EUROPEAN COMMISSION Brussels, 3.6.2021 SWD(2021) 130 final EVALUATION COMMISSION STAFF WORKING DOCUMENT Accompanying the document REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL on the evaluation of Regulation (EU) No 910/2014 on electronic identification and trust services for electronic transactions in the internal market (eIDAS) {COM(2021) 290 final} - {SEC(2021) 229 final}



Table of contents 1.Introduction5 2.Background5 Description of the intervention and its objectives 5 Baseline and points of comparison 7 3.Implementation / state of Play11 Electronic identification 11 Trust services 14 4.Method17 5.Analysis and answers to the evaluation questions19 5.1 Effectiveness 19 Q1. To what extent has the Regulation met its operational objectives? 20 Q2. To what extent has the Regulation met its specific objectives? 29 Q3. To what extent has the Regulation met its general objectives? 33 5.2 Efficiency 35 Q4. Did the regulatory intervention create any additional costs and benefits for targeted stakeholders? 35 Q5. How proportionate is the amount of costs and benefits to cost and benefit items? How are they broken down? How do they compare across different stakeholder groups? 40 Q6. To what extent have the aggregate costs of the Regulation been justified and proportionate given the aggregate benefits achieved? 44 Q7. Are there opportunities to simplify the legislation or reduce unnecessary regulatory costs without undermining the intended objectives of the intervention? 46

5.3 Relevance 47 Q8. To what extent do the initial objectives still correspond to the current needs and concerns? 47 Q9. To what extent do the solutions and standards address user needs? 49 Q10. To what extent are there adaptation mechanisms in place to follow technological, scientific and social developments? 51 Q11. To what extent has the eIDAS Regulation addressed relevant needs in specific sectors and what other areas should be covered? 52 Q12. To what extent have alternative solutions been developed to address current needs, in parallel with the mechanisms and solutions foreseen by the eIDAS Regulation? 55 Q13. How does the eIDAS Regulation support the requirements for customer data portability and the emerging paradigm of full user control of personal data (as proposed by MyData or the Decentralised Identity Foundation)? 56 Q14. How well adapted is the intervention to subsequent technological or scientific advances? What are the opportunities for expanding the number of trust services currently covered by the Regulation (by e.g. blockchain, eArchiving, IoT) and for extending eID services to the private sector? 58 5.4 Coherence 60 Q15. Are there issues of internal coherence (i.e. between parts of the eIDAS Regulation and implementing acts)? 60 Q16. Are there coherence issues with relevant Member States’ rules and regulations? 67 Q17. Are there overlaps or complementarities between the eIDAS Regulation and any other Community actions, which share objectives? 69 5.5 EU added value 76 Q18. Is there additional value (at national, European and international level) resulting from the eIDAS Regulation, compared to what could be achieved with similar regulatory frameworks at national level? 76 Q19. To what extent do the issues addressed by the eIDAS Regulation require further action at EU level? Which recommendations can be made to improve EU added value? 76 Q20. What would be the most likely consequences of repealing the eIDAS Regulation? 77 6.Conclusions77 Annex 1: Procedural information84 Annex 2: Stakeholder consultation87 Annex 3: Methods used in preparing the evaluation99

Annex 4: Additional information116 Glossary Term or acronym Meaning or definition BYOI Bring your own identity eIDAS Regulation (EU) No 910/2014 on electronic identification and trust services for electronic transactions in the internal market eID Electronic Identification ENISA European Union Agency for Cybersecurity ERDS Electronic Registered Delivery Service ETSI European Telecommunications Standards Institute FATF Financial Action Task Force FESA Forum of European Supervisory Authorities for trust service providers GDPR General Data Protection Regulation KYC Know Your Customer LEI Legal Entity Identifier LoA Level Of Assurance LOTL European List of Trusted Lists NFC Near-field communication NQTS / QTS Non-Qualified Trust Service / Qualified Trust Service NQTSP / QTSP Non-Qualified Trust Service Provider / Qualified Trust Service Provider OOP Once Only Principle PKI Public key infrastructure PSD Payment Services Directive QWAC Qualified Website Authentication Service SDGR Single Digital Gateway Regulation TSPs Trust Service Providers W3C World Wide Web Consortium 1.Introduction Article 49 of Regulation EC 910 (2014) on electronic identification and trust services for electronic transactions in the internal market (hereafter “the eIDAS Regulation”) requires the Commission to review the application of this Regulation and to evaluate in particular whether it is appropriate to modify its scope or its specific provisions taking into account the experience gained in its application, as well as technological, market and legal developments. This Staff Working Document (SWD) provides the results of the evaluation of the application of the eIDAS Regulation. The Commission has assessed to what extent the eIDAS framework remains fit for purpose delivering the intended outcomes, results and impacts. In addition, the evaluation also identifies areas where the current digital identity and trust services framework can be improved or complemented. The evaluation provides critical assessment of the implementation of the legal framework and its adoption at EU and Member State level including its implementing acts and the sectoral legislation that refer to the eIDAS framework. It identifies possible gaps, opportunities and challenges, as well as potential gains in efficiency, effectiveness, and regulatory simplification and formulates conclusions and recommendations where applicable. The evaluation covers EU Member States and EFTA EEA countries (Iceland, Liechtenstein and Norway) including the period of membership of the United Kingdom. Cooperation with 3rd countries is also assessed where appropriate. 2.Background Description of the intervention and its objectives The eIDAS Regulation was adopted by the European Parliament and the Council on 23 July 2014 and entered into force on 28 July 2014. The Regulation was conceived as an instrument to ensure the proper functioning of the internal market and an adequate level of security of electronic identification means and trust services. The objective of the eIDAS Regulation is to enhance trust in electronic transactions in the internal market by providing a common foundation for secure and seamless electronic interaction between citizens, businesses and public authorities, thereby increasing the effectiveness of public and private online services, electronic business and electronic commerce in the EU. It repeals Directive 1999/93/EC on a Community framework for electronic signatures. The figure below provides an overview of the general objectives of the Regulation as well as the specific and operational objectives as described in the initial impact assessment supporting the adoption of the regulatory framework. The key challenges the eIDAS Regulation seeks to address are fragmentation in the market for eID and trust services and a lack of trust and confidence in electronic transactions. Further to its legal base, Article 114 TFEU, the eIDAS Regulation intends to improve the functioning of the Digital Single Market by increasing the availability and take-up of electronic identification and trust services cross-border and cross-sector and by stimulating and strengthening competition. For this purpose, the eIDAS Regulation introduces a predictable and comprehensive legislative framework to enable secure and trustworthy electronic transactions between businesses, citizens and public authorities. More specifically, the eIDAS Regulation seeks to: ·ensure that individuals and businesses can use their national electronic identification schemes (eIDs) for online access to public services in other EU Member States through establishing interoperability and enforcing mutual recognition. ·create a European internal market for electronic Trust Services (eTS) - namely electronic signatures, electronic seals, time stamps, electronic delivery services and website authentication - by ensuring that they are recognised across borders with the same legal status as traditional paper based processes. The main aim of the eIDAS Regulation in this respect is to foster transparency and trust in online services as a means of stimulating the internal market. One of the cornerstones of the Regulation is the risk-based approach. For trust services, the eIDAS framework imposes certain specific risk management and security obligations on qualified trust service providers and establishes a clear liability regime to ensure compliance at various levels. The risk management approach covers operations, conduct and procedures. For eID, cooperation among Member States should facilitate technical interoperability of notified electronic identification schemes with a view to fostering a high level of trust and security appropriate to the degree of risk. Exchange of information and sharing of best practices facilitates mutual recognition and cooperation.

The eIDAS framework follows an outcome-based approach. Based on the principle of technological neutrality, it establishes minimum requirements, standards and procedures to achieve the necessary security requirements. Mutual recognition of eID systems only applies to those electronic identification schemes notified to the Commission and respecting a number of requirements, formats and procedures (hereinafter “notified eIDs”). The choice to notify the Commission of all, some or none of the electronic identification schemes used at national level to access, at least, public online services or specific services is up to Member States. Although the Regulation only imposes obligations for recognition of eID on the public sector, it also foresees that Member States encourage the private sector to voluntarily use eID means in order to extend trust and security to commercial interactions. The Regulation also fosters market development and use of innovative solutions and services, such as mobile signing or cloud signing. Baseline and points of comparison Before the Regulation entered into force there was no comprehensive EU cross-border and cross-sector framework for secure, trustworthy and easy-to-use electronic transactions for electronic identification, authentication and trust services. The Commission proposal (COM(2012) 238 final) of 4 June 2012 accompanied by the Impact Assessment (SWD(2012) 135 final) identified four general objectives: ·ensuring the development of a digital single market; ·promoting the development of key cross-border public services; ·stimulating and strengthening competition in the single market; ·enhancing user-friendliness (citizens and businesses). The eIDAS framework was a positive driver for the Member States to build up eID schemes in general. Before eIDAS there was no legal framework to define what are the requirements and features of a national eID system. The European “blueprint” for electronic identification schemes provided by eIDAS gave Member States the reassurance that, if they follow the rules, they would establish robust identity systems underpinning all public transactions and interactions. While eIDAS plays an undisputed role in the internal market, a lot has changed since its adoption. Adopted in 2014, eIDAS is based on national eID systems following diverse standards and focuses on a relatively small segment of the electronic identification needs of citizens and businesses: secure cross-border access to public services. Since then, digitalisation of all functions of society has increased dramatically. Not least has the COVID-19 pandemic had a very strong impact on the speed of digitalisation. As a result, the provision of both public and private services is increasingly becoming digital. Citizens and businesses’ expectations are to achieve high security and convenience for any online activity. As a consequence, the demand for means to identify and authenticate online, as well as to digitally exchange information related to identity, attributes or qualifications securely and with a high degree of data protection, has increased radically. Electronic identification Before the adoption of the Regulation, different types of solutions were introduced on the market, either led by governments to complement paper-based ID cards or provided by the private sector. However, no common standards were used and electronic identification of citizens and businesses remained fragmented and in many cases duplicated. In addition, the usage of eID was mostly limited to the access of online services and interactions at national level or for use within a specific sector. An eID issued in one Member State could not be used to access online services in another Member State. The reasons for this were of both technical and legal nature. Member States used different technological solutions, which led to a lack of cross-border and cross-sector interoperability, there was a lack of a common legal framework to determine the reliability of the entity issuing the eID, a lack of legal certainty on the cross-border use of eIDs and a lack of rules for liability, regarding the correctness of the identity. Before the adoption of the Regulation, there was a lack of trust and confidence in electronic transactions, the tools provided, the legal framework and the security of eIDs among the general public. The lack of a common European legal framework hindered security and trust among citizens, businesses and public administrations when interacting online in cross-border scenarios. In addition, there was a lack of awareness of the added value of eID. These factors led to a limited use of public and private online services. As a response to these problems and needs and with the aim to ensure mutual recognition and acceptance of notified eIDs, the Regulation introduced the principle of mutual recognition of eID means to access online public services. By introducing the notification of these eID schemes, the eIDAS Regulation also established a process by which Member States can make their national eID schemes available for cross-border and cross-sector use, with the aim to ensure usage of notified eIDs by public and private sector entities. For the use of eID in practice and due to the need for trust, security and data protection, online service providers need certainty that a specific eID gives the appropriate level of assurance for each online service. Hence, online service providers dealing with sensitive information or transactions would require an eID that is highly trustworthy. In order to make this a reality, the eIDAS Regulation introduced assurance framework with minimum technical specifications and procedures defining three levels of assurance – low, substantial and high – for notified eID schemes. To ensure an optimal scope and level of governance for eID, the eIDAS framework established four bodies involved in the governance of eID - the eIDAS expert group, the eIDAS Committee, the Cooperation Network and the eIDAS eID technical subgroup. Overall, by setting up a common legal and technical framework for eID, the eIDAS Regulation has tackled important needs and problems in the field of eID, which has the potential to ensure a reduction of administrative burden and an increased quality of services. Hereby, the eIDAS Regulation also contributes to the overall objectives of developing a Digital Single Market and promoting the interest and protection of consumers in the EU. Another major factor determining the success in achieving these overall objectives lies within the need and goal to strengthen competitiveness and ensure technological neutrality in the field of eID. The figure below provides a schematic overview of the intervention logic and evaluation criteria, including the needs, problems and issues preceding the Regulation, the objectives it is set to achieve, the activities it initiated, the desired outputs and results and impacts.

Trust services The digital transformation of administrative processes and of business relations calls for secure, reliable and seamless electronic interaction and requires increasing the effectiveness of online services offered in the public and private sectors and creating trust in electronic transactions. User confidence in the security of electronic transactions is a condition for their widespread use. European trust service providers play a major role in assuring the security of electronic transactions. Before the adoption of the eIDAS Regulation, the European regulatory framework in this area covered only electronic signatures (eSignatures) and eSignature creation devices regulated under the eSignatures Directive. A study on the cross-border interoperability of e-signatures concluded in 2010 that the regulatory framework of the eSignatures Directive remained incomplete and did not sufficiently address challenges, such as market fragmentation, the use of outdated standards and different implementation, interpretation and levels of supervision by Member States. This lead to market distortion for trust service providers which were required to meet different standards depending on their country of establishment and their country of business activity. Divergent implementation and the adoption of varying rules for services at national level also led to the introduction of new categories of signatures in Member States which only differed in terminology creating market confusion. Furthermore, diverging interpretations of the Directive led to cross-border interoperability challenges and to a lack of mutual recognition and acceptance. The eSignature Directive did not lay out common standards for electronic signatures resulting in a patchwork of national legislation. None of the Member States implemented the same procedural standards for enforcement, with adverse effects on interoperability and the functioning of the Single Market. The regulatory challenges impacted the trust service providers in a number of ways. Service providers wanting to offer their services in another Member state were faced with high costs due to varying technical requirements and the need to comply with the country of destination. The varying levels of supervision led to a lack of trust and legal certainty of trust services in the European market, thereby hindering the cross-border uptake of the services. They resulted in an uneven playing field with respect to trustworthiness and costs; audit expenses were incurred by the service provider. Outdated standards were another issue not addressed in the eSignatures Directive. The Directive did not lay out common standards for electronic signatures resulting in a patchwork of national legislation. The eIDAS Regulation therefore sought to address these issues. An overall objective of the eIDAS Regulation is to establish trust and confidence in legal certainty and security of trust services by the introduction of the qualified status. Trust services compliant with the requirements laid out in the Regulation ‘shall not be denied legal effect and admissibility as evidence in legal proceedings solely on the grounds that it is in electronic form’ i.e. the Regulation provides for non-discrimination of electronic forms vis-à-vis the paper equivalent. Introducing the concept of qualified trust services is crucial in ensuring legal certainty, liability and burden of proof. Furthermore the provisions on security requirements’ provisions aim to ensure an adequate level of security and risk management in the provision of trust services. The Regulation lays down further specific requirements for QTSPs, e.g. by ensuring that when issuing a qualified certificate QTSPs shall verify in trustworthy manner the identity of a person. The QTSP must provide news on any changes to its organisation to the supervisory body, in order for the supervisory body to maintain the trusted list, thereby ensuring trust and confidence for users. In order to effectively oversee the provision of trust services, the Regulation aims to ensure an optimal scope and level of governance. The Regulation establishes a European wide supervision regime that aims to create a fairer playing field for trust service providers, enhance trust and confidence in services offered by a service provider established in another Member State, and thereby increase the take-up of services in the European market. In addition, number of trust services necessary to foster secure and seamless online transactions, were not regulated at EU level: ·Timestamping – validating date and time on an electronic document to prove that the document existed at the given point in time and that it has not been modified since; ·Electronic seal – the electronic equivalent of a seal or stamp applied to a document to guarantee its origin and integrity; ·Electronic delivery – mail registered and delivered digitally; ·Website authentication – certificates that allow verification of a website’s authenticity and its link to a natural or legal person All these measures are aimed at increasing the availability of cross-border and cross-sector trust services and strengthen competitiveness while ensuring technological neutrality. Ultimately this should also lead to a reduction in administrative burden due to increased use of electronic transactions as well as and increased quality of services. The figure below provides a schematic overview of the intervention logic and evaluation criteria, including the needs, problems and issues preceding the eIDAS Regulation, the objectives it is set to achieve, the activities it initiated, the desired outputs and results and impacts. 3.Implementation / state of Play

Electronic identification One of the most important implementation indicators of the eID part of the Regulation is the number of the eIDAS notifications of national eID schemes. Since the entering into force of this part of the Regulation in September 2017, 14 Member States have notified at least one eID scheme and four Member States have already notified multiple schemes. In total, 19 eID schemes have been notified so far. By April 2021 three Member States have pre-notified their schemes. Since there is no obligation to notify eID schemes under the eIDAS Regulation, several Member States with national eID schemes in place have so far not notified them. Although the Regulation states that Member States should not be obliged to notify their national eIDs to the Commission, the expectation and the target set at the institutional level (Strategic Management Plan DG CONNECT 2016-2020) was that by the time the mutual obligation provision enters into force (September 2018), all Member States would have recognised the notified schemes. In the Tallinn Ministerial Declaration on eGovernment of 6 October 2017, Member States agreed to provide citizens and businesses with the option to interact digitally with public administrations, and to ensure timely implementation, and promote the widespread use across sectors, of the eIDAS Regulation, including to undertake the voluntary notification of national eIDs. However, by the end of 2018 seven Member States had done so. Peer reviews are an essential activity within the notification process. 28 Member States (including UK) and the 3 EEA are eligible to participate in them. So far, 16 countries participated in the 15 peer reviews conducted so far. Following the notification of an eID scheme, Member States have one year to conclude peer reviews and take a position on the eligibility of the scheme for mutual recognition under eIDAS. As of 18 December 2020, European citizens can use national eID schemes from 12 EU Member States across borders. However, this is only the case provided that the eID means corresponds to the level of assurance “substantial” or “high” and that the eID scheme reaches the minimum level of assurance requested by the service provider. As the use of eID under eIDAS is open to the private sector, businesses can also benefit from this cross-border recognition of eID, however, the conditions for the use of the eIDAS eIDs by the private sector are defined by the Member States and to date these transactions are very limited. The eIDAS Network for eID consists of the eIDAS nodes, established at Member State and EU level- including EFTA EEA Countries (Iceland, Liechtenstein, and Norway)-, and interconnects the notified eID schemes connected to the eIDAS node at national level. While most eIDAS nodes are in production, it seems that Cyprus, Ireland, Iceland and Poland are conducting some testing and may therefore not be fully operational. Information for Bulgaria, France, Hungary, Liechtenstein and Romania is missing. Generally, Member States are prioritising the development of their receiving function. The sending function might only be developed once a country has effectively pre-notified an eID scheme. Due to the lack of the monitoring requirements, there is not a complete picture of the use of the eIDAS infrastructure. Some limitations of the implementation showed during the evaluation are due to the pending transition period of the notified eIDs, which were not yet subject to the mutual recognition obligation. The success at this point in time would require that all Member States would have fully integrated the technical infrastructure to support the cross-border access to national online public services via notified eIDs and that online private services providers would have found it attractive to rely on notified eIDs. The Commission has launched several studies and events to support the implementation of the eIDAS framework and to cover relevant trends in the field of eID. These studies are partly sector-specific (e.g. banking, higher education, aviation, SMEs, migration), focus on more general principles related to eID under eIDAS (e.g. awareness-raising, user experience) or analyse current trends in eID (e.g. mobile first, biometrics, analytics enabling real-time and continuous authentication, blurring lines between physical and digital worlds, citizen-controlled data, changing identity ecosystem). Among the sector-specific studies, several focus on the potential impact of the eIDAS Regulation on the banking sector, as it helps financial institutions to meet legal obligations in the fields of know-your-customer (KYC), Anti-Money Laundering and strong authentication of parties. An analysis carried out in 2018 on the reuse of eIDAS-based eID in the banking sector concluded thatsome eIDs created in the banking sector have become available nation-wide while in some other cases banks already participate in a federation of ID providers contributing to a government ID scheme. The study concluded that efficiency gains would best be achieved through a full coverage of the EU with eID notified schemes under eIDAS Regulation and made available for use by the private sector and that the financial sector lacked sufficient understanding of the benefits of the eIDAS Regulation. Although the use of the eIDs under eIDAS is voluntary by the private sector and dependent on the conditions set by the Member States, several eID providers confirmed that the confirmation of the compliance with the eIDAS helped them to gain momentum on the market and facilitated the access to additional services, in particular at the national level. Another sector in which the use of eIDAS could lead to considerable efficiency gains and reduce administrative burden is higher education. A study showed in 2018 that identification and student-specific data in the context of the ERASMUS+ programme was manually entered and verified with limits to reliability and considerable administrative burden. With the mutual recognition of eID under eIDAS between Member States, universities are able to exchange identification data of the students in a seamless, reliable and trusted way. However, students still need to manually enter the student-specific data (such as HEI code, student identifier, student email, etc.) and provide the requested supporting documents. Hence, as for the banking sector, an addition of domain-specific attributes to the eIDAS minimum dataset could further reduce administrative burden. In the aviation sector, eIDAS-based eIDs could automatize data entry, reduce error rates and allow for a seamless and smooth customer-journey. At the same time, as in other sectors, the absence of necessary attributes and data (e.g. biometrics) are limiting factors. In eHealth, several Member States have linked national eID solutions to their social security systems. Studies concluded that the current eIDAS framework could allow for the exchange of sector-specific attributes, such as patient ID or the direct notification of an eHealth eID solution. The eHealth Network (eHN) continues to investigate the reuse of eID for eHealth purposes and some pilots are ongoing. The Joint Action supporting the eHN by developing strategic guidance and tools in priority areas issued the Common eID Strategy for eHealth that can leverage EU regulations and create a holistic approach to eID in eHealth and related ICT services, both for patient and clinician identification, achieving innovative use of health data and interoperability within and across borders, supported by an increased strength in the security of identification of persons. Regarding the use of eID under the eIDAS by SMEs, low awareness has been identified as a key barrier for uptake although there is considerable potential for improving user experience, security, liability and operational efficiency of SMEs. As a result, a guidebook, checklist and toolkit for SMEs have been developed. Other studies have identified as blocking factors for the uptake of eID, the lack of awareness and understanding of the Regulation and its impact and poor user experience, which also discourages private service providers to make their online services accessible via the eIDAS Network for the risk of compromising on the quality of the services they provide. At the same time, advances in technology shape the future of eID and may help increase availability and uptake, enhance user experience and mitigate cybersecurity risks . Today, not all Member States allow the use of eID schemes by the private sector operators established in their own country and abroad (i.e. a national eID scheme cannot be used by the private sector relying party for authentication and identification). As liabilities and costs are not regulated at EU level and incentives differ, the take-up of eID /eIDAS by the private sector is partial and fragmented. Trust services The contribution to the development of an internal market for trust services in the EU is a key result indicators for the implementation of the eIDAS Regulation. Before the eIDAS Regulation, the service providers wanting to offer their services in another Member State were faced with high costs due to varying technical requirements and the need to comply with the country of destination rules. European trust service providers could not operate in another Member State without incurring additional costs. These conditions were evidently not favourable for the functioning of the internal market. There are currently 202 active qualified trust service providers operating in 29 of the 30 EU and EEA/EFTA countries. There are further 59 trust service providers without active trust services listed.

Markets with the most active Qualified Trust Service Providers (QTSPs) are Spain (36), Italy (22), France (24) and Germany (12), while Denmark currently does not have any active qualified trust service providers. Qualified eSignatures are the service provided most on the market, followed by qualified time stamps and qualified eSeals. Out of the five core trust services (Qualified certificate for electronic signature, Qualified certificate for electronic seal, Qualified time stamp, Qualified certificate for website authentication, Qualified electronic registered delivery service), the latter service is the most limited one, featuring only 20 active services in seven Member States at present. Type of Qualified Trust Service Number of active Qualified Trust Services Number of countries (EU and EEA/EFTA) in which the Qualified Trust Service is active EU and EEA/EFTA countries in which the Qualified Trust Service is active Qualified certificate for electronic signature 152 28 AT, BE, BG, HR, CY, CZ, EE, FI, FR, DE, EL, HU, IS, IE, IT, LI, LT, LV, LU, MT, NL, NO, PL, PT, RO, SK, SI, ES Qualified time stamp 109 23 AT, BE, BG, HR, CZ, EE, FR, DE, EL, HU, IE, IT, LV, LT, LU, NL, NO, PL, PT, RO, SK, SI, ES Qualified certificate for electronic seal 102 24 AT, BE, BG, HR, CY, CZ, EE, FR, DE, EL, HU, IE, IT, LV, LT, LU, NL, NO, PL, PT, RO, SK, SI, ES Qualified certificate for website authentication 51 20 AT, BE, BG, HR, CZ, FI, FR, DE, EL, HU, IT, LU, NL, NO, PL, PT, RO, SK, SI, ES Qualified electronic registered delivery service 20 7 BE, FR, DE, NL, PL, SI, ES Qualified validation service for qualified electronic signature 15 10 BE, BG, CZ, FR, LT, PL, SI, SK, ES, SE Qualified validation service for qualified electronic seal 15 10 BE, BG, CZ, FR, LT, PL, SK, SI, ES, SE Qualified preservation service for qualified electronic seal 13 9 BG, CZ, FR, HU, MT, PL, RO, SK, ES Qualified preservation service for qualified electronic signature 12 7 BG, CZ, FR, HU, MT, PL, RO, SK, ES National supervisory bodies for trust service providers can carry out audits, grant qualified status, and take enforcement action. They also keep the national Trusted List of QTSPs with few exceptions (e.g. AT, DE, PL) and are established in all Member States alongside National Accreditation Bodies. Conformity Assessment Bodies which are generally private or semi-private, are present in 12 Member States, with numbers differing between seven in IT and one in NL and PT. The European List of Trusted Lists (LOTL) comprises all of the trusted lists managed by Member States and information on QTPSs and their QTSs and contains pointers to the locations of publication of the national trusted lists. The European Commission developed a tool that enables its users to browse current trust service providers and trust services – the Trusted List Browser. Users can browse trust services using various filters, such as the type of service and the country, the name of trust service and signed file. In order to further ensure the security, legal certainty and the harmonisation of European trust services, standards are developed and maintained for European trust services. The Commission supports the use of ETSI/ CEN standards. The standards for trust services are frequently updated and published in order for trust service market players to ensure that they are following the most recent standards. ETSI standardization in relation to European trust services is currently used for policy requirements , assessment scheme (conformity assessment) and trust service status lists . Protocols for trust service providers providing long-term data preservation services is due to be published soon. Today, there are generally ETSI/ CEN standards for trust services in almost all relevant areas. 4.Method The eIDAS Regulation is substantively split into two parts; electronic identification (chapter II) and trust services (chapter III). Not only is there a difference in the timeline of the entry into force of the legal provisions linked to trust services and eID, but the nature of the frameworks governing eID and trust services fundamentally differ. For the purposes of the evaluation it is key to assess and analyse both domains separately, while also comparing across and looking at the eIDAS Regulation as a whole. The different implementation period had some impacts on the evaluation, in particular with respect to the eID part of the Regulation. The majority of the notified eIDs only became subject to the mutual recognition obligation in the course of 2020 or the implementation is yet ongoing. Additional increase in the usage of notified eIDs can be expected in the coming years, as more schemes become available and more citizens become aware of the possibility to reuse their national eIDs abroad. The present evaluation of the eIDAS Regulation was carried out between September 2019 and December 2020. It builds on evidence collected by an external support study assessing the performance of the eIDAS Regulation compared with its objectives and whether it remains fit for purpose to deliver the intended results and impacts. The evaluation has been carried out on the basis of data collected from different sources. A more detailed insight is provided in Annex 3. The evaluation draws on data from various sources: ·Open Public Consultation (onwards ‘OPC’ - 24 July to 2 October 2020); ·Targeted Stakeholders consultations including surveys, interviews and workshops; ·External studies; ·Literature review. The estimation of the actual number of stakeholders for the categories had to rely on a series of assumptions, which makes the interpretation of the findings more complex. On the one hand, the estimation of the number of active service providers (eID) and non-qualified trust service providers had to rely entirely and exclusively on stakeholder consultation activities, and therefore the findings are of limited reliability. On the other hand, the number of national authorities and eIDAS node operators, eID providers, bodies and qualified trust service providers is continuously adjourning, as the implementation of eIDAS (notification, qualification, set up of nodes) proceeds. Therefore, the aggregate figures refer to a hypothetical year, where all stakeholders begin operations, sustain initial costs, sustain recurring (yearly) costs once, and enjoy (yearly) benefits once.

The data gathering activities, in particular with respect to the implementation of the eID part of the Regulation, has been carried out at different levels – workshops, surveys and the scoping interviews with the Member States representatives, the service providers, the experts, follow up interviews after submitting the inputs to the online surveys and the literature analysis. Certain limitations in the data gathering are due to the lack of monitoring and reporting obligations in the Regulation, which limits the access to reliable data, in particular for the implementation of the eID part of the Regulation, which relied during the evaluation on the openness and willingness of some of the Member States to share the data on the usage of the national eIDAS infrastructure for cross border transactions. Regulatory efficiency was assessed through a Cost-Benefit Analysis (CBA) to quantify and monetise the main costs and benefits, thereby providing a baseline scenario for future assessment and possible policy intervention. The collection of quantitative data proved to be a difficult task for the consulted stakeholders. The most critical aspect was the distinction between duties (and thus costs) that were directly linked to the eIDAS Regulation and the other obligations that stakeholders incurred due to related initiatives (e.g. the provision of the eID service at national level). A large part of the sample of stakeholders, however, was reluctant in giving quantitative values or simply did not have in place a monitoring system able to gather relevant data for the CBA. The CBA has been particularly challenging due to the fact that in most cases the stakeholders that are targeted by the Regulation are at the same providing electronic identification services at national level. This means that respondents to survey and interviews found it particularly challenging to disentangle the costs only due to the Regulation from the other costs incurred due to the provision of these services (either eID or trust services) at national level due to other regulatory sources. The calculations provided in the report rely on estimates reported by stakeholders and should be considered as indicative averages by category of respondent. For all types of organisations either providing the eID or the trust services, costs and benefits may change considerably due to several variables: size of the country, number of operators, technological take-up of eIDs and trust services, size of the organisation and market position. Given these limitations, the final estimates are based only on a sub-sample of responses. A series of strategic interviews with individuals and organisations provided strategic input to better define data collection strategies and questionnaires. Targeted stakeholder surveys and interviews allowed to collect views, primary data and evidence for the analysis of key evaluation questions identified through desk research and strategic interviews. In the Open Public Consultation, 318 respondents expressed their views on the evaluation questions and in particular on drivers and barriers to the development and uptake of eID and trust services. To gather primary data a number surveys targeting key stakeholders were carried out: ·Member State representatives – The objective of this survey was to gather the views of Member States’ representatives in the eIDAS Cooperation Network, eIDAS Expert Group and operators of eIDAS nodes on the functioning of the Regulation, the interaction of the Regulation with other initiatives and on the costs associated with its implementation. ·Service providers (Relying parties) – The objective of this survey was to gather the views of both public and private service providers on the functioning of the Regulation and its impact on the services they provide. ·Supervisory Bodies, Conformity Assessment Bodies, Accreditation Bodies – The objective of this survey was to gather the views of the different Bodies responsible for the supervision of trust services with specific regard to governance and associated costs. ·Trust services providers and representative organisations of trust service providers – The objective of this survey was to gather the views of both qualified and non-qualified trust service providers on the functioning of the Regulation and its market impacts. ·Identity providers and representation organisations of identity providers – The survey gathered the views of both notified and non-notified identity providers on the functioning of the Regulation and on its market impacts. ·Technology providers, providers of trust services not covered by eIDAS, representative organisations of technology providers and standardisation bodies – This survey gathered the views of relevant experts not targeted in other surveys in order to gather a complete view on the functioning and impact of the Regulation. 5.Analysis and answers to the evaluation questions 5.1 Effectiveness The evaluation of the effectiveness of the eIDAS Regulation is based on the general, specific and operational objectives of the Regulation (as described in Section 2). Introduction of a common legal and technical framework for eID aimed at tackling important needs and problems in the field of eID, which had the potential to ensure a reduction of administrative burden and an increased quality of services. The eIDAS Regulation also aimed at contributing to the overall objectives of developing a Digital Single Market and promoting the interest and protection of consumers in the EU. Another major factor determining the success in achieving these overall objectives lies within the need and goal to strengthen competitiveness and ensure technological neutrality in the field of eID. Overall in the field of trust services, the eIDAS measures aimed at increasing the availability of cross-border and cross-sector trust services and strengthen competitiveness while ensuring technological neutrality. Ultimately this should also lead to a reduction in administrative burden due to increased use of electronic transactions as well as and increased quality of services. The intervention logic, including a schematic overview of the needs, problems and issues preceding the eIDAS Regulation, the objectives of the intervention, the desired outputs and results and impacts are further detailed in Annex 3.

This section follows a bottom-up approach, analysing first the operational objectives, most of which are sub-categories of the specific objectives, which then feed into the general objectives. Q1. To what extent has the Regulation met its operational objectives? Electronic identification Mutual recognition and acceptance of notified eIDs One of the main goals of the eIDAS Regulation is to ensure mutual recognition and acceptance of notified eID schemes. The obligation of mutual recognition consists in ensuring that if electronic identification is required under national law or by administrative practice to access an online public service provided in one Member State, eID schemes notified under eIDAS and issued by other Member States shall be recognized, as long as they can provide the minimum level of assurance required by the specific online public service. Member States have up to one year to adapt their respective technical systems between the publication of the notification of an eID scheme in the Official Journal of the European Union and the obligation of mutual recognition of this eID scheme by other Member States. The acceptance of notified eID scheme relies therefore on two conditions: ·the national eIDAS node of the receiving country needs to be operational (“in production”); and ·the service provider in the receiving country needs to be connected to the national eIDAS node to offer the possibility to use notified eID schemes to access the respective services. To date 14 Member States have notified in total 19 eID schemes. The notification is voluntary for the Member States and the eIDAS allows for the notification of the eID schemes endorsed by the Member States. The evaluation showed that the required endorsement is seen as a barrier for the private sector eID providers. To make use of cross-border authentication through eIDAS more attractive for end users, the user experience needs to be improved overall. Many Member States, citizens, businesses and other stakeholders have agreed in the OPC and targeted surveys that an important factor is enabling mobile technologies, however, there is a need to remain technologically neutral. How eID schemes and systems have been evolving in Member States is also subject to cultural, organisational, and other differences. The design of the notification model in the Regulation reflects these differences by requiring that notified national eIDs can be owned either by the Member States, developed under their mandate, or provided independently but endorsed by the Member State. For a Member States it is more straightforward to notify and take liability of eID schemes they control. When Member States have functioning eID schemes provided by the private sector (e.g. banks or telecom companies), they might hesitate in notifying those schemes since it would imply accepting the liability for the functioning of a scheme they do not control, in the cross-border context. In cases where Member States have no control on the provision of a private sector scheme, they may be reluctant to take such liability without firstly clarifying the liabilities and responsibilities in the national regulatory framework that governs the notified eID provided by the private sector provider. The reasons for not notifying national eIDs by a number of Member States vary and rely on a combination of country-specific internal factors, of disincentives stemming directly from the regulatory regime under eIDAS or from lack of demand for cross border authentications to online public services. An important reason for not notifying an eID scheme is firstly that certain Member States have not used eID schemes widely at national level. Notification would require developing such a scheme, thus implying the deployment of substantial expertise and resources. The development of an eID scheme is thus assessed against other national priorities. Status of national eIDAS nodes As the eIDAS Regulation does not harmonise the technical standards of national eID schemes for the purpose of their interconnection, technical nodes (“eIDAS nodes”) are necessary to ensure the interoperability of the different national eID schemes notified under eIDAS. In order to support outgoing and incoming identification requests, an eIDAS node is composed of two functions: receiving and sending. The receiving capacity enables the Member States to accept authentications originating from other Member States. The sending capacity is necessary to enable citizens to authenticate for services in another Member State. One incentivising factor for the deployment of the interoperability framework was EU funding for eIDAS nodes, which in turn also helped to improve authentication security in some Member States where it was implemented centrally. State of Play Receiving Capacity: In September 2020, only 22 out of 30 countries had enabled the receiving function of their eIDAS nodes. Four other eIDAS nodes are still testing their receiving capability, while five eIDAS nodes are not operational. State of Play Sending Capacity: In September 2020, 19 eID schemes of 14 Member States had been successfully notified, however not all of these 14 Member States had nodes with sending functions fully operational. In addition, not all nodes in production are connected to all the nodes of Member States that have notified an eID scheme. Connections are created and tested manually and are not automated at EU level. Overall, the operational state of eIDAS nodes is not satisfactory and several Member States appear in non-compliance with the Regulation. The lack of reporting and monitoring mechanisms for the eID framework in the Regulation limits the effectiveness of the enforcement. Most of the non-compliance issues are related to the implementation of the interoperability framework that have been identified in the course of the evaluation process and testing surveys. Some of the identified non-compliance findings are being gradually solved at national level as increasingly notified eID schemes are becoming subject to mutual recognition obligation. Status of service providers’ connection to the eIDAS network and availability of services

eIDAS nodes in production for both the sending and receiving Member State is a first condition for a successful cross-border authentication. The second condition is the connection of service providers to their national eIDAS node and the third condition is an actual offer for citizens and businesses from abroad to authenticate with their notified eID on their website or application. There is currently no monitoring and no repository for the number of service providers connected to national eIDAS nodes. Estimates by Member State range from less than 50 to more than 5000, but cannot be verified. In addition, the fact that a service provider is connected does not mean that a cross-border authentication will be possible and successful. Consequently, this indicator cannot be used to evaluate the effective access of citizens to cross-border public services. The number of services available and the effective possibility for citizens to access them highly depends on the architectural choices of the Member States with regard to their national identity systems. Member States that have centralised their eGovernment services on a central platform or who have put into place a national identity gateway are more likely to enable a good access to the eIDAS network and to effectively recognise notified eID schemes as a valid authentication means on their platforms. In such cases, a “national module” is integrated on service providers websites. The connection of the national authentication gateway to the national eIDAS node means that from one day to the other, all connected service providers that had already adopted the module can now consume identities received via the national eIDAS node. Member States that do not have such gateways or centralised eGovernment platforms need to enable bilateral connections to their national node for every single service provider. To review the level of acceptance of notified eIDs, the Commission has assessed the possibility to authenticate for seven key public services for cross-border users. The list of key services was determined based on feedback received from Member States that had performed user research and/or analysed statistics of cross-border usage. The review shows that across all EU Member States, only 14% of providers of these 7 key services allowed cross-border authentication with eIDAS/eID, while 44% of providers allowed for sign-in only via a national eID. In conclusion, the large majority of providers of seven key public services do not offer eIDAS authentication to cross-border users. This suggests the conclusion that the eIDAS framework has not been able to effectively implement mutual recognition of eID and cross-border access to public services and European citizens are faced with multiple obstacles to use their notified eID schemes across borders. Cross-border interoperability of eID The eIDAS framework requires that notified national eID schemes shall be interoperable and an interoperability framework is established for this purpose. An implementing act defines the architecture of the eIDAS network based on national nodes and it foresee the adoption of technical specifications notably for the eIDAS minimum data set and message format, as well as links to the assurance levels of the notified eID schemes. As part of the Open Public Consultation, only 24% of respondents agreed that the eIDAS interoperability framework sufficiently supported the mutual recognition of the eID schemes while 43% disagreed. The interoperability of the eIDAS network can be assessed in several dimensions: ·Technical interoperability has been ensured through the creation of a network of nodes based on common technical specifications. The Commission provides technical assistance to Member States and ready-made solutions to facilitate the set-up and maintenance of their nodes which is used by more than half of Member States. ·Organisational interoperability: Member States have raised issues linked to the matching of eIDAS/eID identities with an existing national profile. There is currently no process at EU level to avoid that one person owns multiple eIDs issued under different notified eID schemes. This can lead to denial of access in some cases where the receiving Member State cannot exclude duplication. In addition, non-harmonisation of the minimum data set which is communicated in an authentication can also lead to denials of service. Some service providers require a national registry number to grant access to online public services, however not all Member states issue such a number. Consequently cross-border users may be automatically denied access if the eIDAS authentication does not include such number. Obtaining a national registry number often requires physical presence. This is an obstacle for users from abroad even in case they are eligible to obtain a national registry number and to access a service. ·Semantic interoperability is enabled by the eIDAS attributes profile (technical specifications). These specifications are continuously updated by the eIDAS eID technical subgroup and no major difficulties have been reported. The usage of notified eID by public and private sectors The decentralised nature of the eIDAS network makes it difficult to obtain specific data on the usage of notified eID schemes by public and private sectors. Few Member States have put in place modules allowing to keep track of the statistics of usage of their eIDAS nodes. To assess the usage of notified eID schemes, a number of criteria at the supply and demand side are relevant: ·A critical mass of eID schemes must be notified; ·Relying parties must be connected to the national nodes; ·Private service providers must be entitled to access the domestic node, foreign nodes and notified identity providers; ·Citizens and businesses must have a need to access a service across borders and must be aware about the possibilities to use their national eID for this purpose;

In theory, 59% of the EU population currently has access to a notified eID scheme. A limited number of Member States have provided the number of relying parties connected to their eIDAS node and the situation can vary considerably between Member States depending on size and organisation of their public services: in some countries, each municipality provides some specific services and would therefore need to connect to the national node while in other countries, key public services are provided centrally. However, the number of services connected to the national nodes is considerably smaller than the number of services declared as being accessible via the domestic eID scheme. On the basis of available data it seems that only about half of the services accessible through domestic eID are connected to the national eIDAS node. Member State 2017 2018 2019 2020 Comments Belgium (FAS) 1000 Public services only Czech Republic (eID card) 79 Germany (eID card) 95 Netherlands (DigID) 663 (Target: 12 000 ) Netherlands (eHerkenning) 260 330 393 Italy (SPID) Public 4 478 (Target: 10 000) Data from 30/07/2020 Data from 03/06/2020 Private 11 Portugal 150 202 Public and private Luxembourg Public >200 Private 6 The number of cross-border authentications and especially the number of receiving transactions provides an estimate on the usage of notified eID schemes, as it is related to the number of use cases where citizens request access to an online service across borders. The evolution of the number of transactions in certain Member States confirms that the usage of notified eID schemes is increasing progressively since September 2018, as more and more eID schemes become available for cross-border use. The acceptance of notified eIDs is only mandatory for public sector service providers. The usage of notified eIDs by the private sector is limited by two reasons: ·each Member State remains free to set the conditions for the reuse of its national eIDAS infrastructure by the private sector and for the sharing of the minimum data set of its national eID scheme with private service providers; ·private service providers are not subject to a mutual recognition obligation and can recognize notified eID schemes on a voluntary basis. 17 Member States have at least one national eID scheme in place that accepts private service providers but only 12 Member States have notified such eID scheme. This limits cross-border availability for private service providers and makes it difficult to build a business case given the difficulties for private service providers to identify available eID schemes and actual market size that they will be able to reach. For example, in the Czech Republic, holders of the national eID can use it to access health insurance companies , online gaming and betting websites , and a law firm on top of eGovernment services. The Danish NemID can be used to authenticate to online banking. In Germany, the list of authorised relying parties is also published and includes banks, notaries, pension insurances and system providers for accountants and attorneys. To assess the potential cross-border usage for public services, different proxies can be used. According to Eurostat, in 2019 less than 4% of EU citizens of working age were residents of another EU Member State than where they hold their citizenship. In principle, they should be able to use one eID to access public services in both Member States. In addition, there are online public services where user authentication is needed and that can be used by e.g. tourists (about 30% of EU population travel yearly to another Member State) such as buying tickets for public transport, museums or subscribing to bike rentals. A possibility for assessing the overall potential of eID use is relying on existing use as proxies. Available data from some Member States (e.g. NO, SE, EE, LV, LT), where user authentication solutions are widely re-used by different service providers, authenticating oneself with a legal identity is done roughly around 20 times per month, of which 1 is in the public sector. If that relationship is extrapolated to the EU level, the potential for the EU could be assumed to be roughly 100 billion user authentications per year of which 5 billion in the public sector. On the basis of these assumptions, for example, if expected 3-4% of EU population living in another Member State only use eIDAS in the current scope, the potential of eIDAS authentications in this case would be 150 million authentications per year. Ensure maximum reduction of administrative burden and increase of quality of services The targeted stakeholder consultation indicated that the eIDAS Regulation has reduced administrative burden and increased quality of services for eID. In the OPC, a majority of respondents refer to time savings (77% of respondents), to a simplification of administrative procedures (74% of respondents), to cost savings (68% of respondents) and an increase in service quality (65% of respondents). Reduction of administrative burden is related to the eIDAS Regulation itself and to other related EU legislations which build on the eIDAS ecosystem, such as the Single Digital Gateway Regulation (SDGR). The SDG Regulation enables users to authenticate remotely using their eIDAS notified eID to initiate an exchange of evidence to perform administrative procedures across borders following the ‘once-only’ principle. For public services, eID eases the administrative burden of operational transactions. But there are also benefits for business. Estonia reports that thanks to eID and the digitalization of its administrative procedures, it is possible to establish a company in Estonia in just under 3 hours, including from abroad.

However, the eIDAS Regulation has not achieved its full potential regarding its contribution to a reduction of the administrative burden, as some obstacles such as physical presence to obtain a national registry number and official registration in another Member State persist. For instance, requesting a grant for university studies requires to be officially registered with the local authority. This often requires acquiring a local eID solution. Ensure trust and confidence in the legal certainty and security of eID Vulnerabilities may impact the trust and confidence in the security of eID . However, stakeholders consulted as part of the evaluation indicate that the eIDAS Regulation has ensured trust and confidence in the legal certainty and security of eID increasing certainty on the users’ identity (73% of respondents), service security (66% of respondents) and clarity on the liability of the provider of the electronic identity (51% of respondents). Both Member States and industry actors have raised some concerns that current tools for eID security breaches are not effective and that eID incident management is not adequately regulated at the EU level. In case of reasonable doubts or proof that a notified eID scheme is victim of a security breach, relying Member States do not have the possibility to suspend its usage. The different forums established by the Regulation on the cooperation between the Member States (e.g. the Cooperation Network or eID technical subgroup) are working with ENISA on an incident management tool. A pilot has been initiated with ENISA to adapt current reporting tools to the specific case of eID under eIDAS but to date no general solution has been rolled-out towards Member States. Communication channels were established between Member States following the discovery of a vulnerability in the CEF eID sample software of the eIDAS node in summer 2019. Some stakeholders question the need of maintaining the level of assurance (LoA) “Low” in the eIDAS Regulation in future as it was barely used and would not provide the necessary guarantees for the eID to be trusted. Finally, liability rules are not harmonised across Member States, which creates legal insecurity for service providers. Liability rules are set by the notifying Member State and maximum amounts differ considerably. Trust services Ensure trust and confidence in the legal certainty and security of trust services In the view of the respondents of the Open Public Consultation, the eIDAS Regulation has successfully contributed to ensuring legal certainty on the liability and burden of proof with respect to the provision and use of trust services. Furthermore, the eIDAS Regulation is seen to have successfully defined the legal effects of electronic signatures, electronic seals, electronic time stamps, electronic registered delivery services and electronic documents. Trust and confidence in the security of trust services has also been ensured by regulating the supervision and security requirements for trust services including the requirements imposed on qualified trust service providers on the EU trusted list. Trust service providers and supervisory authorities agree to a large majority that the procedure to follow in case of security breaches is adequate and trust service providers also confirmed to more than 70% that the Regulation had overall ensured trust and confidence in the security of trust services. A number of specific issues linked to the lack of a harmonisation on some aspects were raised by stakeholders: ·Legal certainty of remote signatures: An amendment to Commission Implementing Decision 2016/650 should reference standards CEN EN 419 241-2 and CEN EN 419 221-5. ·Link between eSignature to an eTimestamp: The eIDAS Regulation does not regulate a securely link with the result that the time of signing cannot be relied upon by third parties. ·Common approach with regard to vulnerabilities and incidents reporting: The FESA and ENISA Article 19 Expert Groups suggest adoption of an implementing act defining the technical and organisational measures to manage risk. ·Update of Qualified Electronic Signature Creation Devices (QSCDs): QSCDs are certified with no time limit although vulnerabilities and new requirements are identified. Some stakeholders recommend to increase the periodic assessment of vulnerability and to set a validity limit for such devices. ·Termination of Qualified Trust Services: FESA observes that the lack of requirements on the termination of Qualified Trust Services leads to different practices between Member States. ·Verification of Identity: Trust service providers issuing a qualified certificate must verify in accordance with national law, the identity and if applicable, any specific attributes of the natural or legal person to whom the qualified certificate is issued. Currently article 24 of the eIDAS Regulation requires identity verification by physical presence or by using "other identification methods recognised at national level". The non-harmonisation of these practices raises challenges regarding the trust into the security of services and a common level playing field. ·Transparency of audit results: Some stakeholders call for more transparency on audits results to increase trust between Member States, international actors and to remedy the lack of harmonisation of some governance aspects. Reduce administrative burden and increase the quality of service

A majority of respondents to the OPC agreed that the eIDAS Regulation has led to time savings (85% of respondents), simplification of administrative procedures (77% of respondents), cost savings (72% of respondents), an increase of service quality (69% of respondents) and enhancing user friendliness (61% of respondents). Limiting factors mentioned by stakeholders include a lack of awareness (50% of respondents), a lack of availability for relevant services (39% of respondents) and a lack of user-friendliness and accessibility for persons with disabilities (36% of respondents). A further 10% of respondents considered trust service solutions too expensive. Among the consulted trust service providers, 75% considered that the eIDAS Regulation had a positive impact on the quality of trust services offered on the EU market and on user satisfaction. Ensure cross-border and cross-sector interoperability of trust services A majority of respondents of the stakeholder consultation agreed that interoperability has been ensured with respect to eSignatures (57%), eSeals (52%) and eTimestamps (59%) while 26% of respondents considered that the eIDAS Regulation had failed to ensure the interoperability of trust services. Concerning Qualified Website Authentication certificates (QWACs), a majority of stakeholders (66% of respondents) considered them as not sufficiently interoperable. Consulted trust services providers expressed some reservations with regards to the link between the introduction of the eIDAS Regulation and the increase interoperability of trust services in Europe. 30% of respondents did not believe that the legal framework led to an increase in interoperability. Some stakeholders considered that most of the trust services’ interoperability is linked to an ongoing work of standardisation organisations that would have performed this work with or without the eIDAS Regulation. Moreover, some national dispositions define specific requirements for trust services’ certificates, forcing operators to use different types of certificates in different Member States, effectively reducing their interoperability. Electronic documents Chapter IV of the eIDAS Regulation defines the principle of non-discrimination of the legal effects of electronic documents and their admissibility in legal proceedings. As part of the OPC, 70% of respondents agreed that the legal effect provided to electronic documents by the eIDAS Regulation helped increase their take-up and admissibility in legal proceedings. The European Blockchain Services Infrastructure (EBSI) considers that the current definition of electronic document under eIDAS (any content stored in an electronic form, in particular text or sound, visual or audiovisual recording) would mean that blocks in a blockchain in view of Self Sovereign Identity concepts would equally benefit from the legal effect granted to electronic documents under eIDAS . Q2. To what extent has the Regulation met its specific objectives? Electronic identification Increase availability and take-up of cross-border eID schemes One of the key performance indicators of the eIDAS framework is the number of notifications of eID schemes. To date, 19 Member States have notified at least one national eID solution. Following the notification of an eID scheme, Member States have 12 months to ensure acceptance for authentication to national public online services. As of 13 September 2020, citizens of 11 Member States can use eID notified under eIDAS across borders and Member States are obliged to recognise them for access to their online public services provided they match the minimum level of assurance requested by the service provider (at least “substantial” or “high”). The number of notifications has been steadily progressing with several countries reporting their intention to pre-notify eID schemes. However, some Member States have raised concerns with the difficulty they may face to notify private sector schemes used at the national level to access eGovernment services due to the absence of a commercial model at the EU level and possibility for private identity providers to recover their costs. While the availability of notified eID schemes is progressing, the actual take-up/ usage in terms of the number of cross-border authentications performed has been limited. The limited data of cross-border authentications provided by Member States shows that numbers remain low (<10 000 authentications per year) compared to the usage of eID at domestic level (> millions authentication per year). However, there is a clear trend towards an exponential growth of such transactions in the last years for those Member States where data has been provided (cf. Figure 9). Regarding domestic use of eID data availability is better. Sweden clearly stands out in this table in terms of the total number of transactions and transaction per inhabitant. This is due to the fact that the Swedish eID is provided by the banking sector and used in private sector transactions mainly, while less than 7% of the total 4.1 billion requests performed in 2019 are related to public sector services which makes it comparable to the number of public sector transactions in Denmark and the Netherlands in that same year. The number of unique users per eID scheme is not a sufficient indicator for the take-up of eID as it does not indicate active use. This is particularly relevant in countries that issue eID means (such as national electronic ID cards) to the entire population . Other eID means are taken up voluntarily. Coverage varies between 1% to 96% or even 102% as in the case of Estonia , but this data cannot be directly compared. In general, the availability and uptake of cross border eID schemes is progressing. The growth at domestic level in the usage of national eID schemes will positively impact the further use of notified eID schemes at the European level. Stakeholders agree that the eIDAS framework has fostered the topic of eID high on the agenda of the different EU Member States. Compliance requirements with the eIDAS Regulation have pushed Member States to integrate eID in their respective eGovernment strategies and recognized it as a key enabler for the digital transformation of the European public administration and digital single market. However, the effective uptake and use of notified eID schemes for cross-border transactions remains low. Ensure a governance framework providing sufficient legal certainty, trust and security of electronic transactions throughout the EU

The eIDAS Regulation has established a governance framework for the eID chapter of the Regulation. The key forum of decision and coordination is the Cooperation Network. Overall, members of the Cooperation Network consulted consider that the current governance is effective and adequate. However, there are concerns of Member States regarding the effectiveness and efficiency of the current system of notification and peer review established to support mutual recognition between Member States. Member States criticise the overall length of the procedure to notify an eID scheme which has taken in the past 9 months in average from pre-notification to publication in the official journal. Given that there is a 12-month delay for the application of mutual recognition following the publication in the Official Journal, eID schemes only become effectively available for cross-border authentication after almost 2 years. This duration is very long compared to the speed at which the identity market is developing and could deter private identity providers to enter such procedure. A vast majority of the members of the Cooperation Network consulted on their perception of the peer review procedure replied that the understanding of the peer review and its scope between Member States required clarification. As part of this evaluation, 39% of consulted members of the Cooperation Network were also of the opinion that the circumstances, formats and procedures for the pre-notification of eID schemes were not adequate. Member States raised concerns over the tendency in some peer reviews to go beyond scope with regard to the level of security scrutiny, rather than focus on an overall assessment of the eID schemes against the requirements of the Regulation and correct assessment of the Member State declared LoA of its pre-notified eID solution. There is also no uniform understanding on how to assess new and emerging technologies and innovative solutions. Since 2018, there is an ongoing controversy among experts in the Cooperation Network about the security of mobile schemes, remote on-boarding solutions, biometric authentication and the associated best-practices and levels of assurance. These controversies and disagreements complicate peer reviews and in one specific case have delayed the conclusion of the notification procedure for over one year. Guidance documents have not been able to substantially improve these procedural weaknesses given that by September 2020 agreement between Member States’ experts had not yet been found on guidance regarding levels of assurance and peer reviews despite discussions ongoing for around two years. Another concern raised by Member States with regard to the peer review procedure is the lack of legal value from the opinion. As such, nothing prevents a Member State to notify an eID scheme at a higher level of assurance than the conclusion of the peer review performed by the member of the Cooperation Network. Such a situation would greatly disrupt the whole trust framework as Member States would be compelled to recognise such eID scheme. There is a lack of common vision among Member States on the purpose of the peer review process: some are focussing on the technical details and implementation of the eID schemes while others are adopting a more risk assessment approach. There is an agreement that more resources should be dedicated to the issuance of guidance on understanding how to assess new technological developments (e.g. remote video solutions, biometrics, etc…). Ensure that all consumers can benefit from the advantages of cross-border eID In many cases, access to an eID scheme is linked to the residence status of the respective user. Currently, 41% of EU citizens don’t have access to a notified and high level-of-assurance eID because their countries do not offer such a solution and they are unable to obtain an eID in another country. One aim of the Regulation was to ensure that eID schemes notified under eIDAS would be used by public and private sectors to access online services across borders. In February 2021, 14 of the EU Member States have already notified at least one eID scheme and 2 Member States have pre-notified. This means that half of the EU have not pre-notified or notified an eID scheme under eIDAS yet. This lack of availability of notified eID schemes limits the usage of notified eIDs by public and private sectors in Europe. Even for the notified eID schemes, there is a limited availability of services in practice. Not all public services that should have been accessible via the eIDAS framework can actually be accessed that way. Trust services Increase availability and take-up of cross-border and cross-sector trust services While the availability of trust services refers to the number of services available across Europe, the take-up of trust services describes the actual usage of the different trust services. Both the availability and take-up of trust services in Europe have been increasing since the introduction of the eIDAS Regulation, however, there are differences among Member States and among different trust services, not least due to the prevalence of national requirements for the use of trust services in specific sectors. The increased availability of services correlates with an increased number of trust services providers, as indicated by the entries on the EU Trusted List: Respondents to the OPC agreed that the eIDAS Regulation has increased the availability of electronic trust services in the EU as follows: eSignature (78%), eSeal (78%), and eTimestamps (73%). A majority of respondents furthermore agreed that the eIDAS Regulation had increased the availability of ERDS (51%). With regard to their uptake, 77% of respondents to the OPC stated that they had already used electronic trust services, and 65% stated that they felt more comfortable and confident to use trust services now compared to five years ago. Still, 89% of respondents agreed that public administrations should make better use of electronic trust services in their contact with citizens and businesses. In terms of the repartition of trust services, QeSignature, QeSeals and QTimestamps are the services mostly used. The number of QWAC, QeSeal, Preservation, QERD, QVal are significantly less in demand.

Ensure an optimal level and scope of governance for trust services The eIDAS Regulation has set up a governance framework for trust services that includes supervisory bodies, conformity assessment bodies and trusted lists for trust service providers in Member States. A full description of the supervisory mechanism of trust services is presented in Section 3.2. Respondents to the OPC were divided on the effectiveness of the governance framework and only 37% agreed that it was adequate. The key governance issue raised by stakeholders concerns the lack of harmonisation in conformity assessment which resulted in different national approaches and a possible ‘race to the bottom’ where trust service providers may turn to the cheapest or least stringent certification scheme. Several stakeholders proposed to base accreditation on standards in order to provide more clarity to the CABs on how to assess qualified trust service providers. This opinion is shared by ENISA in a report published in May 2019. Stakeholders also complain about the lack of referenced standards as foreseen in articles 24(1), 24(5), 28(6), 32(3), 33(2), 34(2), 38(6), 40, 42, 44(2) and 45 in order to allow for a more harmonised assessment of the functional requirements against appropriate technical and organisational standards. Another issues raised by a number of stakeholders is the different approach of Supervisory Bodies regarding the acceptance of remote identification methods and their consideration as equivalent to “physical presence” as per article 24(1)(b) of the eIDAS Regulation given the absence of EU-level guidance with the associated risks of an unlevelled playing field and ‘race to the bottom’. At the same time, there is a growing demand to authorize remote identification for on-boarding of users given physical distance requirements as a result of the COVID-19 crisis. Supervisory Authorities are therefore calling for the harmonization of requirements with regard to remote identification. Some supervisory authorities have also raised concerns regarding the lack of supervision of non-qualified trust service providers. Article 19(1) of the eIDAS Regulation requires that qualified and non-qualified trust service providers take appropriate technical and organisational measures to manage security risks. However, the absence of supervision obligations at EU level leads to a lack of market data and may result in non-reporting of security breaches by non-qualified TSPs. The ENISA Article 19 Expert group also points to a gap in the supervision of third-country trust services provided within the EU. Trust services providers established in third countries providing trust services in Europe, e.g. for the provision of QWACs, rely on registration offices or “supporting services” in the EU which however are not supervised themselves. This may also be linked to a lack of common understanding for the concept of establishment (Article 17.3). Need for the recognition of the forum of cooperation in the field of trust services Article 18(1) of the eIDAS Regulation foresees that Supervisory bodies cooperate with a view to exchanging good practice, however no formal governance body has been established for this purpose similar to the Cooperation Network on eID. An informal forum of information exchange was created by ENISA to facilitate cooperation on security breaches following article 19 of the eIDAS Regulation. The focus of the group is to define technical details of incident reporting, ensure ad-hoc reporting about incidents, as well as an annual summary report. The decisions of this group are not binding. Q3. To what extent has the Regulation met its general objectives? Develop a digital single market for eID and trust services The market for identity authentication and fraud solutions is set to grow from EUR 10.3 billion in 2018 to about EUR 23.6 billion by 2023 worldwide, with identity authentication making up a major part of this growth. In Europe, the identity verification market is expected to grow from EUR 1.23 billion in 2018 to EUR 3.71 billion by 2027. eIDAS and the Connecting Europe Facility (CEF) programme have built a digital infrastructure across the EU that successfully supports Member States and businesses to set up this infrastructure via a set of generic digital building blocks. In the area of trust services, the eIDAS Regulation has enabled companies to develop their business cross borders. More than half of trust service providers consulted consider that the eIDAS Regulation enabled them to increase their customer base in the EU and 75% think that the eIDAS Regulation has resulted in an increased use of the trust services they provided. Although the aggregated feedback of public and stakeholder consultations clearly confirm an important and positive contribution by eIDAS to the creation of a European market for trust services, the analysis of the eID market shows continuing fragmentation between public and private providers with limited take-up of eID/eIDAS in the private sector. The World Economic Forum has identified the lack of commercial models for public-led eID schemes as a distinct gap in the digital identity landscape today. At the moment, the absence of a common commercial model for eID including common rules on costs and liabilities lead to a fragmented eID market which is not attractive to private service providers. The current situation does not justify investments by service providers to connect to the eIDAS network: ·Member States set terms and conditions of access to eIDAS nodes at national level. In some cases access is free while in other cases investment costs are recovered. In addition, there is no obligation for Member States to accept cross-border authentication requests coming from private service providers. ·Cost recovery rates and procedures for the use of notified eID have not been set generally requiring individual contracts with service providers and different invoicing models and conditions. ·Private service providers miss information on the terms and conditions of their access to eIDAS nodes. In case they offer services at EU level only, there is no guidance to which national eIDAS node to connect; ·Fragmentation of the market and multiple conditions make it difficult for private service providers to build a business case based on connection to the eIDAS network and effective access to a critical mass of users.

A different path on national level has been followed by Nordic countries where public sector authorities purchase identity provision from the private sector (bankID). Each transaction is therefore a cost for the state budget, contrary to countries which have integrated eID as a publicly financed infrastructure. However, it is less straightforward for Member States to notify a private sector led eID scheme (e.g bankID) that the government does not fully control. For example, in all Member States banks have methods of authenticating their users. Some eID means can be used only in one bank, others across different banks, government and other private services. Promote the interest and protection of end-users (citizens and businesses) Trust service providers consulted were divided on whether the eIDAS Regulation adequately addresses data and privacy concerns (51% agreed with the statement while 29% disagreed). 19% of OPC respondents mentioned privacy concerns as a limiting factor for the use of eID and trust services. The Future Trust research project investigated to what extend the eIDAS Interoperability Framework should be adapted to comply with the high level of data protection introduced by the European General Data Protection Regulation (GDPR). At the moment, when a user authenticates to a foreign online service, the whole eIDAS minimum dataset is automatically shared with the relying party. The study proposes a modification of the technical specifications in order to enable selective disclosure (e.g. sharing only the necessary attributes for the service) and pseudonymisation (e.g. tokenization of unique identifiers) of transmitted attributes. The eIDAS Regulation foresees a minimum data set for legal persons. Only one Member States has notified so far an eID scheme for legal persons (NL – eHerkenning). However, in general, the number of schemes dedicated to legal persons in Europe is rather limited. We assume that the lack of notification is due to the minimal availability of such schemes and not due to a blocking factor linked to the disposition of the eIDAS framework. Overall, the eIDAS framework has proven ineffective to ensure that EU citizens have access to a secure means of eID that can be used cross-border. This is due to a number of key limiting factors and multiple conditions that must be met to ensure successful cross-border authentication. The current technical and legal set-up is too complex and limited to too few use cases, while the needs and business cases of private sector service providers are not captured. In the area of trust services, the eIDAS Regulation has proven generally effective, in particular with regard to eSignatures, eSeals and eTimestamps. 5.2 Efficiency Q4. Did the regulatory intervention create any additional costs and benefits for targeted stakeholders? Electronic identification Concerning eIDs (Article 6 to 12), the main purpose of the Regulation is to ensure that national eID schemes issued in one country can be used in any other. This implies the need to coordinate a series of activities, including communication and verification of information performed by different stakeholders. The key stakeholders includes: ·National authorities and eIDAS node operators responsible for ensuring correct performance of the eIDAS infrastructure; ·eID providers responsible for issuing the electronic identification means; ·Service providers (using eID) offering online services that rely on eID for cross-border authentication according to Article 7 (eligibility for notification), Article 8 (assurance levels) and Article 11 liability of the eIDAS Regulation. Administrative burdens Substantive compliance Enforcement costs National authorities and eIDAS node operators ·Mutual recognition of eID nodes ·Notification of eID schemes (and pre-notification) – including preparation for peer review ·Peer review of other MS schemes ·Communication security breaches ·Cooperation and interoperability with other MS ·Operational costs (node operators) ·Costs entailed by the assurance levels ·Costs due to adaptation of national regulatory framework (if needed) ·Liability costs in case of security breaches ·Supervisory of private eID providers ·Compliance certifications of private eID providers eID providers ·Notification of eID schemes (and pre-notification) – including preparation for peer reviews ·Interface with national infrastructure/technical interoperability ·Technical costs related to level of assurance ·Liability costs in case of security breaches Service Providers ·Specific interface with national infrastructure – connector ·Adaptation costs Administrative burdens and costs For national authorities and eIDAS node operators: ·Mutual recognition obligations (Article 6): These obligations require Member States to recognise notified electronic identity issued in another Member State. The main costs relate to obligations set in Article 7 identifying eligible entities to issue an electronic identification scheme and to Article 9 setting information obligations that must be provided in the notification process (par. 1) and obligations regarding the communication of eID schemes that are no longer valid (par. 4).

·Cooperation and interoperability (Article 12): – ID EU 2015/296. Costs entailed by the participation of Member States to the interoperability framework (exchange of information, good practices, peer review of electronic identification schemes, etc.). ·Notifications of security breaches and suspension or revocation of eID schemes For eID providers: For eID providers, the main administrative burden relates to the notification process. Substantive compliance costs Substantive compliance costs include investments and expenses to be covered by businesses and citizens to comply with obligations or requirements. For national authorities and eIDAS node operators: Substantive compliance costs are generated by the following procedures: ·eIDAS node Management: Annual operating costs (both internal costs and outsourcing costs) that Member States Agencies and node operators incur to manage the eIDAS node. ·Security: Security is the most relevant source of cost since notified electronic schemes must comply with the levels of Assurance as defined in Article 8 “Assurance levels of electronic identification schemes”. These levels of assurance (low, substantial and high) are linked to requirements which in practice require investments into certain levels of technology. ·Regulatory adaptation Costs: These costs incur in the adaptation of national regulatory frameworks such as national regulatory provisions on the use of electronic identities issues in other Member States for the access of national public services. ·Liability Costs (Article 11): Liability costs may arise to cover security breaches as Member States are liable for damage caused intentionally or negligently to any natural or legal person due to a failure to comply with the obligations stated in the eIDAS Regulation. For eID providers: ·Connection Costs: Operational costs for the eID provider to connect to the national Node. ·Investment in Technology: eID must ensure a certain level of security or assurance. Investment in technology is required to ensure assurance levels are met; ·Liability costs in case of security breaches: Also eID providers, are liable in case of security breaches according to Article 10. For Service Providers: The eIDAS Regulation does not foresee costs for service providers which can access the network free of charge. However, adaptation costs may incur for the purpose of identity reconciliation in external / national databases for the purposes of the service it provides. Enforcement costs Enforcement costs are associated with activities such as monitoring, enforcement and adjudication. For these activities, the eIDAS Regulation mandates national authorities that, in cases of security breach, may suspend or revoke electronic identity schemes. In addition, in Member States where eID/eIDAS providers are private, costs incur for the purpose of their supervision and issuing of certifications of compliance.

Benefits National authorities and eIDAS node operators Direct benefits of the eIDAS Regulation for national authorities and eIDAS node operators are difficult to identify and quantify. In qualitative terms, national authorities and eIDAS node operators consulted, underlined that cross-border usage of eIDs and exchange of information and best practices can increase the efficiency in the implementation process of new technologies, thereby resulting in administrative cost-savings for public services. eID Providers Benefits result from the reputational value associated with compliance with the high standards of EU Regulation, which in turn improves the market position of a private provider and generates potential benefits in terms of revenues and access to capital. In addition eIDAS can generate indirect benefits associated with legal compliance with requirements in the area of financial services, AML, privacy and cybersecurity. Service Providers Administrative savings are generated by the reduced front-desk costs for service providers, which is also reflected in time-saving for end-users (both in terms of the process to acquire an additional ID in another country and the need to be present physically). For private service providers, a source of benefit is the larger market base provided by cross-border use as more users can access digital services from abroad. In addition, interviewees underlined the benefits of increased security and assurance, particularly in certain countries. Key benefits of trusted eID provision to private service providers in terms of liability management and cost-savings through the outsourcing of identification and authentication could not be quantified given the insufficient take-up of eID / eIDAS with private sector service providers. Trust services The analysis of costs related to Trust Services focuses on the effects of their cross-border recognition ensured by the eIDAS Regulation. The stakeholder mapping below provides an overview of the entities for which the eIDAS Regulation envisages specific requirements or duties (and the related articles from the eIDAS Regulation) that are generating costs. Administrative burden Substantive compliance Enforcement costs Supervisory body ·Informing national body responsible for trusted lists ·Reporting to European Commission ·Informing Data Protection Authorities ·Cost for reciprocal assistance provision ·Analysing conformity assessment reports ·Carrying out audits (borne by QTSPs) ·Granting or withdrawing qualified status ·Requiring (Q)TSP to remedy failures Qualified TSP ·Qualification procedure ·Communication of security breaches ·Audit costs ·Technical expenses ·Physical assets ·Liability costs Non-Qualified TSP ·Communication of security breaches ·Technical expenses ·Physical assets ·Liability costs N/A Administrative burden and costs Supervisory Authorities Supervisory activities generate two types of costs: enforcement costs and administrative costs related to reporting and cooperation obligations. For supervisory authorities, the following administrative costs may incur: ·Cooperation with other supervisory bodies and assistance in accordance with Article 18; ·Information on breaches of security or loss of integrity in accordance with Article 17.4(c); ·Activity reporting to the Commission in accordance with paragraph 6 of Article 17.4(c); ·Cooperation with data protection authorities and information on audits of qualified trust service providers where personal data protection rules appear to have been breached; ·Information on updates to the national trusted list referred to in Article 22(3) unless the list is managed by the supervisory body. Supervisory authorities ensure that market operators (TSPs and QTSPs) operate in compliance with relevant regulations and meet the requirements of the eIDAS Regulation. In this context, costs related to the following enforcement activities may incur :

·Ex ante and ex post supervisory activities to ensure that QSTPs and the qualified trust services that they provide meet the requirements laid down in this Regulation; ·Action taken in relation to non-qualified trust service providers established through ex post supervisory activities in case those TSPs or the trust services they provide do not meet the requirements laid down in this Regulation; ·Analysis of conformity assessment reports referred to in Articles 20(1) and 21(1); ·Audits of the qualified trust service providers; ·Granting of qualified status t