Trust services in Estonia: qualified and non-qualified providers

Trust services are electronic services such as issuing certificates for electronic signatures and seals, creating time stamps and providing electronic registered delivery¹. In Estonia they are governed by the EU eIDAS Regulation and the Estonian Electronic Identification and Trust Services for Electronic Transactions Act⁷. A provider needs a licence from the Information System Authority for qualified status of itself and its service¹⁰¹⁷.

Information as of 11 November 2026. Every numbered statement of this page was checked in the official text named below and re-checked by a second reviewer on 2026-11-11. The page is general information, not legal advice; the authority decides on every application.

What the activity is

Regulation (EU) No 910/2014 on electronic identification and trust services (the eIDAS Regulation, as amended by Regulation (EU) 2024/1183) defines a trust service as an electronic service, normally provided for remuneration, that consists of activities such as: issuing or validating certificates for electronic signatures, electronic seals or website authentication; creating or validating electronic signatures and seals; preserving signatures, seals and their certificates; managing remote signature or seal creation devices; issuing or validating electronic attestations of attributes; creating or validating electronic time stamps; electronic registered delivery; electronic archiving; and recording data in an electronic ledger¹.

A trust service provider may provide its services either as a qualified or as a non-qualified provider². A qualified trust service provider is one that provides one or more qualified trust services and has been granted qualified status by the supervisory body³. A qualified electronic signature has the equivalent legal effect of a handwritten signature⁴.

Not covered: trust services used exclusively within closed systems resulting from national law or from agreements between a defined set of participants⁵. Also not covered: "trust and company services" under the Money Laundering and Terrorist Financing Prevention Act (company formation, acting as a director, providing a registered address and similar), which is a different activity under a different act⁶.

The legal act and the authority

• Regulation (EU) No 910/2014 (eIDAS), applied directly, as amended by Regulation (EU) 2024/1183.
• E-identimise ja e-tehingute usaldusteenuste seadus (Electronic Identification and Trust Services for Electronic Transactions Act, EUTS). It regulates trust services to the extent that the eIDAS Regulation does not⁷.
• Majandustegevuse seadustiku üldosa seadus (General Part of the Economic Activities Code Act) applies to starting and carrying on the activity, subject to the special rules of EUTS and eIDAS⁸.

The competent authority under EUTS is the Riigi Infosüsteemi Amet (Estonian Information System Authority, RIA)⁹. RIA decides the licence application¹⁰, keeps the Estonian trusted list under Article 22 of eIDAS¹¹, publishes the list of trust service providers and trust services on its website¹², and carries out state and administrative supervision¹³. The Consumer Protection and Technical Regulatory Authority (TTJA) is the controller of the Register of Economic Activities¹⁴.

Where it shows: a qualified provider and its service are entered in the trusted list for the period of validity of the licence¹⁵. Under the general rules, the data of each activity licence are also entered in the register¹⁶.

Who must apply

A licence is required for providing a qualified trust service: the person and the service must have qualified status under Article 21(2) of eIDAS, evidenced by the licence¹⁷. The licence is valid for two years¹⁸.

A non-qualified provider may be entered in the trusted list by a decision of RIA, for two years¹⁹; in that case it must undergo a conformity assessment by a conformity assessment body before starting the service and at least every two years²⁰. Non-qualified providers must have risk-management policies and notify security breaches within 24 hours²¹, and the supervisory body acts on them through ex post supervision²².

The eIDAS Regulation applies to trust service providers established in the Union²³.

Requirements for the applicant

Financial cover. Whether a minimum share capital applies is specified for the client's situation. The provider must hold liability insurance with a sum insured per year of at least EUR 1 million per insured event and at least EUR 1 million for all events together, or a comparable guarantee or financial resources of the same amount, and must publish information about this cover²⁴.

Termination plan. An up-to-date termination plan must include at least: how customers are informed; how private keys are destroyed; and how hardware is destroyed or reset²⁵. eIDAS also requires an up-to-date termination plan²⁶.

Staff. Staff providing the service must not have a valid conviction for an intentional criminal offence²⁷. Under eIDAS, staff and subcontractors must have the necessary expertise, reliability, experience and qualifications and training in security and personal data protection, and management procedures must correspond to European or international standards²⁸.

Systems and operations. eIDAS requires trustworthy, tamper-protected systems and products, secure storage of data, measures against forgery and theft, risk-management policies, 24-hour notification of significant security breaches, and, for certificate issuers, a certificate database²⁹. EUTS requires a log of operations to be kept for ten years and identity evidence for ten years after the end of the certificate's validity³⁰.

Notices. A qualified provider must inform the supervisory body at least one month before any change in its qualified services and at least three months before ceasing them³¹.

Tax. The applicant must have no state or local tax debt³².

AML/CFT. The licence grounds in EUTS § 8 do not list anti-money-laundering internal rules or a compliance officer³³; whether other acts apply to the business is specified for the client's situation.

Ongoing audit. Qualified providers are audited at their own expense at least every 24 months and must send the report to the supervisory body within three working days of receipt³⁴.

Documents filed with the application

The process starts with notifying the supervisory body together with a conformity assessment report issued by a conformity assessment body³⁵. A conformity assessment body is one accredited under Regulation (EC) No 765/2008 as competent to assess qualified trust service providers³⁶.

The EUTS application contains, in addition to the data required by the General Part of the Economic Activities Code Act³⁷:

• the name and description of the trust service, its policies (practice principles), certificate and the conformity assessment report;
• proof of no state or local tax debt, if these data are not available from a state database³⁸.

The policies must be described exhaustively; this is presumed where they follow the European Telecommunications Standards Institute (ETSI) standards or an equivalent public specification³⁹.

The general data include the company's name and registry code, contact details, the activity name and classification code, and the name and contact details of the person signing⁴⁰.

State fee and processing time

State fees (State Fees Act § 116²)⁴¹:

Time limits: RIA decides after receiving proper data and documents within 80 days for a first licence and 50 days for a repeat licence⁴². Under Article 21(2) of eIDAS, qualified status is to be granted and the trusted-list body informed not later than three months after notification; if the verification is not concluded in that time, the supervisory body informs the provider of the reasons and of the period in which it will be concluded⁴³. RIA may ask for clarifying information during the procedure⁴⁴. After the licence is granted, RIA enters the provider in the trusted list within ten days⁴⁵, and the qualified service may begin only after the qualified status is indicated in the trusted list⁴⁶.

These are the time limits set by law, not a promise of a date or of the outcome; the decision is RIA's.

What LexorCorp Global OÜ does and how to order

LexorCorp Global OÜ prepares the application documents for an activity licence and manages the process: it reads the requirements of the act for the activity from the official text, prepares the application and the documents it needs, and handles the written follow-up of the authority's questions. It does not provide legal advice, audits or tax advice, does not carry out the conformity assessment (that is done by an accredited conformity assessment body), and does not meet the insurance, staff or systems requirements for the client. The licence cannot be promised; RIA decides. State fees are not included and are paid by the client.

The price for trust services is given on request. Open the guide Activities that need a licence or a notice in Estonia, section "Trust services", and use "Request a price" next to the service concerned; the request reaches us by email and we reply by email.

Sources

1. eIDAS Art. 3(16) — text in force from consolidated version 18.10.2024 (incl. Reg. 2024/1183, corrigendum 9.4.2025)
2. eIDAS Art. 3(19) — text in force from consolidated version 18.10.2024 (incl. Reg. 2024/1183, corrigendum 9.4.2025)
3. eIDAS Art. 3(20) — text in force from consolidated version 18.10.2024 (incl. Reg. 2024/1183, corrigendum 9.4.2025)
4. eIDAS Art. 25(2) — text in force from consolidated version 18.10.2024 (incl. Reg. 2024/1183, corrigendum 9.4.2025)
5. eIDAS Art. 2(2) — text in force from consolidated version 18.10.2024 (incl. Reg. 2024/1183, corrigendum 9.4.2025)
6. RahaPTS § 8 — text in force from 21.07.2026
7. EUTS § 1(1) — text in force from 01.01.2026 (RT I, 30.12.2025, 16)
8. EUTS § 1(4) — text in force from 01.01.2026 (RT I, 30.12.2025, 16)
9. EUTS § 2 — text in force from 01.01.2026 (RT I, 30.12.2025, 16)
10. EUTS § 7(1) — text in force from 01.01.2026 (RT I, 30.12.2025, 16)
11. EUTS § 3(1) — text in force from 01.01.2026 (RT I, 30.12.2025, 16)
12. EUTS § 15(1) — text in force from 01.01.2026 (RT I, 30.12.2025, 16)
13. EUTS § 22 — text in force from 01.01.2026 (RT I, 30.12.2025, 16)
14. MSÜS § 8(4) — text in force from 01.09.2025
15. EUTS § 6(3) — text in force from 01.01.2026 (RT I, 30.12.2025, 16)
16. MSÜS § 53(1), § 8(1) — text in force from 01.09.2025
17. EUTS § 6(1) — text in force from 01.01.2026 (RT I, 30.12.2025, 16)
18. EUTS § 6(2) — text in force from 01.01.2026 (RT I, 30.12.2025, 16)
19. EUTS § 10(1),(3) — text in force from 01.01.2026 (RT I, 30.12.2025, 16)
20. EUTS § 11(3) — text in force from 01.01.2026 (RT I, 30.12.2025, 16)
21. eIDAS Art. 19a(1) — text in force from consolidated version 18.10.2024 (incl. Reg. 2024/1183, corrigendum 9.4.2025)
22. eIDAS Art. 46b(3)(b) — text in force from consolidated version 18.10.2024 (incl. Reg. 2024/1183, corrigendum 9.4.2025)
23. eIDAS Art. 2(1) — text in force from consolidated version 18.10.2024 (incl. Reg. 2024/1183, corrigendum 9.4.2025)
24. EUTS § 5(2), (2¹) — text in force from 01.01.2026 (RT I, 30.12.2025, 16); § 5(2),(2¹) in force 13.03.2023
25. EUTS § 5(4) — text in force from 01.01.2026 (RT I, 30.12.2025, 16)
26. eIDAS Art. 24(2)(i) — text in force from consolidated version 18.10.2024 (incl. Reg. 2024/1183, corrigendum 9.4.2025)
27. EUTS § 5(9) — text in force from 01.01.2026 (RT I, 30.12.2025, 16)
28. eIDAS Art. 24(2)(b) — text in force from consolidated version 18.10.2024 (incl. Reg. 2024/1183, corrigendum 9.4.2025)
29. eIDAS Art. 24(2)(e),(f),(fa),(fb),(g),(k) — text in force from consolidated version 18.10.2024 (incl. Reg. 2024/1183, corrigendum 9.4.2025)
30. EUTS § 5(3),(7) — text in force from 01.01.2026 (RT I, 30.12.2025, 16)
31. eIDAS Art. 24(2)(a) — text in force from consolidated version 18.10.2024 (incl. Reg. 2024/1183, corrigendum 9.4.2025)
32. EUTS § 8 p 3 — text in force from 01.01.2026 (RT I, 30.12.2025, 16)
33. EUTS § 8 — text in force from 01.01.2026 (RT I, 30.12.2025, 16)
34. eIDAS Art. 20(1) — text in force from consolidated version 18.10.2024 (incl. Reg. 2024/1183, corrigendum 9.4.2025)
35. eIDAS Art. 21(1) — text in force from consolidated version 18.10.2024 (incl. Reg. 2024/1183, corrigendum 9.4.2025)
36. eIDAS Art. 3(18) — text in force from consolidated version 18.10.2024 (incl. Reg. 2024/1183, corrigendum 9.4.2025)
37. EUTS § 7(3) — text in force from 01.01.2026 (RT I, 30.12.2025, 16)
38. EUTS § 7(3) p 1–2 — text in force from 01.01.2026 (RT I, 30.12.2025, 16)
39. EUTS § 7(4) — text in force from 01.01.2026 (RT I, 30.12.2025, 16)
40. MSÜS § 19(2) p 1, § 15(1) p 1–4, 7 — text in force from 01.09.2025
41. Riigilõivuseadus § 116² — text in force from 01.11.2026; § 116² in force 01.01.2025
42. EUTS § 7(2) — text in force from 01.01.2026 (RT I, 30.12.2025, 16)
43. eIDAS Art. 21(2) — text in force from consolidated version 18.10.2024 (incl. Reg. 2024/1183, corrigendum 9.4.2025)
44. EUTS § 7(5) — text in force from 01.01.2026 (RT I, 30.12.2025, 16)
45. EUTS § 14 — text in force from 01.01.2026 (RT I, 30.12.2025, 16)
46. eIDAS Art. 21(3) — text in force from consolidated version 18.10.2024 (incl. Reg. 2024/1183, corrigendum 9.4.2025)

Official sources

The laws this article names, each linked to its official text, as read on 9 October 2026. For the Estonian acts we read the English translation in Riigi Teataja; the legally binding text is the Estonian one.

• Money Laundering and Terrorist Financing Prevention Act — Riigi Teataja, English translation
• State Fees Act — Riigi Teataja, English translation

Sources in the text are named without links; the official texts are linked under Official sources. To see which of our services your company needs, open the Business Navigator.