eIDAS: Regulation (EU) No 910/2014
The regulation on electronic identification and trust services of 23 July 2014 created a common framework for signatures, seals, time stamps, registered email and website certificates. Its trust service rules have applied since 1 July 2016. It applies directly in every Member State, with no transposition needed.
For websites, the 2014 eIDAS created the qualified certificate for website authentication and set out its content in Annex IV. But it obliged no one to recognise it: browsers treated QWACs like any other certificate, and the qualified identity stayed hidden in the details.
eIDAS 2: Regulation (EU) 2024/1183
Adopted on 11 April 2024 and in force since 20 May 2024, it overhauled eIDAS: it created the European Digital Identity Wallet and new trust services (electronic attestations of attributes, electronic archiving, electronic ledgers) and rewrote the QWAC regime.
Article 45: requirements and recognition by browsers
- 1. Qualified certificates for website authentication shall meet the requirements laid down in Annex IV. The evaluation of compliance with those requirements shall be carried out in accordance with the standards, specifications and procedures referred to in paragraph 2 of this Article.
- 1a. Qualified certificates for website authentication issued in accordance with paragraph 1 of this Article shall be recognised by providers of web-browsers. Providers of web-browsers shall ensure that the identity data attested in the certificate and additional attested attributes are displayed in a user-friendly manner. Providers of web-browsers shall ensure support and interoperability with qualified certificates for website authentication referred to in paragraph 1 of this Article, with the exception of microenterprises or small enterprises […] during the first five years of operating as providers of web-browsing services.
- 1b. Qualified certificates for website authentication shall not be subject to any mandatory requirements other than the requirements laid down in paragraph 1.
- 2. By 21 May 2025, the Commission shall, by means of implementing acts, establish a list of reference standards and, where necessary, establish specifications and procedures for qualified certificates for website authentication […].
In short: browsers must recognise QWACs, display the identity in a user-friendly way and ensure interoperability; and no one may impose mandatory requirements on QWACs beyond those of eIDAS. That last point was the most debated, because browsers run their own root programmes, with their own rules, to decide which Certification Authorities they accept.
Article 45a: precautionary measures
- 1. Providers of web-browsers shall not take any measures contrary to their obligations set out in Article 45, in particular the requirements to recognise qualified certificates for website authentication and to display the identity data provided in a user-friendly manner.
- 2. By way of derogation from paragraph 1 and only in the event of substantiated concerns related to security breaches or the loss of integrity of an identified certificate or set of certificates, providers of web-browsers may take precautionary measures in relation to that certificate or set of certificates.
Paragraphs 3 and 4 set out the procedure: a browser that takes precautionary measures notifies the Commission, the competent supervisory body, the certificate holder and the issuing provider in writing; the supervisory body investigates and, if it does not withdraw the qualified status, asks the browser to lift the measures.
Recital 65 of Regulation 2024/1183 adds an important clarification: the obligation to recognise QWACs should not affect the freedom of browsers to ensure web security, domain authentication and the encryption of web traffic by the methods and technologies they consider most appropriate. This is what makes the 2-QWAC model possible, described in How it works.
Other eIDAS provisions that matter for QWACs
- Annex IV: the mandatory content of a QWAC, amended in 2024 (see What is a QWAC).
- Article 24a(7): mutual recognition of QWACs between Member States.
- Article 24: how the qualified provider verifies the identity of the applicant.
- Article 22: national trusted lists.
- Article 23: the EU trust mark, which only qualified providers may use for the qualified services they provide.
- Article 13: liability of trust service providers.
Implementing Regulation (EU) 2025/2527
Article 45(2) required the Commission to set the reference standards by 21 May 2025. The act was adopted on 16 December 2025, published in the Official Journal on 17 December and applies from 6 January 2027. The one-year gap gives qualified providers time to be audited.
The annex divides QWACs into two groups:
| Use | Reference standards |
|---|---|
| QWACs for TLS authentication outside the context of a web browser (APIs, server-to-server connections) | ETSI EN 319 411-2 V2.6.1 (2025-06), under the QNCP-w-gen, QEVCP-w or QNCP-w policies; or ETSI TS 119 495 V1.7.1 (2024-07), the PSD2 QWAC standard |
| Other QWACs, including within the context of a web browser | ETSI TS 119 411-5 V2.1.1 (2025-02) |
Recital 2 explains the reasoning: the standards should allow QWACs to be issued in different ways, as standalone certificates or bound to other certificates, without affecting the freedom of browser providers to ensure web security. The regulation does not, by itself, impose technical obligations on browsers, and it does not mention certificate transparency.
Full text: Implementing Regulation (EU) 2025/2527 on EUR-Lex.
The ETSI standards, one by one
- ETSI EN 319 401: general policy requirements for all trust service providers.
- ETSI EN 319 411-1: requirements for Certification Authorities issuing certificates (including the DVCP, OVCP and EVCP policies, aligned with the CA/Browser Forum rules).
- ETSI EN 319 411-2: additional requirements for qualified certificates, with the QWAC policies (QEVCP-w, QNCP-w, QNCP-w-gen).
- ETSI EN 319 412-4: technical profile of website certificates.
- ETSI EN 319 412-5: the qualified statements (QcStatements) that mark a certificate as qualified and its type of use.
- ETSI TS 119 411-5: how QWACs work with browsers. Defines the two models, 1-QWAC and 2-QWAC.
- ETSI TS 119 495: profile and requirements of QWACs and QSealCs for PSD2, with the payment provider’s roles and the authorising authority. See PSD2 QWAC.
- ETSI TS 119 612: format of the trusted lists.
Browser rules (CA/Browser Forum)
Alongside European law there is a second, private set of rules: the CA/Browser Forum Baseline Requirements and each browser’s root programme (Chrome, Mozilla, Apple, Microsoft). A QWAC that is also the site’s TLS certificate (the 1-QWAC model) must meet both. The most visible change in 2026 is the reduction of the maximum validity of TLS certificates:
- 398 days
- 200 days
- 100 days
- 47 days
That is why a “5-year” QWAC is in practice a 5-year subscription, with the certificate reissued as often as the rules require. Organisation validation is reused for the permitted period and then repeated.
Another rule with a direct effect on QWACs: since June 2026, the Chrome root programme no longer accepts public TLS certificates with the client authentication usage (clientAuth). This mainly affects PSD2 QWACs used in mutual TLS. See PSD2 QWAC.
In Portugal
eIDAS applies directly. The supervisory body for qualified providers is the Gabinete Nacional de Segurança (GNS, National Security Office), which publishes the Portuguese trusted list. Qualified providers established in other Member States may issue QWACs to Portuguese entities, with the same effect.
For PSD2, the authority that authorises payment service providers is Banco de Portugal, and its identifier appears in the PSD2 QWACs of Portuguese entities.