eIDAS (EU Regulation on electronic identification and trust services)

eIDAS is Regulation (EU) No 910/2014 on electronic identification and trust services for electronic transactions in the internal market. It does two things: it lets EU member states recognise each other's notified national electronic identification schemes, and it creates a legal framework for trust services, including electronic signatures, electronic seals, electronic timestamps, electronic registered delivery and website authentication. A trust service is "qualified" when provided by a supervised Qualified Trust Service Provider (QTSP) listed on an EU Trusted List; most of these services are built on PKI. Regulation (EU) 2024/1183, often called eIDAS 2.0, amends the original regulation and introduces the European Digital Identity Wallet.

Why it matters

Qualified services carry defined legal effects across the EU; for example, a qualified electronic signature, a particular kind of digital signature created on a certified device, has the equivalent legal effect of a handwritten signature. For PKI practitioners, eIDAS explains certificate types met in European projects: qualified certificates for electronic signatures and seals, and QWACs for websites. These are X.509 certificates with extra statements and policies defined in ETSI standards.

Example

Qualified certificate for electronic signature    -> a natural person signs a contract
Qualified certificate for electronic seal (QSealC) -> a legal person seals an invoice
QWAC                                              -> identifies the operator of a website

Common misconceptions

• eIDAS is only about website certificates. Website authentication is one trust service among several, alongside electronic identification.
• eIDAS 2.0 replaced the 2014 regulation. Regulation (EU) 2024/1183 amends Regulation 910/2014 rather than repealing it.
• Any certificate from an EU CA is "qualified". Only certificates issued as qualified by a QTSP holding qualified status for that service are.