Inquiry
| Dokumendiregister | Riigi Infosüsteemi Amet |
| Viit | 1.1-21/262167 |
| Registreeritud | 09.01.2026 |
| Sünkroonitud | 12.01.2026 |
| Liik | Sissetulev kiri |
| Funktsioon | 1.1 Asutuse tegevuse korraldamine |
| Sari | 1.1-21 Õigusalane kirjavahetus ja muu dokumentatsioon |
| Toimik | 1.1-21/2025 |
| Juurdepääsupiirang | Avalik |
| Juurdepääsupiirang | |
| Adressaat | IDVIA |
| Saabumis/saatmisviis | IDVIA |
| Vastutaja | Järelevalveosakond |
| Originaal | Ava uues aknas |
Failid
|
Some people who received this message don't often get email from [email protected].
Learn why this is important
|
Dear Erika,
Thank you very much for the detailed guidance and links, this is extremely helpful.
We understand that qualified trust services are cross-border in nature and that our existing qualified status in Spain is valid throughout the EU. However, our intention is to establish a new legal entity in Estonia and obtain QTSP status under Estonian supervision, with the service entered on the Estonian Trusted List.
Following your guidance, we have now shortlisted and contacted several EU-listed Conformity Assessment Bodies. To support our planning, could you please clarify two points:
- Is there a specific application form, checklist, or template pack that you recommend we use to ensure the submission is complete and can be processed without interruptions? If so, please could you share the latest version or point us to where it can be downloaded.
- Since the service is already qualified and operational under TrustCloud in Spain (and will be replicated under the Estonian entity with governance and legal responsibility updates), does RIA typically accept a conformity assessment that reuses existing technical evidence where identical, with the CAB focusing on the Estonian entity’s governance and operational controls?
Additionally, for timeline expectations: should this be treated as an initial licence (80-day decision window) in all cases, or can there be any streamlined approach in scenarios where the service is already qualified in another Member State?
Thank you again for your support. Once we have confirmed the CAB and incorporation timeline, we will prepare the submission.
Best,
|
|
Cristina Vega
|
|
This message and any attached files are confidential. They are for the intended recipients only. If an error has misdirected this e-mail to you, please, notify the author and do not use, disclose, distribute, copy, print or relay this e-mail. IDVIA. does not accept legal responsibility for the contents of this message. Any views or opinions presented are solely those of the author and do not necessarily represent those of the firm unless otherwise specifically stated. |
From:
Erika Adams <[email protected]>
Date: Tuesday, 6 January 2026 at 10:27
To: Cristina Vega | IDVIA <[email protected]>
Cc: Tais Vakrõõm <[email protected]>, Riigi Infosüsteemi Amet <[email protected]>
Subject: RE: Inquiry - eIDAS Qualified Preservation Service
|
EXTERNAL SENDER: |
Dear Cristina
Thank you for your inquiry and for your interest in providing qualified trust services in Estonia. Below we provide an initial overview of the process for applying for QTSP status and the related supervisory requirements in Estonia.
Please note that if you wish to provide the same QTSP service in Estonia while remaining registered on the Spanish Trusted List and under the supervision of the Spanish competent authority, it is not necessary to register the service on the Estonian Trusted List or to come under Estonian supervision. The provision of qualified trust services is cross-border in nature. It is sufficient for a qualified trust service to be registered and supervised by the competent authority of one EU Member State and included in that Member State’s Trusted List. The qualified status of the service is valid throughout the European Union.
If you nevertheless wish to obtain an operating authorisation in Estonia and be placed under Estonian supervision, the provision of qualified trust services would require the establishment of a legal entity in Estonia and an application for QTSP status submitted in accordance with Estonian and EU requirements.
Complience with the following legislation is required:
1. REGULATION (EU) No 910/2014 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL (eIDAS);
2. Electronic Identification and Trust Services for Electronic Transactions Act, is available here https://www.riigiteataja.ee/en/eli/ee/527102016001/consolide/current
3. General Part of the Economic Activities Code Act, https://www.riigiteataja.ee/en/eli/515042021004/consolide
4. Commercial Code is available here https://www.riigiteataja.ee/en/eli/ee/511012021004/consolide/curren
5. Commission implementing regulation (EU) 2025/1946 (service-based), https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32025R1946
6. Submission of the completed and signed application, together with the required data and documentation to the Information System Authority at [email protected].
Conformity assessment must follow the Estonian regulation „Trust service provider and trust service conformity assessment procedure available at https://www.riigiteataja.ee/akt/128102016017 (in Estonian) .
Please note that there currently no Conformity Assessment Bodies (CABs) established in Estonia that are competent to issue eIDAS- compliant certificates. Estonian QTSPs and their services are assessed by CABs from ohter EU Member States abroad. Accepted CABs are listed in the EU list of CABs https://eidas.ec.europa.eu/efda/browse/notification/cab-nab .
Only compliance of a specific trust service with the applicable ETSI standards and Commission Implementing Regulations are accepted. To provide a qualified trust service, both the service provider and the trust service must have a qualified status in accordance with Article 21 (2) of Regulation (EU) No. 910/2014 of the European Parliament and of the Council, as evidenced by the Estonian Information System Authority.
The information System Authority decides on an application after receipt of all required data and documents:
1. within 80 days in case of an application for an initial trust service licence;
2. within 50 days in case of an application for a repeated trust service licence.
Qualified trust service providers and trust services are entered in the Trusted List for two years.
State fees related to operations in the Estonian Trusted List:
- review of an application for an initial trust service licence and inclusion in the Trusted List: EUR 1,030 per trust service;
- review of an application for a renewed trust service licence and inclusion in the Trusted List: EUR 770 per trust service;
- review of an application for modification of trust service provider or service data: EUR 65;
More detailed information on obtaining a trust service provider operating licence is available at https://www.eesti.ee/eraisik/en/artikkel/licences-and-notices-of-economic-activity/usaldusteenused/trust-service-providers-operating-licence
If you have any further questions, please do not hesitate to contact us.
Best regards
Erika Adams
Chief Expert of Cyber Security Centre
and Trust Services
Estonian Information System Authority
Pärnu mnt 139a Tallinn 15169
From: Cristina Vega | IDVIA <[email protected]>
Sent: Friday, December 19, 2025 6:24 PM
To: Riigi Infosüsteemi Amet <[email protected]>
Subject: Inquiry - eIDAS Qualified Preservation Service
|
You don't often get email from [email protected]. Learn why this is important |
E-kiri saadeti väljastpoolt RIA-t. Kui Sa ei tunne saatjat, siis ära ava linke ega manuseid!
Dear RIA Team,
I represent IDVIA, part of the TrustCloud Group. TrustCloud is currently a Qualified Trust Service Provider listed on the EU Trusted List in Spain for the Qualified Preservation of Qualified Electronic Signatures and Qualified Electronic Seals under Regulation (EU) No. 910/2014 (eIDAS).
We are assessing the establishment of a new legal entity in Estonia to operate the same Qualified Preservation service under Estonian supervision. The service architecture, controls, and policies are already fully compliant with ETSI EN 319 401, 319 511, and 319 512, and have undergone conformity assessment in Spain.
We would appreciate guidance on:
- The process for obtaining QTSP status in Estonia for an already qualified service
- Any local supervisory expectations or prerequisites
- Whether you have preferred or commonly used Conformity Assessment Bodies for eIDAS scopes
We are currently scoping timelines and would welcome any initial guidance.
Best,
|
|
Cristina Vega
|
|
This message and any attached files are confidential. They are for the intended recipients only. If an error has misdirected this e-mail to you, please, notify the author and do not use, disclose, distribute, copy, print or relay this e-mail. IDVIA. does not accept legal responsibility for the contents of this message. Any views or opinions presented are solely those of the author and do not necessarily represent those of the firm unless otherwise specifically stated. |
Seosed
| Nimi | K.p. | Δ | Viit | Tüüp | Org | Osapooled |
|---|---|---|---|---|---|---|
| Järelepärimine | 06.01.2026 | 1 | 1.1-21/262167 | Väljaminev kiri | ria | IDVIA |