Notifications
Clear all
Topic starter
11/07/2026 8:43 pm
TL;DR: EPREL uses qualified electronic seals and registry checks to verify that product data comes from an authorised legal entity before registration, while updated EU labelling rules now require tighter identity proofing and better transparency for market oversight, according to GlobalSign. The governance lesson is that registry trust depends on binding organisation identity to the right signing authority, not just digitising a form flow.
NHIMG editorial — based on content published by GlobalSign: EPREL identity verification and qualified electronic seals
By the numbers:
- Since March 2021, consumers have had access to the EPREL database to search for energy labels and product information sheets.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
Questions worth separating out
Q: How should organisations govern delegated authority in regulated digital registries?
A: They should separate proof that an organisation exists from proof that a specific actor may submit on its behalf.
Q: Why do qualified electronic seals matter in identity governance?
A: They matter because they turn organisational identity into a verifiable, reusable credential for regulated workflows.
Q: What breaks when registry access is not tied to lifecycle offboarding?
A: The registry can continue accepting submissions from actors who no longer represent the organisation, which creates stale authority and compliance exposure.
Practitioner guidance
- Map delegated authority separately from organisational identity Document which user, role, or service can submit on behalf of each legal entity, then review that mapping whenever business ownership changes.
- Treat qualified seals as managed credentials Assign owners, renewal dates, revocation triggers, and monitoring to every organisational seal used in regulatory submission flows.
- Validate lifecycle offboarding for registry access Remove submission rights when a supplier relationship ends, when a representative changes, or when an organisation no longer needs access to the registry.
What's in the full article
GlobalSign's full article covers the operational detail this post intentionally leaves for the source:
- The EU Login and EPREL organisation registration steps needed before model submission.
- The verification sequence for qualified electronic seals and accepted organisational identifiers.
- The updated NTR requirement for qualifying seals after the April 2025 policy change.
- The label and QR-code changes that affect market surveillance and consumer lookup.
👉 Read GlobalSign's analysis of EPREL identity verification and digital seals →
EPREL identity verification: what digital seals change for practitioners?
Explore further
11/07/2026 9:10 pm
Organisational identity proofing is only useful when it is paired with delegated authority control. EPREL does not merely ask whether a company exists. It also asks whether the submitting profile is authorised to act for that legal entity, which is the real governance problem in regulated digital workflows. Enterprises often stop at authentication and miss the harder control boundary, which is who is allowed to bind the organisation to an action. The practitioner lesson is to govern authority, not just identity.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which is why credential governance often fails before teams can even measure it.
A question worth separating out:
Q: How should security teams reduce blast radius for workload credentials?
A: Start by removing shared, long-lived secrets from the highest-risk workflows, especially API integrations, CI/CD jobs, and autonomous services. Prefer short-lived tokens, signed assertions, or runtime-attested identities so a stolen credential has limited replay value. Then align rotation, revocation, and authorisation policies so the control remains effective after deployment.
👉 Read our full editorial: Digital seals and registry controls for EPREL identity verification
