Subject: Re: Inquiry - eIDAS Qualified Preservation Service
From: "Cristina Vega | IDVIA" <[email-masked]>
To: "Erika Adams" <[email-masked]>
Cc: Tais Vakrõõm <[email-masked]>,Riigi Infosüsteemi Amet <[email-masked]>
Date: Fri, 9 Jan 2026 13:51:40 +0200

Some people who received this message don't often get email from
[email-masked].  <https://aka.ms/LearnAboutSenderIdentification> Learn
why this is important

E-kiri saadeti väljastpoolt RIA-t. Kui Sa ei tunne saatjat, siis ära ava
linke ega manuseid!

Dear Erika,

Thank you very much for the detailed guidance and links, this is extremely
helpful.

We understand that qualified trust services are cross-border in nature and
that our existing qualified status in Spain is valid throughout the EU.
However, our intention is to establish a new legal entity in Estonia and
obtain QTSP status under Estonian supervision, with the service entered on
the Estonian Trusted List.

Following your guidance, we have now shortlisted and contacted several
EU-listed Conformity Assessment Bodies. To support our planning, could you
please clarify two points:

1.	Is there a specific application form, checklist, or template pack
that you recommend we use to ensure the submission is complete and can be
processed without interruptions? If so, please could you share the latest
version or point us to where it can be downloaded.

1.	Since the service is already qualified and operational under
TrustCloud in Spain (and will be replicated under the Estonian entity with
governance and legal responsibility updates), does RIA typically accept a
conformity assessment that reuses existing technical evidence where
identical, with the CAB focusing on the Estonian entity’s governance and
operational controls?

Additionally, for timeline expectations: should this be treated as an
initial licence (80-day decision window) in all cases, or can there be any
streamlined approach in scenarios where the service is already qualified
in another Member State?

Thank you again for your support. Once we have confirmed the CAB and
incorporation timeline, we will prepare the submission.

Best,

<https://eur10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fidvia.c
om%2F&data=05%7C02%7Cria_uldmeil%40ria.ee%7C2611b28a0e064cd85f5d08de4f758c
b7%7Cb6dc47a368bc49d3a9cf0db148e9f818%7C0%7C0%7C639035563476691281%7CUnkno
wn%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zM
iIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=dBzdtqqIAmQNmxj8v%2
FOhQUEnxeMTMndVS3jvqZ2EpCE%3D&reserved=0>

Cristina Vega
VP of Product
Mobile: +44 7740 868 310
Email:  <mailto:[email-masked]> [email-masked]

<https://eur10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.lin
kedin.com%2Fin%2Fvegacris%2F&data=05%7C02%7Cria_uldmeil%40ria.ee%7C2611b28
a0e064cd85f5d08de4f758cb7%7Cb6dc47a368bc49d3a9cf0db148e9f818%7C0%7C0%7C639
035563476721554%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLj
AuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sd
ata=Lsf%2BxcaJVBHeGjq76CThknseIbbYwIA5jB%2FvIFoC%2FzM%3D&reserved=0>
@vegacris

This message and any attached files are confidential. They are for the
intended recipients only. If an error has misdirected this e-mail to you,
please, notify the author and do not use, disclose, distribute, copy,
print or relay this e-mail. IDVIA. does not accept legal responsibility
for the contents of this message. Any views or opinions presented are
solely those of the author and do not necessarily represent those of the
firm unless otherwise specifically stated.

From: Erika Adams <[email-masked]>
Date: Tuesday, 6 January 2026 at 10:27
To: Cristina Vega | IDVIA <[email-masked]>
Cc: Tais Vakrõõm <[email-masked]>, Riigi Infosüsteemi Amet
<[email-masked]>
Subject: RE: Inquiry - eIDAS Qualified Preservation Service

EXTERNAL SENDER:
Warning: this message comes from an EXTERNAL SENDER. Please be careful,
especially with links and attachments.

Dear Cristina

Thank you for your inquiry and for your interest in providing qualified
trust services in Estonia. Below we provide an initial overview of the
process for applying for QTSP status and the related supervisory
requirements in Estonia.

Please note that if you wish to provide the same QTSP service in Estonia
while remaining registered on the Spanish Trusted List and under the
supervision of the Spanish competent authority, it is not necessary to
register the service on the Estonian Trusted List or to come under
Estonian supervision. The provision of qualified trust services is
cross-border in nature. It is sufficient for a qualified trust service to
be registered and supervised by the competent authority of one EU Member
State and included in that Member State’s Trusted List. The qualified
status of the service is valid throughout the European Union.

If you nevertheless wish to obtain an operating authorisation in Estonia
and be placed under Estonian supervision, the provision of qualified trust
services would require the establishment of a legal entity in Estonia and
an application for QTSP status submitted in accordance with Estonian and
EU requirements.

Complience with the following legislation is required:

1. REGULATION (EU) No 910/2014 OF THE EUROPEAN PARLIAMENT AND OF THE
COUNCIL (eIDAS);

2.  Electronic Identification and Trust Services for Electronic
Transactions Act,  is available here
https://www.riigiteataja.ee/en/eli/ee/527102016001/consolide/current
<https://eur10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.rii
giteataja.ee%2Fen%2Feli%2Fee%2F527102016001%2Fconsolide%2Fcurrent&data=05%
7C02%7Cria_uldmeil%40ria.ee%7C2611b28a0e064cd85f5d08de4f758cb7%7Cb6dc47a36
8bc49d3a9cf0db148e9f818%7C0%7C0%7C639035563476741349%7CUnknown%7CTWFpbGZsb
3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWF
pbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=2Vm6%2FGKmGVd2LgNws9gbAviMgjWZefK
RaQenlYFYV1A%3D&reserved=0>

3. General Part of the Economic Activities Code Act,
https://www.riigiteataja.ee/en/eli/515042021004/consolide
<https://eur10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.rii
giteataja.ee%2Fen%2Feli%2F515042021004%2Fconsolide&data=05%7C02%7Cria_uldm
eil%40ria.ee%7C2611b28a0e064cd85f5d08de4f758cb7%7Cb6dc47a368bc49d3a9cf0db1
48e9f818%7C0%7C0%7C639035563476763218%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1h
cGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ
%3D%3D%7C0%7C%7C%7C&sdata=D6l%2B70AGf8htD3wjBL7QpSq5c%2BqMgyLe7XyR4brBPDs%
3D&reserved=0>

4. Commercial Code  is available here
https://www.riigiteataja.ee/en/eli/ee/511012021004/consolide/curren
<https://eur10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.rii
giteataja.ee%2Fen%2Feli%2Fee%2F511012021004%2Fconsolide%2Fcurren&data=05%7
C02%7Cria_uldmeil%40ria.ee%7C2611b28a0e064cd85f5d08de4f758cb7%7Cb6dc47a368
bc49d3a9cf0db148e9f818%7C0%7C0%7C639035563476783319%7CUnknown%7CTWFpbGZsb3
d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFp
bCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=Se84RnjehnoK0ah8%2FO3rgGMcmnCIaGDF
2cHF5UVH9%2BY%3D&reserved=0>

5. Commission implementing regulation (EU) 2025/1946 (service-based),
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32025R1946
<https://eur10.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur-lex
.europa.eu%2Flegal-content%2FEN%2FTXT%2F%3Furi%3DCELEX%3A32025R1946&data=0
5%7C02%7Cria_uldmeil%40ria.ee%7C2611b28a0e064cd85f5d08de4f758cb7%7Cb6dc47a
368bc49d3a9cf0db148e9f818%7C0%7C0%7C639035563476803852%7CUnknown%7CTWFpbGZ
sb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiT
WFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=g0i4d4PcOo6uJgdzkDV8IrhH%2FZELk
yePmUj6Xs%2FPZxs%3D&reserved=0>

6. Submission of the completed and signed application, together with the
required data and documentation to the Information System Authority at
[email-masked].

Conformity assessment must follow the Estonian regulation „Trust service
provider and trust service conformity assessment procedure  available at
https://www.riigiteataja.ee/akt/128102016017    (in Estonian) .

Please note that there currently no Conformity Assessment Bodies (CABs)
established in Estonia that are competent to issue eIDAS- compliant
certificates.  Estonian QTSPs and their services are assessed by CABs from
ohter EU Member States abroad. Accepted CABs are listed in the EU list of
CABs https://eidas.ec.europa.eu/efda/browse/notification/cab-nab
<https://eur10.safelinks.protection.outlook.com/?url=https%3A%2F%2Feidas.e
c.europa.eu%2Fefda%2Fbrowse%2Fnotification%2Fcab-nab&data=05%7C02%7Cria_ul
dmeil%40ria.ee%7C2611b28a0e064cd85f5d08de4f758cb7%7Cb6dc47a368bc49d3a9cf0d
b148e9f818%7C0%7C0%7C639035563476825461%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU
1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoy
fQ%3D%3D%7C0%7C%7C%7C&sdata=vkAicRbIGCOp2Wh3xbLrAEImhwlCtl2XOOaNY%2BSa4Ig%
3D&reserved=0>   .

Only compliance of a specific trust service with the applicable ETSI
standards and Commission Implementing Regulations are accepted. To provide
a qualified trust service, both the service provider and the trust service
must have a qualified status in accordance with Article 21 (2) of
Regulation (EU) No. 910/2014 of the European Parliament and of the
Council, as evidenced by the Estonian Information System Authority.

The information System Authority decides on an application after receipt
of all required data and documents:

1. within 80 days in case of an application for an initial trust service
licence;

2. within 50 days in case of an application for a repeated trust service
licence.

Qualified trust service providers and trust services are entered in the
Trusted List for two years.

State fees related to operations in the Estonian Trusted List:

*	review of an application for an initial trust service licence and
inclusion in the Trusted List: EUR 1,030 per trust service;
*	review of an application for a renewed trust service licence and
inclusion in the Trusted List: EUR 770 per trust service;
*	review of an application for modification of trust service
provider or service data: EUR 65;

More detailed information on obtaining a trust service provider operating
licence is available at
https://www.eesti.ee/eraisik/en/artikkel/licences-and-notices-of-economic-
activity/usaldusteenused/trust-service-providers-operating-licence

If you have any further questions, please do not hesitate to contact us.

Best regards

Erika Adams

Chief Expert of Cyber Security Centre

and Trust Services

[email-masked]

Estonian Information System Authority

Pärnu mnt 139a Tallinn 15169

From: Cristina Vega | IDVIA <[email-masked]>
Sent: Friday, December 19, 2025 6:24 PM
To: Riigi Infosüsteemi Amet <[email-masked]>
Subject: Inquiry - eIDAS Qualified Preservation Service

You don't often get email from [email-masked]. Learn why this is
important <https://aka.ms/LearnAboutSenderIdentification>

E-kiri saadeti väljastpoolt RIA-t. Kui Sa ei tunne saatjat, siis ära ava
linke ega manuseid!

Dear RIA Team,

I represent IDVIA, part of the TrustCloud Group. TrustCloud is currently a
Qualified Trust Service Provider listed on the EU Trusted List in Spain
for the Qualified Preservation of Qualified Electronic Signatures and
Qualified Electronic Seals under Regulation (EU) No. 910/2014 (eIDAS).

We are assessing the establishment of a new legal entity in Estonia to
operate the same Qualified Preservation service under Estonian
supervision. The service architecture, controls, and policies are already
fully compliant with ETSI EN 319 401, 319 511, and 319 512, and have
undergone conformity assessment in Spain.

We would appreciate guidance on:

*	The process for obtaining QTSP status in Estonia for an already
qualified service
*	Any local supervisory expectations or prerequisites
*	Whether you have preferred or commonly used Conformity Assessment
Bodies for eIDAS scopes

We are currently scoping timelines and would welcome any initial guidance.

Best,

<https://eur10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fidvia.c
om%2F&data=05%7C02%7Cria_uldmeil%40ria.ee%7C2611b28a0e064cd85f5d08de4f758c
b7%7Cb6dc47a368bc49d3a9cf0db148e9f818%7C0%7C0%7C639035563476869052%7CUnkno
wn%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zM
iIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=eGDXy4QoALH8LlKN0ph
aC3C1YHDHDG12WcviUPQlRm0%3D&reserved=0>

Cristina Vega
VP of Product
Mobile: +44 7740 868 310
Email:  <mailto:[email-masked]> [email-masked]

<https://eur10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.lin
kedin.com%2Fin%2Fvegacris%2F&data=05%7C02%7Cria_uldmeil%40ria.ee%7C2611b28
a0e064cd85f5d08de4f758cb7%7Cb6dc47a368bc49d3a9cf0db148e9f818%7C0%7C0%7C639
035563476890838%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLj
AuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sd
ata=QOHe%2BqGz4unMoNwL%2FkABxo4GV1wEE60zMSAAU8Zdl2A%3D&reserved=0>
@vegacris

This message and any attached files are confidential. They are for the
intended recipients only. If an error has misdirected this e-mail to you,
please, notify the author and do not use, disclose, distribute, copy,
print or relay this e-mail. IDVIA. does not accept legal responsibility
for the contents of this message. Any views or opinions presented are
solely those of the author and do not necessarily represent those of the
firm unless otherwise specifically stated.