DVV signature and seal checks gain EU qualified status

Digital and Population Data Services Agency (Digi- ja väestötietovirasto, DVV) validation services for electronic signatures and electronic seals have reached the level of EU qualified trust services. The services validate the validity of a signed or sealed document EU-wideDVV: whether the signature or seal is valid, whether the certificate used was valid at the moment of signing or sealing, whether the document was altered afterwards, and whether the signature or seal meets the eIDAS Regulation requirements. The services do not create signatures or seals; they check integrity and validity and report the validation result.

A qualified validation service may only be provided by a qualified trust service provider. Under Regulation (EU) No 910/2014, the provider must validate in compliance with Article 32(1) and deliver the result to relying parties in an automated manner that is reliable and efficient and bears the provider's advanced electronic signature or seal, as Article 33(1) requires. Article 32(1) sets the checks the process must confirm, including that the supporting certificate was a qualified certificate at the time of signing, that it was issued by a qualified provider and valid at that time, that the signature was created by a qualified creation device, that the signed data has not been compromised, and that the Article 26 advanced-signature requirements were met. For seals, Articles 32 to 33 apply mutatis mutandis to validation under Article 40. Reference standards for these qualified validation services are laid down in Commission Implementing Regulation (EU) 2025/1942.

Qualified status becomes operational through the trusted lists. A provider that was not qualified notifies the supervisory body with a conformity assessment report, the supervisor verifies compliance, grants qualified status and informs the body responsible for the trusted lists, and the provider may begin providing the qualified service once the status is indicated in the list, under Article 21. Each Member State establishes, maintains and publishes its trusted list with its qualified providers and their qualified services in a form suitable for automated processing, and notifies the Commission of the responsible body and publication details, under Article 22(1) to 22(3). The Commission makes that information available through a secure channel, and the EU list of trusted lists (LOTL) chains the national lists into one whole so signatures and seals can be checked consistently across Member States. In Finland the trusted list is maintained by the Transport and Communications Agency TraficomDVV as the public register of notified qualified providers and their qualified servicesDVV. Inclusion confirms the service's conformity was assessed under EU rules and strengthens DVV's position as a qualified provider in Finland and in other Member States.

For organisations, the practical effect is uniform checking across the EU. Legal, compliance and trust teams that validate signed and sealed documents can use DVV validation to confirm validity, level and document integrity rather than building Member-State-specific checks, which supports cross-border digital dealings by citizens, businesses and authorities. The validation covers signatures and seals based on qualified certificates, reports whether post-signing changes occurred, and shows whether eIDAS requirements are met, while creation of signatures and seals remains outside the service. Teams should point their verification to the Finnish trusted list entry and the EU LOTL chain and retain the provider-signed validation result as evidence of the check.

Legal basis: Regulation (EU) No 910/2014, Articles 21, 22, 32, 33 and 40; Commission Implementing Regulation (EU) 2025/1942, Articles 1 and 2.