eIDAS Article 42: how to check that a timestamp is really qualified

The short answer

A timestamp is qualified only if it meets the requirements of Article 42 of the eIDAS Regulation and is issued by a trust service provider that holds qualified status for time stamping. Only then does it enjoy the presumption in Article 41(2): the accuracy of the date and time it indicates and the integrity of the data to which that date and time are bound.

A PDF that says “qualified timestamp” proves nothing on its own. What counts is the time-stamp token itself, the provider’s status on the EU Trusted List at the time of issue, and a signature that still verifies. All three can be checked by a court, an expert or the other side, without having to trust the vendor that created the evidence.

What Article 42(1) requires

Article 42(1) lists the requirements a qualified electronic time stamp must meet. Read together with the definition in Article 3(34), they give four conditions:

• Binding: it binds the date and time to the data in a way that reasonably precludes the possibility of the data being changed undetectably.
• Time source: it is based on an accurate time source linked to Coordinated Universal Time (UTC).
• Signature: it is signed with an advanced electronic signature or sealed with an advanced electronic seal of the qualified trust service provider, or by an equivalent method.
• Issuer: it is issued by a qualified trust service provider that has been granted qualified status for this service.

A timestamp that misses any of these is not worthless. Under Article 41(1) it cannot be denied legal effect merely because it is electronic or not qualified, but the court weighs it freely, without the presumption. That difference matters when the date of a web page, a contract or a post is disputed.

What eIDAS 2 changed: Article 42(1a) and Regulation 2025/1929

Regulation (EU) 2024/1183, known as eIDAS 2, amended Article 42. It added a presumption of compliance (Article 42(1a)): where a time-stamping service meets the reference standards set by the Commission, the requirements of Article 42(1) are presumed to be met. Article 42(2) tells the Commission to set those standards by implementing acts.

The Commission did so in Implementing Regulation (EU) 2025/1929 of 29 September 2025, in force since 20 October 2025. Its recitals make clear that the presumption is aimed at supervisory bodies: a provider that follows the listed standards should be presumed compliant when its qualified status is granted or confirmed. For anyone relying on timestamps, the practical effect is one published technical baseline for what a qualified time-stamping service must do.

The technical standards behind a qualified timestamp

The annex of Implementing Regulation 2025/1929 builds on documents you will see referred to in provider policies and in verification reports:

• ETSI EN 319 421 V1.3.1: policy and security requirements for providers that issue time stamps, including protection of the signing keys, clock accuracy and regular security testing.
• ETSI EN 319 422 V1.1.1: the time-stamping protocol and token profile. A token declared as a qualified electronic time stamp must carry a qcStatements extension with the statement esi4-qtstStatement-1.
• RFC 3161: the Internet time-stamp protocol on which the token format is based.

How to check a timestamp yourself: six steps

You do not need to be a cryptographer. These checks take minutes with free tools and the evidence package itself:

• Get the token. Ask for the RFC 3161 time-stamp token (often a .tsr or .tst file) and the exact data or hash it covers, not only a report that mentions it.
• Read it. Free tools such as OpenSSL (openssl ts -reply -text) show the issuing time-stamping unit, the time, the policy and the hash of the stamped data.
• Match the hash. Compute the SHA-256 of the evidence, or of the manifest the token binds, and compare it with the hash inside the token. One changed byte breaks the match.
• Check the provider on the EU Trusted List. Find the provider and confirm a qualified time-stamping service (service type QTST) with the status granted at the time shown in the token.
• Verify the signature chain. The token’s signing certificate must chain to the certificate that the Trusted List records for that qualified service.
• Look for the qualified statement. Under EN 319 422, a token declared qualified carries esi4-qtstStatement-1; if it is missing, ask questions before you rely on the presumption.

Red flags: when a timestamp is not what it claims

• You only get a PDF or a screenshot that mentions a timestamp, and no token you can verify.
• The provider is not on the EU Trusted List, or its time-stamping service was not in granted status on the relevant date.
• The time comes from the vendor’s own server clock or from a blockchain alone. A blockchain anchor can be useful additional evidence, but it is not a qualified electronic time stamp.
• Verification only works on the vendor’s website, with no way to check offline.
• The hash in the token does not match any file in the package, or nobody can tell you exactly what was stamped.

What a qualified timestamp does not prove

Article 41(2) presumes two things: that the date and time are accurate, and that the stamped data has not changed since. It does not say that the content is true, who created it, or that a web capture shows everything a visitor saw. Those questions concern how the evidence was collected, which is why the capture method, its documentation and the chain of custody still matter.

In practice, a qualified timestamp closes one line of attack, namely that the evidence could have been changed later, so the argument moves to the content itself. That is where you want a dispute about online evidence to be.

Where GetProofAnchor fits

On every paid GetProofAnchor plan, each proof is bound by SHA-256 into a qualified electronic time stamp (RFC 3161) from SK ID Solutions, an EU qualified trust service provider. You can run the six checks above on our own evidence packages:

• Web app: capture a page by URL or from your browser and get an Evidence ZIP with the timestamp token, a snapshot of the EU Trusted List and a SHA-256 manifest of every file. From 9 € excl. VAT for 3 proofs (10.89 € incl. 21 % VAT), monthly plans from 19 € excl. VAT.
• Forensic Browser: a Windows app for multi-page and logged-in sessions that can produce a PDF with the qualified timestamp embedded (PAdES), which validates in Adobe Acrobat Reader. Annual licences from 290 € excl. VAT.
• Assisted Capture: we capture the URLs for you, from 49 € excl. VAT per URL within 90 minutes, or with the Rush tier within 60 minutes.

The open-source gpa-verify checks our packages offline, including the timestamp chain, so neither the court nor the other side has to take our word for it.

FAQ

Sources

• Regulation (EU) No 910/2014 (eIDAS), Articles 3, 41 and 42
• Regulation (EU) 2024/1183 amending eIDAS (eIDAS 2)
• Commission Implementing Regulation (EU) 2025/1929 on qualified electronic time stamps
• EU Trusted Lists browser (European Commission)
• RFC 3161: Internet X.509 PKI Time-Stamp Protocol (TSP)