What is a QTSP? Why Your Digital Signature Provider Must Be EU-Listed

Not all digital signatures are equal under EU law. A digital signature created by a consumer app, a SaaS signing tool, or an internal PKI system may be cryptographically valid — but it carries no legal presumption before EU courts unless it was issued by a Qualified Trust Service Provider (QTSP) listed on an EU member state's national trusted list.

This distinction matters enormously in practice. In commercial disputes, regulatory proceedings, and cross-border legal processes, courts and regulators apply the eIDAS framework (EU Regulation 910/2014) to determine the legal effect of electronic signatures and timestamps. A signature from a non-QTSP has no guaranteed legal presumption. A qualified signature or qualified timestamp from an EU-listed QTSP carries a statutory presumption that neither party can simply dismiss.

What Is a QTSP?

A Qualified Trust Service Provider (QTSP) is a trust service provider that meets the requirements set out in Article 21 and Article 24 of eIDAS Regulation 910/2014 and has been:

Audited by a conformity assessment body accredited under ISO 17065

Approved by the supervisory authority of an EU member state

Listed on that member state's national trusted list, which feeds into the EU Trust List published by the European Commission

The EU Trust List (the "EUTL") is publicly accessible at esignature.ec.europa.eu/efb/search/. Any member of the public — or any party's legal counsel — can verify in seconds whether a trust service provider is listed, and for which trust services it is qualified.

QTSPs can be qualified to provide one or more of the following:

Qualified electronic signatures (QES)
Qualified electronic seals (QeSeal)
Qualified electronic timestamps (QTS)
Qualified website authentication certificates (QWAC)
Qualified electronic registered delivery services

For document signing and timestamping purposes, the relevant qualifications are QES (for signatures that carry the same legal effect as a handwritten signature under eIDAS Art. 25) and QTS (for timestamps that carry a legal presumption of accuracy under eIDAS Art. 41).

Why Non-QTSP Signatures Fall Short in Legal Proceedings

EIDAS creates a tiered system of electronic signatures:

Simple electronic signatures (SES): Any electronic data attached to or logically associated with other data. No presumption of identity or integrity. Email sign-offs qualify.
Advanced electronic signatures (AdES): Uniquely linked to and capable of identifying the signatory. Created using data under the signatory's sole control. Detectable if the signed data changes. No statutory legal presumption.
Qualified electronic signatures (QES): Advanced electronic signatures created by a qualified electronic signature creation device and based on a qualified certificate. Carry the same legal effect as a handwritten signature in all 27 EU member states under eIDAS Art. 25(2).

The critical difference between AdES and QES in litigation is burden of proof. An advanced signature can be challenged without any special evidential burden: the challenging party simply asserts that the signature is unreliable or that the signer was not who they claimed. The signer must then prove the signature's validity.

A qualified signature (QES) from a QTSP reverses this. Under eIDAS Art. 25(2), a QES carries a legal presumption equivalent to a handwritten signature. The challenger must prove it is invalid — not the signer prove it is valid.

The same asymmetry applies to qualified timestamps under Art. 41: the challenger must rebut the presumption that the timestamp is accurate and the data is intact.

In complex commercial disputes, this evidentiary asymmetry is often dispositive.

How Swisscom Qualifies Under Both ZertES and eIDAS

Swisscom Trust Services is one of a small number of providers globally that holds dual accreditation under both the Swiss ZertES framework and the EU eIDAS framework:

Under [ZertES (SR 943.03)](https://www.fedlex.admin.ch/eli/cc/2016/752/en): Swisscom is an accredited certification service provider (Zertifizierungsdiensteanbieter, ZDA) under Swiss federal law, regulated by BAKOM (Federal Office of Communications). This accreditation enables Swisscom to issue qualified electronic signatures and timestamps with legal presumption under Swiss law.

Under eIDAS: Swisscom is listed as a QTSP on the EU Trust List for qualified electronic signatures, qualified electronic seals, and qualified electronic timestamps. This listing covers Swisscom's services in all 27 EU member states simultaneously.

This dual qualification means that a document sealed through Swiss Trust Layer — which uses Swisscom Trust Services as its timestamping authority — carries legal presumption in Swiss proceedings under ZertES and in EU proceedings under eIDAS simultaneously. A single seal satisfies both frameworks.

For businesses operating across the Switzerland-EU corridor — a significant proportion of Swiss-based companies in financial services, pharma, medtech, and professional services — this dual coverage eliminates the need to use separate providers for Swiss and EU compliance contexts.

How to Verify a Provider Is a QTSP

Verification takes under two minutes:

Go to esignature.ec.europa.eu/efb/search/

Search by country or provider name

Check the trust service types listed (look for "QCertESig" for qualified signature certificates, "QTimestamp" for qualified timestamps)

Confirm the status is "granted" (not "withdrawn" or "under supervision")

For Swiss providers operating under ZertES, the equivalent check is the BAKOM-published list of accredited certification service providers at bakom.admin.ch.

If a provider is not on the EU Trust List and not on the BAKOM list, it is not a QTSP. Its signatures and timestamps carry no statutory legal presumption under eIDAS or ZertES, regardless of any marketing claims.

DocuSign, Adobe Sign, and Non-QTSP Providers

Many widely used digital signature platforms — including DocuSign and Adobe Sign in their standard configurations — are not EU Trust List QTSPs for qualified electronic signatures in the eIDAS sense. They offer advanced electronic signatures, which are cryptographically valid but carry no Art. 25 legal presumption.

For low-stakes commercial agreements where no dispute is anticipated, this distinction may not matter. For agreements where legal enforceability is critical — financial contracts, IP assignments, regulatory submissions, cross-border professional services agreements — the distinction between AdES and QES is significant.

Swisscom-backed Swiss Trust Layer provides QTS (qualified electronic timestamps) through a QTSP-accredited service, giving sealed documents the Art. 41 legal presumption. For the highest-level signatures (QES), the signing workflow uses Swisscom's QTSP-qualified signature infrastructure.

What This Means for EU and Swiss Businesses

If your organisation is using electronic signatures and timestamps for legally significant documents, the first question to ask your provider is: are you listed on the EU Trust List as a QTSP?

If the answer is no, or if the provider cannot point you to their specific entry on the EUTL, your documents do not carry the statutory legal presumption that GDPR Art. 32, eIDAS, and national implementing legislation contemplate for qualified electronic trust services.

Swiss Trust Layer uses Swisscom Trust Services — EU Trust List QTSP — for all document sealing. Every seal carries the eIDAS Art. 41 qualified timestamp presumption. Every seal is publicly verifiable at swisstrustlayer.com/validate without login.

Start protecting your documents at swisstrustlayer.com.