Kirjavahetus
| Dokumendiregister | Riigi Infosüsteemi Amet |
| Viit | 1.1-21/2676 |
| Registreeritud | 13.01.2026 |
| Sünkroonitud | 14.01.2026 |
| Liik | Väljaminev kiri |
| Funktsioon | 1.1 Asutuse tegevuse korraldamine |
| Sari | 1.1-21 Õigusalane kirjavahetus ja muu dokumentatsioon |
| Toimik | 1.1-21/2025 |
| Juurdepääsupiirang | Avalik |
| Juurdepääsupiirang | |
| Adressaat | IDVIA |
| Saabumis/saatmisviis | IDVIA |
| Vastutaja | Järelevalveosakond |
| Originaal | Ava uues aknas |
Failid
From: Tais Vakrõõm
Sent: Tue, 13 Jan 2026 19:01:17 +0000
To: Cristina Vega | IDVIA <[email protected]>; Erika Adams <[email protected]>
Subject: RE: Inquiry - eIDAS Qualified Preservation Service
Dear Cristina
Thank you for your question.
At this stage, we would like to clarify that we cannot accept a CAB report that relies on or references conformity evidence and assessments performed for another company, even if the implementation is described as identical.
For our purposes, the conformity assessment must be conducted specifically for the Estonian entity, based on evidence that has been independently reviewed and assessed for that entity alone, with full responsibility resting on the CAB for that specific assessment.
We therefore require a standalone report that is prepared explicitly for the Estonian entity and does not depend on assessments carried out for other organizations.
Thank you for your understanding, and please let us know if you need any further clarification.
With kind regards
Tais Vakrõõm
+372 58058709
From: Cristina Vega | IDVIA <[email protected]>
Sent: Monday, January 12, 2026 6:50 PM
To: Tais Vakrõõm <[email protected]>; Erika Adams <[email protected]>
Subject: Re: Inquiry - eIDAS Qualified Preservation Service
You don't often get email from [email protected]. Learn why this is important |
E-kiri saadeti väljastpoolt RIA-t. Kui Sa ei tunne saatjat, siis ära ava linke ega manuseid!
Dear Tais,
Thank you very much for the clarification and for sharing the link to the application materials.
We confirm our understanding of the following points:
- * The application will be handled as an initial application for the Estonian legal entity, with a decision period of up to 80 days as per the legislation.
- * The Conformity Assessment Report must be fully addressed to the Estonian entity.
- * RIA will participate in the CAB audit procedures as observers, and we will notify you in advance once the audit schedule is confirmed.
We are currently finalising the incorporation timeline and collecting proposals from EU-listed CABs. Once the CAB is confirmed and audit dates are agreed, we will inform you accordingly and proceed with preparation of the submission via the process outlined on the Eesti.ee portal.
To ensure we align everything correctly from the outset, we would appreciate confirmation of one practical point:
- * Is it acceptable for the CAB report to reference existing conformity evidence and assessments from the Spanish qualified entity where the implementation is identical, provided that conclusions and responsibility are clearly attributed to the Estonian entity?
This will help us ensure the CAB structures the report in a way that meets RIA’s expectations without unnecessary rework.
Thank you again for your guidance and support. We will revert once the next milestones (entity registration and CAB confirmation) are in place.
Best,
| Cristina Vega
|
This message and any attached files are confidential. They are for the intended recipients only. If an error has misdirected this e-mail to you, please, notify the author and do not use, disclose, distribute, copy, print or relay this e-mail. IDVIA. does not accept legal responsibility for the contents of this message. Any views or opinions presented are solely those of the author and do not necessarily represent those of the firm unless otherwise specifically stated. |
From: Tais Vakrõõm <[email protected]>
Date: Monday, 12 January 2026 at 16:30
To: Cristina Vega | IDVIA <[email protected]>, Erika Adams <[email protected]>
Subject: RE: Inquiry - eIDAS Qualified Preservation Service
EXTERNAL SENDER: |
Dear Cristina
All the information regarding the application together with the application form is available here: https://www.eesti.ee/eraisik/en/artikkel/licences-and-notices-of-economic-activity/usaldusteenused/trust-service-providers-operating-licence
Please let us know in case you will have any additional questions.
As a new Estonian legal entity will be created then also the whole CAB report should be addressed at this particular entity. Please let us know beforehand when the audit procedures will take place, we will also participate as viewers.
Also, please note that this will be handled as an initial application and most probably take the amount of days specified in the legislation (up to 80 days).
With kind regards
Tais Vakrõõm
Leading expert
+372 58058709
Information System Authority
Cyber Security Centre NCSC-EE
Department of Supervision
Pärnu mnt 139a Tallinn 15169
From: Cristina Vega | IDVIA <[email protected]>
Sent: Friday, January 9, 2026 1:52 PM
To: Erika Adams <[email protected]>
Cc: Tais Vakrõõm <[email protected]>; Riigi Infosüsteemi Amet <[email protected]>
Subject: Re: Inquiry - eIDAS Qualified Preservation Service
Some people who received this message don't often get email from [email protected]. Learn why this is important |
E-kiri saadeti väljastpoolt RIA-t. Kui Sa ei tunne saatjat, siis ära ava linke ega manuseid!
Dear Erika,
Thank you very much for the detailed guidance and links, this is extremely helpful.
We understand that qualified trust services are cross-border in nature and that our existing qualified status in Spain is valid throughout the EU. However, our intention is to establish a new legal entity in Estonia and obtain QTSP status under Estonian supervision, with the service entered on the Estonian Trusted List.
Following your guidance, we have now shortlisted and contacted several EU-listed Conformity Assessment Bodies. To support our planning, could you please clarify two points:
- 1. Is there a specific application form, checklist, or template pack that you recommend we use to ensure the submission is complete and can be processed without interruptions? If so, please could you share the latest version or point us to where it can be downloaded.
- 2. Since the service is already qualified and operational under TrustCloud in Spain (and will be replicated under the Estonian entity with governance and legal responsibility updates), does RIA typically accept a conformity assessment that reuses existing technical evidence where identical, with the CAB focusing on the Estonian entity’s governance and operational controls?
Additionally, for timeline expectations: should this be treated as an initial licence (80-day decision window) in all cases, or can there be any streamlined approach in scenarios where the service is already qualified in another Member State?
Thank you again for your support. Once we have confirmed the CAB and incorporation timeline, we will prepare the submission.
Best,
| Cristina Vega
|
This message and any attached files are confidential. They are for the intended recipients only. If an error has misdirected this e-mail to you, please, notify the author and do not use, disclose, distribute, copy, print or relay this e-mail. IDVIA. does not accept legal responsibility for the contents of this message. Any views or opinions presented are solely those of the author and do not necessarily represent those of the firm unless otherwise specifically stated. |
From: Erika Adams <[email protected]>
Date: Tuesday, 6 January 2026 at 10:27
To: Cristina Vega | IDVIA <[email protected]>
Cc: Tais Vakrõõm <[email protected]>, Riigi Infosüsteemi Amet <[email protected]>
Subject: RE: Inquiry - eIDAS Qualified Preservation Service
EXTERNAL SENDER: |
Dear Cristina
Thank you for your inquiry and for your interest in providing qualified trust services in Estonia. Below we provide an initial overview of the process for applying for QTSP status and the related supervisory requirements in Estonia.
Please note that if you wish to provide the same QTSP service in Estonia while remaining registered on the Spanish Trusted List and under the supervision of the Spanish competent authority, it is not necessary to register the service on the Estonian Trusted List or to come under Estonian supervision. The provision of qualified trust services is cross-border in nature. It is sufficient for a qualified trust service to be registered and supervised by the competent authority of one EU Member State and included in that Member State’s Trusted List. The qualified status of the service is valid throughout the European Union.
If you nevertheless wish to obtain an operating authorisation in Estonia and be placed under Estonian supervision, the provision of qualified trust services would require the establishment of a legal entity in Estonia and an application for QTSP status submitted in accordance with Estonian and EU requirements.
Complience with the following legislation is required:
1. REGULATION (EU) No 910/2014 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL (eIDAS);
2. Electronic Identification and Trust Services for Electronic Transactions Act, is available here https://www.riigiteataja.ee/en/eli/ee/527102016001/consolide/current
3. General Part of the Economic Activities Code Act, https://www.riigiteataja.ee/en/eli/515042021004/consolide
4. Commercial Code is available here https://www.riigiteataja.ee/en/eli/ee/511012021004/consolide/curren
5. Commission implementing regulation (EU) 2025/1946 (service-based), https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32025R1946
6. Submission of the completed and signed application, together with the required data and documentation to the Information System Authority at [email protected].
Conformity assessment must follow the Estonian regulation „Trust service provider and trust service conformity assessment procedure available at https://www.riigiteataja.ee/akt/128102016017 (in Estonian) .
Please note that there currently no Conformity Assessment Bodies (CABs) established in Estonia that are competent to issue eIDAS- compliant certificates. Estonian QTSPs and their services are assessed by CABs from ohter EU Member States abroad. Accepted CABs are listed in the EU list of CABs https://eidas.ec.europa.eu/efda/browse/notification/cab-nab .
Only compliance of a specific trust service with the applicable ETSI standards and Commission Implementing Regulations are accepted. To provide a qualified trust service, both the service provider and the trust service must have a qualified status in accordance with Article 21 (2) of Regulation (EU) No. 910/2014 of the European Parliament and of the Council, as evidenced by the Estonian Information System Authority.
The information System Authority decides on an application after receipt of all required data and documents:
1. within 80 days in case of an application for an initial trust service licence;
2. within 50 days in case of an application for a repeated trust service licence.
Qualified trust service providers and trust services are entered in the Trusted List for two years.
State fees related to operations in the Estonian Trusted List:
- * review of an application for an initial trust service licence and inclusion in the Trusted List: EUR 1,030 per trust service;
- * review of an application for a renewed trust service licence and inclusion in the Trusted List: EUR 770 per trust service;
- * review of an application for modification of trust service provider or service data: EUR 65;
More detailed information on obtaining a trust service provider operating licence is available at https://www.eesti.ee/eraisik/en/artikkel/licences-and-notices-of-economic-activity/usaldusteenused/trust-service-providers-operating-licence
If you have any further questions, please do not hesitate to contact us.
Best regards
Erika Adams
Chief Expert of Cyber Security Centre
and Trust Services
Estonian Information System Authority
Pärnu mnt 139a Tallinn 15169
From: Cristina Vega | IDVIA <[email protected]>
Sent: Friday, December 19, 2025 6:24 PM
To: Riigi Infosüsteemi Amet <[email protected]>
Subject: Inquiry - eIDAS Qualified Preservation Service
You don't often get email from [email protected]. Learn why this is important |
E-kiri saadeti väljastpoolt RIA-t. Kui Sa ei tunne saatjat, siis ära ava linke ega manuseid!
Dear RIA Team,
I represent IDVIA, part of the TrustCloud Group. TrustCloud is currently a Qualified Trust Service Provider listed on the EU Trusted List in Spain for the Qualified Preservation of Qualified Electronic Signatures and Qualified Electronic Seals under Regulation (EU) No. 910/2014 (eIDAS).
We are assessing the establishment of a new legal entity in Estonia to operate the same Qualified Preservation service under Estonian supervision. The service architecture, controls, and policies are already fully compliant with ETSI EN 319 401, 319 511, and 319 512, and have undergone conformity assessment in Spain.
We would appreciate guidance on:
- * The process for obtaining QTSP status in Estonia for an already qualified service
- * Any local supervisory expectations or prerequisites
- * Whether you have preferred or commonly used Conformity Assessment Bodies for eIDAS scopes
We are currently scoping timelines and would welcome any initial guidance.
Best,
| Cristina Vega
|
This message and any attached files are confidential. They are for the intended recipients only. If an error has misdirected this e-mail to you, please, notify the author and do not use, disclose, distribute, copy, print or relay this e-mail. IDVIA. does not accept legal responsibility for the contents of this message. Any views or opinions presented are solely those of the author and do not necessarily represent those of the firm unless otherwise specifically stated. |
