Trust services

The eIDAS qualified seal and the Digital Product Passport

Every passport registered in the EU DPP Registry must be signed with a qualified electronic signature or sealed with a qualified electronic seal under the eIDAS Regulation. Here is what that requires — and the practical way to meet it.

Last updated: 26 August 2026

Important: the signing requirement applies to every registered version, not just the first. Each update to a passport must be re-sealed.

What the registry requires

On submission, the registry validates the presence of a valid qualified electronic signature (for a natural person) or seal (for a legal entity) in accordance with eIDAS. Without it, the passport is not accepted. The seal is produced over the passport version's content hash, so any later change is detectable.

Two ways to meet it

Direct: the operator obtains a qualified electronic seal from a qualified trust service provider (QTSP) and signs each registration. Provider-delegated: a platform holds its own qualified seal and registers on the operator's behalf through a verified account — a valid model under eIDAS. Either way, the operator remains legally accountable for the data.

How to check a qualified seal is really qualified

“Digitally signed”, “cryptographically sealed” and “tamper-evident” are marketing descriptions. Qualified is a legal status under Regulation (EU) No 910/2014, and it has exactly one test: the certificate must come from a Qualified Trust Service Provider that appears on an EU member state’s trusted list, aggregated in the EU Trusted List browser.

So the check takes a minute, and you can run it on any vendor including us:

Ask which QTSP issues the certificate. A vendor that cannot name one is not offering a qualified seal, whatever the brochure says.
Look that provider up on the EU Trusted List. If it is not there, the seal is not qualified.
Check the service type. A provider can be qualified for timestamps and not for seals. The entry has to cover qualified certificates for electronic seals specifically.

On cost: QTSPs price per certificate and per sealing volume and most do not publish rates, so any figure quoted without naming the provider and the volume is not a real number. Ask for the QTSP name first — the price only means something once you know who is issuing.

How PassPer handles it

PassPer's qualified-seal signing is built into the registry-submission path. It produces a CAdES electronic seal over each frozen passport version's content hash and exposes a public verification endpoint. It runs in a remote-QTSP mode (an HSM-held seal via a signing API) or a local-certificate mode, and activates the moment the qualified certificate is provisioned — no change to your workflow.

Frequently asked questions

Do I need eIDAS sealing for a Digital Product Passport?

Yes. The EU DPP Registry requires a qualified electronic signature or seal under eIDAS on every registered passport version.

Can a platform sign the DPP for me?

Yes — a platform can hold its own qualified seal and register on your behalf through a verified account. You remain legally accountable for the data.

Does every DPP update need to be re-signed?

Yes. The signing requirement applies to each registered version, not only the first, so every update is re-sealed.

See where you stand — three ways, all free.

Take the 2-minute readiness check, watch the 10-minute interactive walkthrough, or download the full 2026 compliance guide. No account needed.

Free readiness check → See it in action Get the guide (PDF)

Rather talk it through? Book a 30-minute consult — free, and we come prepared.