Skip to main content

NL-TL: National Top-Level EUDIW Certification Scheme

NL-TL: National Top-Level EUDIW Certification Scheme

Download PDF (2.5 MB, 35 pages)Read the full text
Cover page of the document, as printed
Document referenceNL-TL
VersionRC1.1
StatusRelease Candidate
Date31/10/2026
Document typeCertification Scheme Scheme Specification (EN ISO/IEC 17067)
Parent frameworkNL-SYS-01, NL-SYS-02, NL-SYS-03, NL-SYS-04, NL-SYS-05
Scheme OwnerKingdom of the Netherlands Minister of Economic Affairs
Certification targetEuropean Digital Identity Wallet Providers (and the Wallet Solutions provided)
Primary audienceScheme Owners, CABs, EUDI Wallet providers
Secondary audienceEUDI Wallet ecosystem stakeholders
Assurance levelHigh/High
Subsidiary DocumentsNL-P-W & NL-P-P
How to read this page

This page summarises the document. Every statement points to the section and page of the authoritative PDF it comes from: click a reference such as §6.1, p. 10 to open that page. If this summary and the PDF differ, the PDF applies.

What this document is​

NL-TL is the specification for the Wallet Provider Top-Level Certification Scheme: it defines the Certification Scheme, in the sense of ISO/IEC 17067, that accredited CABs shall apply when assessing the conformity of European Digital Identity Wallet (Provider)s in conjunction with the electronic identification scheme under which they are provided (§1, p. 6). It is "primarily addressed to CABs"; Wallet Providers should read it with the applicable NL-P-* subsidiary documents, which specify the substantive requirements (§1, p. 6). It specifies the Certification Scheme to be applied by the National eID scheme owners to Wallet Providers that seek to acquire a Top-Level Certificate and seek to be admitted to the National eID scheme ("stelsel") (§2, p. 7).

Scope and object of certification​

  • Object of certification: "the conformity of European Digital Identity Wallet (Provider)s in conjunction with the electronic identification scheme under which they are provided" (§2, p. 7; §6.1, p. 11).
  • It encompasses (a) the wallet provider having satisfied the applicable scheme requirements, having the required underlying certificates and having demonstrated that it meets the national admission-conditions set in National law, and (b) the government-assigned PID provider that the Wallet Provider is linked to also having satisfied the applicable requirements and having the required certificates (§2, p. 7).
  • The CAB assesses conformity against the requirements determined by the composition rules of the NL EUDI Certification System (NL-SYS-01) "and additional national admission criteria" (§6.1, p. 11).
  • The top-level process determines "whether the Wallet Provider, the Wallet Solution version(s) in scope, and the government-assigned PID Provider to which the Wallet Provider is linked collectively satisfy the conditions for certification" (§8.1, p. 21).

Who it applies to​

Table 1 "Overview of Roles and Responsibilities" (§6.2.1, p. 11):

  • Scheme Owner — "Owns and supervises the scheme; authorises CABs; maintains certificate register; monitors the scheme." (normative basis ISO/IEC 17067). Also determines the effective date of this version and transition deadlines, and sets up the governance mechanism for interpretation questions (§10.4–10.5, p. 28); is informed of certificate decisions and status changes (§9.4, p. 27).
  • CAB — "Plans, performs and documents the evaluation; issues the certification decision and certificate of conformity; manages surveillance and recertification activities." (ISO/IEC 17065; NL-SYS-05). Only a certification body that is "accredited and also authorized under Dutch law" is eligible as CAB under NL-TL (§6.1, p. 11).
  • Applicant / Certificate Holder — "Submits the eID scheme for certification; provides evaluation evidence; complies with post-certification obligations including surveillance cooperation and change notification." (NL-TL). The Wallet Provider ceases using the mark of conformity without undue delay when a certificate is suspended or withdrawn (§6.6, p. 13).
  • National Accreditation Body (NAB) — "Accredits CABs in accordance with ISO/IEC 17065 for the relevant scope under this scheme." (Regulation (EC) No 765/2008).
  • Market Surveillance Authorities — "Oversight of certified services in the market. This role will be performed by the NL-TL Scheme Owner." (ISO/IEC 17067 & National Law).
  • Government-assigned PID Provider — must have satisfied the applicable requirements and hold the required certificates covering PID issuance and lifecycle services and "transversal services that support the trust in the overall eID national scheme (like user dashboard and notification in order to combat fraud)" (§6.4, p. 12).
  • Competent authority under national law — where national law reserves an admission determination to it, the CAB verifies that determination and does not substitute its own decision (§8.4.3, p. 22; §10.1, p. 28).
  • Subordinate CABs — the top-level CAB coordinates evidence and status information with them (§9.4, p. 27).

Contents​

No.TitleContentStart page
1ForewordNature of the scheme and intended readers6
2ScopeObject of certification and what NL-TL establishes7
3Legal BasisEU legal instruments; placeholder for national law and admission criteria8
4ReferencesStandards, parent documents (NL-SYS-01…05), subsidiary documents (NL-P-P, NL-P-W)9
5Terms and DefinitionsRefers to NL-SYS-0210
6Certification Scheme StructureObject, roles (Table 1), CAB accreditation, impartiality, relationship to NL-P-W/NL-P-P, scheme type, marks11
7Evaluation FrameworkGeneral approach, scope, methods, evidence, proportionality, reliance, evaluation criteria14
8Certification ProcessApplication through recertification (8.1–8.12)21
9Top-level Certificate Control and Lifecycle CoordinationDependency register, status monitoring, impact assessment, coordination, records27
10Final ProvisionsNational legislation, contracts, costs, effective date, interpretation and precedence28
Annex A(Normative) Mandatory Evidence and Dependency MatrixMinimum verification and top-level use per evidence category29
Annex B(Normative) Composite Evaluation FrameworkEvaluation sequence, reliance determination, coverage, interfaces, findings, sampling, competence, confidentiality30
Annex C(Normative) Minimum Contents of the Evaluation PlanList of required plan contents32
Annex D(Normative) Minimum Contents of the Eval. Evidence RecordList of required evidence-record contents33
Annex E(Normative) Evaluation Results MatrixRequired fields of the evaluation matrix34
Annex F(Normative) Minimum Contents of the Top-level CertificateList of required certificate contents35

Key points​

Composition of the top-level certificate

  • NL-TL is "a composite certification scheme established in accordance with the principles of EN ISO/IEC 17067"; it relies on results and certificates from subordinate schemes, which include Type 5 and Type 6 schemes (§6.5, p. 12).
  • The CAB verifies that the wallet provider meets NL-P-W and holds the required NL-PW certificates (provision and operation of wallet solutions) and conformity statements on the national admission-conditions, and that the linked government-assigned PID provider meets its scheme and holds the required certificates (§6.4, p. 12).
  • The CAB bases its evaluation on valid certificates and results from the subordinate schemes "for the Wallet Provider, the Wallet Solution and the government-assigned PID Provider" (§7.1, p. 14). Annex A evidence categories: Wallet Provider certification; PID Provider certification; Wallet Solution functional certification; Wallet Solution cybersecurity certification; National admission evidence; Interface and dependency evidence; Other assurance evidence ("May supplement, but not replace, mandatory subordinate certificates") (§Annex A, p. 29).
  • Activities adequately covered by valid subordinate certificates are not repeated; the CAB evaluates requirements, national admission conditions, dependencies and interfaces not sufficiently covered (§6.5, p. 12; §7.1, p. 14).
  • The CAB remains responsible for the top-level decision irrespective of reliance on subordinate results (§6.5, p. 12; §7.1, p. 14; §8.1, p. 21).
  • The evaluation takes into account the minimum requirements for evaluating eID schemes in Annex VI to CIR (EU) 2024/2981, including evaluation of the applicable risk register (§7.1, p. 14).
  • Proportionality "shall not compensate for the absence, expiry, suspension, withdrawal or insufficient scope of a subordinate certificate", nor replace demonstration of national admission conditions (§7.5, p. 18).
  • Other assurance evidence "shall not be accepted as a substitute for a subordinate certificate that is mandatory" (§7.7, p. 20); criteria for it: issuer competence and impartiality, scope adequacy, timeliness, rigour and depth, findings and qualifications, traceability (§7.7, p. 20).
  • Reliance is recorded as Full, Partial or None per conformity aspect (§B.3, p. 30).
  • The same CAB may perform the top-level and subordinate certifications if impartiality, separation of review and decision and competence are maintained; "it would be advisable that the accredited/authorized/assigned CAB for NL-TL is the same as for NL-P certification" (§8.1, p. 21).

Certificates, validity and conditions

  • Certificate contents (§8.7): title and unique identifier; holder name and legal identity; Wallet Solution and version(s); linked government-assigned PID Provider; object and scope; reference to NL-TL and version; identifiers and scopes of the mandatory subordinate certificates; conditions, limitations or exclusions; decision date, issue date and expiry date; issuing CAB; a statement that validity is conditional on continuing validity of the subordinate certificates and admission conditions (§8.7, p. 24). Annex F adds legal name and identifier of the Wallet Provider, "authorised signature or equivalent authentication" and "certificate status information or authoritative register reference" (§Annex F, p. 35).
  • The certificate "shall not imply certification of an entity, service, component or version outside the demonstrated scope" (§8.7, p. 24).
  • Validity: "shall not exceed the period permitted by NL-SYS-01" and never beyond the point where continuing conformity can no longer be established; no number of years is stated in NL-TL (§8.8, p. 24).
  • Renewal of a subordinate certificate "does not automatically renew the top-level certificate" (§8.8, p. 24).
  • A top-level certificate "shall not remain presented as fully valid where an indispensable dependency is no longer valid or applicable"; partial continuation only with a formally reduced scope (§9.3, p. 27).

Marks

  • "Only the NL EUDI Wallet Mark as defined in NL-SYS-03 shall be used as a mark of conformity"; no additional marks are defined in NL-TL (§6.6, p. 12).
  • The CAB grants, suspends and withdraws the right to use the mark per its decisions (§6.6, p. 13).

Timelines

  • NL-TL states no numeric periods. Time terms used: notification of changes by the holder "without undue delay" (§8.10, p. 25); impact assessment "without undue delay" (§9.2, p. 27); cessation of mark use "without undue delay" (§6.6, p. 13); recertification "before expiry if continuity of certification is required" (§8.12, p. 26).

Contracts, costs, precedence

  • The CAB concludes an enforceable certification agreement covering access to evidence, change notification, surveillance cooperation, use of certificates and marks, confidentiality, information exchange, complaints and appeals, and consequences of suspension, termination, withdrawal and expiry (§10.2, p. 28).
  • Costs are "based on the activities necessary to obtain sufficient and appropriate evidence and to maintain certification" (§10.3, p. 28).
  • "NL-SYS-01 and applicable law prevail where this scheme conflicts with system-level rules or legal requirements"; interpretation "shall not be used to waive a mandatory certification condition" (§10.5, p. 28).

Process​

  1. Application: the applicant submits an application identifying object and scope, with at least: legal identity and contacts of the Wallet Provider; Wallet Solution versions, configurations and deployment models; the government-assigned PID Provider and the PID issuance relationship; a complete inventory of mandatory subordinate certificates and declarations (identifiers, issuing CABs, objects, scopes, versions, validity periods, status); evidence of national admission conditions; dependencies and interfaces; known changes, limitations, open findings, suspensions or incidents; other assurance evidence for reliance; the CAB's application and contractual information (Applicant) (§8.2, p. 21).
  2. Application review: completeness, scope ambiguities, competence and resources, eligibility; evaluation does not start until object, certificate set, admission conditions and interfaces are sufficiently defined (CAB) (§8.2, p. 21-22).
  3. Evaluation planning: a proportionate evaluation plan distinguishing aspects accepted on subordinate certificates, certificate-level verification, national admission conditions, collective coverage/interfaces, and gaps; optional kick-off meeting (CAB) (§8.3, p. 22; §Annex C, p. 32).
  4. Evaluation: verification of every mandatory subordinate certificate (authenticity, issuer competence, accreditation/authorisation, object, scope, versions, validity, status, conditions) using authoritative information or confirmation from the issuing CAB or register; evaluation of collective coverage and interfaces; verification of national admission conditions; supplementary evaluation limited to uncovered matters (CAB) (§8.4, p. 22-23; §B.2, p. 30).
  5. Findings and Evaluation Report: findings classified per NL-SYS-01 and NL-SYS-05; no positive recommendation while a mandatory certificate is absent, expired, suspended, withdrawn or insufficient, or a material gap or unresolved major nonconformity remains (CAB) (§8.5, p. 23). Results per requirement: Conforming, Major nonconformity, Minor nonconformity, or Not concluded (§Annex E, p. 34).
  6. Review and decision: review by a person or function not involved in the evaluation; decision by the CAB, not delegated externally; the evaluation team does not make the decision; a positive decision requires all mandatory subordinate certificates valid and sufficient, all admission conditions fulfilled, collective coverage demonstrated, dependencies evaluated, supplementary evaluation completed, no unresolved major nonconformity, and accurate scope (CAB reviewer and decision maker) (§8.6, p. 23; §B.6, p. 31).
  7. Negative decision: the CAB informs the applicant of the reasons and of complaint and appeal arrangements; complaints and appeals are handled under NL-SYS-01 and the CAB's procedures (CAB) (§8.6, p. 23).
  8. Certificate issuance and publication: the CAB issues the top-level certificate (contents §8.7/Annex F) and provides certificate information to the Scheme Owner for inclusion in the applicable register per NL-SYS-01 and NL-SYS-03 (CAB) (§8.7, p. 24); the Scheme Owner maintains the certificate register (Scheme Owner) (§6.2.1, p. 11).
  9. Lifecycle control: the CAB maintains a dependency register per certificate, monitors status changes and performs impact assessments; contracts require the holder to report relevant changes (CAB, Certificate Holder) (§9.1–9.3, p. 27).
  10. Surveillance: throughout the certificate life cycle per NL-SYS-01, risk-based, checking subordinate certificates, admission conditions, changes, incidents, vulnerabilities, complaints and subordinate surveillance results (CAB) (§8.9, p. 24-25).
  11. Changes: the holder notifies the CAB without undue delay; the CAB decides whether the certificate continues, needs scope amendment or additional evaluation, is suspended, or requires recertification; scope is not extended on notification alone (Certificate Holder, CAB) (§8.10, p. 25).
  12. Suspension: where an essential condition is temporarily not satisfied or cannot be confirmed, including suspension, expiry without replacement or insufficient scope of a mandatory subordinate certificate, or an admission condition no longer fulfilled pending resolution (CAB) (§8.11, p. 25).
  13. Withdrawal: where grounds cannot be remedied, a mandatory subordinate certificate is withdrawn without acceptable replacement, an indispensable admission condition is no longer met, or conformity can no longer be demonstrated; termination may occur at the holder's request (CAB) (§8.11, p. 25).
  14. Notification: the CAB notifies the Scheme Owner of suspension, termination, withdrawal and expiry per NL-SYS-01 and NL-SYS-03; the holder ceases claims and mark use as required (CAB, Certificate Holder) (§8.11, p. 25). NL-TL does not itself describe notification to the European Commission.
  15. Recertification: completed before expiry if continuity is required; new review and decision for the complete top-level object; previous-cycle evidence reused only where continuing relevance is demonstrated (CAB) (§8.12, p. 26).
  16. Records: dependency register, verification records, impact assessments, correspondence, reports, review records and decisions retained for the period specified in NL-SYS-01 (CAB) (§9.5, p. 27).

Requirements in this document​

NL-TL contains no requirement identifiers. Paragraphs are numbered 1–76 in sections 1–7; sections 8–10 and the annexes have unnumbered paragraphs (§1–10, p. 6-28). Annex E requires a "Requirement ID: Unique identifier of the applicable top-level requirement" field in the evaluation matrix (§Annex E, p. 34), but NL-TL does not define such identifiers.

  • Parent documents: NL-SYS-01 (composition rules, reliance rules, validity period, surveillance, records, complaints and appeals, transition, precedence), NL-SYS-02 (terms), NL-SYS-03 (mark of conformity, register, notification), NL-SYS-04 (risk register), NL-SYS-05 (CAB accreditation, competence, impartiality, process requirements of Section 7) (§4.2, p. 9; §5, p. 10; §6.2.2–6.6, p. 11-12; §7.1, p. 14; §8, p. 21-26; §10.4–10.5, p. 28).
  • Subsidiary documents: NL-P-P (NL PID Provider Certification Scheme) and NL-P-W (NL Wallet Provider Certification Scheme) (§4.3, p. 9); NL-P-* documents specify the substantive requirements for Wallet Providers (§1, p. 6).
  • Standards: ISO/IEC 17065, ISO/IEC 17067 (§4.1, p. 9).
  • EU legal acts: Regulation (EU) 2014/910 modified by 2024/1183 (Art. 5a, 5c, 8(3)); CIR (EU) 2024/2977, 2024/2979, 2024/2982; CIR (EU) 2024/2981 (incl. Annex VI); CIR (EU) 2024/482 (EUCC); Regulation (EU) 2019/881 Art. 54; CIR (EU) 2015/1502; Regulation (EU) 765/2008 Art. 4 and 5 (§3, p. 8; §7.1, p. 14).
  • National law: "[Placeholder for references to NL national law when available]" and "Notably the provisioning wrt admission criteria" (§3, p. 8); the scheme is applied together with national legislation governing the NL eID scheme and admission of Wallet Providers (§10.1, p. 28).

Notes on this draft​

Sources​