Interoperability academy 2024 - Day 3 - EU Mutual Recognition Mechanisms_detailed overview.pdf

Presentation given at the Cross-regional exchange and learning week on Interoperability and Digital Transformation in the Western Balkans and Eastern Partnership region that took place 24-28 June 2024 in Brussels.

1. DIGITAL eSignature
EU Mutual Recognition Mechanisms
DG DIGIT -Apostolos (Tolis) APLADAS

2. EU -3rd Country Mutual
Recognition of eIDAS
QTSP/QTS
2

3. 3
Article 14 of eIDAS Regulation
•Recognition of 3rd country TSP/TS as legally equivalent to EU QTSP/QTS
•Closed list of 9 types of EU QTSP/QTS
•Under an agreementconcluded between the Union and the 3rd country or an
international organisationin accordance with Article 218 TFEU
•3
rd
country TSP/TS must meet the eIDAS requirements applicable to EU
QTSP/QTS
•Reciprocityof the legal equivalence of EU QTSP/QTS in 3rd country or
international organization

4. 3rd country preparing to MRA under Art.14 of eIDAS
4
•Expected to make use of the MRA cookbookdocumentation and of the technical pilot facilities
•Allowing them to:
Assessthe readiness and compliance of the 3rd country TSP/TS framework for mutual
recognition with EU QTSP/QTS on four relevant pillars:
Legalframework
Supervisoryframework
Technicalstandards and best practices
Trusted listrepresentation of TSP/TS approval
Better understand the technical implications /assumptions for the implementation of an eIDAS
MRA
Prepare the establishment of suitable implementation of 3rd country TL andpointer to EU LOTL
to express a future formal MRA
Set-up appropriate validation tools for “cross -validation” of equivalent (qualified) trust services
and their outputs when MRA is implemented
Be better prepared for engaging a mutual recognition process and assessment on the way
towards an MRA

5. Conclusion of a mutual recognition agreement (MRA) under Art.14 of
eIDAScan be a long journey
A typical eIDASArt.14 MRA life-cycle process flow
5

6. Main pillars for comparing PKI – based trust service schemes
(e.g. in a view of establishing recognition)
6

7. Commission’s Third
Countries Trust List (TCTL)
Programme
7

8. The Genesis of the TCTL Programme
Formal request
received from the
Ukrainian
Government to:
Technical
implementation
byEC and UA:
Recognize UA-QES
as eIDASAdES
Publication of AdESLOTL
pointing to UA TL
Update of DSSlibrary to
support MRA*elements
Supported by eIDASArt. 27(1)
To be adopted by MSs on a voluntary basis
8
* The MRA technical element was introduced in the context of the pilot for international compatibility of Trust Services of the eSignature building block

9. 9
Objective, scope and solution
Objective: Provide technical means for the Member States to facilitate the validation of electronic signatures
originating from 3
rd
countries
Scope: Recognition of a 3
rd
country’s Qualified Electronic Signatures (TC QES*) as eIDAS Advanced Electronic
Signatures (eIDAS AdES)
Solution:
1)Host a TC AdES LOTL,for voluntaryMember States to:
odownload and authenticate the TC’s trusted list
ovalidate TC QES* as eIDAS AdES, using the machine-processableMRA element, as specified in the
Pilot for the International Compatibility of Trust Services
2)Update the DSS library to support the processing of the MRA element
* Recognize electronic signatures that are not qualified in the EU, but that meet similar requirements in third
countries regulatory framework, as being fit for purpose in contexts requiring an advanced electronic signature .

10. Third Countries Trust List (TCTL) Programme at a glance
A document repository with all the necessary documentation and guidance for the 3
rd
countries. This material is available here
TCTL programmeby the European Commission offers:
A streamlinedand well-defined onboarding journey for the 3
rd
countries willing to align their Trust Services with the European ones
The eIDASDashboard that unifies and centralizes the DIGITAL eSignature and eID building blocks new and already existing tools and
information related to the eIDAStrust services backbone e.g. TL Browser, eSignature validation test cases, eIDAS lists, notification tool,
eIDASeIDNode management and reporting.
International Compatibility Pilot: MRA Technical Specification, a test LOTL, a test PKI, sample electronic signatures, DSS library

11. Recognition of TC-QES as eIDAS AdES
Legal context –eIDASRegulation Chapter III on Trust Services
Article 27(1) on “Electronic signatures in public services” states:
“If a Member State requires an advanced electronic signatureto use an online service offered by
[…] a public sector body, that Member State shall
recognize advanced electronic signatures, […]
in at least the formats or using methods defined in the implementing acts […].”
✘Must notbe confused with Article 14(1) on “International aspects”:
“Trust services provided by trust service providers established in a third country shall be recognised as legally
equivalent to qualified trust services[…] where the trust services originating from the third country are
recognisedunder an agreement concludedbetween the Union and the third country […] in accordance with
Article 218 TFEU.”
11

12. Recognition of TC-QES as
eIDAS AdES
To allow Member States on a voluntary basisto:
•Download and authenticate the TC trusted list;
•Validate TC-QES as eIDAS AdES, using the Mutual
Recognition Agreement (MRA) element.
MRA element defines equivalencebetween the UA
framework and the eIDASframework.
•Equivalence statements are defined within the
AdESLOTL
•Machine-processable
Pointer to UA TL (later
other TC TLs)
•UA TL signing certificates
•UA TL location
•UA country code
•MRA element
TC AdESLOTL
TL
Pointer to EU/EEA TLs
•TL signing certificates
•TL location
•Country code
EU/EEA LOTL
Scheme Information
Pointer to TC AdES LOTLPointer to EU/EAA LOTL
EU Official Journal
EU/EEA LOTL EC signing certificates
Pointer to UATL (later
other TC TLs)
•UATL signing certificates
•UATL location
•UAcountry code
•MRA element
Scheme Information
Pointer to TC AdESLOTL
Signed with EU/EEA LOTL
EC signing certificates
EU/EEA LOTL location
Publication of Third Countries AdES LOTL
pointing to TC Trusted List (TL)
12

13. Publication of TC AdESLOTL & update of DSS library to support the
processing of MRA elements
13
UA-QESig
DSS validation tool
TC AdESLOTL
UA TL
Signed document
UA-QTSP
1
UA-QTSP
…
UA-QTSP
x
Uses
Validation report
MRA
International Compatibility Pilot for Trust Services
Contains technical documentation and specifications for the technical execution
of Art. 14 mutual recognition agreement or facilitating Art. 27(1) application to
non-EU electronic signatures.

14. User-friendly display of TC AdESLOTL in the eIDAS Dashboard

15. Technical Pilot Tools
15

16. 16
Objective of the pilot tools
Demonstrate the technical feasibility of
mutual recognition of electronic signatures:
3
rd
Country qualified signature recognized by EU
EU qualified signature recognized by 3
rd
Country

17. Tools being made available
17
•A test LOTL, pointing to the eIDAS TLs and to
a 3
rd
country TL.
•The 3
rd
country TL contains a TSP entry with a qualified
status.
•The test LOTL and 3
rd
country TL point to each other.
Each pointer contains MRA information.

18. Tools being made available
18
•A small test PKI, set up in order to implement the
QTSP/QTS listed in the 3
rd
country TL, and a test keystore
containing the private key supported by a test end- entity
qualified certificate for electronic signatures issued by
this QTSP/QTS
•A sample document that has been signed with the above
3
rd
country QC for electronic signatures, and a QC for
electronic signatures from Belgium.

19. Tools being made available
19
A DSS library-based web
application to validate
signatures / certificates (from
EU and from the 3
rd
country)
of the sample document.
https://eidas.ec.europa.eu/efd
a/validation-tool

20. Recognition of TC-QES as
eIDAS AdES
21

21. Preliminary Assessment
•A general description of the 3rd country (Q)TS framework, covering all four legal, supervisory,
technical and trust representation aspects
•The legislative documents ruling its (Q)TS frameworkor other relevant legislations e.g. on data
protection, consumer rights, privacy, freedom of expression, etc.
•Links to the 3rd country relevant (Q)TS framework normative or informative resources
•An eIDAS Art.14 self-assessment
•The list of standards the 3rd country (Q)TS framework refers to / uses and a description of the way
these standards are used / complied to

22. Detailed Mutual Assessments
•The Commission undertakes the conduction of a detailed assessment of technical and/or legal pilots
•Commission drafts an MRA execution plan , including the proposed resulting pointer in the EC LOTL
•Commission drafts MRA monitoring and termination plans that will be discussed with the applicant
3rd country
•Commission drafts an MRA monitoring plan that addresses the relevance of the exchange of annual
reports between the MRA signatories

23. Minimum requirements for 3
rd
Country’s TSP/TS Framework
The following areas will be assessed by the Commission:
•Legal landscape; assessment of the 3rd Country’s legal framework on QTSP/QTS (“P1. Legal -eIDAS
benchmarking” sheet) and secondly with the UNCITRAL Model Law and other eIDAS related EU laws,
including personal data protection and privacy, consumer protection and consumer rights, and
freedom of expression
•Supervision and conformity; assessmentof the 3
rd
Country’s supervision and auditing regime related
to the (Q)TS Framework
•Technical and best practices; assessmentof the 3
rd
Country’s Trust Services Framework in terms of
the applicable technical specifications, standards and practices followed by the (Q)TSPs
•Trust representation; assessmentof the 3
rd
Country’s Trust representation model, in particular with
regards to the 3
rd
Country’s Trusted List(s)

24. A Mutual Recognition Agreement is beneficial for both parties
•Education:
•Digital diplomas
•Online enrolment to a University Campus
•Health:
•ePrescriptions
•Medical records exchange among hospitals in a fast and secure way
•Business:
•eInvoicing
•Contract signing
•Faster recruitment
•Trade:
•Online certificates
•Elimination of red tape

25. Sources
•Website on Pilot for the International Compatibility of Trust Services
•eidas.ec.europa.eu
•Documentation
•MRA CookBook
•eIDAS Article 14 Assessment Check -List
•MRA element specification (and XML Schema Definition)
•MRA element usage

26. THANK YOU