eIDAS is the European Union’s regulation on electronic identification and trust services. It gives people and organizations common rules for proving who they are online, signing documents electronically, and trusting what they receive from another party across EU borders.
The name stands for electronic IDentification, Authentication and trust Services. The legal text is Regulation (EU) No 910/2014. If you run a website, you meet eIDAS in one specific place: the qualified website authentication certificate, or QWAC.
What is eIDAS?
eIDAS was adopted in 2014 and set one legal framework for two things that used to vary country by country:
- Electronic identification (eID): national digital ID schemes that one EU country can recognise in another, so a citizen can use their own country’s digital identity to reach public services elsewhere.
- Trust services: electronic services that create, check, or protect evidence online. These include electronic signatures, electronic seals, timestamps, electronic registered delivery, and website authentication.
Because it is an EU regulation, it applies directly in every member state without needing separate national laws. The rules for trust services have applied since 2016.
What is eIDAS 2.0?
eIDAS 2.0 is the common name for Regulation (EU) 2024/1183, which amended the original regulation. It entered into force in 2024. Its best-known change is the European Digital Identity Wallet: member states must offer citizens a wallet app for identity and credentials.
The update also widened the list of trust services, and it tightened what is expected of website certificates. For websites, it is the amended text that requires web browsers to recognise qualified website authentication certificates. That is why QWAC support in mainstream browsers is now a practical matter and not only a legal one. The QWAC overview covers which browsers support them.
Who does eIDAS apply to?
The regulation touches several groups in different ways:
- EU member states and public bodies must recognise notified eID schemes from other member states when they offer online services that need electronic identification.
- Trust service providers established in the EU must meet its security and audit requirements. A qualified trust service provider (QTSP) has been assessed, is supervised by a national authority, and is listed on an official EU trusted list.
- Businesses and individuals are users. You are not regulated just because you use an electronic signature or a QWAC, but the rules decide what legal weight those tools carry.
The framework reaches beyond the EU in practice. A qualified provider can verify and certify organizations anywhere that meet its requirements, so a company outside Europe can still obtain a QWAC if the provider can verify it. Check each provider’s own requirements for your country.
Where do QWACs fit in eIDAS?
Website authentication is one of the trust services eIDAS defines. A Qualified Website Authentication Certificate is the qualified form of it. It links a website’s domain to a real, verified organization, and it is issued by a qualified trust service provider under the regulation.
A basic SSL certificate shows that the connection is encrypted. It says little about who runs the site. A QWAC adds the verified organization behind the domain, checked by a government-supervised provider. Because the qualified status comes from the regulation, it carries more than an ordinary organization-validated certificate does.
Three things make a certificate a QWAC rather than another certificate with a company name in it:
- It is issued by a qualified trust service provider listed on an EU trusted list.
- The provider verified the organization and its link to the domain under eIDAS requirements.
- It follows the certificate profile the regulation and its supporting standards define.
What eIDAS means for your website
eIDAS does not force every website to carry a QWAC. You may want one if visitors, partners, or automated agents need to know exactly which legal entity runs the site, for example in finance, healthcare, public procurement, or any service where impersonation is costly.
If you decide to add one:
- Choose a qualified provider that can verify your organization.
- Decide whether to serve the QWAC alongside your existing SSL certificate or combined with it. See the deployment options.
- Connect it to your host. Our hosting guides show how for each supported platform.
- Plan renewals, since the identity needs to stay current.
Go deeper
- What is a QWAC? The short version: who created them, which browsers support them, and how agents verify them.
- SSL, OV, EV and QWAC compared shows how much identity each certificate type carries.
- The complete guide to qualified website authentication certificates covers certificate attributes, verification, and deployment in detail.
- Qualified identity for SEO and AEO explains why verified identity matters to search and AI agents.
Ready to give your website a verified identity? Get started with QWAC.com.
This guide is general information, not legal advice. For compliance decisions, read the current regulation text and your provider’s certificate policy.
References
- Regulation (EU) No 910/2014 as amended
- European Commission: eIDAS regulation
- European Commission: EU trusted lists
Ready to add your website’s identity? Get started.