Skip to main content

NL-SYS-03: Organization and Support for the NL EUDI Certification System Owner

NL-SYS-03: Organization and Support for the NL EUDI Certification System Owner

Download PDF (2.6 MB, 19 pages)Read the full text
Cover page of the document, as printed
Document referenceNL-SYS-03
VersionRC1.1
StatusRelease Candidate
Date31/10/2026
Document typeFramework document
Parent frameworknone
Scheme OwnerKingdom of the Netherlands Minister of Economic Affairs
Certification targetEuropean Digital Identity Wallets and the electronic identification scheme under which they are provided
Primary audienceSystem/Scheme Owner, CABs, EUDI Wallet providers, PID Provider
Secondary audienceEUDI Wallet ecosystem stakeholders
Assurance levelHigh/High
Subsidiary DocumentsNL-TL, NL-FS-*, NL-CS-*, NL-PW-* and NL-PP-*
How to read this page

This page summarises the document. Every statement points to the section and page of the authoritative PDF it comes from: click a reference such as §6.1, p. 10 to open that page. If this summary and the PDF differ, the PDF applies.

What this document is​

The document "enumerates obligations and procedures of the System Owner & Top-Level Scheme Owner in relation to the NL EUDI Wallet certification system" (§1, p. 5). It also describes the role of the Supervisory Body in surveillance of the Trust Framework, "given its strong influence on risks to the EUDI Wallet related services which are subject to certification" (§1, p. 5). Its current scope "covers supervising the application and maintenance obligations for the the certification (schemes) for Wallet Providers and PID Providers ()" (§1, p. 5).

Scope and object of certification​

  • For the Netherlands, the System Owner & Top-Level Scheme Owner will be the Minister of Economic Affairs (§1, p. 5).
  • The document covers governance and maintenance, technical vulnerability management, marks and labels, the Trust Framework (supervision of CABs and of wallets, access and registration certificates, registration of Wallet Providers), reporting and notification to the European Commission, complaint handling and secured exchange of information (§Table of Content, p. 4).
  • It does not define an object of certification; the certification system is established for compliance with Regulation (EU) 2024/1183 amending Regulation (EU) No 910/2014 on the basis of ISO/IEC 17067 and ISO/IEC 17065 and operated under the accreditation system of Regulation 765/2008 (§2, p. 6).

Who it applies to​

  • System and Top-Level Scheme Owner — role assigned to the Minister of Economic Affairs, governing "in close collaboration with the Minister of the Interior as with regard to the specificities of the NL National eID Scheme" (§3.1, p. 7). Tasks: continuous alignment with Regulation (EU) 2024/1183, the Implementing Regulations "and optionally the Architecture and Reference Framework (ARF)"; ongoing monitoring of ecosystem developments; assessing changes and updating governance, documentation and procedures; integrating information from certification, notification, monitoring and statistical reporting; operating a periodic review procedure (§3.2, p. 7); transmitting draft national schemes to the European Digital Identity Cooperation Group (§3.3.1, p. 8); discussing the system and top-level scheme periodically with peers in the EUDIW Certification System Collaboration Group when relevant changes or events occur (§3.3.2, p. 8); vulnerability coordination (see Process) (§4.1, p. 9-10); granting CABs the right to use the mark of conformity and keeping the register of entitled entities (§5.2, p. 11); designating access and registration certificate providers and putting them and Wallet Providers on a designated TrustList (§6.2–6.3, p. 14-15); communicating CAB information to the European Commission (§7.1, p. 16); designating cryptographic mechanisms and maintaining an inventory of them (§9, p. 19).
  • "NL EUDIW Certification System Management Board" — supports the Minister in practical maintenance of the system; consists of representatives of the respective government actors "as well as government-designated actors on Certification, Accreditation, Supervision, Cyber Resilience and Dutch Law" (§3.1, p. 7).
  • Scheme Owners (Top-level, Functional, Cyber Security and Provider Scheme Owners) — complaint handling (§8, p. 18); cooperate with the National Cybersecurity Certification Authority on EUCC-related vulnerabilities (§4.1, p. 10) and on complaints lodged under Article 25 of the Act on the National Cybersecurity Certification System (§8, p. 18).
  • Supervisory Body / Supervisory Authority — oversight of CABs (text marked as to be included in national law) (§6.1, p. 13-14); supervision of European Digital Identity Wallets under Art. 46a of Regulation (EU) 2014/910 (§6.1, p. 14); may suspend or cancel registered providers and Wallet Providers (§6.2–6.3, p. 15); verifies certification and admission, communicates Wallet Provider information and notifies the Commission of certification, expiration, suspension or revocation of a Wallet Solution's top-level certificate (§7.2–7.3, p. 16-17).
  • CAB-CB — informs the Scheme Owner about vulnerabilities based on the Wallet Provider's Impact Analysis Report and decides on suspension and on prolonging suspension (§4.1, p. 10); has “the right to transfer this Trust Mark to holders of valid certificates issued under these schemes” (§5.2, p. 11); may be tasked by the Scheme Owner to provide expert documentation in complaints (§8, p. 18).
  • Conformity Assessment Bodies accredited by the Dutch Accreditation Body — receive from the System Owner the right to use the mark of conformity (§5.2, p. 11).
  • Wallet Provider — detects vulnerabilities, conducts vulnerability impact analysis and performs internal remediation and patching (§4.1, p. 9-10); must incorporate a Trust Mark UI view in the Wallet Instance (§5.1, p. 11).
  • PID Provider and EUDI Wallet Provider — may be requested to submit evidence in complaint investigations (§8, p. 18).
  • EUDIW Certification System Collaboration Group — supports cooperation among national authorities, scheme owners, supervisory authorities and other organisations involved in EUDIW certification (§3.3.2, p. 8).
  • European Digital Identity Cooperation Group, European Commission, ENISA, other Member States — receive information on vulnerabilities, suspensions and closures (§4.1, p. 10).
  • National Cybersecurity Certification Authority — cooperates with the Scheme Owner on EUCC-related vulnerabilities and complaints (§4.1, p. 10; §8, p. 18).
  • National Accreditation Body — notified of the initiation of the non-conformity process in cases of confirmed non-conformity (§8, p. 18).
  • Data protection authority — the Supervisory Body coordinates with it on rule violations or data breaches (§6.1, p. 14).
  • Designated QTSPs / Trusted List Provider — the System Owner designates the Access Certificate Provider and the Provider of registration certificates “to designated QTSPs”; the trust anchors are published in a Trusted List by a designated Trusted List Provider (§6.2, p. 14-15).

Contents​

No.TitleContentStart page
1ScopeSubject of the document and the System/Top-Level Scheme Owner5
2Legal and normative documentsEU legal instruments; placeholder for NL law6
3Governance and System / Scheme ManagementGovernance arrangements (3.1), maintenance and review (3.2), harmonisation via EDICG opinions and the Collaboration Group (3.3)7
4Technical Vulnerability ManagementVulnerability handling procedure with Figure 2 (4.1)9
5Marks and LabelsEU DI Wallet Trust Mark (5.1), national mark of conformity (5.2), design (5.3), rules of use (5.4)11
6Trust FrameworkSupervision of CABs and of wallets (both numbered 6.1), access & registration certificates (6.2), registration of Wallet Providers (6.3)13
7Reporting & Notification proceduresNotifications to the European Commission on CABs (7.1), Wallet and PID Providers (7.2), issues/status changes (7.3)16
8Complaint HandlingIntake, investigation and resolution of complaints18
9Secured Exchange of InformationConfidentiality and cryptographic mechanisms19

Key points​

Organisation and governance

  • System and Top-level Scheme Owner: Minister of Economic Affairs, in close collaboration with the Minister of the Interior (§3.1, p. 7).
  • Supported by the "NL EUDIW Certification System Management Board" (§3.1, p. 7).
  • Reviews are both ad hoc (triggered by significant technical or regulatory updates) and periodic (§3.2, p. 7).
  • Changes resulting from security incidents or vulnerabilities are handled per Chapter 4 (§3.2, p. 7).
  • Under art. 5c(4) of Regulation (EU) 2024/1183, the System Owner transmits the draft national certification schemes to the European Digital Identity Cooperation Group, which may issue opinions and recommendations (§3.3.1, p. 8).
  • The EUDIW Certification System Collaboration Group's "end-objective" is "to ensure a harmonized high level of assurance of the European Digital Identity Wallet throughout Europe"; it also targets "a smooth transition towards harmonized EUDIW European Certification Schemes" (§3.3.2, p. 8).

Vulnerability management

  • The procedure relates to the NL-P-P/W series (resilience, software development and vulnerability management requirements) and is established in accordance with CIR (EU) 2024/2981 and the NIS 2 Directive (§4.1, p. 9).
  • A CAB-CB suspension decision "is to be cascaded up to the top-level certificate" and the NL EUDIW top-level Certificate Scheme Owner notifies the European Commission (§4.1, p. 10).
  • "It is upon the CAB decision to prolong the period of certificate suspension, if it is justified" (§4.1, p. 10).
  • For components certified under EUCC, CIR 2024/482, chapter VI "Vulnerability Management and Vulnerability Disclosure" applies and the Scheme Owner cooperates with the National Cybersecurity Certification Authority (§4.1, p. 10).

Marks

  • The EUDI Wallet Trust Mark is related to the top-level certificate issued according to the procedure in NL-TL (§5.1, p. 11).
  • The Wallet Instance of the certified Wallet Solution "shall incorporate a dedicated Trust Mark UI view" that renders the official Trust Mark graphics/logo, displays localised informational text on the certification, and links to a list of certified Wallet Solutions and to a page with the certification information of the user's active Wallet Solution (§5.1, p. 11).
  • The NL EUDI Certification System "shall establish an official mark of conformity" attesting successful evaluation and certification of relevant elements of the Wallet solution (§5.2, p. 11).
  • The mark is presented under the brand "NL EUDI Wallet certification system"; graphical rules are in a dedicated publication by the Minister of Economic Affairs; the logo is complemented by a QR code with a URL to a portal hosted by the Certification System Owner (§5.3, p. 11-12).
  • The System Owner keeps a register of entities entitled to use the mark, the associated certificates and their status (current, suspended, revoked or expired) (§5.2, p. 11).
  • Permitted uses: system/scheme information issued by the System/Scheme Owner; official CAB or Scheme Owner documents; information platforms linked to the certified product or service provider with clear indication of the certification; technical and commercial documentation produced by the certificate holder (§5.4, p. 12). Other uses require prior approval of the Scheme Owner (§5.4, p. 12).
  • Prohibited: use on products, services or versions not included in the certificate; modifying or combining the mark with other trademarks or logos; use in relation to suspended, revoked or expired certificates; improper use "will be subject to legal action" (§5.4, p. 12).

Trust Framework and supervision

  • The Supervisory Body oversees CABs through ex-ante and ex-post supervision, monitors their competence, impartiality, independence and integrity, reviews certification processes and decisions, conducts on-site and off-site supervision, may demand documentation, investigates complaints and irregularities, may require corrective actions, may order suspension of certification activities and require review, suspension or withdrawal of affected certificates, and prepares periodic reports (§6.1, p. 13-14).
  • The wallet Supervisory Body is designated under Art. 46a(1) of Regulation (EU) 2014/910 and "shall be appointed by national law" (§6.1, p. 14).
  • Under Art. 46a(5), if a wallet provider fails to comply with a remediation demand in time, the Supervisory Body may order suspension or complete cessation of wallet provision, communicated without undue delay to the Commission, other Member States' supervisory bodies, relying parties and end-users (§6.1, p. 14).
  • The Supervisory Body submits an annual report on the preceding calendar year to the European Commission by March 31 (Art. 46a(6) and (7)) (§6.1, p. 14).
  • The System Owner designates the Access Certificate Provider and the Provider of registration certificates "to designated QTSPs"; their trust anchors are published in a Trusted List by a designated Trusted List Provider and made available via the Commission's List of Trusted Lists (§6.2, p. 14-15).
  • After successful certification, additional evaluation and verification by the Supervisory Authority, Wallet Providers are recognised in the NL Wallet eID Scheme and notified by NL to the EU to be put on a designated TrustList (§6.3, p. 15).
  • On suspension or revocation the entity's Trusted List status becomes Invalid, and "all valid Wallet Unit Attestations (WUAs) associated with Wallet Units issued by that provider shall be revoked" (§6.3, p. 15).

Notifications to the European Commission

  • CAB information (name and address; accreditation details and scope; modifications; withdrawal, suspension or termination of accreditation or authorisation) is communicated to the Commission by the NL Certification System Owner (Art. 20(1b) of Regulation (EU) 2024/1183) (§7.1, p. 16).
  • Information on certified and admitted Wallet Providers is communicated by the Supervisory Authority; under Art. 3 of CIR (EU) 2024/2980 this includes the bodies providing wallets, the bodies associating PID with wallets, and the validation mechanisms for PID, relying parties and wallets (§7.2, p. 16-17).
  • The Supervisory Authority notifies the Commission without undue delay of certification of a Wallet Solution (the top-level certificate) and its expiration, suspension or revocation, giving reasons for suspension or revocation; notifications are in English via the secure electronic notification system (§7.3, p. 17).

Complaints and information security

  • Complaints are registered in the Complaint Management System hosted by the NL EUDIW Certification Scheme Owner (§8, p. 18).
  • The System Owner adopts the cryptographic mechanisms specified in the relevant technical specifications in compliance with Annex I of CIR (EU) 2024/2979, and maintains and disseminates an inventory of applicable mechanisms for CABs and Applicants (§9, p. 19).

Process​

Technical vulnerability management (Figure 2 "Technical Vulnerability Management", p.9; swimlanes System Owner, Wallet Provider, CAB-CB, ENISA, EC, Other Member States, Cooperation Group):

  1. Wallet Provider detects the vulnerability and conducts a Vulnerability Impact Analysis (Wallet Provider) (§4.1, p. 9).
  2. CAB-CB produces/forwards the Vulnerability Impact Analysis Report and informs the Scheme Owner with all elements needed to understand impact, required changes and broader implications (CAB-CB) (§4.1, p. 10).
  3. System Owner decides whether top-level certificate suspension is required; on YES, information about the suspension goes to the EC and the Cooperation Group; on NO, the flow goes directly to “Final information on the vulnerability”; based on the CAB-CB suspension decision, the top-level Certificate Scheme Owner notifies the European Commission (System Owner / top-level Scheme Owner) (§4.1, p. 10).
  4. Coordination of disclosure and information exchange: information about the vulnerability to the database maintained by ENISA (if applicable), the EC, other Member States and the Cooperation Group; also shared with the NL EUDI Certification System owner and the Collaboration Group (top-level Scheme Owner) (§4.1, p. 10).
  5. Define the scope of support; Wallet Provider runs the internal remediation and patching process; CAB-CB reviews remediation effectiveness (System Owner, Wallet Provider, CAB-CB) (§4.1, p. 10).
  6. Monitor status of remediation; decision "Is prolongation of certificate suspension justified?" — YES loops back to define scope of support (decision lies with the CAB) (top-level Scheme Owner, CAB) (§4.1, p. 10).
  7. After completion: final information on the vulnerability; notify the European Commission of the change of top-level certificate status and inform stakeholders (notification of revocation of suspension to EC and Cooperation Group; information about closed vulnerability to ENISA and other Member States) (Top-Level Certificate Scheme Owner) (§4.1, p. 10).

Complaint handling:

  1. Registration of the complaint in the Complaint Management System hosted by the NL EUDIW Certification Scheme Owner (Scheme Owner) (§8, p. 18).
  2. Formal analysis by the respective Scheme Owner; if formally deficient, the Scheme Owner asks the Complainant for completions or clarifications; then substantive analysis of scope and validity (Scheme Owner) (§8, p. 18).
  3. Investigation with the Scheme Owner as central coordinator; it may request evidence from the PID or EUDI Wallet Provider, task the CAB with expert documentation or an opinion, commission dedicated supervisory activities or seek external independent experts (Scheme Owner) (§8, p. 18).
  4. Resolution: if unfounded, notification to the Complainant with rationale; if valid, notification to the Complainant and, where appropriate, information to the provider and the CAB; in cases of confirmed non-conformity, formal notification to the Complainant, CAB, PID or EUDI Wallet Provider, National Accreditation Body and Supervisory Authority of the initiation of the non-conformity process (Scheme Owner) (§8, p. 18).
  5. Complaints lodged under Article 25 of the Act on the National Cybersecurity Certification System: the Scheme Owner cooperates with and informs the National Cybersecurity Certification Authority (Scheme Owner) (§8, p. 18).

Scheme maintenance and review:

  1. Ongoing monitoring of developments (legislation, technical specifications, interoperability) (System and Top-Level Scheme Owner) (§3.2, p. 7).
  2. On changes, assess relevance and update governance arrangements, documentation and procedures (System and Top-Level Scheme Owner) (§3.2, p. 7).
  3. Periodic review procedure, in addition to ad-hoc reviews (System and Top-Level Scheme Owner) (§3.2, p. 7).
  4. Transmit draft schemes to the European Digital Identity Cooperation Group for opinions and recommendations (System Owner) (§3.3.1, p. 8); discuss periodically in the Collaboration Group (System and Top-Level Scheme Owner) (§3.3.2, p. 8).

Requirements in this document​

No requirement identifiers. Paragraphs are numbered but not consecutively (see Notes).

  • NL-TL: procedure for the EUDI Wallet Trust Mark / top-level certificate (§5.1, p. 11); listed as subsidiary document with NL-FS-, NL-CS-, NL-PW-, NL-PP- (§cover, p. 2); NL-TS, NL-FS, NL-CS and NL-P-P/W schemes for which CABs get the mark (§5.2, p. 11).
  • NL-P-P/W series: resilience, software development and vulnerability management requirements to which the vulnerability procedure relates (§4.1, p. 9).
  • Standards: ISO/IEC 17067, ISO/IEC 17065 (§2, p. 6); Architecture and Reference Framework (ARF), optional (§3.2, p. 7).
  • EU legal acts: Regulation (EU) 2024/1183 amending Regulation (EU) No 910/2014 (Art. 5a, 5a(1), 5a(5)(f), 5a(18), 5c, 5c(4), 8(3), 20(1b), 45a(4), 46a(1),(3),(5),(6),(7)); CIR (EU) 2024/2977, 2024/2979 (incl. Annex I), 2024/2980 (Art. 3, Art. 4, Annex II), 2024/2982; CIR (EU) 2024/2981; CIR (EU) 2024/482 (EUCC; chapter VI); Regulation (EU) 2019/881 Articles 58-59; CIR (EU) 2015/1502; Regulation 765/2008; NIS 2 Directive (§2, p. 6; §3.3.1, p. 8; §4.1, p. 9-10; §6.1, p. 14; §7, p. 16-17; §9, p. 19).
  • National law: "[Placeholder for references to NL national law when available]" (§2, p. 6); "Act on the National Cybersecurity Certification System", Article 25 (§8, p. 18).

Notes on this draft​

  • The cover page reads "NL-03" while the metadata reads "NL-SYS-03" (§cover, p. 1-2).
  • Paragraph numbering is non-consecutive and duplicated: 1–4 then 7; "9" used in §2 and §3.1; "16" used in §3.2 and §3.3.1; §4.1 starts at 30; "39" used twice; §5.2 starts at 44; §5.4 starts at 52; 65–68 used in §6.1 and again in §6.2; §6.3 75–77; 84/85/89–93 used in both §7.1 and §7.2; §7.3 101–104; §8 115–119; §9 121, 124–126 (§1–9, p. 5-19).
  • The TOC and body number two sections "6.1" (Supervision of Conformity Assessment Bodies; Supervision of European Digital Identity Wallets) (§Table of Content, p. 4; §6, p. 13-14).
  • §3.1 is titled "Ministry of Digital Affairs governance arrangements" but assigns the role to the Minister of Economic Affairs (§3.1, p. 7).
  • §1 ends "Wallet Providers and PID Providers ()" (empty parentheses) (§1, p. 5).
  • §4.1 refers to "the notification mechanism described in 7.1.2" (§4.1, p. 10); there is no section 7.1.2.
  • §4.1 paragraph 38 is truncated: "In case the vulnerability is related to the component certified under the EUCC scheme, the provisions of Commission Implementing Regulation" (§4.1, p. 10).
  • §5.1 contains an empty bullet "o )" (§5.1, p. 11).
  • §5.2 refers to "NL-TS" and says CAB-CBs may transfer "this Trust Mark" in a section about the national mark of conformity (§5.2, p. 11).
  • §5.3 paragraph 50 has an unclosed parenthesis; §5.4 paragraph 55 reads "Any improper use of the will be subject to legal action taken" (§5.3–5.4, p. 12).
  • §6.1 (CAB supervision) is enclosed in square brackets beginning "[That means the following requirements will be included in national law and replaced by a reference at that time:" and ending after paragraph 65 (§6.1, p. 13-14).
  • §6.1 paragraph 68 has a list item run into the previous one ("…compliance monitoring, o Conducting both on-site inspections…") (§6.1, p. 14).
  • §7.3 paragraph 101 states that "the System Owner notifies the Commission to transition a Wallet Solution into a 'Valid' state", while paragraph 102 assigns notification of the certification to the Supervisory Authority (§7.3, p. 17).
  • §7.1 paragraph 90 ends with a stray “$” (§7.1, p. 16).
  • §7.2 and §7.3 contain a stray closing quotation mark after "admission)" (§7.2, p. 16; §7.3, p. 17).
  • §9 refers to "the EUDICG" (§9, p. 19); elsewhere the body is called the European Digital Identity Cooperation Group (§3.3.1, p. 8).
  • §2 lists CIR 2024/2980 and Cybersecurity Act Articles 58-59 (§2, p. 6); NL-SYS-01 lists 2024/2977, 2024/2979, 2024/2982 and Cybersecurity Act Article 54 (cross-reference: (NL-SYS-01 §2, p. 8)).
  • Figure 2 is the only figure in the document; there is no Figure 1 (§4.1, p. 9).
  • Typos: "CABsn the Wallet Provider", "in the extend", "wil issue", "to to ensureauthenticity" (§4.1, p. 9-10; §6.2, p. 15).

Sources​