Topic starter
11/11/2026 6:05 pm
TL;DR: 20 months is the recertification horizon Hopae cites for some QTSPs, showing how quickly eIDAS alignment can turn into a capacity problem rather than a policy one. Wallet and notified eID acceptance now need continuous operational ownership, not a one-off integration.
Editorial analysis by NHI Mgmt Group, based on content published by Hopae: “3 things slipping under QTSPsâ radar before the 2027 eIDAS deadlines”.
Key questions
Q: Why does document-based identity proofing become harder under eIDAS 2.0?
A: Document-based identity proofing becomes harder because eIDAS 2.0 pushes higher assurance, stronger fraud resistance, and better linkage between the presented document and the real person.
Q: What is the best way to govern wallet acceptance across Member States?
A: The best way is to define a common trust policy, map each Member State’s legal and technical acceptance rules, and enforce them through a central governance process.
Q: How should QTSPs plan eIDAS 2.0 recertification timelines?
A: QTSPs should plan recertification against the specific eIDAS 2.0 qualified service requirements, their conformity assessment cycle, and any national supervision timetable.
Practitioner guidance
- Define the ETSI recertification path now Map every document-based proofing flow to the current conformity baseline and identify where recertification effort will exceed the remaining deadline window.
- Assign ownership for cross-border acceptance Name a single operational owner for wallet and notified eID acceptance, including registration, monitoring, incident handling and change management across Member States.
- Reassess fallback proofing as a regulated path Treat document-based fallback identity proofing as a governed production control, with the same evidence, review and fraud assumptions as primary onboarding.
Bottom line: QTSP readiness for eIDAS 2.0 is being constrained by operational throughput, not by lack of awareness.
Glossary terms: Eudi Wallet, Article 24, Qualified Trust Service Provider, ETSI TS 119 461
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:06 pm
Operational readiness is now the governing control, not awareness of the rule change. QTSPs do not mainly fail because they missed the direction of eIDAS 2.0. They fail because recertification, integration and ownership work take longer than the remaining runway. That makes capacity planning part of trust-service governance, not a back-office concern.
A question worth separating out:
Q: When should teams build versus partner for trust-service acceptance?
A: Teams should build when trust-service acceptance is a core differentiator or requires deep integration with their own workflows, control model, or risk rules. They should partner when the capability is standard, heavily regulated, or faster to obtain through an established trust-service provider, while keeping clear accountability for assurance and revocation handling.
👉 Read our full editorial: QTSPs face an operational deadline gap before 2027 eIDAS compliance