Am I a trust service provider under NIS 2?
Trust service providers sit in NIS 2 Annex I sector 8. Article 2(2)(a)(ii) brings them in regardless of size, qualified and non-qualified. Size only decides the category: qualified providers are always essential entities. eIDAS sits in parallel and governs the trust service itself.
The short version
A trust service provider is anyone who provides one or more trust services as defined in Article 3(16) eIDAS Regulation (EU) 910/2014: electronic signatures, electronic seals, electronic time stamps, electronic registered delivery, website authentication certificates, or the preservation of any of these. Annex I sector 8 of NIS 2 names trust service providers explicitly as part of Digital Infrastructure.
Article 2(2)(a)(ii) NIS 2 then pulls a lever that does not apply to most other sectors: trust service providers are in scope regardless of size. Qualified trust service providers, as defined in Article 3(20) eIDAS, are also always essential entities (Article 3(1)(b) NIS 2). A two-person qualified TSP that issues qualified certificates for electronic signatures is bound the same way as a 500-person CA. The medium-enterprise threshold from Article 2(1) does not gate them.
Non-qualified TSPs are in scope too, whatever their size. A large non-qualified provider is an essential entity, a smaller one an important entity (Article 3(1)(a) and 3(2) NIS 2). In Germany, § 28 BSIG makes qualified TSPs besonders wichtige Einrichtungen and other TSPs wichtige Einrichtungen. Two regimes run in parallel either way: eIDAS for the trust service itself, NIS 2 for the cyber duties (Article 20 management training, §32 BSIG significant-incident reporting, Article 21 risk-management measures).
NIS 2 Directive (2022/2555), Annex I sector 8 (Digital Infrastructure)
Internet Exchange Point providers; DNS service providers, excluding operators of root name servers; TLD name registries; cloud computing service providers; data centre service providers; content delivery network providers; trust service providers; providers of public electronic communications networks; providers of publicly available electronic communications services
Verbatim from OJ L 333/146. Sector 8 is Digital Infrastructure. Trust service providers are one of the listed entity types. The sector list does not split qualified from non-qualified; that split is made by Article 3 NIS 2 and by eIDAS.
Article 2(2)(a)(ii) and 3(1)(b) NIS 2 + Article 3(16) and 3(20) eIDAS
Article 2(2) NIS 2: Regardless of their size, this Directive also applies to entities of a type referred to in Annex I or II, where: (a) services are provided by: […] (ii) trust service providers; […] Article 3(1)(b) NIS 2: qualified trust service providers and top-level domain name registries as well as DNS service providers, regardless of their size; Article 3(20) eIDAS: 'qualified trust service provider' means a trust service provider who provides one or more qualified trust services and is granted the qualified status by the supervisory body; Article 3(16) eIDAS (as amended by Regulation (EU) 2024/1183): 'trust service' means an electronic service normally provided for remuneration which consists of any of the following: (a) the issuance of certificates for electronic signatures, certificates for electronic seals, certificates for website authentication or certificates for the provision of other trust services; […] (n) the recording of electronic data in an electronic ledger;
Two definitions stacked. Article 3(16) eIDAS tells you what counts as a trust service. Article 3(20) tells you who is a qualified provider: one granted qualified status by the supervisory body. NIS 2 then says: every trust service provider is in regardless of headcount or turnover (Article 2(2)(a)(ii)), and a qualified one is always an essential entity (Article 3(1)(b)).
§28 BSIG + Vertrauensdienstegesetz (Germany)
§28 BSIG transposes the Annex I scope into German law and makes qualified trust service providers 'besonders wichtige Einrichtungen' (§ 28(1) no. 2) and other trust service providers 'wichtige Einrichtungen' (§ 28(2) no. 1), regardless of size. The Vertrauensdienstegesetz (VDG) is the national accompanying law to the eIDAS Regulation; it designates the Bundesnetzagentur as the supervisory body for trust services and operates the German trusted list.
The eIDAS Regulation applies directly without German transposition. The VDG only adds the supervisory machinery. NIS 2 sits separately on top of both: §28 BSIG places qualified TSPs in the highest tier (besonders wichtige Einrichtung) and other TSPs in the wichtige Einrichtung tier, regardless of size, with the BSI as the cyber regulator.
Do you provide a trust service?
Match your offering against Article 3(16) eIDAS. The closed list is: electronic signatures, electronic seals, electronic time stamps, electronic registered delivery services, website authentication certificates, and the preservation of any of these. The service is normally provided for remuneration. If your offering does not fit any of these categories, you are not a TSP under eIDAS, no matter how much cryptography you ship.
Are you the provider or only a user?
A TSP issues or operates the trust service for others. A company that signs its own invoices with an external qualified signature service is a user of that service, not a TSP. A consultancy that helps a client deploy signature workflows is a user too. Provider status hangs on whether you create, validate, deliver or preserve the trust service itself, for someone else, for money.
Qualified or non-qualified?
Check the national trusted list (in Germany: the Bundesnetzagentur trusted list under the VDG). If you are listed there as a qualified provider, you are an essential entity regardless of size (Article 3(1)(b) NIS 2). If you are not listed, you are non-qualified: still in scope regardless of size (Article 2(2)(a)(ii)), as an essential entity if large and an important entity otherwise. Two- and three-person TSPs are common in this sector, and they are all in scope.
Size does not decide scope
Article 2(2) NIS 2 lists the cases where the size test does not apply, and trust service providers are among them (point (a)(ii)). Trust services made the list because the harm from a compromised qualified certificate is structural: every signature, seal or time stamp issued under it loses legal effect. The size of the provider has no bearing on the size of the damage downstream. A two-person CA can break an entire member state's signature chain. That is why the size test is switched off.
Qualified TSPs run two parallel regimes
eIDAS Article 19, which used to set the security duties for trust services, was deleted by Article 42 NIS 2 with effect from 18 October 2024. The security measures and incident reporting now come from NIS 2. eIDAS still governs the service itself: qualified TSPs are audited at least every 24 months by a conformity assessment body, and that audit also confirms compliance with Article 21 NIS 2 (Article 20(1) eIDAS). NIS 2 adds the cross-organisational cyber duties: Article 20 management training, Article 21 risk-management measures, Article 23 significant-incident reporting. Article 4 NIS 2 does not switch NIS 2 off here. Both regimes apply in full. The eIDAS supervisory body and the NIS 2 competent authority can be different (in Germany: Bundesnetzagentur for eIDAS, BSI for NIS 2).
BSI / §28 BSIG (NIS 2 side)
The BSI is the NIS 2 competent authority. It runs the §33 BSIG registration portal, receives §32 BSIG significant-incident notifications, and supervises the §30 BSIG risk-management measures. Qualified TSPs land in the 'besonders wichtige Einrichtung' tier through §28(1) BSIG, other TSPs in the 'wichtige Einrichtung' tier through §28(2), which means tighter supervision and the same incident reporting timelines as KRITIS operators.
Bundesnetzagentur (eIDAS side)
The Bundesnetzagentur is the supervisory body for trust services under the Vertrauensdienstegesetz. It operates the German trusted list, accredits qualified status, receives the conformity assessment reports from the 24-month audit under Article 20(1) eIDAS. Where an incident is both a §32 BSIG significant incident and a breach qualified TSPs must notify under Article 24(2)(fb) eIDAS, you report both, to both authorities.
ENISA Technical Implementation Guidance + EUDI Wallet work
ENISA publishes technical implementation guidance for the CIR, which also covers trust service providers, and writes the cybersecurity baseline that feeds into national supervisor expectations. The same body is now writing the trust-service work package for the European Digital Identity Wallet, which extends the qualified TSP perimeter from 2026 onwards.
National transposition laws
eIDAS is een verordening, dus de regels voor vertrouwensdiensten zijn in de hele EU uniform. NIS 2 is een richtlijn, dus elke lidstaat zet haar zelf om: NL via de Cyberbeveiligingswet, AT via de NISG, terwijl in FR de omzetting nog een wetsontwerp in het parlement is. Bijlage I, sector 8 en de regel van artikel 2, lid 2, onder a), ii), dat de omvang er niet toe doet, zijn overal gelijk. De bevoegde autoriteit voor de NIS 2-kant verschilt per land.
Non-qualified trust services are outside NIS 2.
Wrong. Non-qualified TSPs are still in Annex I sector 8, and Article 2(2)(a)(ii) NIS 2 brings them in regardless of size. Qualification only decides the category. A 60-staff non-qualified time stamp provider is in NIS 2 as an important entity; a large non-qualified provider is an essential entity.
eIDAS already covers cybersecurity, so NIS 2 does not add anything.
eIDAS Article 19, which used to set the security baseline, was deleted by Article 42 NIS 2 with effect from 18 October 2024. The security baseline now comes from NIS 2. NIS 2 Articles 20, 21 and 23 add cross-organisational duties: management body training, the full risk-management catalogue from cryptography to supply chain, and significant-incident reporting under §32 BSIG with a 24-hour early warning. Article 4 NIS 2 lex specialis does not switch NIS 2 off for trust services. Two parallel regimes, neither replaces the other.
We are too small for NIS 2.
For a trust service provider, size is the wrong question. Article 2(2)(a)(ii) puts you in regardless of headcount, turnover or balance sheet, qualified or not. A two-person qualified certificate authority is in the same NIS 2 tier as a multinational CA. The reason is downstream: every signature issued under a compromised qualified certificate loses its legal effect, regardless of who issued it.
Typical case: a 12-person qualified TSP issuing qualified certificates for electronic signatures, with a 24-month eIDAS conformity assessment cycle and a national trusted list entry through the Bundesnetzagentur. NIS 2 scope is automatic through Article 2(2)(a)(ii). §28 BSIG places the company in the 'besonders wichtige Einrichtung' tier. Two regulators, two reporting channels, one company.
What practitioners actually do: take the evidence from the eIDAS Article 20(1) audit, which already checks Article 21 NIS 2, and reuse it for the relevant Article 21 NIS 2 controls (cryptography, access control, incident handling, business continuity). Run the §33 BSIG registration with the BSI. Add the items eIDAS does not cover: Article 20 management training, Article 21(2)(d) supplier risk, the §32 BSIG significant-incident channel. The two regimes overlap on cryptography and incident response; everything else is additional.
- Directive (EU) 2022/2555 (NIS 2), Annex I sector 8, Article 2(2)(a)(ii), Article 3(1)(b) and Article 42: eur-lex.europa.eu/eli/dir/2022/2555/oj
- Regulation (EU) 910/2014 (eIDAS) as amended by Regulation (EU) 2024/1183, Article 3(16), 3(19), 3(20), Article 20(1) and Article 24: eur-lex.europa.eu/eli/reg/2014/910/oj
- BSI Act (BSIG), §28 (Anwendungsbereich), §32 (Meldepflichten) and §33 (Registrierung) as amended by the NIS2 Implementation and Cybersecurity Strengthening Act
- Vertrauensdienstegesetz (VDG): gesetze-im-internet.de/vdg
- Bundesnetzagentur German trusted list under Article 22 eIDAS
- ENISA Technical Implementation Guidance for Implementing Regulation (EU) 2024/2690, which covers trust service providers: enisa.europa.eu
In de praktijk
Waar dit in de begeleide doorloop terugkomt
De begeleide doorloop maakt hier stappen van die u invult, met de wet bij elke stap uitgelegd. Open een stap om het scherm te zien, ingevuld voor een verzonnen bedrijf.
De doorloop zelf is in het Duits en het Engels.
Registration & Reporting
Register with your authority
Your company registers once with your authority.
Moet u zich met NIS2 bezighouden?
We begeleiden u stap voor stap. U vult in, wij leggen elk punt in eenvoudige woorden uit, en aan het eind tekent de directie.
