Uncategorized

The impact of the eIDAS regulation and understanding the new requirements

The impact of the eIDAS regulation and understanding the new requirements

The impact of the eIDAS regulation and understanding the new requirements

The Renaissance Spotlight for November is on Compliance. Many businesses and other organisations have to operate within regulatory frameworks specific to their industry, and all organisations need to comply with regulations such as GDPR. One of the most important regulations covers electronic transactions carried out by citizens of the EU — the Electronic Identification and Trust Services (eIDAS) regulation.

eIDAS has been in force for half a decade. The experience gained from its operation led to a review and recommendations for some tweaks and changes to what eIDAS mandates. These changes need to be in place by June 2024. But what’s changed? This article will briefly recap what eIDAS is, outline the headline proposed changes, and how Entrust eIDAS solutions can ensure your organisation complies with current and updated requirements.

As ever, if you want to chat with someone about the Entrust eIDAS solutions and tools, then contact Renaissance to start a conversation.

What is eIDAS?

The current eIDAS regulations protect EU citizens, consumers, and commercial entities using public services via electronic transactions, both within EU member states and the internal market, and when dealing with non-EU organisations operating in the EU.

Organisations operating in the EU that want to use services such as electronic identification, electronic seals, electronic trust services, qualified electronic signatures, digital signatures, qualified certificates, and electronic document verification have to abide by the eIDAS regulations.

To do so, they need to be an eIDAS Trust Service Provider (TSP) or use an external one. TSPs offer third-party trust services that underpin the requirements necessary to deliver digital ID, signatures, and all the authentication required for full eIDAS implementation and compliance. Entrust is a TSP that offers a complete portfolio of high assurance solutions for eIDAS, including identity, digital signing & time stamping, digital certificates, and hardware security modules (HSMs) — more on this below.

The eIDAS Regulations Review

The EU commenced a review to update the eIDAS regulations based on learning and feedback obtained from real-world use. The rapid shift to remote work in 2020 fed into the review and the findings released in June 2021. You can download the 73-page PDF report from the EU document library.

The report outlines that the original eIDAS regulations drafted in 2014 have not achieved their potential across the EU. The authors found that only 59% of citizens had access to valid electronic ID (eID) schemes. The report authors also noted that acceptance of validly notified eIDs by service providers within member states was limited. They also highlighted that most of the requirements for services covered by eIDAS regulations were in the private sector, and availability and uptake of electronic identity and signing in this sector was poor.

What’s Does the eIDAS Review Propose?

Some of the headline changes to the eIDAS regulations proposed by the review report authors are:

  • Mandatory Digital wallets for all citizens — member states will be required to provide all their citizens with a digital wallet capable of storing and presenting identifying documents like driving license, passport, national ID card, online services identification in electronic format, plus the ability to perform digital agreement signing.
  • Updates to remote signature services — an update to the regulations to include references to remote Qualified Signature Creation Devices and standards that govern them.
  • A common toolbox for EU digital identity — EU Commission is to work with the Member States to establish a common toolbox by October 2022 with the technical architecture, standards, and guidelines to follow when implementing EU digital identity wallets.
  • Adapt to the changing digital landscape- the digital landscape is very different in 2021 than in 2014. The new eIDAS regulations seek to reflect this fact and to enable more use of technologies like smart mobile devices for eID and digital signing.
  • Harmonisation with other EU regulations- clean up any inconsistencies introduced between different EU rules and regulations released in the years since eIDAS went into force.

The regulations will go to the EU Commission for adoption and should be in force by June 2024. You can find much more detail in the full 73-page report.

Entrust eIDAS Solutions Deliver Compliance

As mentioned earlier, Entrust is a TSP offering a complete portfolio of high assurance solutions for eIDAS, including identity, digital signing, time stamping, digital certificates, and hardware security modules (HSMs). Entrust’s HSMs securely store all the cryptographic keys needed for eIDAS services. They allow users to safely enter credentials and sign documents using a smartphone, a tablet, a computer, or any other electronic device with web browsing capability. An HSM also acts as a qualified signature creation device in a workflow.

Entrust HSMs are the ideal solution to generate and protect the crucial PKI keys, certificates and other items used to secure data and other services regulated by eIDAS. Under eIDAS, several kinds of trusted services require HSMs to be in place for the TSP to become qualified. The Entrust HSMs are fully compliant with this requirement. Entrust HSMs are also future-proofed via their full integration with cloud services that are increasingly the default for application deployment and other service delivery online.

To get the complete picture of Entrust eIDAS solutions, visit their eIDAS Compliance Starts Here page, where you can read more and download a comprehensive eIDAS Regulations for Dummies ebook.

Next Steps

Entrust is a top-tier trust service provider who can deliver all a business needs to fulfil its eIDAS requirements. From physical HSMs to cloud-based certificates and other security services, Entrust has the products and expertise you need.

Renaissance partners with Entrust to make their solutions available in Ireland. Contact us today to find out more, and visit our November Renaissance Spotlight: Compliance page for more information on delivering compliance for your organisation and your clients.