{"id":6507,"date":"2026-09-28T08:00:00","date_gmt":"2026-09-28T06:00:00","guid":{"rendered":"https:\/\/www.eadtrust.eu\/?p=6507"},"modified":"2026-09-29T15:09:57","modified_gmt":"2026-09-29T13:09:57","slug":"what-is-a-qeaa","status":"publish","type":"post","link":"https:\/\/www.eadtrust.eu\/en\/blog\/what-is-a-qeaa\/","title":{"rendered":"What Is a QEAA and Why Should Your Organisation Start Issuing Them Now?"},"content":{"rendered":"\n

There is a concept within the EUDI Wallet ecosystem that many organisations are not yet aware of and that will determine who gains a competitive advantage in the digital trust market over the coming years: QEAAs<\/strong>, Qualified Electronic Attestations of Attributes<\/em>.<\/p>\n\n\n\n

In simple terms, a QEAA is a verifiable credential with full legal validity throughout the European Union that certifies a specific attribute of a person: that they are a registered medical practitioner, that they have powers of representation to sign contracts above a certain amount, that they have completed a professional certification, that they are of legal age or that their company is registered in the Commercial Registry with a particular corporate purpose. It has one characteristic that distinguishes it from any other digital credential: it can only be issued by a qualified trust service provider (QTSP)<\/strong>.<\/p>\n\n\n\n

This makes QTSPs, and organisations that partner with a QTSP to issue their credentials, central participants in the digital trust ecosystem being built around the EUDI Wallet. What notaries were to paper documents, QTSPs will be to digital verifiable credentials. The window of opportunity to establish a position in this role is opening now.<\/p>\n\n\n\n

Glossary<\/strong><\/h2>\n\n\n\n

Attribute<\/strong><\/h3>\n\n\n\n

A quality, property or status of a person that can be certified through a QEAA. Examples include professional registration, academic qualifications, powers of representation, legal age and employment status.<\/p>\n\n\n\n

Authentic source<\/strong><\/h3>\n\n\n\n

The organisation or system that holds the official information about the attribute to be certified. For professional registration, the authentic source is the professional association. For a university degree, it is the university. For powers of representation, it is the Commercial Registry or the notarised power of attorney. The QTSP verifies the attribute against the authentic source before issuing the QEAA.<\/p>\n\n\n\n

Revocation policy<\/strong><\/h3>\n\n\n\n

The mechanism through which the issuer of a QEAA can invalidate it before its expiry date. This is relevant when a professional loses their registration, an employee leaves the company or a certification ceases to be valid.<\/p>\n\n\n\n

Issuing QTSP<\/strong><\/h3>\n\n\n\n

The QTSP that acts as the issuer of QEAAs, signing the credentials with its own qualified electronic seal and guaranteeing that the attributes it certifies are authentic. EADTrust acts as the issuing QTSP for organisations seeking to issue their credentials within the Spanish IDUE Wallet ecosystem.<\/p>\n\n\n\n

What exactly is a QEAA: the technical and legal definition<\/strong><\/h2>\n\n\n\n

Article 45i of Regulation (EU) 2024\/1183 defines the qualified service for electronic attestations of attributes and establishes its requirements. A QEAA is an electronic attestation of attributes, meaning a set of data affirming that a person or entity has a particular quality, property or status, that meets the most stringent technical and organisational requirements under the eIDAS 2 Regulation.<\/p>\n\n\n\n

The technical requirements of a QEAA are specific: it must be based on authentic information obtained directly from authentic sources or verified through organisations with authorised access, accurately identify the issuer, be unequivocally linked to the person to whom it relates, accurately include the attributes it certifies, contain metadata about its validity and be recognisable as a QEAA by wallet systems.<\/p>\n\n\n\n

The legal consequence is similar to that of a qualified electronic signature: a QEAA issued by a QTSP in any Member State of the European Union is recognised as a QEAA in every other Member State<\/strong>. There is no consular involvement, no apostille and no cross-checking process. A university diploma issued as a QEAA in Spain has full legal validity in Germany, France or Poland without any additional procedure.<\/p>\n\n\n\n

A QEAA is a digital diploma, professional registration certificate or power of representation that any organisation in Europe can verify instantly without contacting the issuing organisation. It is the silent revolution in professional digital identity.<\/strong><\/p>\n\n\n\n

The difference compared with other existing digital credentials<\/strong><\/h2>\n\n\n\n

Digital credentials already exist in the market: LinkedIn badges, digitally signed PDF certificates and QR-format accreditations. What makes a QEAA different?<\/p>\n\n\n\n

The level of legal assurance<\/strong><\/h3>\n\n\n\n

A LinkedIn badge may be false because the source is not verified. A PDF certificate may be modified and, without a robust verification mechanism, there is no certainty that it is authentic. A QEAA issued by a QTSP benefits from a legal presumption of authenticity under the eIDAS 2 Regulation. The recipient can verify cryptographically that the credential was issued by that specific QTSP, on that date, for that person and that it has not been modified.<\/p>\n\n\n\n

Technical interoperability<\/strong><\/h3>\n\n\n\n

Existing digital credentials operate in silos: they work within the ecosystem of the provider that issues them but cannot be presented interoperably in every verification system. A QEAA follows the SD-JWT VC and ISO\/IEC 18013-5 standards, the formats defined in the European implementing acts. Any verifier implementing those standards can verify it, regardless of who issued it or where the verifier\u2019s electronic office is located.<\/p>\n\n\n\n

Privacy by design<\/strong><\/h3>\n\n\n\n

Traditional credentials disclose the entire document: to verify that someone is a doctor, the hospital must see their professional registration number, the issue date and all the information on the diploma. A QEAA with selective disclosure allows the doctor to prove that they are professionally registered without revealing any additional information that is not strictly necessary for that specific purpose.<\/p>\n\n\n\n

Control by the holder<\/strong><\/h3>\n\n\n\n

The QEAA is stored in the citizen\u2019s wallet, under their control. The organisation that issued it cannot revoke access to it without the holder\u2019s knowledge, nor can it track where and when it is used. The citizen, not the issuer, controls its presentation.<\/p>\n\n\n\n

Who can issue QEAAs: only QTSPs<\/strong><\/h2>\n\n\n\n

This is the central restriction that defines the strategic value of QEAAs: only qualified trust service providers included in the EU Trusted List as QEAA providers can issue them with full legal validity<\/strong>.<\/p>\n\n\n\n

This has several direct implications. A professional association cannot independently issue a professional registration QEAA with full legal validity: it needs a QTSP to issue it on its behalf or the association itself must obtain QTSP status, which is a lengthy and costly process. A university cannot directly issue a diploma as a QEAA: it needs a QTSP behind it. A company cannot independently issue verifiable powers of representation as QEAAs: it needs a QTSP.<\/p>\n\n\n\n

This is where the opportunity lies: organisations that establish a relationship with a QTSP to issue their QEAAs now, while the ecosystem is being built, will have an advantage over those that arrive later. The first QEAA issuers in each sector will define the standards for issuing those credentials within that sector. Those that arrive later will have to adapt to what the first issuers have established.<\/p>\n\n\n\n

EADTrust is a QTSP capable of issuing QEAAs now that the eIDAS 2 technical framework permits it. We are already working with organisations seeking to become the first to issue their credentials in QEAA format within the Spanish IDUE Wallet ecosystem.<\/p>\n\n\n\n

The most relevant use cases by sector<\/strong><\/h2>\n\n\n\n

Professional associations: professional registration as a QEAA<\/strong><\/h3>\n\n\n\n

The most obvious use case and the one with the greatest immediate impact. A doctor, lawyer, architect or any other registered professional must prove their professional status in dozens of situations throughout their career: when joining a company, contracting with a client, accessing certain services or acting in proceedings that require professional authorisation.<\/p>\n\n\n\n

Today, this process involves requesting a certificate of professional registration, waiting for the professional association to issue it, attaching it to the relevant documentation and having the recipient verify it by contacting the association or accessing an online registry that may or may not be reliable.<\/p>\n\n\n\n

With a professional registration QEAA issued by the association through a QTSP, the process is transformed: the professional stores the registration QEAA in their wallet, presents it within seconds to whoever needs it and the recipient verifies it cryptographically in real time without contacting the association. The registration status remains permanently up to date: when the association revokes the registration, the QEAA automatically ceases to be valid.<\/p>\n\n\n\n

Universities: academic qualifications as QEAAs<\/strong><\/h3>\n\n\n\n

Digital university qualifications already exist in several European countries in proprietary formats. With a QEAA, a qualification becomes an interoperable credential that any employer or institution in the 27 Member States can verify within seconds.<\/p>\n\n\n\n

The impact for graduates is clear: they can prove their qualifications in any recruitment process, in any EU country, without requiring an apostille or official translation and with the same validity as presenting the physical qualification. For universities, issuing qualifications as QEAAs provides a competitive differentiator and a valuable service for graduates.<\/p>\n\n\n\n

Companies: powers of representation as QEAAs<\/strong><\/h3>\n\n\n\n

When an employee negotiates a contract, signs an agreement or acts on behalf of their company before third parties, they must prove that they have the necessary powers of representation. Today, this process involves presenting a copy of the notarised power of attorney, which the recipient may or may not verify depending on their level of diligence.<\/p>\n\n\n\n

With a power of representation QEAA, a company can issue verifiable credentials to its employees that specify exactly what they are authorised to sign and for what amount. The employee presents the credential from their wallet. The recipient verifies it within seconds. There is no ambiguity about the scope of the authority, no risk of an expired power of attorney being presented and the company can revoke the authority immediately if the employee leaves the organisation.<\/p>\n\n\n\n

Training providers: professional certifications<\/strong><\/h3>\n\n\n\n

Training certificates and professional accreditations, including refresher courses, security certifications and specific authorisations, have limited value in the current labour market because they are difficult to verify. Many employers do not verify training certificates because the process is costly and slow.<\/p>\n\n\n\n

With a certification QEAA, the training provider issues the credential through a QTSP, the professional stores it in their wallet and any employer can verify it instantly. The market for training credentials becomes transparent and reliable.<\/p>\n\n\n\n

Official registries: commercial and administrative registrations<\/strong><\/h3>\n\n\n\n

The status of a legally incorporated company with a particular corporate purpose and registered with a specific provincial Commercial Registry can become a QEAA that the company presents in public procurement procedures, due diligence processes or onboarding processes with new banking or insurance customers.<\/p>\n\n\n\n

This QEAA, issued by the Commercial Registry or by an authorised QTSP with access to the Registry\u2019s data, removes the need to request registry extracts, registration certificates or apostilles to prove a company\u2019s legal status.<\/p>\n\n\n\n

The process for your organisation to start issuing QEAAs<\/strong><\/h2>\n\n\n\n

Issuing QEAAs requires two preliminary decisions and a technical process. The preliminary decisions are:<\/p>\n\n\n\n

First decision: which attributes do I want to issue?<\/strong><\/h3>\n\n\n\n

Not all credentials have the same value for recipients or the same level of issuance complexity. The organisation must identify which attributes are most valuable to its members, customers or employees and which verifiable source data it holds to support those credentials.<\/p>\n\n\n\n

Second decision: which QTSP will issue the QEAAs?<\/strong><\/h3>\n\n\n\n

The organisation cannot issue QEAAs directly: it needs a qualified QTSP to act as the issuer. This may involve a relationship in which the QTSP issues the credentials on behalf of the organisation, which acts as the authentic source of the data, or one in which the QTSP and the organisation configure an automated issuance system.<\/p>\n\n\n\n

Once those decisions have been made, the technical process involves:<\/p>\n\n\n\n