Article 24

What Article 24 requires

Article 24 is the compliance anchor for qualified trust service providers, because it turns qualification into an ongoing obligation rather than a one-time status. The provision matters less as a single technical rule than as a baseline for how an organisation must organise controls, evidence, liability, and supervision around qualified trust services.

In practice, Article 24 is where trust service governance becomes testable: the provider has to be able to show that its operating model matches the conditions for qualification, and that it can sustain that position under oversight. That makes the article central to auditability, accountability, and the credibility of the trust service itself.

Organisational controls and accountability

The article’s control emphasis is organisational, not just technical. It expects a qualified trust service provider to maintain defined responsibilities, internal controls, and decision-making discipline so that trust services are run in a consistent, supervised way. That is why Article 24 is often read alongside broader governance and security obligations rather than as a stand-alone compliance note.

For readers mapping this into operational reality, the key point is that qualification depends on repeatable governance. If the provider cannot demonstrate ownership of controls, incident handling, record keeping, and compliance oversight, the qualification status becomes fragile even if the underlying service is technically sound.

Evidence, record keeping, and supervision

Article 24 is also about proof. Qualified trust services are only as strong as the records that support them, including the evidence needed for supervision, audits, and dispute resolution. Without reliable records, a provider may struggle to defend the integrity of its service, its decision history, or its compliance posture.

This is why supervisory review is so important in the eIDAS model. The legal test is not simply whether the service exists, but whether it can be examined, verified, and held to account over time. A trustworthy service therefore needs documentation that is complete enough to support ongoing supervision, not merely operational continuity.

Why Article 24 matters for trust and liability

Article 24 sits at the intersection of trust and liability. Qualified services are relied on by others for legally significant actions, so failures can have consequences well beyond the provider’s own environment. When qualification controls are weak, the risk is not just non-compliance, but erosion of trust in signatures, seals, timestamps, certificates, and related reliance chains.

That is also why Article 24 is a baseline reference for assessing whether a provider is genuinely operating as a qualified trust service provider, or only presenting itself that way. In regulated trust services, the ability to sustain qualification is part of the service promise itself.

Risk and Threat Considerations

Weak Article 24 controls can create both compliance exposure and trust collapse. If organisational controls, record keeping, or supervision are incomplete, a provider may be unable to prove that a qualified service was delivered under the required conditions, which can undermine legal reliance and trigger supervisory action.

Failure mechanism: Gaps in governance, logging, evidence retention, or oversight make it harder to detect control failures, reconstruct events, or demonstrate that qualification conditions were continuously met.

Impact: The result can be suspension of trust in the service, failed audits, liability disputes, and broader loss of confidence in qualified trust services that depend on the provider’s assurances.

Practitioner Guidance

Why practitioners should care: Article 24 is the point where qualification becomes operationally provable. Teams should treat it as a governance requirement that must be sustained through controls, evidence, and supervision, not as a legal reference to file away after certification.

Common misunderstanding: Organisations often focus on the trust technology and underestimate the importance of records, accountability, and supervision. In qualified trust services, those supporting controls are part of the assurance model, not administrative overhead.

Practitioner takeaway: If you cannot evidence how qualification is maintained over time, you cannot confidently claim that the service still meets Article 24 expectations.

Related resources from NHI Mgmt Group

• What does the article say is missing from MCP deployments?
• What should teams do in the first 24 to 72 hours after suspected package compromise?
• What should teams do in the first 24 to 72 hours after a trusted identity is abused?
• What should teams do in the first 24 to 72 hours after discovering a compromised AI agent runtime?