Kirjavahetus
| Dokumendiregister | Riigi Infosüsteemi Amet |
| Viit | 9-7/26-0014/26118 |
| Registreeritud | 19.01.2026 |
| Sünkroonitud | 20.01.2026 |
| Liik | Väljaminev kiri |
| Funktsioon | 9 Küberturvalisuse valdkonna teenuste korraldamine |
| Sari | 9-7 Usaldusteenuse osutamisega seonduv kirjavahetus ning tegevuslubade menetlemine |
| Toimik | 9-7/26-0014 |
| Juurdepääsupiirang | Avalik |
| Juurdepääsupiirang | |
| Adressaat | IDVIA |
| Saabumis/saatmisviis | IDVIA |
| Vastutaja | Järelevalveosakond |
| Originaal | Ava uues aknas |
Failid
From: Cristina Vega | IDVIA <[email protected]>
Sent: Thu, 15 Jan 2026 11:08:12 +0000
To: Tais Vakrõõm <[email protected]>; Erika Adams <[email protected]>
Subject: Re: Inquiry - eIDAS Qualified Preservation Service
Dear Tais,
Thank you for the clarification and for pointing us to the relevant regulation.
Understood. We will ensure that the selected CAB explicitly states in the Conformity Assessment Report that the service complies both with the eIDAS Regulation and with the applicable Estonian legislation, in line with the regulation you referenced.
We will align with the CAB on this requirement from the outset so that it is clearly reflected in the report.
Thank you again for your guidance. We will reach out if any further clarification is needed as we progress.
Best,
|
|
Cristina Vega
|
|
This message and any attached files are confidential. They are for the intended recipients only. If an error has misdirected this e-mail to you, please, notify the author and do not use, disclose, distribute, copy, print or relay this e-mail. IDVIA. does not accept legal responsibility for the contents of this message. Any views or opinions presented are solely those of the author and do not necessarily represent those of the firm unless otherwise specifically stated. |
From:
Tais Vakrõõm <[email protected]>
Date: Wednesday, 14 January 2026 at 16:56
To: Cristina Vega | IDVIA <[email protected]>, Erika Adams <[email protected]>
Subject: RE: Inquiry - eIDAS Qualified Preservation Service
|
EXTERNAL SENDER: |
Dear Cristina
Thank you for Your feedback!
We would just like to clarify, that the CAB report must explicitly state that the service complies with Estonian legislation as well as with the eIDAS Regulation. Please look up the respective regulation: https://www.riigiteataja.ee/akt/128102016017 (That one is available only in Estonian, but I believe that Google Translate will do its part 😊)
Please let us know if you need any additional information from our side.
With kind regards
Tais Vakrõõm
+372 58058709
From: Cristina Vega | IDVIA <[email protected]>
Sent: Wednesday, January 14, 2026 1:06 PM
To: Tais Vakrõõm <[email protected]>; Erika Adams <[email protected]>
Subject: Re: Inquiry - eIDAS Qualified Preservation Service
E-kiri saadeti väljastpoolt RIA-t. Kui Sa ei tunne saatjat, siis ära ava linke ega manuseid!
Dear Tais,
Thank you for the clarification. We understand and acknowledge RIA’s position.
We confirm that we will proceed on the basis that:
- * the conformity assessment will be conducted specifically for the Estonian legal entity, and
- * the CAB will produce a standalone Conformity Assessment Report addressed exclusively to that entity, without reliance on assessments performed for other organisations.
We will ensure that the CAB is aligned with these expectations from the outset and that full responsibility for the assessment rests with the CAB in respect of the Estonian entity.
We are currently finalising incorporation steps and CAB selection. Once the audit schedule is confirmed, we will notify you in advance so that RIA may participate as observers, as indicated.
Thank you again for the clear guidance. Should any further questions arise as we prepare the submission, we will reach out accordingly.
Best,
|
|
Cristina Vega
|
|
This message and any attached files are confidential. They are for the intended recipients only. If an error has misdirected this e-mail to you, please, notify the author and do not use, disclose, distribute, copy, print or relay this e-mail. IDVIA. does not accept legal responsibility for the contents of this message. Any views or opinions presented are solely those of the author and do not necessarily represent those of the firm unless otherwise specifically stated. |
From:
Tais Vakrõõm <[email protected]>
Date: Tuesday, 13 January 2026 at 19:01
To: Cristina Vega | IDVIA <[email protected]>, Erika Adams <[email protected]>
Subject: RE: Inquiry - eIDAS Qualified Preservation Service
|
EXTERNAL SENDER: |
Dear Cristina
Thank you for your question.
At this stage, we would like to clarify that we cannot accept a CAB report that relies on or references conformity evidence and assessments performed for another company, even if the implementation is described as identical.
For our purposes, the conformity assessment must be conducted specifically for the Estonian entity, based on evidence that has been independently reviewed and assessed for that entity alone, with full responsibility resting on the CAB for that specific assessment.
We therefore require a standalone report that is prepared explicitly for the Estonian entity and does not depend on assessments carried out for other organizations.
Thank you for your understanding, and please let us know if you need any further clarification.
With kind regards
Tais Vakrõõm
+372 58058709
From: Cristina Vega | IDVIA <[email protected]>
Sent: Monday, January 12, 2026 6:50 PM
To: Tais Vakrõõm <[email protected]>; Erika Adams <[email protected]>
Subject: Re: Inquiry - eIDAS Qualified Preservation Service
|
You don't often get email from [email protected]. Learn why this is important |
E-kiri saadeti väljastpoolt RIA-t. Kui Sa ei tunne saatjat, siis ära ava linke ega manuseid!
Dear Tais,
Thank you very much for the clarification and for sharing the link to the application materials.
We confirm our understanding of the following points:
- * The application will be handled as an initial application for the Estonian legal entity, with a decision period of up to 80 days as per the legislation.
- * The Conformity Assessment Report must be fully addressed to the Estonian entity.
- * RIA will participate in the CAB audit procedures as observers, and we will notify you in advance once the audit schedule is confirmed.
We are currently finalising the incorporation timeline and collecting proposals from EU-listed CABs. Once the CAB is confirmed and audit dates are agreed, we will inform you accordingly and proceed with preparation of the submission via the process outlined on the Eesti.ee portal.
To ensure we align everything correctly from the outset, we would appreciate confirmation of one practical point:
- * Is it acceptable for the CAB report to reference existing conformity evidence and assessments from the Spanish qualified entity where the implementation is identical, provided that conclusions and responsibility are clearly attributed to the Estonian entity?
This will help us ensure the CAB structures the report in a way that meets RIA’s expectations without unnecessary rework.
Thank you again for your guidance and support. We will revert once the next milestones (entity registration and CAB confirmation) are in place.
Best,
|
|
Cristina Vega
|
|
This message and any attached files are confidential. They are for the intended recipients only. If an error has misdirected this e-mail to you, please, notify the author and do not use, disclose, distribute, copy, print or relay this e-mail. IDVIA. does not accept legal responsibility for the contents of this message. Any views or opinions presented are solely those of the author and do not necessarily represent those of the firm unless otherwise specifically stated. |
From:
Tais Vakrõõm <[email protected]>
Date: Monday, 12 January 2026 at 16:30
To: Cristina Vega | IDVIA <[email protected]>, Erika Adams <[email protected]>
Subject: RE: Inquiry - eIDAS Qualified Preservation Service
|
EXTERNAL SENDER: |
Dear Cristina
All the information regarding the application together with the application form is available here: https://www.eesti.ee/eraisik/en/artikkel/licences-and-notices-of-economic-activity/usaldusteenused/trust-service-providers-operating-licence
Please let us know in case you will have any additional questions.
As a new Estonian legal entity will be created then also the whole CAB report should be addressed at this particular entity. Please let us know beforehand when the audit procedures will take place, we will also participate as viewers.
Also, please note that this will be handled as an initial application and most probably take the amount of days specified in the legislation (up to 80 days).
With kind regards
Tais Vakrõõm
Leading expert
+372 58058709
Information System Authority
Cyber Security Centre NCSC-EE
Department of Supervision
Pärnu mnt 139a Tallinn 15169
From: Cristina Vega | IDVIA <[email protected]>
Sent: Friday, January 9, 2026 1:52 PM
To: Erika Adams <[email protected]>
Cc: Tais Vakrõõm <[email protected]>; Riigi Infosüsteemi Amet <[email protected]>
Subject: Re: Inquiry - eIDAS Qualified Preservation Service
|
Some people who received this message don't often get email from [email protected]. Learn why this is important |
E-kiri saadeti väljastpoolt RIA-t. Kui Sa ei tunne saatjat, siis ära ava linke ega manuseid!
Dear Erika,
Thank you very much for the detailed guidance and links, this is extremely helpful.
We understand that qualified trust services are cross-border in nature and that our existing qualified status in Spain is valid throughout the EU. However, our intention is to establish a new legal entity in Estonia and obtain QTSP status under Estonian supervision, with the service entered on the Estonian Trusted List.
Following your guidance, we have now shortlisted and contacted several EU-listed Conformity Assessment Bodies. To support our planning, could you please clarify two points:
- 1. Is there a specific application form, checklist, or template pack that you recommend we use to ensure the submission is complete and can be processed without interruptions? If so, please could you share the latest version or point us to where it can be downloaded.
- 1. Since the service is already qualified and operational under TrustCloud in Spain (and will be replicated under the Estonian entity with governance and legal responsibility updates), does RIA typically accept a conformity assessment that reuses existing technical evidence where identical, with the CAB focusing on the Estonian entity’s governance and operational controls?
Additionally, for timeline expectations: should this be treated as an initial licence (80-day decision window) in all cases, or can there be any streamlined approach in scenarios where the service is already qualified in another Member State?
Thank you again for your support. Once we have confirmed the CAB and incorporation timeline, we will prepare the submission.
Best,
|
|
Cristina Vega
|
|
This message and any attached files are confidential. They are for the intended recipients only. If an error has misdirected this e-mail to you, please, notify the author and do not use, disclose, distribute, copy, print or relay this e-mail. IDVIA. does not accept legal responsibility for the contents of this message. Any views or opinions presented are solely those of the author and do not necessarily represent those of the firm unless otherwise specifically stated. |
From:
Erika Adams <[email protected]>
Date: Tuesday, 6 January 2026 at 10:27
To: Cristina Vega | IDVIA <[email protected]>
Cc: Tais Vakrõõm <[email protected]>, Riigi Infosüsteemi Amet <[email protected]>
Subject: RE: Inquiry - eIDAS Qualified Preservation Service
|
EXTERNAL SENDER: |
Dear Cristina
Thank you for your inquiry and for your interest in providing qualified trust services in Estonia. Below we provide an initial overview of the process for applying for QTSP status and the related supervisory requirements in Estonia.
Please note that if you wish to provide the same QTSP service in Estonia while remaining registered on the Spanish Trusted List and under the supervision of the Spanish competent authority, it is not necessary to register the service on the Estonian Trusted List or to come under Estonian supervision. The provision of qualified trust services is cross-border in nature. It is sufficient for a qualified trust service to be registered and supervised by the competent authority of one EU Member State and included in that Member State’s Trusted List. The qualified status of the service is valid throughout the European Union.
If you nevertheless wish to obtain an operating authorisation in Estonia and be placed under Estonian supervision, the provision of qualified trust services would require the establishment of a legal entity in Estonia and an application for QTSP status submitted in accordance with Estonian and EU requirements.
Complience with the following legislation is required:
1. REGULATION (EU) No 910/2014 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL (eIDAS);
2. Electronic Identification and Trust Services for Electronic Transactions Act, is available here https://www.riigiteataja.ee/en/eli/ee/527102016001/consolide/current
3. General Part of the Economic Activities Code Act, https://www.riigiteataja.ee/en/eli/515042021004/consolide
4. Commercial Code is available here https://www.riigiteataja.ee/en/eli/ee/511012021004/consolide/curren
5. Commission implementing regulation (EU) 2025/1946 (service-based), https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32025R1946
6. Submission of the completed and signed application, together with the required data and documentation to the Information System Authority at [email protected].
Conformity assessment must follow the Estonian regulation „Trust service provider and trust service conformity assessment procedure available at https://www.riigiteataja.ee/akt/128102016017 (in Estonian) .
Please note that there currently no Conformity Assessment Bodies (CABs) established in Estonia that are competent to issue eIDAS- compliant certificates. Estonian QTSPs and their services are assessed by CABs from ohter EU Member States abroad. Accepted CABs are listed in the EU list of CABs https://eidas.ec.europa.eu/efda/browse/notification/cab-nab .
Only compliance of a specific trust service with the applicable ETSI standards and Commission Implementing Regulations are accepted. To provide a qualified trust service, both the service provider and the trust service must have a qualified status in accordance with Article 21 (2) of Regulation (EU) No. 910/2014 of the European Parliament and of the Council, as evidenced by the Estonian Information System Authority.
The information System Authority decides on an application after receipt of all required data and documents:
1. within 80 days in case of an application for an initial trust service licence;
2. within 50 days in case of an application for a repeated trust service licence.
Qualified trust service providers and trust services are entered in the Trusted List for two years.
State fees related to operations in the Estonian Trusted List:
- * review of an application for an initial trust service licence and inclusion in the Trusted List: EUR 1,030 per trust service;
- * review of an application for a renewed trust service licence and inclusion in the Trusted List: EUR 770 per trust service;
- * review of an application for modification of trust service provider or service data: EUR 65;
More detailed information on obtaining a trust service provider operating licence is available at https://www.eesti.ee/eraisik/en/artikkel/licences-and-notices-of-economic-activity/usaldusteenused/trust-service-providers-operating-licence
If you have any further questions, please do not hesitate to contact us.
Best regards
Erika Adams
Chief Expert of Cyber Security Centre
and Trust Services
Estonian Information System Authority
Pärnu mnt 139a Tallinn 15169
From: Cristina Vega | IDVIA <[email protected]>
Sent: Friday, December 19, 2025 6:24 PM
To: Riigi Infosüsteemi Amet <[email protected]>
Subject: Inquiry - eIDAS Qualified Preservation Service
|
You don't often get email from [email protected]. Learn why this is important |
E-kiri saadeti väljastpoolt RIA-t. Kui Sa ei tunne saatjat, siis ära ava linke ega manuseid!
Dear RIA Team,
I represent IDVIA, part of the TrustCloud Group. TrustCloud is currently a Qualified Trust Service Provider listed on the EU Trusted List in Spain for the Qualified Preservation of Qualified Electronic Signatures and Qualified Electronic Seals under Regulation (EU) No. 910/2014 (eIDAS).
We are assessing the establishment of a new legal entity in Estonia to operate the same Qualified Preservation service under Estonian supervision. The service architecture, controls, and policies are already fully compliant with ETSI EN 319 401, 319 511, and 319 512, and have undergone conformity assessment in Spain.
We would appreciate guidance on:
- * The process for obtaining QTSP status in Estonia for an already qualified service
- * Any local supervisory expectations or prerequisites
- * Whether you have preferred or commonly used Conformity Assessment Bodies for eIDAS scopes
We are currently scoping timelines and would welcome any initial guidance.
Best,
|
|
Cristina Vega
|
|
This message and any attached files are confidential. They are for the intended recipients only. If an error has misdirected this e-mail to you, please, notify the author and do not use, disclose, distribute, copy, print or relay this e-mail. IDVIA. does not accept legal responsibility for the contents of this message. Any views or opinions presented are solely those of the author and do not necessarily represent those of the firm unless otherwise specifically stated. |
