What eIDAS 2 requires of browsers
Article 45(1a) imposes three things on web-browser providers:
- recognise QWACs issued in line with Annex IV and the reference standards;
- display the identity data and attested attributes in a user-friendly manner;
- ensure support and interoperability with QWACs.
Micro and small enterprises are exempt during their first five years as browser providers. And Article 45a only allows measures against specific certificates in the event of substantiated security concerns, with notification to the Commission and the supervisory body.
The standards that say how to recognise them (Implementing Regulation 2025/2527) apply from 6 January 2027. From then on the technical framework is settled, and more browsers can be expected to announce support.
The 2023 controversy
In November 2023, when the eIDAS 2 text was agreed, Mozilla promoted an open letter signed by hundreds of researchers and security experts, joined by organisations such as the EFF; the Internet Society made similar criticisms. The argument: forcing browsers to trust certificates from any provider designated by Member States for encrypting connections, without going through root programmes, would open the door to traffic interception. They recalled the case of Kazakhstan, which in 2019 tried to impose a government certificate that browsers blocked.
The final text kept the recognition obligation, but recital 65 made clear that it does not affect browsers’ freedom to ensure web security, domain authentication and traffic encryption by the means they consider appropriate. ETSI TS 119 411-5 accommodated this with the 2-QWAC model, in which qualified identity is separated from encryption. See How it works.
What about EV certificates?
Until 2019, browsers showed the company name in green in the address bar for EV certificates. They stopped because studies showed users did not notice the difference. That is the main criticism of QWACs: “it’s EV all over again”. The difference is the framework: EV is a private CA/Browser Forum rule, whereas a QWAC is a European legal status with public supervision, liability defined in law and a display obligation imposed on browsers.
Outside the browser
Much of the value of QWACs lies outside browsers: in APIs between banks and payment providers (PSD2), in connections between corporate and public-sector systems, and in any machine-to-machine integration where the client validates the server certificate against the EU trusted lists. There is no interface to show there, just an automatic check of qualified status. See PSD2 QWAC.
How to test in your browser
Install or update Firefox to version 153 or later and visit a site with a QWAC. Click the padlock: on a site with a QWAC, the panel identifies the organisation, the provider and the eIDAS framework. On a site with an ordinary certificate, only the usual connection information appears.