU member state. This status is documented in the European Trust List, known as the EU Trusted List.
A QTSP can offer various qualified services, for example:
– Qualified electronic signatures, or QES
– Qualified electronic seals, or qSeal
– Qualified electronic timestamps
– Qualified certificates for signatures or seals
– Qualified preservation services for electronic signatures and seals
– Services for validating qualified signatures or seals
If a QTSP offers the issuance of qualified certificates for electronic signatures or seals, it assumes the function of a qualified certification authority. However, not every QTSP issues certificates: Depending on the qualified status, it may also offer other trust services such as timestamps, validation, or preservation services.
For companies, this means: When a process requires a high level of trust, such as for contracts, applications, approvals, powers of attorney, or official documents, a QTSP can provide the necessary trust infrastructure.
TSP vs. QTSP: What’s the Difference?
A Trust Service Provider (TSP) can offer electronic trust services. However, this does not necessarily mean that these services are qualified.
The difference lies in the regulatory status:
TSP = Provider of trust services, but not necessarily qualified
QTSP = Qualified trust service provider with approval, auditing, and entry in the EU Trust List
A QTSP must meet stricter requirements. These include verified security concepts, robust identification processes, technical protective measures, documented processes, and regular audits by a conformity assessment body. This is precisely why qualified services have a special legal effect and a higher level of trust.
What Makes a Trust Service Provider “Qualified”?
A provider does not become a QTSP by self-designation. The qualified status is achieved only through a formal procedure under eIDAS.
This includes in particular:
– Proof of appropriate technical and organizational security measures
– Compliance with the requirements of the eIDAS Regulation
– Supervision by the competent supervisory authority
– Entry of the service in the national Trust List
– Publication in the EU Trusted List
Importantly, not always is the entire provider qualified. Often, only certain services are qualified. A company should therefore not only check whether a provider presents itself as a QTSP but also which specific service is listed as qualified in the Trust List.
Even a qualified preservation service does not obtain its status solely through the provider’s designation. The specific service must meet the requirements of the eIDAS Regulation, be audited, and be listed as qualified in the Trust List.
What is a Qualified Electronic Signature?
The Qualified Electronic Signature is the highest form of electronic signature under eIDAS. It is based on a qualified certificate and is created using a qualified signature creation device.
In practice, this means: The identity of the signatory has been reliably established, the certificate comes from a QTSP, and the signature process meets high security requirements.
A QES generally has the same legal effect as a handwritten signature in the EU. This makes it particularly relevant for documents and transactions where high binding force, traceability, and legal security are required.
Typical areas of application include:
– Contracts requiring written form
– Employment and financial documents
– Administrative procedures
– Approvals and applications
– Regulated business processes
– Cross-border digital transactions
Why Do Companies Need Qualified Electronic Signatures?
Many digital processes fail not due to technology but due to a lack of trust. Who signed? Was the document unchanged? Is the signature valid? Can the signing be proven later? These questions are particularly relevant in legal disputes, as reliable documentation can facilitate evidence and play an important role regarding the burden of proof.
Qualified electronic signatures help companies answer these questions reliably. The main advantages are:
– High legal recognition in the EU
– Strong identity verification of the signatory
– Better traceability in case of disputes
– Support for compliance and audit requirements
– Seamless digital processes
– Cross-border use within the EU
For documents that need to remain legally secure for many years, a qualified preservation service can additionally be used. This helps maintain the validity of electronic signatures and seals as well as the associated certificates, timestamps, and validation information over the long term. This can be particularly relevant in later disputes, evidence, and questions regarding the burden of proof.
Especially legal, compliance, IT, and specialist departments benefit when digital signatures do not need to be individually assessed legally each time but are based on an established eIDAS trust framework.
Why eIDAS Compliance Should Be Verified
Not every electronic signature is automatically a QES. And not every signature service meets qualified requirements. Therefore, companies should systematically verify the eIDAS compliance of an electronic signature.
This involves, among other things, the following questions:
– Is the certificate qualified?
– Was it issued by a QTSP?
– Is the service listed in the EU Trust List?
– Was the certificate valid at the time of signing?
– Has the document remained unchanged since signing?
– Are valid timestamps or validation information available?
For verification, validation services, signature verification software, or qualified validation services can be used. It is crucial not only to look at the visible signature image in the document. The cryptographic evidence and the trust chain to the QTSP are decisive. However, for documents that need to be preserved long-term, a one-time check is often not sufficient. A qualified preservation service can help maintain the validity of electronic signatures and seals over longer periods.
QTSP Selection: What Companies Should Consider
Choosing a QTSP is not just a purchasing decision. It affects security, compliance, process design, and long-term scalability.
Important decision criteria include:
– Entry in the EU Trusted List: Is the specific service qualified?
– Service scope: Signatures, seals, timestamps, certificates?
– Country coverage: Which EU member states and languages are supported?
– Identification procedures: What methods are available for signatories?
– Integration: Are there APIs, interfaces, and support for existing systems?
– Operational security: How robust are availability, support, and security processes?
– EUDI Wallet readiness: Is the provider prepared for new identity and wallet requirements?
– Preservation service: Do electronic records need to remain valid and verifiable over many years?
QTSP examples are not found in any random provider overview but are bindingly listed in the EU Trust List. Even service providers or platforms in the signature market, such as Scrive or other providers, may work with or integrate qualified trust services. However, the specific qualified service and its status in the official list always remain decisive.
Can QTSPs Operate Internationally?
Yes, QTSPs can generally offer their qualified services to customers in other EU member states. Within European countries, the eIDAS legal framework applies across borders. A company in Germany can therefore generally use the services of a QTSP from another member state, provided the relevant service is qualified and listed in the EU Trusted List.
Outside the EU, the situation is more nuanced. A QTSP can technically and organizationally operate internationally. However, the legal effect of qualified trust services arises from the European eIDAS framework. For third countries, local laws, recognition mechanisms, and contractual arrangements apply.
eIDAS, eIDAS 2.0, and the EUDI Wallet
The eIDAS Regulation creates the European legal framework for electronic identification and trust services. With eIDAS 2.0, this framework gains further importance, particularly through the European Digital Identity Wallet, or EUDI Wallet.
The EUDI Wallet aims to enable citizens and businesses to securely use digital identity data and credentials. For organizations, this means: Digital identities, signatures, seals, attributes, and trustworthy credentials will be more strongly interconnected.
New requirements may particularly arise in:
– Acceptance of digital identity credentials
– Integration of wallet-based processes
– Verification of electronic attributes and credentials
– Use of qualified signatures and seals
– Adaptation of compliance and security processes
QTSPs and qualified trust services play an important role here because they secure trust, validity, and traceability in digital ecosystems.
What Happens If a QTSP Loses Its Qualified Status?
If a QTSP loses its qualified status, it may no longer offer the affected services as qualified. For companies, it is therefore important to regularly check the status and contractually regulate how to handle changes.
Signatures or seals already created do not automatically become worthless. What matters is whether they were valid at the time of signing and whether the necessary evidence, certificates, timestamps, and validation information are preserved. For long-term evidence, preservation services and robust validation data are therefore particularly relevant.
Frequently Asked Questions about QTSP and eIDAS
What is a QTSP simply explained?
A QTSP is a qualified trust service provider under eIDAS. It provides regulated services such as qualified electronic signatures, seals, certificates, or timestamps.
Can I use a QTSP from another EU member state?
Yes. Qualified trust services from one EU member state are generally recognized throughout the EU, provided the specific service is listed in the EU Trusted List.
Why does a QTSP need to be audited?
A QTSP must be audited because its services have a special legal effect. The audit ensures that security, identity, process, and compliance requirements are met.
How do I verify the validity of an electronic signature?
Validity is checked via signature verification software, validation services, and the trust chain to the certificate. Important factors include certificate status, time of signature, document integrity, and the QTSP’s entry in the Trust List.
What is the advantage of a QES over a simple signature?
It offers the highest level of trust under eIDAS and is largely legally equivalent to a handwritten signature. It provides more security, traceability, and acceptance in regulated processes.
When is a qualified preservation service useful?
A qualified preservation service is particularly useful when electronic signatures or seals need to remain verifiable and legally robust for many years. It helps maintain the necessary certificates, timestamps, and validation information over the long term.
Conclusion: QTSPs are Trust Anchors for Digital Processes
A QTSP is much more than just a technical signature provider. It is a regulated trust anchor for digital transactions, electronic signatures, seals, certificates, and evidence. For companies and authorities, this trust is becoming increasingly important – not only because of eIDAS but also in view of the EUDI Wallet, digital identities, and new European requirements. For documents and evidence that need to remain verifiable over a long period, a qualified preservation service can additionally be relevant. It helps maintain the validity of electronic signatures and seals over the long term.
Those who use qualified trust services should carefully examine the specific service, its status in the EU Trust List, its integration capability, and long-term evidence management.
SIGN8 supports organizations in implementing trust infrastructure, electronic signatures, preservation services, digital identity processes, and EUDI Wallet readiness – with a focus on security, regulatory compliance, and trustworthy digital processes.
