Annex II to Regulation (EU) No 910/2014 sets out the requirements for qualified electronic signature creation devices and qualified electronic seal creation devices.

The task of drawing up the technical specifications needed for the production and placing on the market of products, taking into account the current stage of technology, is carried out by organisations competent in the standardisation area.

ISO/IEC (International Organisation for Standardization/International Electrotechnical Commission) establishes the general concepts and principles of IT security and specifies the general model of assessment to be used as the basis for evaluation of security properties of IT products.

The European Committee for Standardisation (CEN) has developed, under the standardisation mandate M/460 given by the Commission, standards for qualified electronic signature and seals creation devices, where the electronic signature creation data or electronic seal creation data is held in an entirely but not necessarily exclusively user-managed environment. These standards are considered suitable for the assessment of conformity of such devices with the relevant requirements set out in Annex II to Regulation (EU) No 910/2014.

Annex II to Regulation (EU) No 910/2014 sets that only a qualified trust service provider can manage electronic signature creation data on behalf of a signatory. Security requirements and their respective certification specifications are different when the signatory physically possesses a product and when a qualified trust service provider operates on behalf of the signatory. To address both situations as well as to favour the development over time of products and assessment standards suitable to particular needs, the Annex to this Decision should list standards covering both situations.

At the time this Commission Decision has been adopted, several trust service providers already offer solutions managing electronic signature creation data on behalf of their customers. Certifications of products are currently limited to the hardware security modules certified against different standards but are not yet certified specifically against the requirements for qualified signature and seal creation devices. Nevertheless, published standards, such as EN 419 211 (applicable to electronic signature created in an entirely but not necessarily exclusively user-managed environment) do not yet exist for an equally important market of certified remote products. Since standards that might be appropriate for such purposes are currently under development, when such standards are available and assessed as compliant with the requirements set out in Annex II to Regulation (EU) No 910/2014, the Commission will complement this Decision. Until the moment where the list of such standards is established, an alternative process can be used for the assessment of the conformity of such products under the conditions provided for under point (b) of Article 30(3) of Regulation (EU) No 910/2014.

The Annex lists EN 419 211 which consists of different parts (1 to 6) covering different situations. EN 419 211 Part 5 and 419 211 Part 6 give extensions related to the qualified signature creation device environment, such as communication with trusted signature creation applications. Product manufacturers are free to apply such extensions. According to recital 56 of Regulation (EU) No 910/2014, the scope of certification under Articles 30 and 39 of that Regulation is limited to protecting the signature creation data and signature creation applications are excluded from the scope of the certification.

To ensure that the electronic signatures or seals generated by a qualified signature or seal creation device are reliably protected against forgery, as required by Annex II to Regulation (EU) No 910/2014, suitable cryptographic algorithms, key lengths and hash functions are the prerequisite for the security of the certified product. Since this matter has not been harmonised at European level, Member States should cooperate to agree on cryptographic algorithms, key lengths and hash functions to be used in the field of electronic signatures and seals.

The adoption of the present Decision renders Commission Decision 2003/511/EC obsolete. It should therefore be repealed.

The measures provided for in this Decision are in accordance with the opinion of the Committee referred to in Article 48 of Regulation (EU) No 910/2014,