Art. 20

32014R0910 → 02014R0910-20240520

Article 20 Supervision of qualified trust service providers 1. Qualified trust service providers shall be audited at their own expense at least every 24 months by a conformity assessment body. The purpose of the audit shall be to confirm that the qualified trust service providers and the qualified trust services provided by them fulfil the requirements laid down in this Regulation. The qualified Regulation and in Article 21 of Directive (EU) 2022/2555. Qualified trust service providers shall submit the resulting conformity assessment report to the supervisory body within the period of three working days after receiving it. of receipt. 1a. Qualified trust service providers shall inform the supervisory body at the latest one month before any planned audits and shall allow the supervisory body to participate as an observer upon request. 1b. Member States shall, without undue delay, notify to the Commission the names, addresses and accreditation details of the conformity assessment bodies referred to in paragraph 1 and any subsequent changes thereto. The Commission shall make that information available to all Member States. 2. Without prejudice to paragraph 1, the supervisory body may at any time audit or request a conformity assessment body to perform a conformity assessment of the qualified trust service providers, at the expense of those trust service providers, to confirm that they and the qualified trust services provided by them fulfil the requirements laid down in this Regulation. Where personal data protection rules appear to have been breached, the supervisory body shall shall, without undue delay, inform the data protection competent supervisory authorities established pursuant to Article 51 of the results of its audits. Regulation (EU) 2016/679. 3. Where the supervisory body requires the qualified trust service provider to remedy any failure fails to fulfil any of the requirements under set out by this Regulation and where Regulation, the supervisory body shall require it to provide a remedy within a set time limit, if applicable. Where that provider does not act accordingly, and if provide a remedy and, where applicable within a the time limit set by the supervisory body, the supervisory body, taking into account, where justified in particular, particular by the extent, duration and consequences of that failure, may shall withdraw the qualified status of that provider or of the affected service it provides and inform provides. 3a. Where the competent authorities designated or established pursuant to Article 8(1) of Directive (EU) 2022/2555 informs the supervisory body referred that the qualified trust service provider fails to fulfil any of the requirements set out in Article 22(3) for 21 of that Directive, the purposes supervisory body, where justified in particular by the extent, duration and consequences of updating that failure, shall withdraw the trusted lists referred qualified status of that provider or of the affected service that it provides. 3b. Where the supervisory authorities established pursuant to Article 51 of Regulation (EU) 2016/679 informs the supervisory body that the qualified trust service provider fails to fulfil any of the requirements set out in Article 22(1). that Regulation, the supervisory body, where justified in particular by the extent, duration and consequences of that failure, shall withdraw the qualified status of that provider or of the affected service it provides. 3c. The supervisory body shall inform the qualified trust service provider of the withdrawal of its qualified status or of the qualified status of the service concerned. The supervisory body shall inform the body notified pursuant to Article 22(3) of this Regulation for the purposes of updating the trusted lists referred to in paragraph 1 of that Article and the competent authority designated or established pursuant to Article 8(1) of Directive (EU) 2022/2555. 4. The By 21 May 2025, the Commission may, shall, by means of implementing acts, establish a list of reference number of standards and, where necessary, establish specifications and procedures for the following standards: following: (a) the accreditation of the conformity assessment bodies and for the conformity assessment report referred to in paragraph 1; (b) the auditing rules under which requirements for the conformity assessment bodies will to carry out their conformity assessment, including composite assessment, of the qualified trust service providers as referred to in paragraph 1; (c) the conformity assessment schemes for carrying out the conformity assessment of the qualified trust service providers as by the conformity assessment bodies and for the provision of the report referred to in paragraph 1. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).