Skip to main content

The life of a certificate

A certificate is not a one-off. This page describes what happens after a certificate is issued, first according to the general rules of NL-SYS-01 and the top-level scheme NL-TL, then per subordinate scheme.

Validity​

CertificateValiditySource
Top-level certificate (NL-TL)Four years(NL-SYS-01 §5.10, p. 23)
Wallet Provider and PID Provider certificates (NL-P-W, NL-P-P)Four years(NL-SYS-01 §5.10, p. 23)
Functional certificate (NL-FS)Expiry date at most 5 years after issuance(NL-FS §8.4, p. 20)
Cybersecurity certificate of the Wallet Instance (NL-CS)At most five years(NL-CS Part 1 §6.3, p. 18)

The validity period of the top-level certificate shall not exceed the period permitted by NL-SYS-01. It never extends beyond the point at which the CAB can no longer establish continuing conformity (NL-TL §8.8, p. 24). The top-level certificate remains conditional on (NL-TL §8.8, p. 24):

  • the continued validity and applicability of every mandatory subordinate certificate;
  • continued fulfilment of the national admission conditions;
  • continued applicability of the certified Wallet Solution and PID Provider relationship;
  • fulfilment of surveillance and change-notification obligations;
  • effective resolution of findings and corrective actions.

Renewal of a subordinate certificate does not automatically renew the top-level certificate (NL-TL §8.8, p. 24). The CAB maintains a dependency register for every top-level certificate. The register lists all subordinate certificates, declarations, admission determinations, entities, versions and interfaces the certificate depends on (NL-TL §9.1, p. 27).

Surveillance​

The top-level certificate is subject to annual surveillance by the CAB-CB. The surveillance takes into account the outcomes of surveillance under NL-FS, NL-CS and NL-P-P/W (NL-SYS-01 §5.4, p. 20). NL-TL requires surveillance throughout the certificate life cycle. It is risk-based and determines whether the conditions behind the top-level decision are still met (NL-TL §8.9, p. 24). It includes at least (NL-TL §8.9, p. 24):

  • checking the status, validity, scope and applicability of all mandatory subordinate certificates;
  • checking that the national admission conditions are still fulfilled;
  • reviewing changes to the Wallet Provider, the Wallet Solution, the linked PID Provider, the certified versions and the relevant interfaces;
  • reviewing incidents, vulnerabilities, complaints and regulatory or supervisory information;
  • reviewing findings and surveillance results of the subordinate schemes;
  • evaluating whether the set of certificates is still complete and consistent;
  • performing supplementary evaluation where the evidence is insufficient.

Each subordinate scheme has its own surveillance:

  • Functional (NL-FS): surveillance follows the certification cycle of NL-SYS-01 and takes into account how fast the requirements and specifications change (NL-FS §8.2, p. 19). A surveillance evaluation is triggered at least by a change to the object of certification that affects its functional behaviour or declared features, a change to the implementing acts or referenced specifications that materially affects the certified requirements, or a change to a test case specification that alters, adds or removes applicable test cases (NL-FS §8.2, p. 19).

  • Cybersecurity (NL-CS): the reference schedule of Implementing Regulation (EU) 2024/2981 Annex IX is described as a recommendation. Other schedules are possible as long as the validity does not exceed five years and each evaluation is performed within 12 months of the previous one (NL-CS Part 2 §7.1, p. 19). A vulnerability assessment is performed at least every two years in surveillance evaluations (NL-CS Part 2 §7.1, p. 19).

  • Wallet Provider (NL-P-W): the CAB conducts annual surveillance. Each surveillance activity is conducted within 12 months of the issuance of the certificate and thereafter within 12 months of the previous one. Recertification is conducted within 12 months after the last surveillance activity (NL-P-W §8.8, p. 19) (NL-P-W §8.8, p. 20). A vulnerability assessment is performed at the initial evaluation, at each recertification and at least every two years during surveillance (NL-P-W §8.8, p. 20). Surveillance also verifies that the wallet solution still holds valid NL-FS and NL-CS certificates (NL-P-W §8.8, p. 19).

Changes​

Changes that affect the EUDI Wallet solution, and so the top-level certificate, are handled under the CAB-CB's regular change management process. That process is part of certificate maintenance. When the certificate holder initiates a change, it notifies the CAB-CB and describes the change in an Impact Analysis Report (IAR) (NL-SYS-01 §5.6, p. 21). A change resulting from a security incident or vulnerability is handled with respect to the assurance continuity principle (NL-SYS-01 §5.6, p. 22).

NL-SYS-01 Figure 4: change management process implemented in the certification system

NL-SYS-01, Figure 4: Change management process implemented in the certification system (NL-SYS-01 §5.6, p. 21)

For the top-level certificate, the holder notifies the CAB without undue delay of changes that may affect conformity. Examples are changes to its legal identity, the Wallet Solution version or architecture, the PID Provider relationship, the admission status or a mandatory subordinate certificate. The CAB assesses the impact. It decides whether the certificate can continue unchanged, needs a scope amendment or additional evaluation, must be suspended, or requires recertification (NL-TL §8.10, p. 25).

In the cybersecurity scheme, the product developer notifies the CB of all planned changes before they are implemented. The CB decides per change, using a delta assessment with three outcomes (NL-CS Part 2 §7.4, p. 20):

  • covered: the change is recorded and examined in the next surveillance;
  • partially covered: a special evaluation of the affected requirements;
  • not covered: a full evaluation.

Obligations of the certificate holder​

After certification, the certificate holder shall (NL-SYS-01 §5.5, p. 20):

  • comply with the European and national legislation on the EUDI Wallet solution, including Implementing Regulation (EU) 2024/2981;
  • maintain communication channels with the CAB-CBs, CAB-ITSEFs where applicable, and the Scheme or System Owner, to fulfil its notification obligations;
  • make essential information on the secure use, certification and updates of the EUDI Wallet solution available to end users, in accessible and understandable language;
  • run a continual process to identify, analyse and assess vulnerabilities that can affect the EUDI Wallet solution;
  • maintain vulnerability handling procedures, and cooperate with the CAB-CB and the Scheme Owner when a vulnerability is identified;
  • publish or reference publicly known vulnerabilities that can affect the EUDI Wallet solution. The information shall identify the vulnerability, the affected versions and the available mitigating or updating measures, without details that allow exploitation (NL-SYS-01 §5.5, p. 21);
  • use the mark of conformity according to the rules of NL-SYS-03.

The cybersecurity scheme sets time limits for vulnerability notifications. Critical vulnerabilities and active exploits are notified within 24 hours of discovery, and high-severity vulnerabilities within 72 hours (NL-CS Part 2 §8.1, p. 21). The CB suspends the certificate without undue delay once it has confirmed that a breach affects conformity (NL-CS Part 2 §8.5, p. 21).

Nonconformities​

Any non-fulfilment of a specified requirement by the object of certification is a nonconformity (NL-SYS-01 §5.7, p. 22). Each scheme has its own specific provisions for nonconformities (NL-SYS-01 §5.7, p. 22). When the CAB-CB finds that a certificate holder does not comply with its obligations under European or national regulations or the contract, the CAB-CB (NL-SYS-01 §5.7, p. 22):

  1. formally notifies the certificate holder of the non-compliance, describing the obligation concerned, the available evidence and the possible impact on trust or on the certification;
  2. asks the certificate holder for clarification;
  3. if the clarification is not sufficient, sets a maximum period of no more than thirty (30) calendar days. Within that period the certificate holder proposes corrective measures and commits to carrying them out within a reasonable time.

If the deadline is missed, the proposals are unsatisfactory or there is no response, the CAB-CB starts the suspension procedure (NL-SYS-01 §5.7, p. 22).

Suspension, withdrawal and expiry​

A certificate may be suspended or withdrawn when nonconformities are found in the certified object or part of it (NL-SYS-01 §5.8, p. 22). NL-SYS-01 sets these general rules (NL-SYS-01 §5.8, p. 23):

  • Withdrawal or termination at the holder's request is final: the certificate is not reinstated. Withdrawal does not automatically invalidate certificates for individual components, provided those remain compliant.
  • A suspended certificate can be reinstated after a formal certification process. That process must show that the causes have been resolved and that continued conformity is ensured.
  • Expiry: the CAB informs the certificate holder, the System Owner and the top-level scheme owner of the expiry date, and acts towards re-certification without undue delay. The expiry of one Wallet Provider's top-level certificate has no impact on the validity of other certificates in the system.

For the top-level certificate (NL-TL §8.11, p. 25):

  • The CAB suspends the top-level certificate when a condition essential to continued conformity is temporarily not met or cannot be confirmed. This includes a suspended mandatory subordinate certificate, one that expires without accepted replacement or becomes insufficient in scope, or an admission condition that is no longer fulfilled pending resolution.
  • The CAB withdraws the certificate when the grounds cannot be remedied or a mandatory subordinate certificate is withdrawn without an acceptable replacement. The same applies when the holder no longer satisfies an indispensable admission condition, or when conformity can no longer be demonstrated.
  • The CAB notifies the Scheme Owner of suspension, termination, withdrawal and expiry. The holder stops claims and use of the mark of conformity to the extent the decision requires.

In the Wallet Provider scheme, a suspension lasts at most 45 days. Any extension is subject to a decision of the Scheme Owner. NL-P-W adds that it "may not exceed one 90 days" (as printed). The suspension does not affect the validity period of the certificate (NL-P-W §8.10, p. 21). The CAB suspends an NL-P-W certificate in these cases (NL-P-W §8.10, p. 21):

  • the Wallet Provider does not implement corrective actions in time;
  • its NL-FS or NL-CS certificate is suspended or revoked;
  • a significant incident or security breach is notified that can affect conformity;
  • it does not cooperate with surveillance.

Recertification​

Recertification of the top-level certificate is completed before expiry if continuity is required. The CAB may rely on current subordinate certificates and surveillance evidence, but makes a new review and certification decision for the complete top-level object. Evidence from the previous cycle is reused only where its continuing relevance is demonstrated (NL-TL §8.12, p. 26).

For the Wallet Provider, the applicant notifies the CAB of the need for recertification no later than six months before the certificate expires (NL-P-W §8.9, p. 21). Recertification is also required after a major change to the electronic identification scheme, for example a new wallet solution version that the existing certificate does not cover (NL-P-W §8.9, p. 21).

In the functional scheme, recertification is performed against the documents and test case specifications current at that time. Unchanged components can rely on previous evidence under conditions (NL-FS §8.3, p. 19). In the cybersecurity scheme, the developer may request recertification before expiry. The new certificate is valid for at most five years from issue (NL-CS Part 2 §10, p. 23).

Complaints and appeals​

Any certification decision, including suspension or withdrawal, may be appealed by a relevant stakeholder and by a user of an EUDI Wallet. An appeal must be substantiated by reference to the requirements alleged not to be fulfilled (NL-SYS-01 §5.9, p. 23). The CAB-CB handles appeals according to its publicly available procedures, and the Scheme Owner may not alter CAB decisions (NL-SYS-01 §5.9, p. 23). Any EUDI Wallet stakeholder may submit a complaint to the Scheme Owner about any aspect of the certification system (NL-SYS-01 §5.9, p. 23). Complaints and appeals that a CAB-CB has not resolved go to the Scheme Owner (NL-SYS-01 §4.1, p. 14).

Records​

The retention period of records created during certification is to be defined according to the relevant legal requirements. These will include a provision that records of NL-TL, NL-P-P/W and NL-FS/CS certification are also given in custody to the Certification System Owner, in addition to local backups (NL-SYS-01 §5.10, p. 24). A note in NL-SYS-01 recommends a retention period of at least five years after the certificate has expired (NL-SYS-01 §5.10, p. 24). For the top-level certificate, the CAB retains the dependency register, verification records, impact assessments, evaluation reports, review records and decisions. Together they form a complete audit trail (NL-TL §9.5, p. 27).