### on the basis of the subsidiarity principle , the purpose of this regulation is not to harmonize the conditions of cultivation in member states but to grant freedom to member states to invoke other grounds than scientific assessment of health and environmental risks to ban cultivation of gmos on their territory . in addition one of the purposes of directive 98 / 34 / ec of the european parliament and of the council of 22 june 1998 laying down a procedure for the provision of information in the field of technical standards and regulations27 which is to allow the commission to consider the adoption of binding acts at eu level would not be served by the systematic notification of member states ' measures under that directive . moreover , since measures which member states can adopt under this regulation cannot have as a subject the placing of the market of gmos and thus does not modify the conditions of placing on the market of gmos authorised under the existing legislation , the notification procedure under directive 98 / 34 / ec does not appear the most appropriate information channel for the commission . therefore , by derogation , directive 98 / 34 / ec should not be applicable . a simpler notification system of the national measures prior to their adoption appears to be a more proportionate tool for the commission to be aware of these measures . measures which member states intend to adopt should thus be communicated together with their reasons to the commission and to the other member states one month prior to their adoption for information purposes . ### on the basis of the subsidiarity principle , the purpose of this regulation is not to harmonize the conditions of cultivation in member states but to grant flexibility to member states to invoke other grounds apart from scientific assessment of health and environmental risks to ban cultivation of gmos on their territory . such other grounds should be properly substantiated , given that the notification procedure under directive 98 / 34 / ec of the european parliament and of the council of 22 june 1998 laying down a procedure for the provision of information in the field of technical standards and regulations27 appears to be the most appropriate information channel for the commission . measures which member states intend to adopt should thus be communicated together with their reasons to the commission and to the other member states one month prior to their adoption for information purposes .


### experience has shown that cultivation of gmos is an issue which is more thoroughly addressed by member states , either at central or at regional and local level . contrary to issues related to the placing on the market and the import of gmos , which should remain regulated at eu level to preserve the internal market , cultivation has been acknowledged as an issue with a strong local / regional dimension . in accordance with article 2 tfeu member states should therefore be entitled to have a possibility to adopt rules concerning the effective cultivation of gmos in their territory after the gmo has been legally authorised to be placed on the eu market . ### experience has shown that cultivation of gmos is an issue which is more thoroughly addressed by member states , either at central or at regional and local level . contrary to issues related to the placing on the market and the import of gmos , which should remain regulated at eu level to preserve the internal market , cultivation has been acknowledged as an issue with a strong local / regional / territorial dimension and as of particular importance for the self - determination of member states . in accordance with article 2 tfeu member states should therefore be entitled to have a possibility to adopt binding legislative provisions concerning the effective cultivation of gmos in their territory after the gmo has been legally authorised to be placed on the eu market .


### on the basis of the subsidiarity principle , the purpose of this regulation is not to harmonize the conditions of cultivation in member states but to grant freedom to member states to invoke other grounds than scientific assessment of health and environmental risks to ban cultivation of gmos on their territory . in addition one of the purposes of directive 98 / 34 / ec of the european parliament and of the council of 22 june 1998 laying down a procedure for the provision of information in the field of technical standards and regulations which is to allow the commission to consider the adoption of binding acts at eu level would not be served by the systematic notification of member states ' measures under that directive . moreover , since measures which member states can adopt under this regulation cannot have as a subject the placing of the market of gmos and thus does not modify the conditions of placing on the market of gmos authorised under the existing legislation , the notification procedure under directive 98 / 34 / ec does not appear the most appropriate information channel for the commission . therefore , by derogation , directive 98 / 34 / ec should not be applicable . a simpler notification system of the national measures prior to their adoption appears to be a more proportionate tool for the commission to be aware of these measures . measures which member states intend to adopt should thus be communicated together with their reasons to the commission and to the other member states one month prior to their adoption for information purposes . ### on the basis of the subsidiarity principle , the purpose of this regulation is not to harmonize the conditions of cultivation in member states but to grant flexibility to member states to invoke other grounds than scientific assessment of health and environmental risks to restrict or prohibit the cultivation of gmos on their territory in order to ease the decision - making process surrounding the issue of gmos in the union . this regulation , on balance , may therefore benefit the internal market . in addition of the purposes of directive 98 / 34 / ec of the european parliament and of the council of 22 june 1998 laying down a procedure for the provision of information in the field of technical standards and regulations which is to allow the commission to consider the adoption of binding acts at eu level would not be served by the systematic notification of member states ' measures under that directive . moreover , since measures which member states can adopt under this regulation cannot have as a subject the placing of the market of gmos and thus does not modify the conditions of placing on the market of gmos authorised under the existing legislation per se , the notification procedure under directive 98 / 34 / ec does not appear the most appropriate information channel for the commission . therefore , by derogation , directive 98 / 34 / ec should not be applicable . a simpler notification system of the national measures prior to their adoption appears to be a more proportionate tool for the commission to be aware of these measures . measures which member states intend to adopt should thus be communicated together with their reasons to the commission and to the other member states one month prior to their adoption for information purposes .


### member states should therefore be authorised to adopt measures restricting or prohibiting the cultivation of all or particular gmos in all or part of their territory , and respectively amend those measures as they deem appropriate , at all stages of the authorisation , re - authorisation or withdrawal from the market of the concerned gmos . this should apply as well to genetically modified varieties of seed and plant propagating material which are placed on the market in accordance with relevant legislation on the marketing of seeds and plant propagating material and , in particular , in accordance with directives 2002 / 53 / ec and 2002 / 55 / ec . measures should refer to the cultivation of gmos only and not to the free circulation and import of genetically modified seeds and plant propagating material , as or in products , and of the products of their harvest . similarly they should not affect the cultivation of non genetically modified varieties of seed and plant propagating material in which adventitious or technically unavoidable traces of eu authorised gmos are found . ### member states should therefore be authorised to adopt measures restricting or prohibiting the cultivation of all or particular gmos , on a case - by - case basis , in all or part of their territory , provided the relevant measures are adopted and are made publicly accessible to all operators concerned , including producers , at least six months before the start of the cultivation season , and to respectively amend those measures as they deem appropriate , at all stages of the authorisation , re - authorisation or withdrawal from the market of the concerned gmos . this should apply as well to genetically modified varieties of seed and plant propagating material which are placed on the market in accordance with relevant legislation on the marketing of seeds and plant propagating material and , in particular , in accordance with directives 2002 / 53 / ec and 2002 / 55 / ec . measures should refer to the cultivation of gmos only and not to the free circulation and import of genetically modified seeds and plant propagating material , as or in products , and of the products of their harvest . similarly they should not affect the cultivation of non genetically modified varieties of seed and plant propagating material in which adventitious or technically unavoidable traces of eu authorised gmos are found .


### the commission shall develop a european database on drug precursors with the following functions : ### following the adoption of the delegated acts referred to in article 3 , the commission shall establish a european database on drug precursors with the following functions :


### tobacco products other than cigarettes , roll - your - own tobacco and smokeless tobacco products shall be exempted from the prohibitions laid down in paragraphs 1 and 5 . the commission shall be empowered to adopt delegated acts in accordance with article 22 to withdraw this exemption if there is a substantial change of circumstances as established in a commission report . ### tobacco products other than cigarettes , roll - your - own tobacco and smokeless tobacco products shall be exempted from the prohibitions laid down in paragraphs 1 and 5 .


### the power to adopt delegated acts referred to in articles 3 , 3 , 4 , 4 , 6 , 6 , 6 , 8 , 9 , 10 , 11 , 13 , 13 , 14 , 18 and 18 shall be conferred on the commission for an indeterminate period of time from [ office of publications : please insert the date of the entry into force of this directive ] . ### the power to adopt delegated acts referred to in articles 4 , 4 , 8 , 9 , 11 and 14 shall be conferred on the commission for an indeterminate period of time from [ office of publications : please insert the date of the entry into force of this directive ] .


### in addition to the unique identifier , member states shall require that all unit packets of tobacco products which are placed on the market carry a visible , tamper proof security feature of at least 1 cm² , which shall be irremovably printed or affixed , indelible and in no way hidden or interrupted in any form , including through tax stamps and price marks , or other elements mandated by legislation . ### in addition to the unique identifier , member states shall require that all unit packets of tobacco products which are placed on the market carry a tamper proof security feature , which shall be irremovably printed or affixed , indelible and in no way hidden or interrupted in any form , including through tax stamps and price marks , or other elements mandated by legislation .


### cover 75 % of the external area of both the front and back surface of the unit packet and any outside packaging ; ### cover 50 % of the external area of both the front and back surface of the unit packet and any outside packaging ;


### promotes a tobacco product by means that are false , misleading , deceptive or likely to create an erroneous impression about its characteristics , health effects , hazards or emissions ; ### promotes a tobacco product by means that are false , misleading , deceptive or likely to create an erroneous impression about its characteristics , health effects , hazards or emissions , in particular by suggesting that a particular tobacco product is less harmful than others or has vitalising , energetic , healing , rejuvenating , natural , organic or otherwise positive health effects ;


### in order to make this directive fully operational and to keep up with technical , scientific and international developments in tobacco manufacture , consumption and regulation , the power to adopt acts in accordance with article 290 of the treaty on the functioning of the european union should be delegated to the commission , in particular in respect of adopting and adapting maximum yields for emissions and their measurement methods , setting maximum levels for ingredients that increase toxicity , addictiveness or attractiveness , , the use of health warnings , unique identifiers and security features in the labelling and packaging , defining key elements for contracts on data storage with independent third parties , reviewing certain exemptions granted to tobacco products other than cigarettes , roll - your - own tobacco and smokeless tobacco products and reviewing the nicotine levels for nicotine containing products . it is of particular importance that the commission carries out appropriate consultations during its preparatory work , including at expert level . the commission , when preparing and drawing up delegated acts , should ensure a simultaneous , timely and appropriate transmission of relevant documents to the european parliament and council . ### in order to make this directive fully operational and to keep up with technical , scientific and international developments in tobacco manufacture , consumption and regulation , the power to adopt acts in accordance with article 290 of the treaty on the functioning of the european union should be delegated to the commission . it is of particular importance that the commission carries out appropriate consultations during its preparatory work , including at expert level . the commission , when preparing and drawing up delegated acts , should ensure a simultaneous , timely and appropriate transmission of relevant documents to the european parliament and council .


### the likelihood of diverging regulation is further increased by concerns over tobacco products , including smokeless tobacco products , having a characterising flavour other than tobacco , which may facilitate uptake of tobacco consumption or affect consumption patterns . for example , in many countries , sales of mentholated products gradually increased even as smoking prevalence overall declined . a number of studies indicated that mentholated tobacco products can facilitate inhalation as well as smoking uptake among young people . measures introducing unjustified differences of treatment between flavoured cigarettes should be avoided . ### the likelihood of diverging regulation is further increased by concerns over tobacco products , including smokeless tobacco products , having a characterising flavour other than tobacco and traditional flavours such as menthol , which may facilitate uptake of tobacco consumption or affect consumption patterns .


### the delegation of powers referred to in articles 3 , 3 , 4 , 4 , 6 , 6 , 6 , 8 , 9 , 10 , 11 , 13 , 13 , 14 , 18 and 18 may be revoked at any time by the european parliament or by the council . a decision to revoke shall put an end to the delegation of the power specified in that decision . it shall take effect the day following the publication of the decision in the official journal of the european union or at a later date specified therein . it shall not affect the validity of any delegated acts already in force . ### the delegation of powers referred to in articles 4 , 4 , 8 , 9 , 11 and 14 may be revoked at any time by the european parliament or by the council . a decision to revoke shall put an end to the delegation of the power specified in that decision . it shall take effect the day following the publication of the decision in the official journal of the european union or at a later date specified therein . it shall not affect the validity of any delegated acts already in force .


### council directive 89 / 622 / eec of 13 november 1989 on the approximation of the laws , regulations and administrative provisions of the member states concerning the labelling of tobacco products and the prohibition of the marketing of certain types of tobacco for oral use prohibited the sale in the member states of certain types of tobacco for oral use . directive 2001 / 37 / ec confirmed this prohibition . article 151 of the act of accession of austria , finland and sweden grants the kingdom of sweden derogation from this prohibition . the prohibition of the sale of oral tobacco should be maintained in order to prevent the introduction to the internal market of a product that is addictive , has adverse health effects and is attractive to young people . for other smokeless tobacco products that are not produced for the mass market , a strict labelling and ingredients regulation is considered sufficient to contain market expansion beyond their traditional use . ### council directive 89 / 622 / eec of 13 november 1989 on the approximation of the laws , regulations and administrative provisions of the member states concerning the labelling of tobacco products and the prohibition of the marketing of certain types of tobacco for oral use prohibited the sale in the member states of certain types of tobacco for oral use . directive 2001 / 37 / ec confirmed this prohibition . article 151 of the act of accession of austria , finland and sweden grants the kingdom of sweden derogation from this prohibition . upholds the ban on tobacco products for oral use , however , such a ban should not affect historically traditional tobacco products for oral use , which may be allowed by individual member states . for other smokeless tobacco products that are not produced for the mass market , a strict labelling and ingredients regulation is considered sufficient to contain market expansion beyond their traditional use .


### the invoice , order number and payment records of all purchasers from manufacturing to the first retail outlet . ### the invoice , order number and payment records of the first customer who is not affiliated with the manufacturer .


### member states should remain free to maintain or introduce national legislations applying to all products alike for aspects falling outside the scope of this directive , provided they are compatible with the treaty and do not jeopardise the full application of this directive . accordingly , member states could , for instance , maintain or introduce provisions providing standardisation of packaging of tobacco products provided that those provisions are compatible with the treaty , with wto obligations and do not affect the full application of this directive . a prior notification is required for technical regulations pursuant to directive 98 / 34 / ec of the european parliament and of the council of 22 june 1998 laying down a procedure for the provision of information in the field of technical standards and regulations and on rules on information society services . ### member states should remain free to maintain or introduce national legislations applying to all products alike for aspects falling outside the scope of this directive , provided they are compatible with the treaty and do not jeopardise the full application of this directive . with regard to measures already harmonized by this directive , such as labelling und packaging requirements , the procedure foreseen in article 114 tfeu shall apply .


### a delegated act pursuant to articles 3 , 3 , 4 , 4 , 6 , 6 , 6 , 8 , 9 , 10 , 11 , 13 , 13 , 14 , 18 and 18 shall enter into force only if no objection has been expressed either by the european parliament or the council within a period of two months of notification of that act to the european parliament and the council or if , before the expiry of that period , the european parliament and the council have both informed the commission that they will not object . that period shall be extended by two months at the initiative of the european parliament or of the council . ### a delegated act pursuant to articles 4 , 4 , 8 , 9 , 11 and 14 shall enter into force only if no objection has been expressed either by the european parliament or the council within a period of two months of notification of that act to the european parliament and the council or if , before the expiry of that period , the european parliament and the council have both informed the commission that they will not object . that period shall be extended by two months at the initiative of the european parliament or of the council .


### the identity of all purchasers from manufacturing to the first retail outlet ; ### the identity of any known subsequent purchaser ;


### the actual shipment route from manufacturing to the first retail outlet , including all warehouses used ; ### the shipment date , the shipmemt destination , point of departure and consignee ;


### member states shall ensure that manufacturers of tobacco products provide all economic operators involved in the trade of tobacco products from the manufacturer to the last economic operator before the first retail outlet , including importers , warehouses and transporting companies with the necessary equipment allowing for the recording of the tobacco products purchased , sold , stored , transported or otherwise handled . the equipment shall be able to read and transmit the data electronically to a data storage facility pursuant to paragraph 6 . ### member states shall ensure that manufacturers of tobacco products provide all economic operators involved in the trade of tobacco products from the manufacturer to the first customer who is not affiliated with the with the necessary equipment allowing for the recording of the tobacco products purchased , sold to the first customer who is not affiliated with the manufacturer , stored , transported or otherwise handled . the equipment shall be able to read and transmit the data electronically to a data storage facility pursuant to paragraph 6 .


### the agency may decide to make publicly available parts of the information which it holds provided that commercially sensitive information on individual market participants or individual transactions is not released . ### the agency should make publicly available the information which it holds provided that commercially sensitive information on individual market participants or individual transactions is not released .


### it is important to ensure that consumers can have confidence in the integrity of electricity and gas markets and that prices set on wholesale energy markets reflect a fair interplay between supply and demand . ### it is important that prices set on wholesale energy markets reflect a fair interplay between supply and demand to ensure that consumers pay a fair price for electricity and gas in the entire european economic area .


### – secure or attempt to secure , by a person or by persons acting in collaboration , the price of one or several wholesale energy products at an abnormal or artificial level , unless the person who entered into the transactions or issued the orders to trade establishes that his reasons for doing so are legitimate and that these transactions or orders to trade conform to accepted market practices on the wholesale energy market concerned ; or ### – secure or attempt to secure , by a person or by persons acting in collaboration , the price of one or several wholesale energy products at an abnormal or artificial level ; or


### specification of the definitions of inside information and market manipulation is necessary to account for the specificities of wholesale energy markets , which are dynamic and subject to change . the commission should be empowered to adopt delegated acts in accordance with article 290 of the treaty in respect to such detailed rules . ### specification of the definitions of inside information and market manipulation is necessary to account for the specificities of wholesale energy markets , which are dynamic and subject to change . the commission should be empowered to adopt delegated acts in accordance with article 290 of the treaty in respect to such detailed rules . when preparing and drawing up delegated acts , the commission should ensure a simultaneous , timely and appropriate transmission of relevant documents to the european parliament and the council and carry out appropriate and transparent consultations , including at expert level , well in advance as foreseen in the common understanding on practical arrangements for the use of delegated acts .


### electronic seals should serve as evidence that an electronic document was issued by a legal person , ensuring certainty of the document’s origin and integrity . ### valid electronic seals should serve as prima facie evidence for the authenticity and integrity of an electronic document associated with them . this should be without prejudice to national provisions on power of attorney , representation and legal capacity .


### when an electronic identification using an electronic identification means and authentication is required under national legislation or administrative practice to access a service online , any electronic identification means issued in another member state falling under a scheme included in the list published by the commission pursuant to the procedure referred to in article 7 shall be recognised and accepted for the purposes of accessing this service . ### when an electronic identification using an electronic identification means and authentication is required under union or national legislation or administrative practice to access a service online in one member state or provided online by union institutions , bodies , offices and agencies , this electronic identification means issued in another member state or by union institutions , bodies , offices and agencies under a scheme included in the list published by the commission pursuant to article 7 , and with a security level equal to or higher than the security level required to access the service , shall be recognised in the member state or by union institutions , bodies , offices and agencies for the purposes of accessing that service online , not later than six months after the list , including that scheme , is published .


### in order to complement certain detailed technical aspects of this regulation in a flexible and rapid manner , the power to adopt acts in accordance with article 290 of the treaty on the functioning of the european union should be delegated to the commission in respect of interoperability of electronic identification ; security measures required of trust service providers ; recognised independent bodies responsible for auditing the service providers ; trusted lists ; requirements related to the security levels of electronic signatures ; requirements of qualified certificates for electronic signatures their validation and their preservation ; the bodies responsible for the certification of qualified electronic signature creation devices ; and the requirements related to the security levels of electronic seals and to qualified certificates for electronic seals ; the interoperability between delivery services . it is of particular importance that the commission carry out appropriate consultations during its preparatory work , including at expert level . ### in order to complement certain detailed technical aspects of this regulation in a flexible and rapid manner , the power to adopt acts in accordance with article 290 of the treaty on the functioning of the european union should be delegated to the commission in respect of interoperability of electronic identification ; trusted lists ; requirements of qualified certificates for electronic signatures their validation and their preservation ; the bodies responsible for the certification of qualified electronic signature creation devices ; and to qualified certificates for electronic seals ; the interoperability between delivery services . it is of particular importance that the commission carry out appropriate consultations during its preparatory work , including at expert level .


### a qualified electronic seal shall enjoy the legal presumption of ensuring the origin and integrity of the data to which it is linked . ### a valid qualified electronic seal shall serve at least as prima facie evidence for the authenticity and integrity of the electronic document associated with it . this shall be without prejudice to national provisions on power of attorney and representation .


### ‘ qualified electronic signature’ means an advanced electronic signature which is created by a qualified electronic signature creation device , and which is based on a qualified certificate for electronic signatures ; ### ‘ qualified electronic signature’ means an advanced electronic signature which is created by a qualified electronic signature creation device , and which is based on a qualified certificate for electronic signatures issued by a qualified trust provider ;


### this regulation establishes a legal framework for electronic signatures , electronic seals , electronic time stamps , electronic documents , electronic delivery services and website authentication . ### this regulation establishes a legal framework for electronic signatures , electronic seals , electronic validation and verification , electronic time stamps , electronic documents , electronic delivery services and website authentication .


### member states which notify an electronic identification scheme shall forward to the commission the following information and without undue delay , any subsequent changes thereof : a description of the notified electronic identification scheme ; the authorities responsible for the notified electronic identification scheme ; information on by whom the registration of the unambiguous person identifiers is managed ; ### the notifying member state shall forward to the commission the following information and without undue delay , any subsequent changes thereof : a description of the notified electronic identification scheme , including its identity assurance levels ; the authority or authorities responsible for the notified electronic identification scheme ; information on the entity or entities which manages the verification of the person identification data ;


### the commission may , by means of implementing acts , establish reference numbers of standards for trustworthy systems and products . compliance with the requirements laid down in article 19 shall be presumed where trustworthy systems and products meet those standards . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 39 . the commission shall publish those acts in the official journal of the european union . ### the commission may , by means of implementing acts , establish reference numbers of standards for trustworthy systems and products . compliance with the requirements laid down in article 19 shall be achieved through the compliance of trustworthy systems and products with those standards . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 39 . the commission shall publish those acts in the official journal of the european union .


### this regulation applies to electronic identification provided by , on behalf or under the responsibility of member states and to trust service providers established in the union . ### this regulation applies to electronic identification mandated , recognised or issued by or on behalf of member states .


### it is created using electronic signature creation data that the signatory can , with high level of confidence , use under his sole control ; and ### it is created using an electronic signature creation device that the signatory can use under his sole control ; and


### the delegation of power referred to in articles 8 , 13 , 15 , 16 , 18 , 20 , 21 , 23 , 25 , 27 , 28 , 29 , 30 , 31 , 35 and 37 may be revoked at any time by the european parliament or by the council . a decision to revoke shall put an end to the delegation of the power specified in that decision . it shall take effect the day following the publication of the decision in the official journal of the european union or at a later date specified therein . it shall not affect the validity of any delegated acts already in force . ### the delegation of power referred to in articles 8 , 18 , 21 , 23 , 25 , 27 , 29 , 30 , 31 , 35 and 37 may be revoked at any time by the european parliament or by the council . a decision to revoke shall put an end to the delegation of the power specified in that decision . it shall take effect the day following the publication of the decision in the official journal of the european union or at a later date specified therein . it shall not affect the validity of any delegated acts already in force .


### in order to implement paragraphs 1 and 2 , the competent supervisory body shall have the power to issue binding instructions to trust service providers . ### in order to implement paragraphs 1 and 2 , the competent supervisory body shall have the power to issue binding instructions to trust service providers . the supervisory body should coordinate these binding instructions with other relevant regulatory bodies that supervise the trust service provider ' s activities other than the trust service provision .


### this regulation should also establish a general legal framework for the use of electronic trust services . however , it should not create a general obligation to use them . in particular , it should not cover the provision of services based on voluntary agreements under private law . neither should it cover aspects related to the conclusion and validity of contracts or other legal obligations where there are requirements as regards form prescribed by national or union law . ### this regulation should also establish a general legal framework for the use of electronic trust services . however , it should not create a general obligation to use them . in particular , it should not cover the provision of services based on voluntary agreements under private law . it should also be without prejudice to provisions on the form , formation or effect of contracts or to the form , creation or validity of other private - law obligations irrespective of whether they are founded on national or union law , for example articles 10 and 11 of regulation no 593 / 2008 . furthermore this regulation should be without prejudice to the rules and restrictions in national or union law on the use of documents , and should not apply to register procedures , particularly those relating to land registers and trade registers .


### ‘ qualified certificate for electronic signature’ means an attestation which is used to support electronic signatures , is issued by a qualified trust service provider and meet the requirements laid down in annex i ; ### ‘ qualified certificate for electronic signature’ means a certificate which is used to support electronic signatures , is issued by a qualified trust service provider and meet the requirements laid down in annex i ;


### the notifying member state ensures the availability of an authentication possibility online , at any time and free of charge so that any relying party can validate the person identification data received in electronic form . member states shall not impose any specific technical requirements on relying parties established outside of their territory intending to carry out such authentication . when either the notified identification scheme or authentication possibility is breached or partly compromised , member states shall suspend or revoke without delay the notified identification scheme or authentication possibility or the compromised parts concerned and inform the other member states and the commission pursuant to article 7 ; ### the notifying member state ensures the availability of authentication online , so that any relying party established outside of the territory of that member state can validate the person identification data received in electronic form . such authentication shall be provided free of charge when accessing a service online provided by a public sector body . member states shall not unduly impose any specific technical requirements on relying parties intending to carry out such authentication ;


### in line with the obligations under the un convention on the rights of persons with disabilities that has entered into force in the eu , persons with disabilities should be able to use trust services and end user products used in the provision of those services on equal bases with other consumers . ### in line with the obligations under the un convention on the rights of persons with disabilities that has entered into force in the eu , and with respect to and in full compliance with union legislation on accessibility of public sector bodies websites , persons with disabilities should be able to use trust services and electronic identification services and end user products used in the provision of those services on equal bases with other consumers .


### if an electronic signature with a security assurance level below qualified electronic signature is required , in particular by a member state for accessing a service online offered by a public sector body on the basis of an appropriate assessment of the risks involved in such a service , all electronic signatures matching at least the same security assurance level shall be recognised and accepted . ### if an electronic signature with a security assurance level below qualified electronic signature is required , by a member state or by institutions , bodies , offices and agencies of the union for completing a transaction offered by a public sector body on the basis of an appropriate assessment of the risks involved in such a service , all electronic signatures matching at least the same security assurance level shall be recognised and accepted for access to that online service .


### the commission shall report to the european parliament and to the council on the application of this regulation . the first report shall be submitted no later than four years after the entry into force of this regulation . subsequent reports shall be submitted every four years thereafter . ### the commission shall report to the european parliament and to the council on the application of this regulation . the first report shall be submitted no later than two years after the entry into force of this regulation . subsequent reports shall be submitted every four years thereafter


### this regulation does not apply to the provision of electronic trust services based on voluntary agreements under private law . ### this regulation shall apply to both qualified and non - qualified trust service providers established , or providing services , in the union . it does not apply to the provision of electronic trust services based on voluntary agreements under private law not related to access to public services .


### a qualified trust service provider shall be liable for any direct damage caused to any natural or legal person due to failure to meet the requirements laid down in this regulation , in particular in article 19 , unless the qualified trust service provider can prove that he has not acted negligently . ### a qualified trust service provider shall be liable for : any damage caused to any natural or legal person which could reasonably be expected to arise under normal circumstances as a result of its failure to meet the requirements laid down in this regulation , in particular in article 19 , unless the qualified trust service provider can prove that it has acted with due diligence ; point shall apply mutatis mutandis where the qualified trust service provider has guaranteed , pursuant to point of article 10 , the compliance with the requirements of this regulation of a qualified trust service provider established in a third country , unless the qualified trust service provider established in the union can prove that the former has acted with due diligence .


### the commission shall report to the european parliament and to the council on the application of this regulation . the first report shall be submitted no later than four years after the entry into force of this regulation . subsequent reports shall be submitted every four years thereafter . ### the commission shall report to the european parliament and to the council on the application of this regulation , in particular with a view to reaching the aim of the regulation to develop the digital single market by strengthening confidence and trust in secure cross - border electronic transactions . the report shall take account of , amongst others , market developments as well as legal and technological developments . it shall further be accompanied by appropriate legislative proposals if necessary . the first report shall be submitted no later than two years after the entry into force of this regulation . subsequent reports shall be submitted every four years thereafter .


### when an electronic identification using an electronic identification means and authentication is required under national legislation or administrative practice to access a service online , any electronic identification means issued in another member state falling under a scheme included in the list published by the commission pursuant to the procedure referred to in article 7 shall be recognised and accepted for the purposes of accessing this service . ### when an electronic identification using an electronic identification means and authentication is required under union or national legislation or administrative practice to access a service online in one member state or provided online by union institutions , bodies , offices and agencies , this electronic identification means issued in another member state or by union institutions , bodies , offices and agencies under a scheme included in the list published by the commission pursuant to article 7 , and with a security level equal to or higher than the security level required to access the service , shall be recognised in the member state or by union institutions , bodies , offices and agencies for the purposes of accessing that service online , not later than six months after the list , including that scheme , is published .


### member states shall not request for cross - border access to a service online offered by a public sector body an electronic signature at a higher security assurance level than qualified electronic signature . ### member states shall not request for cross - border access to a service online offered by a public sector body an electronic signature at a higher security level than qualified electronic signature .


### qualified trust services and qualified certificates provided by qualified trust service providers established in a third country shall be accepted as qualified trust services and qualified certificates provided by a qualified trust service providers established in the territory of the union if the qualified trust services or qualified certificates originating from the third country are recognised under an agreement between the union and third countries or international organisations in accordance with article 218 tfue . ### qualified trust services and qualified certificates provided by qualified trust service providers established in a third country shall be accepted as qualified trust services and qualified certificates provided by a qualified trust service provider established in the territory of the union if : the qualified trust service provider fulfils the requirements laid down in this regulation and has been accredited under an accreditation scheme established in a member state ; or the qualified trust service provider established within the union which fulfils the requirements laid down in this regulation guarantees the compliance with the requirements laid down in this regulation ; or the qualified trust services or qualified certificates originating from a third country are recognised under an agreement between the union and that third country or international organisation in accordance with article 218 tfeu .


### with reference to paragraph 1 , such agreements shall ensure that the requirements applicable to qualified trust services and qualified certificates provided by qualified trust service providers established in the territory of the union are met by the trust service providers in the third countries or international organisations , especially with regard to the protection of personal data , security and supervision . ### with reference to paragraph 1 , the commission shall verify that such agreements ensure that the requirements applicable to qualified trust services and qualified certificates provided by qualified trust service providers established in the territory of the union are met by the trust service providers in the third countries or international organisations , especially with regard to the protection of personal data , security and supervision .


### the commission may , by means of implementing acts , establish reference numbers of standards for qualified validation service referred to in paragraph 1 . compliance with the requirements laid down in point of paragraph 1 shall be presumed where the validation service for qualified electronic signature meets those standards . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 39 . the commission shall publish those acts in the official journal of the european union . ### the commission may , by means of implementing acts , establish reference numbers of standards for qualified validation service referred to in paragraph 1 . the commission shall ensure , that stakeholder input is duly considered , preferably in form of an impact assessment , when defining standards to be used for the purpose of this regulation . compliance with the requirements laid down in point of paragraph 1 shall be presumed where the validation service for qualified electronic signature meets those standards . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 39 . the commission shall publish those acts in the official journal of the european union .


### a delegated act adopted pursuant to articles 8 , 13 , 15 , 16 , 18 , 20 , 21 , 23 , 25 , 27 , 28 , 29 , 30 , 31 , 35 and 37 shall enter into force only if no objection has been expressed either by the european parliament or the council within a period of two months of notification of that act to the european parliament and the council or if , before the expiry of that period , the european parliament and the council have both informed the commission that they will not object . that period shall be extended by two months at the initiative of the european parliament or of the council . ### a delegated act adopted pursuant to articles 8 , 16 , 23 , 25 , 27 , 29 , 30 , 31 and 37 shall enter into force only if no objection has been expressed either by the european parliament or the council within a period of two months of notification of that act to the european parliament and the council or if , before the expiry of that period , the european parliament and the council have both informed the commission that they will not object . that period shall be extended by two months at the initiative of the european parliament or of the council .


### member states shall designate an appropriate body established in their territory or , upon mutual agreement , in another member state under the responsibility of the designating member state . supervisory bodies shall be given all supervisory and investigatory powers that are necessary for the exercise of their tasks . ### member states shall designate a supervisory body established in their territory or , upon mutual agreement , in another member state under the responsibility of the designating member state . the designated supervisory body , its addresses and the names of responsible persons shall be communicated to the commission . supervisory bodies shall be given adequate resources necessary for the exercise of their tasks .


### the notifying member state ensures the availability of an authentication possibility online , at any time and free of charge so that any relying party can validate the person identification data received in electronic form . member states shall not impose any specific technical requirements on relying parties established outside of their territory intending to carry out such authentication . when either the notified identification scheme or authentication possibility is breached or partly compromised , member states shall suspend or revoke without delay the notified identification scheme or authentication possibility or the compromised parts concerned and inform the other member states and the commission pursuant to article 7 ; ### the notifying member state ensures the availability of an authentication online , at any time so that any relying party established outside of the territory of that member state can validate the person identification data received in electronic form . such authentication shall be provided free of charge where access to a service is provided online by a public sector body . member states shall not impose any disproportionate specific technical requirements on relying parties intending to carry out such authentication .


### this regulation applies to electronic identification provided by , on behalf or under the responsibility of member states and to trust service providers established in the union . ### this regulation applies to electronic identification provided by , on behalf of , under the responsibility or supervision of member states .


### qualified electronic signatures shall be recognised and accepted in all member states . ### qualified electronic signatures shall be recognised and accepted in member states and institutions of the union .


### this regulation applies to electronic identification provided by , on behalf or under the responsibility of member states and to trust service providers established in the union . ### this regulation applies to electronic identification mandated , recognised or issued by or on behalf of member states .


### this regulation should also establish a general legal framework for the use of electronic trust services . however , it should not create a general obligation to use them . in particular , it should not cover the provision of services based on voluntary agreements under private law . neither should it cover aspects related to the conclusion and validity of contracts or other legal obligations where there are requirements as regards form prescribed by national or union law . ### this regulation should also establish a general legal framework for the use of electronic trust services . however , it should not create a general obligation to use them . in particular , it should not cover the provision of services based on voluntary agreements under private law . it should also be without prejudice to provisions on the form , formation or effect of contracts or to the form , creation or validity of other private - law obligations irrespective of whether they are founded on national or union law , for example articles 10 and 11 of regulation no 593 / 2008 . furthermore this regulation should be without prejudice to the rules and restrictions in national or union law on the use of documents , and should not apply to register procedures , particularly those relating to land registers and trade registers .


### trust services provided and end user products used in the provision of those services shall be made accessible for persons with disabilities whenever possible . ### trust services provided and end user products used in the provision of those services shall be made accessible for persons with disabilities in accordance with union law .


### ‘ certificate’ means an electronic attestation which links electronic signature or seal validation data of a natural or a legal person respectively to the certificate and confirms those data of that person ; ### ‘ certificate’ means an electronic attestation which links electronic signature or seal validation data with the identification data of any entity or a natural or a legal person respectively and confirms those data of that person ;


### one of the objectives of this regulation is to remove existing barriers to the cross - border use of electronic identification means used in the member states to access at least public services . this regulation does not aim at intervening on electronic identity management systems and related infrastructures established in the member states . the aim of this regulation is to ensure that for the access to cross - border online services offered by the member states , secure electronic identification and authentication is possible . ### one of the objectives of this regulation is to remove existing barriers to the cross - border use of electronic identification means used in the member states to access at least public services . this regulation does not aim at intervening on electronic identity management systems and related infrastructures established in the member states . the aim of this regulation is to ensure that for the access to cross - border online services offered by the member states , a high degree of security can be provided for electronic identification and authentication , for instance by establishing security levels adjusted according to the types of services to be accessed .


### ‘ creator of a seal’ means a legal person who creates an electronic seal ; ### ‘ creator of a seal’ means an entity or a legal person who creates an electronic seal ;


### the commission may , by means of implementing acts , establish reference numbers of standards for trustworthy systems and products . compliance with the requirements laid down in article 19 shall be presumed where trustworthy systems and products meet those standards . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 39 . the commission shall publish those acts in the official journal of the european union . ### the commission may , by means of implementing acts , establish reference numbers of standards for trustworthy systems and products . compliance with the requirements laid down in article 19 shall be achieved through the compliance of trustworthy systems and products with those standards . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 39 . the commission shall publish those acts in the official journal of the european union .


### ' electronic identification ' means the process of using person identification data in electronic form unambiguously representing a natural or legal person ; ### ' electronic identification ' means the process of using person identification data in electronic form unambiguously representing an entity or a natural or legal person ;


### qualified electronic signature creation devices may be certified by appropriate public or private bodies designated by member states provided that they have been submitted to a security evaluation process carried out in accordance with one of the standards for the security assessment of information technology products included in a list that shall be established by the commission by means of implementing acts . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 39 . the commission shall publish those acts in the official journal of the european union . ### qualified electronic signature creation devices must be certified by public or private certification bodies designated by member states following a security evaluation process carried out in accordance with one of the standards for the security assessment of information technology products included in a list that shall be established by the commission by means of implementing acts . the commission shall ensure , that stakeholder input is duly considered , preferably in form of an impact assessment , when defining standards to be used for the purpose of this regulation . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 39 . the commission shall publish those acts in the official journal of the european union .


### products which comply with this regulation shall be permitted to circulate freely in the internal market . ### products which comply with this regulation shall circulate freely and securely in the internal market .


### trust service providers who are established in the territory of the union shall take appropriate technical and organisational measures to manage the risks posed to the security of the trust services they provide . having regard to state of the art , these measures shall ensure that the level of security is appropriate to the degree of risk . in particular , measures shall be taken to prevent and minimise the impact of security incidents and inform stakeholders of adverse effects of any incidents . ### trust service providers who are established in the territory of the union or provide services in accordance with article 10 of this regulation shall take appropriate technical and organisational measures to manage the risks posed to the security and resilience of the trust services they provide . having regard to state of the art , these measures shall ensure that the level of security is appropriate to the degree of risk . in particular , measures shall be taken to prevent and minimise the impact of security incidents and inform stakeholders of adverse effects of any incidents .


### the delegation of power referred to in articles 8 , 13 , 15 , 16 , 18 , 20 , 21 , 23 , 25 , 27 , 28 , 29 , 30 , 31 , 35 and 37 may be revoked at any time by the european parliament or by the council . a decision to revoke shall put an end to the delegation of the power specified in that decision . it shall take effect the day following the publication of the decision in the official journal of the european union or at a later date specified therein . it shall not affect the validity of any delegated acts already in force . ### the delegation of power referred to in articles 8 , 18 , 21 , 23 , 25 , 27 , 29 , 30 , 31 , 35 and 37 may be revoked at any time by the european parliament or by the council . a decision to revoke shall put an end to the delegation of the power specified in that decision . it shall take effect the day following the publication of the decision in the official journal of the european union or at a later date specified therein . it shall not affect the validity of any delegated acts already in force .


### this regulation does not apply to the provision of electronic trust services based on voluntary agreements under private law . ### this regulation applies to both qualified and non qualified trust service providers established in the union . this regulation does not apply to trust services which are chosen by a closed group of parties and which are used exclusively within that group .


### the power to adopt delegated acts referred to in articles 8 , 13 , 15 , 16 , 18 , 20 , 21 , 23 , 25 , 27 , 28 , 29 , 30 , 31 , 35 and 37 shall be conferred on the commission for an indeterminate period of time from the entry into force of this regulation . ### the power to adopt delegated acts referred to in articles 8 , 16 , 23 , 25 , 27 , 29 , 30 , 31 and 37 shall be conferred on the commission for an indeterminate period of time from the entry into force of this regulation .


### this regulation lays down the conditions under which member states shall recognise and accept electronic identification means of natural and legal persons falling under a notified electronic identification scheme of another member state . ### this regulation lays down the conditions under which member states shall recognise and accept electronic authentication or identification means for natural and legal persons falling under a notified electronic authentication or identification scheme of another member state .


### member states shall designate an appropriate body established in their territory or , upon mutual agreement , in another member state under the responsibility of the designating member state . supervisory bodies shall be given all supervisory and investigatory powers that are necessary for the exercise of their tasks . ### member states shall designate a supervisory body established in their territory or , upon mutual agreement , in another member state under the responsibility of the designating member state . the designated supervisory body , its addresses and the names of responsible persons shall be communicated to the commission . supervisory bodies shall be given adequate resources necessary for the exercise of their tasks .


### the commission may , by means of implementing acts , establish reference numbers of standards for the validation of qualified electronic signatures . compliance with the requirements laid down in paragraph 1 shall be presumed where the validation of qualified electronic signatures meets those standards . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 39 . the commission shall publish those acts in the official journal of the european union . ### the commission may , by means of implementing acts , establish reference numbers of standards for the validation of qualified electronic signatures . the commission shall ensure , that stakeholder input is duly considered , preferably in form of an impact assessment , when defining standards to be used for the purpose of this regulation . compliance with the requirements laid down in paragraph 1 shall be presumed where the validation of qualified electronic signatures meets those standards . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 39 . the commission shall publish those acts in the official journal of the european union .


### the commission may , by means of implementing acts , establish reference numbers of standards for qualified certificates for electronic signature . compliance with the requirements laid down in annex i shall be presumed where a qualified certificate for electronic signature meets those standards . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 39 . the commission shall publish those acts in the official journal of the european union . ### the commission may , by means of implementing acts , establish reference numbers of standards for qualified certificates for electronic signature . the commission shall ensure , that stakeholder input is duly considered , preferably in form of an impact assessment , when defining standards to be used for the purpose of this regulation . compliance with the requirements laid down in annex i shall be presumed where a qualified certificate for electronic signature meets those standards . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 39 . the commission shall publish those acts in the official journal of the european union .


### it is created using electronic signature creation data that the signatory can , with high level of confidence , use under his sole control ; and ### it is created using an electronic signature creation device that the signatory can use under his sole control ; and


### it is created using electronic signature creation data that the signatory can , with high level of confidence , use under his sole control ; and ### there is no way for the signatory to misunderstand the signing transaction and to unwillingly expose his signing access to any third party ; and


### the commission may , by means of implementing acts , establish reference numbers of standards for qualified electronic signature creation devices . compliance with the requirements laid down in annex ii shall be presumed where a qualified electronic signature creation device meets those standards . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 39 . the commission shall publish those acts in the official journal of the european union . ### the commission may , by means of implementing acts , establish reference numbers of standards for qualified electronic signature creation devices . the commission shall ensure , that stakeholder input is duly considered , preferably in form of an impact assessment , when defining standards to be used for the purpose of this regulation . compliance with the requirements laid down in annex ii shall be presumed where a qualified electronic signature creation device meets those standards . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 39 . the commission shall publish those acts in the official journal of the european union .


### when an electronic identification using an electronic identification means and authentication is required under national legislation or administrative practice to access a service online , any electronic identification means issued in another member state falling under a scheme included in the list published by the commission pursuant to the procedure referred to in article 7 shall be recognised and accepted for the purposes of accessing this service . ### when an electronic identification using an electronic identification means and authentication is required under union or national legislation or administrative practice to access a service online in one member state or provided online by union institutions , bodies , offices and agencies , this electronic identification means issued in another member state or by union institutions , bodies , offices and agencies under a scheme included in the list published by the commission pursuant to article 7 , and with a security level equal to or higher than the security level required to access the service , shall be recognised in the member state or by union institutions , bodies , offices and agencies for the purposes of accessing that service online , not later than six months after the list , including that scheme , is published .


### ‘ electronic identification means’ means a material or immaterial unit containing data as referred to in point 1 of this article , and which is used to access services online as referred to in article 5 ; ### ‘ electronic identification means’ means a material or immaterial unit containing data as referred to in point 1 of this article , and which is used to access electronic services as referred to in article 5 ;


### one of the objectives of this regulation is to remove existing barriers to the cross - border use of electronic identification means used in the member states to access at least public services . this regulation does not aim at intervening on electronic identity management systems and related infrastructures established in the member states . the aim of this regulation is to ensure that for the access to cross - border online services offered by the member states , secure electronic identification and authentication is possible . ### one of the objectives of this regulation is to remove existing barriers to the cross - border use of electronic identification means used in the member states to access at least public services . this regulation does not aim at intervening on electronic identity management systems and related infrastructures established in the member states . the aim of this regulation is to ensure that for the access to cross - border online services offered by the member states , a high degree of security can be provided for electronic identification and authentication , for instance by establishing security levels adjusted according to the types of services to be accessed .


### if an electronic signature with a security assurance level below qualified electronic signature is required , in particular by a member state for accessing a service online offered by a public sector body on the basis of an appropriate assessment of the risks involved in such a service , all electronic signatures matching at least the same security assurance level shall be recognised and accepted . ### if an electronic signature with a security assurance level below qualified electronic signature is required , by a member state or by institutions , bodies , offices and agencies of the union for completing a transaction offered by a public sector body on the basis of an appropriate assessment of the risks involved in such a service , all electronic signatures matching at least the same security assurance level shall be recognised and accepted for access to that online service .


### ‘ certificate’ means an electronic attestation which links electronic signature or seal validation data of a natural or a legal person respectively to the certificate and confirms those data of that person ; ### ' certificate ' means an electronic attestation which links electronic signature or seal validation data with the identification data of an entity , or a natural or a legal person respectively and confirms those data of that person ;


### before entering into a contractual relationship , inform any person seeking to use a qualified trust service of the precise terms and conditions regarding the use of that service ; ### before entering into a contractual relationship , inform any person seeking to use a qualified trust service of the precise terms and conditions regarding the use of that service , as well as the liability limits , in a clear and transparent manner ;


### with reference to paragraph 3 , if the qualified trust service provider does not remedy any such failure within a time limit set by the supervisory body , it shall lose its qualified status and be informed by the supervisory body that its status will be changed accordingly in the trusted lists referred to in article 18 . ### with reference to paragraph 3 , if the qualified trust service provider does not remedy any such failure within a time limit and in accordance with the adversarial procedure specified by the supervisory body , it shall lose its qualified status and be informed by the supervisory body that its status will be changed accordingly in the trusted lists referred to in article 18 .


### the power to adopt delegated acts is conferred on the commission subject to the conditions laid down in this article . 2 . the power to adopt delegated acts referred to in articles 8 , 13 , 15 , 16 , 18 , 20 , 21 , 23 , 25 , 27 , 28 , 29 , 30 , 31 , 35 and 37 shall be conferred on the commission for an indeterminate period of time from the entry into force of this regulation . 3 . the delegation of power referred to in articles 8 , 13 , 15 , 16 , 18 , 20 , 21 , 23 , 25 , 27 , 28 , 28 , 29 , 30 , 31 , 35 and 37 may be revoked at any time by the european parliament or by the council . a decision to revoke shall put an end to the delegation of the power specified in that decision . it shall take effect the day following the publication of the decision in the official journal of the european union or at a later date specified therein . it shall not affect the validity of any delegated acts already in force . 4 . as soon as it adopts a delegated act , the commission shall notify it simultaneously to the european parliament and to the council . 5 . a delegated act adopted pursuant to articles 8 , 13 , 15 , , 16 , 18 , 20 , 21 , 23 , 25 , 27 , 28 , 29 , 30 , 31 , 35 and 37 shall enter into force only if no objection has been expressed either by the european parliament or the council within a period of two months of notification of that act to the european parliament and the council or if , before the expiry of that period , the european parliament and the council have both informed the commission that they will not object . that period shall be extended by two months at the initiative of the european parliament or of the council . ### the power to adopt delegated acts is conferred on the commission subject to the conditions laid down in this article . 2 . the power to adopt delegated acts referred to in articles 8a , 15 , 16 , 21 , 23 , 25 , 27 , 29 , 30 , 31 , 35 and 37 shall be conferred on the commission for an indeterminate period of time from the entry into force of this regulation . 3 . the delegation of power referred to in articles 8a , 15 , 16 , 21 , 23 , 25 , 27 , 29 , 30 , 31 , 35 and 37 may be revoked at any time by the european parliament or by the council . a decision to revoke shall put an end to the delegation of the power specified in that decision . it shall take effect the day following the publication of the decision in the official journal of the european union or at a later date specified therein . it shall not affect the validity of any delegated acts already in force . 4 . as soon as it adopts a delegated act , the commission shall notify it simultaneously to the european parliament and to the council . 5 . a delegated act adopted pursuant to articles 8a , 15 , 16 , 21 , 23 , 25 , 27 , 29 , 30 , 31 , 35 and 37 shall enter into force only if no objection has been expressed either by the european parliament or the council within a period of two months of notification of that act to the european parliament and the council or if , before the expiry of that period , the european parliament and the council have both informed the commission that they will not object . that period shall be extended by two months at the initiative of the european parliament or of the council .


### bear the risk of liability for damages by maintaining sufficient financial resources or by an appropriate liability insurance scheme ; ### with regard to the risk of liability for damages as referred to in article 8 , maintain sufficient financial resources or obtain appropriate liability insurance ;


### a trust service provider shall be liable for any direct damage caused to any natural or legal person due to failure to comply with the obligations laid down in article 15 , unless the trust service provider can prove that he has not acted negligently . ### a trust service provider shall be liable under national law for any damage caused to an entity , natural or legal person due to non - compliance with the obligations laid down in article 15 , unless the trust service provider can prove that he has not acted negligently .


### the commission may , by means of implementing acts , establish reference numbers of standards for qualified certificates for electronic seal . compliance with the requirements laid down in annex iii shall be presumed where a qualified certificate for electronic seal meet those standards . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 39 . the commission shall publish those acts in the official journal of the european union . ### the commission may , by means of implementing acts , establish reference numbers of standards for qualified certificates for electronic seal and / or stamp . compliance with the requirements laid down in annex iii shall be presumed where a qualified certificate for electronic seal meet those standards . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 39 . the commission shall publish those acts in the official journal of the european union .


### member states shall designate an appropriate body established in their territory or , upon mutual agreement , in another member state under the responsibility of the designating member state . supervisory bodies shall be given all supervisory and investigatory powers that are necessary for the exercise of their tasks . ### member states shall designate a supervisory body established in their territory or , upon mutual agreement , in another member state under the responsibility of the designating member state . the designated supervisory body , its addresses and the names of responsible persons shall be communicated to the commission . supervisory bodies shall be given adequate resources necessary for the exercise of their tasks .


### member states shall not request for accessing a service online offered by a public sector body an electronic seal with higher security assurance level than qualified electronic seals . ### member states shall not request for cross - border access to a service online offered by a public sector body an electronic seal with higher security level than qualified electronic seals .


### the commission may , by means of implementing acts , establish reference numbers of standards for the preservation of qualified electronic signatures . compliance with the requirements laid down in paragraph 1 shall be presumed where the arrangements for the preservation of qualified electronic signatures meet those standards . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 39 . the commission shall publish those acts in the official journal of the european union . ### the commission may , by means of implementing acts , establish reference numbers of standards for the preservation of qualified electronic signatures . the commission shall ensure , that stakeholder input is duly considered , preferably in form of an impact assessment , when defining standards to be used for the purpose of this regulation . compliance with the requirements laid down in paragraph 1 shall be presumed where the arrangements for the preservation of qualified electronic signatures meet those standards . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 39 . the commission shall publish those acts in the official journal of the european union .


### each member state shall establish , maintain and publish trusted lists with information related to the qualified trust service providers for which it is competent together with information related to the qualified trust services provided by them . ### each member state shall establish , maintain and publish trusted lists with information related to the qualified trust service providers referred to in article 17 for which it is responsible including information allowing identification of the qualified trust service providers and an indication on their qualified status together with information related to the qualified trust services provided by them .


### electronic seals should serve as evidence that an electronic document was issued by a legal person , ensuring certainty of the document’s origin and integrity . ### valid electronic seals should serve as prima facie evidence for the authenticity and integrity of an electronic document associated with them . this should be without prejudice to national provisions on power of attorney , representation and legal capacity .


### trust services provided and end user products used in the provision of those services shall be made accessible for persons with disabilities whenever possible . ### trust services provided and end user products used in the provision of those services shall be made accessible for persons with disabilities in accordance with union law .


### the commission may , by means of implementing acts , establish reference numbers of standards for the security assurance levels of electronic seals . compliance with the security assurance level defined in a delegated act adopted pursuant to paragraph 6 shall be presumed when an electronic seal meets those standards . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 39 . the commission shall publish those acts in the official journal of the european union . ### the commission may , by means of implementing acts , establish reference numbers of standards for the security assurance levels of electronic seals . the commission shall ensure , that stakeholder input is duly considered , preferably in form of an impact assessment , when defining standards to be used for the purpose of this regulation . compliance with the security assurance level defined in a delegated act adopted pursuant to paragraph 6 shall be presumed when an electronic seal meets those standards . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 39 . the commission shall publish those acts in the official journal of the european union .


### supervisory bodies should cooperate and exchange information with data protection authorities to ensure proper implementation of data protection legislation by service providers . the exchange of information should in particular cover security incidents and personal data breaches . ### trust service providers and national bodies responsible for accreditation or supervision shall comply with the requirements laid down in directive 95 / 46 / ec of the european parliament and of the council of 24 october 1995 on tile protection of individuals with regard to the processing of personal data and on the free movement of such data . member states shall also ensure that trust service providers and national bodies responsible for accreditation or supervision cooperate and exchange information with data protection authorities to ensure proper implementation of data protection legislation by service providers . the exchange of information should in particular cover security incidents and personal data breaches , where provided by the applicable law .


### member states which notify an electronic identification scheme shall forward to the commission the following information and without undue delay , any subsequent changes thereof : a description of the notified electronic identification scheme ; the authorities responsible for the notified electronic identification scheme ; information on by whom the registration of the unambiguous person identifiers is managed ; ### the notifying member state shall forward to the commission the following information and without undue delay , any subsequent changes thereof : a description of the notified electronic identification scheme , including its identity assurance levels ; the authority or authorities responsible for the notified electronic identification scheme ; information on the entity or entities which manages the verification of the person identification data ;


### this regulation lays down rules for electronic identification and electronic trust services for electronic transactions with a view to ensuring the proper functioning of the internal market . ### this regulation lays down rules for electronic identification and trust services for electronic transactions with a view to ensuring the proper functioning of the internal market , guaranteeing a high level of security for identification means and trust services and boosting public trust in the digital world .


### when an electronic identification using an electronic identification means and authentication is required under national legislation or administrative practice to access a service online , any electronic identification means issued in another member state falling under a scheme included in the list published by the commission pursuant to the procedure referred to in article 7 shall be recognised and accepted for the purposes of accessing this service . ### when an electronic identification using an electronic identification means and authentication is required under union or national legislation or administrative practice to access a service online in one member state or provided online by union institutions , bodies , offices and agencies , this electronic identification means issued in another member state or by union institutions , bodies , offices and agencies under a scheme included in the list published by the commission pursuant to article 7 , and with a security level equal to or higher than the security level required to access the service , shall be recognised in the member state or by union institutions , bodies , offices and agencies for the purposes of accessing that service online , not later than six months after the list , including that scheme , is published .


### ' electronic identification ' means the process of using person identification data in electronic form unambiguously representing a natural or legal person ; ### ' electronic identification ' means the process of using person identification data in electronic form representing a natural or legal person either unambiguously or to the degree necessary for the specific purpose ;


### if an electronic seal security assurance level below the qualified electronic seal is required , in particular by a member state for accessing a service online offered by a public sector body on the basis of an appropriate assessment of the risks involved in such a service , all electronic seals matching at a minimum the same security assurance level shall be accepted . ### if an electronic seal security level below the qualified electronic seal is required , in particular by a member state for accessing a service online offered by a public sector body on the basis of an appropriate assessment of the risks involved in such a service , all electronic seals matching at a minimum the same security assurance level shall be accepted for access to that online service .


### notification of security breaches and security risk assessments is essential with a view to providing adequate information to concerned parties in the event of a breach of security or loss of integrity . ### notification of security breaches in accordance with directive 95 / 46 / ec and security risk assessments is essential with a view to providing adequate information to concerned parties in the event of a breach of security or loss of integrity .


### ‘ electronic document’ means a document in any electronic format ; ### ‘ electronic document’ means a separate set of structured data in any electronic format ;


### a delegated act adopted pursuant to articles 8 , 13 , 15 , 16 , 18 , 20 , 21 , 23 , 25 , 27 , 28 , 29 , 30 , 31 , 35 and 37 shall enter into force only if no objection has been expressed either by the european parliament or the council within a period of two months of notification of that act to the european parliament and the council or if , before the expiry of that period , the european parliament and the council have both informed the commission that they will not object . that period shall be extended by two months at the initiative of the european parliament or of the council . ### a delegated act adopted pursuant to articles 8 , 18 , 21 , 23 , 25 , 27 , 29 , 30 , 31 , 35 and 37 shall enter into force only if no objection has been expressed either by the european parliament or the council within a period of two months of notification of that act to the european parliament and the council or if , before the expiry of that period , the european parliament and the council have both informed the commission that they will not object . that period shall be extended by two months at the initiative of the european parliament or of the council .


### qualified trust service providers shall be audited by a recognised independent body once a year to confirm that they and the qualified trust services provided by them fulfil the requirements set out in this regulation , and shall submit the resulting security audit report to the supervisory body . ### qualified trust service providers shall be audited by a recognised independent body every two years and following any significant technological or organizational changes to confirm that they and the qualified trust services provided by them fulfil the requirements set out in this regulation , and shall submit the resulting compliance audit report to the supervisory body .


### in order to complement certain detailed technical aspects of this regulation in a flexible and rapid manner , the power to adopt acts in accordance with article 290 of the treaty on the functioning of the european union should be delegated to the commission in respect of interoperability of electronic identification ; security measures required of trust service providers ; recognised independent bodies responsible for auditing the service providers ; trusted lists ; requirements related to the security levels of electronic signatures ; requirements of qualified certificates for electronic signatures their validation and their preservation ; the bodies responsible for the certification of qualified electronic signature creation devices ; and the requirements related to the security levels of electronic seals and to qualified certificates for electronic seals ; the interoperability between delivery services . it is of particular importance that the commission carry out appropriate consultations during its preparatory work , including at expert level . ### in order to complement certain detailed technical aspects of this regulation in a flexible and rapid manner , the power to adopt acts in accordance with article 290 of the treaty on the functioning of the european union should be delegated to the commission in respect of interoperability of electronic identification ; trusted lists ; requirements of qualified certificates for electronic signatures their validation and their preservation ; the bodies responsible for the certification of qualified electronic signature creation devices ; and to qualified certificates for electronic seals ; the interoperability between delivery services . it is of particular importance that the commission carry out appropriate consultations during its preparatory work , including at expert level .


### when an electronic identification using an electronic identification means and authentication is required under national legislation or administrative practice to access a service online , any electronic identification means issued in another member state falling under a scheme included in the list published by the commission pursuant to the procedure referred to in article 7 shall be recognised and accepted for the purposes of accessing this service . ### when an electronic identification using an electronic identification means and authentication is required under national legislation or administrative practice to access a public service online in one member state , the electronic identification means issued in another member state under a scheme , which is included in the list published by the commission pursuant to the procedure referred to in article 7 shall be recognised in the first member states for the purposes of accessing that service online , provided that those electronic identification means correspond to an identity assurance level equal to or higher than the identity assurance level required for access to that service online in the first member state .


### qualified trust service providers shall notify the supervisory body of their intention to start providing a qualified trust service and shall submit to the supervisory body a security audit report carried out by a recognised independent body , as provided for in article 16 . qualified trust service providers may start to provide the qualified trust service after they have submitted the notification and security audit report to the supervisory body . ### qualified trust service providers shall notify the supervisory body of their intention to start providing a qualified trust service and shall submit to the supervisory body a security audit report carried out by a recognised independent body , as provided for in article 16 . qualified trust service providers may start to provide the qualified trust service after they have submitted the security audit report to the supervisory body , and only once obtained the qualified status .


### once the relevant documents are submitted to the supervisory body according to paragraph 1 , the qualified service providers shall be included in the trusted lists referred to in article 18 indicating that the notification has been submitted . ### once the relevant documents are submitted to the supervisory body according to paragraph 1 , the qualified service providers shall be included in the trusted lists referred to in article 18 indicating that the qualified status has been confirmed .


### with reference to paragraph 1 , such agreements shall ensure that the requirements applicable to qualified trust services and qualified certificates provided by qualified trust service providers established in the territory of the union are met by the trust service providers in the third countries or international organisations , especially with regard to the protection of personal data , security and supervision . ### with reference to paragraph 1 , such agreements shall ensure that the requirements applicable to qualified trust services and qualified certificates provided by qualified trust service providers established in the territory of the union are met by the trust service providers in the third countries or international organisations , especially the security of the trust services provided and the supervision of qualified trust service providers . the third country in question shall afford adequate protection of personal data , in accordance with article 25 of directive 95 / 46 / ec .


### ‘ trust service provider’ means a natural or a legal person who provides one or more trust services ; ### ‘ trust service provider’ means an entity , a natural or a legal person who provides one or more trust services ;


### to ensure sustainability and durability of qualified trust services and to boost users ‘ confidence in the continuity of qualified trust services , supervisory bodies should ensure that the data of qualified trust service providers are preserved and kept accessible for an appropriate period of time even if a qualified trust service provider ceases to exist . ### to ensure sustainability and durability of qualified trust services and to boost users ' confidence in the continuity of qualified trust services , supervisory bodies should ensure that the data collected by the qualified trust service providers are preserved and kept accessible for an appropriate period of time even if a qualified trust service provider ceases to exist .


### qualified trust services and qualified certificates provided by qualified trust service providers established in a third country shall be accepted as qualified trust services and qualified certificates provided by a qualified trust service providers established in the territory of the union if the qualified trust services or qualified certificates originating from the third country are recognised under an agreement between the union and third countries or international organisations in accordance with article 218 tfue . ### qualified trust services and qualified certificates provided by qualified trust service providers established in a third country shall be accepted as qualified trust services and qualified certificates provided by a qualified trust service provider established in the territory of the union if : the qualified trust service provider fulfils the requirements laid down in this regulation and has been accredited under an accreditation scheme established in a member state ; or the qualified trust service provider established within the union which fulfils the requirements laid down in this regulation guarantees the compliance with the requirements laid down in this regulation ; or the qualified trust services or qualified certificates originating from a third country are recognised under an agreement between the union and that third country or international organisation in accordance with article 218 tfeu .


### trust service providers who are established in the territory of the union shall take appropriate technical and organisational measures to manage the risks posed to the security of the trust services they provide . having regard to state of the art , these measures shall ensure that the level of security is appropriate to the degree of risk . in particular , measures shall be taken to prevent and minimise the impact of security incidents and inform stakeholders of adverse effects of any incidents . ### trust service providers who are established in the territory of the union shall take appropriate technical and organisational measures to manage the risks posed to the security of the trust services they provide . having regard to the latest technological developments , any such measures shall ensure that the level of security is appropriate to the degree of risk . in particular , measures shall be taken to prevent and minimise the impact of security incidents and inform stakeholders of the adverse effects of any incidents .


### qualified trust service providers shall be audited by a recognised independent body once a year to confirm that they and the qualified trust services provided by them fulfil the requirements set out in this regulation , and shall submit the resulting security audit report to the supervisory body . ### qualified trust service providers shall be audited by a recognised independent body once a year to confirm that they and the qualified trust services provided by them fulfil the requirements set out in this regulation , and shall submit the resulting security audit report to the supervisory body . if , after three years of existence , the annual audit reports raise no concerns , the audits referred to in this paragraph shall be carried out every two years only .


### ‘ qualified electronic seal’ means an advanced electronic seal which is created by a qualified electronic seal creation device , and which is based on a qualified certificate for electronic seal ; ### ‘ qualified electronic seal’ means an advanced electronic seal which is created by a qualified electronic seal creation device , and which is based on a qualified certificate for electronic seal issued by a qualified trust service provider ;


### member states shall cooperate in order to ensure the interoperability of electronic identification means falling under a notified scheme and to enhance their security . ### member states shall cooperate in order to ensure the interoperability and technological neutrality of electronic identification means falling under a notified scheme and to enhance their security .