eIDAS v2 – Qualified Electronic Archiving Service

CEN/TS 18170 (published in May 2025) is the benchmark European technical specification defining the functional requirements for electronic archiving services. It was explicitly drafted to accompany the introduction of electronic archiving services (qualified or non-qualified) by the eIDAS v2 Regulation (Regulation (EU) 2024/1183).

Its primary role is to provide a harmonized technical framework allowing Trust Service Providers (TSPs) to demonstrate compliance. It details the procedures and technologies necessary to ensure the durability, readability, integrity, confidentiality, and proof of origin of electronic records and documents throughout their retention period.

The eIDAS v2 Regulation clearly distinguishes between two distinct types of trust services:

• Electronic Archiving (governed by CEN/TS 18170): Introduced by Article 3(48) of eIDAS v2, it focuses on the comprehensive preservation of the data or document's content itself (durability, readability, integrity) over the long term.
• Preservation of Electronic Signatures, Seals, or Certificates: Governed by Article 3(16)(e) (and covered by ETSI TS 119 511 and TS 119 512), its sole technical purpose is to extend the cryptographic validity of a specific signature or seal affixed to a document.

The CEN/TS 18170 specification states that an electronic archiving service may, however, incorporate or rely upon a signature preservation component if required.

To guarantee absolute trust and achieve eIDAS v2 compliance, an Electronic Archive Trust Service Provider (EATSP) must meet strict technical criteria:

• European Localization: All components of the processing and storage infrastructure must be mandatory located within the European Union (EU).
• Geographical Redundancy: Archived information packages (AIP) must be permanently stored across at least two separate, geographically distinct data centers to mitigate shared physical or environmental risks.
• Integrity and Traceability (Audit Trail): The system must generate immutable logs for "critical events" (such as ingest, format conversion, or deletion). This audit trail must be sealed and protected against tampering using cryptographic signatures or integrity chains (e.g., Merkle trees).

In accordance with Article 45j of eIDAS v2 and the criteria of CEN/TS 18170, the archiving service must be capable of automatically generating a data integrity report. This report is provided upon document retrieval (and at any time during the retention period).

For a Qualified Provider (EAQTSP), this report must mandatory be covered by a qualified electronic seal or signature of the EATSP. By recalculating the document's cryptographic hash and verifying it against the history of the immutable audit trail, it formally certifies that the data has undergone no unauthorized alteration or tampering since the exact moment of its ingestion.

The specific implementing act for qualified electronic archiving is Commission Implementing Regulation (EU) 2025/2532. Officially published in the Official Journal of the EU on December 17, 2025, this text directly completes Article 45j of the eIDAS v2 Regulation.

It establishes uniform implementation conditions across Europe, transforming high-level eIDAS guidelines into definitive, binding audit criteria. To be listed on the European Trusted List, an archiving TSP must successfully pass a conformity assessment aligned with this implementing regulation and technically supported by the CEN/TS 18170 specification.

Implementing Regulation (EU) 2025/2532 introduces a historic legal advantage: a cross-border legal presumption of integrity and accuracy of origin. In practice, this means:

Inversion of the Burden of Proof: In a legal dispute or regulatory inspection, a document extracted from a qualified archiving system is legally presumed authentic and intact since the day it was deposited. The opposing party bears the entire burden of proving any potential tampering.

Automatic Mutual Recognition: A qualified archiving service certified in France by LSTI is automatically recognized with the exact same immediate evidential value before courts and public authorities across the other 26 countries of the European Union.

Yes, absolutely. Implementing Regulation (EU) 2025/2532, in perfect alignment with clause 10.5 of CEN/TS 18170, explicitly addresses media migration (e.g., switching servers, moving to secure cloud environments) and format conversion (e.g., converting an old Word file to PDF/A) to battle technological obsolescence.

The implementing act dictates that these operations must be bound by strict rules:

• Zero Information Loss: The conversion process must preserve the informational integrity and significant properties of the original record.
• Full Traceability: Every migration or conversion is categorized as a critical event. The old format, new format, tooling used, and the cryptographic hash before and after the operation must be immutably recorded in the audit trail.
• Maintenance of Proofs: If the original document carried an electronic signature or seal, the system must apply validation-augmentation techniques (for instance, through a CEN/TS 18170 Evidence Record) to extend the validity of the proof across the entire retention span.