(2)Non-qualified trust service providers can be considered important or essential entities in accordance with Article 3 of Directive (EU) 2022/2555 of the European Parliament and of the Councilnote. Thus, Commission Implementing Regulation (EU) 2024/2690note laying down technical and methodological requirements of cybersecurity risk management measures applies to them. However, the scope of the requirements laid down in Article 19a(1), point (a), of Regulation (EU) No 910/2014 relates to the risk management procedures concerning legal, business, operational and other direct or indirect risks to the provision of non-qualified trust services. To complement the risk management framework set out in Implementing Regulation (EU) 2024/2690 and to enable a coherent approach to the management of all relevant types of risks, specifications and procedures concerning the management of those risks by non-qualified trust service providers should be laid down. Guidance provided by the European Union Agency for Cybersecurity (ENISA) or national competent authorities under Directive (EU) 2022/2555 can support non-qualified trust service providers in the design and implementation of appropriate risk management policies.
Source: EUR-Lex, © European Union, 1998-2026. Reuse authorised under Decision 2011/833/EU.