European UnioneIDAS Regulation, Article 19a(1)(a): Risk-Management Measures of Non-Qualified Trust Service Providers
Regulation (EU) No 910/2014, Article 19a(1)(a)
In force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Governance
As of .
What it requires
- This duty reaches you if you declare that you are an essential or important entity under Directive (EU) 2022/2555 and you are a non-qualified trust service provider, that is, you provide a trust service within the meaning of Article 3, point (16), of Regulation (EU) No 910/2014 (for example issuing certificates for electronic signatures, seals or website authentication, creating electronic timestamps, or providing electronic registered delivery) without being a qualified trust service provider. A qualified trust service provider carries the parallel duty in Article 24(2), point fa.
- Maintain appropriate policies and take corresponding measures to manage the legal, business, operational and other direct or indirect risks to the provision of each non-qualified trust service (Article 19a(1), point (a)).
- Make those measures cover at least registration and onboarding procedures for a trust service, the procedural or administrative checks needed to provide trust services, and the management and implementation of trust services, notwithstanding Article 21 of Directive (EU) 2022/2555 (Article 19a(1), point (a)(i) to (iii)).
If you get it wrong
Private right of actionYes
Penalty structure
Article 16(2) of Regulation (EU) No 910/2014 requires Member States to set the maximum administrative fine for an infringement by a qualified or non-qualified trust service provider at no less than EUR 5,000,000 where the provider is a natural person, or, where it is a legal person, no less than EUR 5,000,000 or 1 percent of the total worldwide annual turnover of the undertaking to which it belonged in the preceding financial year, whichever is higher. The figures are the floor each Member State's own law must set as its statutory maximum, not a cap the Union applies directly. Article 16(1) leaves the other penalty rules to the Member States and is without prejudice to Article 31 of Directive (EU) 2022/2555.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 5,000,000
- Turnover percentage cap
- 1
Who enforces it
Enforcement body
The supervisory body each Member State designates under Article 46b of Regulation (EU) No 910/2014, which takes action against non-qualified trust service providers established in its territory, by means of ex post supervisory activities, when informed that they allegedly do not meet the requirements laid down in the Regulation.
What this law does
Article 19a(1), point (a), requires a non-qualified trust service provider providing non-qualified trust services to have appropriate policies and take corresponding measures to manage legal, business, operational and other direct or indirect risks to the provision of the service.
Those measures include, notwithstanding Article 21 of Directive (EU) 2022/2555, at least measures relating to registration and onboarding procedures for a trust service, the procedural or administrative checks needed to provide trust services, and the management and implementation of trust services.
Article 19a(2) provides that compliance with Article 19a is presumed where the reference standards, specifications and procedures that the Commission establishes by implementing act for point (a) are met.
Article 3, point (16), of Regulation (EU) No 910/2014 defines a trust service as an electronic service normally provided for remuneration which consists of any of the listed activities, the first being the issuance of certificates for electronic signatures, certificates for electronic seals, certificates for website authentication or certificates for the provision of other trust services.
Qualified trust service providers carry the parallel duty in Article 24(2), point (fa), of Regulation (EU) No 910/2014. Article 2(2), point (a)(ii), of Directive (EU) 2022/2555 applies that Directive to entities of a type referred to in Annex I or II, whatever their size, where their services are provided by trust service providers. Article 3(2) of that Directive treats an entity of a type referred to in Annex I or II that does not qualify as an essential entity as an important entity.
Article 13(1) gives any natural or legal person who has suffered material or non-material damage as a result of an infringement of the Regulation by a trust service provider the right to seek compensation in accordance with Union and national law. The burden of proving the intention or negligence of a non-qualified trust service provider lies with the person claiming the damage.
Article 16(2) requires Member States to subject infringements by qualified and non-qualified trust service providers to administrative fines of a maximum of at least EUR 5,000,000 for a natural person or, for a legal person, EUR 5,000,000 or 1 percent of the total worldwide annual turnover, whichever is higher. Regulation (EU) 2024/1183 enters into force on the twentieth day following its publication in the Official Journal of the European Union.
When LexLint raises it
When your app profile says your app runs an essential service.