Qualified Electronic Archiving Under eIDAS 2.0: Why Long-Term Archives Need Qualified Timestamps

Every electronic archive makes the same promise: a document retrieved in ten, twenty or thirty years will be exactly the document that was deposited, and this can be proven to an auditor, a regulator or a court. Storage redundancy, access control and format migration keep the data available and readable. None of them, on their own, can prove that the data has not been altered, or that it existed on a given date.

That proof is cryptographic, and it rests on one building block: the qualified electronic timestamp. With Regulation (EU) 2024/1183 (eIDAS 2.0) now establishing qualified electronic archiving as a trust service in its own right, the way archives create, preserve and renew this evidence is no longer just good practice. It is becoming the benchmark against which every archive will be measured.

This article is written for archive operators, document management and records management vendors, digitisation service providers and the teams that run in-house archives in banks, insurers, healthcare and public administration. It covers the legal framework, the technical mechanisms, the volume planning, and what to require from the timestamping authority your archive will depend on for decades.

The legal framework: from eIDAS to eIDAS 2.0

Qualified electronic timestamps. Under Article 41(2) of Regulation (EU) No 910/2014, a qualified electronic timestamp enjoys a presumption of the accuracy of the date and time it indicates and of the integrity of the data to which that date and time are bound. Article 41(3) requires every Member State to recognise a qualified timestamp issued in another Member State. Article 42 sets the requirements: the timestamp must bind date and time to the data in a way that reasonably precludes undetectable change, be based on an accurate time source linked to Coordinated Universal Time (UTC), and be signed with an advanced electronic signature or seal of the Qualified Trust Service Provider (QTSP).

In practice, this shifts the burden of proof. If the integrity or the date of an archived record is challenged, it is the challenging party that must rebut the presumption, not the archive that must demonstrate its own processes.

Qualified electronic archiving. eIDAS 2.0 introduced electronic archiving services into the Regulation (Articles 45j and 45k). Electronic data and documents preserved using a qualified electronic archiving service enjoy a presumption of their integrity and of their origin for the duration of the preservation period. To be qualified, the service must, among other things, ensure the integrity and accurate origin of the data and use procedures and technologies capable of extending its durability and legibility beyond the technological validity period. This is exactly the problem that timestamp-based evidence renewal solves.

Preservation of qualified signatures and seals. Articles 34 and 40 define qualified preservation services for qualified electronic signatures and seals, with technical requirements set out in ETSI TS 119 511 and TS 119 512. Here too, the core mechanism is the periodic application of qualified timestamps to extend the trustworthiness of the signature beyond the technological validity of its certificates and algorithms.

National archiving frameworks. National rules add their own requirements on top of eIDAS, for example Germany’s BSI TR-03125 (TR-ESOR), France’s NF Z42-013 or Italy’s AgID guidelines on digital preservation. They differ in scope and certification, but they converge on the same principle: integrity and time of deposit must be demonstrable, and the evidence must survive the ageing of the cryptography that produced it.

Why storage controls are not enough

A well-designed archive keeps checksums, write-once storage, audit logs and strict access policies. These controls are necessary, but they share one weakness: they are produced and controlled by the archive itself. An auditor or a court has to trust the operator, its systems and its staff.

A qualified timestamp is different. It is issued by an independent, supervised QTSP, it is verifiable by anyone using public information from the EU Trusted Lists, and it carries a legal presumption that the archive’s internal logs do not. It turns “our systems show that nothing changed” into “an independent qualified authority certified this exact data at this exact time”.

The real challenge: cryptography ages, archives do not

Retention periods of 10, 20 or 30 years are far longer than the lifetime of the cryptography used to protect a document on the day it is archived:

• Certificates expire. Signing certificates and the certificates of timestamping units (TSU) have finite validity periods. Once they expire, the evidence they produced can only be validated if it was protected before expiry.
• Algorithms weaken. Hash and signature algorithms considered secure today will eventually be deprecated, as happened with MD5 and SHA-1. ETSI TS 119 312 tracks the recommended cryptographic suites and their expected lifetime.
• Validation data disappears. OCSP responders and CRL distribution points may change or cease to exist over the retention period.

The answer, standardised by ETSI and the IETF, is evidence renewal. Before the current protection becomes weak, a new archive timestamp is applied over the document and all the evidence collected so far. Each new timestamp protects the previous ones, creating an unbroken chain of evidence that can be verified at any point in the future.

Technical mechanisms

Depending on the document type and the archive architecture, evidence renewal is implemented in one of three standard ways:

Per-document or hash-tree timestamping. ERS allows many documents to be grouped in a Merkle hash tree, with a single timestamp over the root. This is efficient for very large homogeneous batches, such as log records. Many archives nevertheless prefer one timestamp per document, or per small logical record, at ingestion and at each renewal. Each document then carries self-contained evidence that can be exported, disclosed to a third party or produced in court on its own, without revealing anything about other records and without depending on the integrity of a group. For records with legal or evidential value, this is usually the simpler and more defensible design.

Where qualified timestamps fit in the archive lifecycle

1. Ingestion. The document (or its signed form) receives a qualified timestamp at the moment it enters the archive. This fixes the date of deposit and the content as deposited. For signed documents, the signature is extended to B-LT and B-LTA.
2. Digitisation. For scanned paper records, a qualified timestamp, ideally combined with an electronic seal of the digitisation provider, binds the image to the date of scanning.
3. Format migration. When a document is converted to a new format for long-term legibility, the converted version and the conversion record are timestamped, so the chain of custody is preserved across formats.
4. Periodic renewal. Before the TSU certificate approaches expiry, or when the cryptographic suite reaches the end of its recommended lifetime, a new archive timestamp is applied.
5. Disclosure. When a record is exported for an audit or legal proceedings, it leaves the archive together with its complete evidence, verifiable by the recipient without access to the archive’s systems.

Planning the volume

Because evidence must be created at ingestion and renewed periodically, timestamp consumption in an archive grows with the number of documents, not with the number of users. A simple planning model for per-document evidence:

• 1 timestamp per document at ingestion (2 for signed documents extended to B-LTA: one signature timestamp and one document timestamp);
• 1 timestamp per document at each renewal cycle, typically every few years, depending on TSU certificate validity and the cryptographic suite.

Renewal cycles come on top of these figures, and for an archive that already holds millions of records, the first renewal campaign alone can require timestamps for the entire existing stock. Planning for this volume from the start avoids both budget surprises and the temptation to postpone renewals, which is the single most common way long-term evidence is lost.

What to require from your timestamping authority

An archive’s evidence is only as strong as the timestamps it is built on, and the TSA becomes a long-term dependency of the archive itself. Before integrating a provider, an archive operator should verify the following:

• Qualified status, verifiable in the EU Trusted Lists. The provider and its timestamping service must be listed as qualified (service type QTST) in the national Trusted List, accessible through the EU List of Trusted Lists. A provider that is “eIDAS compliant” but not listed as qualified does not give you the Article 41(2) presumption.
• Conformity with ETSI EN 319 421 and EN 319 422, assessed by an accredited Conformity Assessment Body and supervised by the national supervisory body.
• Availability. Ingestion pipelines and renewal campaigns run continuously and in large batches. An unavailable TSA means a stalled pipeline or documents archived without evidence.
• No artificial limits. No daily or monthly caps, no throttling that turns a renewal campaign into a months-long project.
• Standard protocol. Plain RFC 3161, so that the archive is not locked into proprietary clients and any standard library or archiving platform can be used.
• Privacy. Only the hash of the data should ever be sent to the TSA. The archived content must never leave your infrastructure.
• Predictable pricing for large volumes, with packages sized for ingestion plus renewal, not for occasional manual use.

How qtsa.eu supports archiving workflows

qtsa.eu provides qualified electronic timestamps issued by AlfaTrust Certification S.A., a Qualified Trust Service Provider supervised under eIDAS and listed in the EU Trusted Lists for the issuance of qualified electronic timestamps. The service is designed for exactly the kind of continuous, high-volume use that archives require:

• eIDAS qualified and listed in the EU Trusted Lists. Every timestamp carries the legal presumption of Article 41(2) and is recognised in all EU Member States. Qualified status can be verified independently by any auditor.
• Uptime above 99.9%. A highly available infrastructure, so your ingestion pipelines and renewal campaigns run without interruption.
• Simple to use, without restrictions. A standard RFC 3161 endpoint that works with any signing library, archiving platform or ERS implementation. No daily or monthly quotas and no throttling: use your timestamps at your own pace, whether that is a steady ingestion flow or a one-off renewal of millions of records.
• 24-month validity. Every prepaid package can be used over 24 months from the date of purchase, which fits naturally with annual budgets and with renewal campaigns that span several months.
• Volume packages up to 1.200.000 timestamps, with tailored offers for larger archives and multi-year contracts.
• Hash-only requests. Your documents never leave your systems.
• No VAT for EU businesses. Companies registered in another EU Member State with a valid VAT number are invoiced under the reverse charge mechanism.

Test it on your archive pipeline

The fastest way to evaluate a timestamping authority is to connect it to a real pipeline. Request 50 free qualified timestamps, configure our TSA in your archiving platform or ERS implementation, and verify the resulting evidence with your own validation tools. Our integration guides cover the most common environments, and our team can help size a package for your ingestion and renewal volumes.

Get 50 free eIDAS qualified timestamps → | See volume packages →

Frequently asked questions