How eIDAS 2’s Strong Authentication Satisfies NIS2 Article 21 MFA — One Identity Policy, Two EU Directives

In April 2024, the EU published Regulation (EU) 2024/1183 — eIDAS 2 — rewriting the rules for electronic identity and trust services across 27 member states. Four months later, the NIS2 transposition deadline passed. Two frameworks, two deadlines, and one compliance question most guides leave unanswered: where do they actually overlap, and which one governs?

The answer is set out in Recital 50 of eIDAS 2: trust service providers subject to NIS2 carry “complementary” obligations under both regulations — not parallel or competing ones. For organisations that operate trust services, the qualified-status conformity assessment is designed to verify both frameworks in a single audit cycle. For organisations accepting EU Digital Identity Wallet authentication, the wallet’s “assurance level high” can support — and be cited as evidence for — a NIS2 Article 21(2)(j) MFA control where appropriate, rather than requiring a separate system.

This guide maps the four specific intersection points and explains what each means for your compliance role.

Who This Applies To

The eIDAS 2 and NIS2 intersection affects two distinct groups — but with very different implications. Identify your position before reading further.

Your Role	How Both Frameworks Apply
Trust service provider (TSP)	Directly in scope for both. eIDAS 2 governs your qualified status; NIS2 places qualified TSPs in the essential-entity category regardless of company size (Article 3, digital infrastructure sector). The eIDAS 2 qualification conformity assessment covers NIS2 Article 21 as part of your qualification cycle, and Recital 50 frames the two obligation sets as complementary.
CISO / IT Security Manager	EU Digital Identity Wallet authentication at eIDAS 2 assurance level high can support your Article 21(2)(j) MFA control, where appropriate to the risk. Document the mapping from eIDAS assurance level to your access control policy to evidence the NIS2 control.
Compliance Officer / Legal	Qualified electronic signatures create a court-admissible audit trail for NIS2 governance documentation — policy approvals, incident response decisions, supplier onboarding records — each mapping to a specific Article 21 measure.
SME Owner / Board	If your business relies on a qualified certificate authority, e-ID provider, or remote signing service, that supplier is a NIS2 essential entity under proactive supervision with €10 million penalty exposure. Your supply chain due diligence obligation (Article 21(2)(d)) extends to that provider.

How eIDAS 2 Explicitly Absorbs NIS2 Security Requirements

Most cross-framework guides treat NIS2 and eIDAS 2 as separate compliance tracks that happen to share some topic area. They are not. eIDAS 2 contains explicit legislative architecture connecting the two.

Recital 50 of Regulation (EU) 2024/1183 (eIDAS 2) states that trust service providers’ cybersecurity risk-management and reporting obligations under Directive (EU) 2022/2555 (NIS2) “should be considered to be complementary to the requirements imposed on trust service providers under this Regulation.” A recital is interpretive rather than a stand-alone obligation, but the phrasing signals clear legislative intent: TSPs are not meant to choose between eIDAS 2 and NIS2 compliance. In practice, both are verified together in the qualified-status conformity assessment described below.

Recital 51 reinforces this coordination. It states that the eIDAS 2 supervisory bodies (designated under Article 46b of Regulation (EU) No 910/2014) and the “competent authorities designated or established pursuant to Article 8(1) of Directive (EU) 2022/2555” should cooperate closely and exchange relevant information. In practice, your national supervisory body for qualified trust services and your NIS2 competent authority are expected to work in coordination — not independently issue duplicate audit requests.

The conformity assessment mechanism reflects this integration directly. When a trust service provider seeks or renews qualified status, an accredited conformity assessment body (CAB) must verify compliance with both eIDAS 2 requirements and NIS2 Article 21 simultaneously. That assessment repeats every 24 months. In practice this means most TSPs do not face a wholly separate NIS2 audit — Article 21 compliance is built into the qualification cycle.

For TSPs, this collapses what most compliance consultants frame as two projects into one: the eIDAS 2 qualification renewal already carries the NIS2 cybersecurity review inside it.

TSP Classification Under NIS2 — Essential, Not Just “In Scope”

Most compliance guides describe trust service providers as being “in scope” for NIS2. That framing understates the regulatory exposure considerably.

Trust service providers appear in NIS2 Annex I — the essential entities list — under the digital infrastructure sector. Qualified trust service providers are classified as essential entities regardless of company size. A 12-person qualified certificate authority carries the same essential entity classification, and the same regulatory obligations, as a major cloud provider.

Obligation	Essential Entity (Qualified TSP)	Important Entity
Supervision mode	Proactive ex ante — authorities can inspect at any time, without prior evidence	Reactive ex post — only triggered by evidence of non-compliance
Maximum fine	€10 million or 2% of total annual global turnover	€7 million or 1.4% of total annual global turnover
Article 21 measures	Mandatory (all ten)	Mandatory (all ten)
Incident reporting	24-hour early warning, 72-hour formal notification	Same timeline applies

The supervision difference is the operational one that catches organisations off guard. Essential entities cannot wait for a regulatory incident to trigger scrutiny. Proactive supervision means a competent authority can open an on-site inspection without advance notice or prior evidence of a violation. The €3 million difference in maximum fines matters less, in practice, than the audit-readiness gap that proactive supervision exposes.

If you operate a qualified trust service and have not assessed your NIS2 essential entity status, the NIS2 scope and applicability guide covers the classification criteria and registration requirements in full.

eIDAS 2 Assurance Level High and NIS2 Article 21(2)(j) MFA

NIS2 Article 21(2)(j) requires “the use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems within the entity, where appropriate.”

eIDAS 2 requires the EU Digital Identity Wallet to be provided at assurance level high (Article 5a of eIDAS 2; the assurance levels themselves are defined in Article 8 of Regulation (EU) No 910/2014). Assurance level high is a defined technical standard — not a brand claim — and in practice combines multiple authentication factors, such as possession of a certified secure element on the device and inherence via biometric verification, together with protection against duplication and forgery. Because of this, wallet authentication can serve as a multi-factor or continuous authentication mechanism under Article 21(2)(j) — though that measure applies “where appropriate” on a risk basis rather than mandating any specific technology.

For CISOs — the practical control mapping: organisations requiring EUDIW authentication for employee access to sensitive systems can cite the wallet’s assurance level high (eIDAS 2 Article 5a) as documented evidence for their Article 21(2)(j) control, where MFA is appropriate to the risk. The wallet is an auditor-recognisable MFA mechanism with a clear regulatory basis — no proprietary MFA system required for those access points.

For compliance officers — the documentation path: record in your access control policy (Article 21(2)(i)) which authentication mechanisms you accept for which access categories. Cross-reference eIDAS 2 Article 5a (wallet assurance level high) for wallet-based authentication. This single policy entry creates the Article 21(2)(j) compliance evidence without a separate technical document.

By end of 2027, all businesses and public administrations requiring strong customer authentication must accept EUDIW proof of identity. Planning your access control policy now to accommodate wallet authentication avoids a retrospective rewrite once mandatory acceptance takes effect. The NIS2 MFA requirements guide covers the Article 21(2)(j) implementation criteria, including the specific technical thresholds set by Commission Implementing Regulation (EU) 2024/2690.

Qualified Electronic Signatures in Your NIS2 Compliance Trail

NIS2 requires entities to demonstrate governance accountability — not just that security policies exist, but that decisions were made by authorised individuals at documented times. Article 21(1) places responsibility on management bodies to approve cybersecurity measures. Article 23 requires specific incident response actions within defined timeframes. Neither article specifies the mechanism for creating that accountability record.

Qualified electronic signatures (QES) and qualified electronic timestamps under eIDAS 2 meet that evidentiary standard. Under EU law, a QES carries the same legal effect as a handwritten signature, with a presumption of authenticity — a challenger must prove the signature is invalid, not the signer prove it is valid. Qualified timestamps establish legally accepted proof of time. Combined, they produce an audit trail that is court-admissible in all 27 member states without jurisdiction-by-jurisdiction validation.

Four NIS2 document types where QES creates measurable compliance value:

• Policy approvals (Article 21(1)) — who authorised the information security policy, on what date, with what organisational authority. A QES-signed policy document answers all three questions in a single file.
• Change management records (Article 21(2)(e)) — system acquisition, development, and change decisions with accountable, non-repudiable signatories. An auditor asking who approved a system change gets a court-admissible answer.
• Supplier security agreements (Article 21(2)(d)) — contractual supply chain security requirements with direct suppliers. A QES-timestamped agreement proves when the contract was executed and by whom, satisfying the supply chain accountability requirement.
• Incident response decisions (Article 23) — who declared an incident, at what documented time, and what response steps were authorised. Timestamps are particularly valuable here given the 24-hour early warning obligation.

NIS2 transposition is now active across the majority of EU member states, with enforcement accelerating as competent authorities move into systematic compliance cycles. One eIDAS-qualified signing tool covers the entire enforcement perimeter — the cross-border validity of QES means you do not need separate signing infrastructure for each jurisdiction where you operate.

ENISA’s Role Across Both Frameworks

ENISA holds an advisory and standards function in both frameworks — not as a coincidence of mandate, but because both frameworks regulate overlapping populations of entities in digital infrastructure.

On the eIDAS side, ENISA advises on security standards and certification requirements for trust service providers. This work feeds into the ETSI standards — including EN 319 401, the baseline policy and security standard for TSPs — that underpin the eIDAS qualification framework.

On the NIS2 side, ENISA published its NIS2 Technical Implementation Guidance on 26 June 2025, implementing the technical requirements of the Commission Implementing Regulation (EU) 2024/2690. That guidance explicitly covers digital infrastructure entities including trust service providers, providing practical evidence examples and control mappings for all ten Article 21(2) measures.

When ENISA’s NIS2 guidance specifies access control or cryptography requirements for digital infrastructure entities, it accounts for the eIDAS technical framework those same entities already operate within. The two bodies of guidance are deliberately consistent — TSPs do not face contradictory requirements from the same agency on the same subject.

Decision Guide: Which Framework Governs What?

For organisations subject to both frameworks, the question that determines compliance programme design is which directive creates the primary obligation and which provides the validation mechanism.

Obligation Type	Primary Framework	Role of the Other Framework
TSP qualification and audit cycle	eIDAS 2 — CAB assessment every 24 months	NIS2 Art. 21 embedded in CAB scope; not a separate audit track
MFA and strong authentication controls	NIS2 Art. 21(2)(j) — defines the obligation	eIDAS 2 Art. 5a / Art. 8 (Reg. 910/2014) — assurance level high can support the technical standard, where appropriate
Incident reporting timelines	NIS2 Art. 23 — 24-hour early warning, 72-hour notification	eIDAS 2 Recital 50 — frames TSP security obligations as complementary
Supervisory authority coordination	eIDAS 2 supervisory body — primary contact for TSPs	NIS2 competent authority — coordination required per eIDAS 2 Art. 51
Compliance documentation trail	eIDAS 2 QES — provides legal basis and cross-border admissibility	NIS2 Art. 21(2)(i) — governance accountability satisfied by QES audit trail
Cryptography standards	NIS2 Art. 21(2)(h) — defines the organisational requirement	eIDAS 2 key management requirements align with this provision for TSPs

For non-TSP organisations, eIDAS 2 functions primarily as a validation layer: eIDAS-qualified services produce the technical evidence base for NIS2 control documentation. For TSPs, NIS2 Article 21 is verified inside the eIDAS qualification cycle, with Recital 50 framing the two regimes as complementary — so a wholly separate compliance track is generally not needed.

Frequently Asked Questions

Are all trust service providers required to comply with NIS2, or only qualified ones?

All trust service providers fall within NIS2 Annex I digital infrastructure scope. Qualified trust service providers face the highest exposure: classified as essential entities regardless of size, they are subject to proactive supervision and the €10 million or 2% of global turnover penalty ceiling. Non-qualified TSPs are still in scope but may fall under different size thresholds depending on whether they exceed the medium-enterprise ceiling.

If we accept EU Digital Identity Wallets for employee authentication, does that automatically satisfy NIS2 Article 21(2)(j)?

Not automatically. The wallet’s assurance level high (eIDAS 2 Article 5a; assurance levels defined in Article 8 of Regulation (EU) No 910/2014) can support a multi-factor or continuous authentication control under Article 21(2)(j). But that measure applies “where appropriate” on a risk basis, so you still need to document the control in your access control policy, specify which systems use wallet authentication, and confirm the assurance level matches the risk profile of each access point. The wallet can provide the technical mechanism; the risk assessment and documentation remain your responsibility.

Is a qualified electronic signature legally valid for NIS2 compliance documentation across all EU member states?

Yes. Under EU law, a QES carries legal equivalence to a handwritten signature in all 27 member states, with a presumption of authenticity. NIS2 enforcement is now active across the majority of EU member states, with competent authorities conducting systematic compliance assessments. A QES-signed policy document is court-admissible evidence across the entire NIS2 enforcement perimeter without re-signing under local formalities.

This article provides general information only and does not constitute legal or regulatory advice. Requirements may vary by jurisdiction and organisation type. Consult a qualified legal professional or compliance specialist for advice specific to your situation.

Sources

1. Regulation (EU) 2024/1183 (eIDAS 2) — EUR-Lex (hyperlinked in article body above)
2. NIS 2 Directive Article 21: Cybersecurity risk-management measures — nis-2-directive.com (hyperlinked in article body above)
3. Questions & Answers on Trust Services under the European Digital Identity Regulation — European Commission
4. NIS2 Essential vs Important Entities Explained — Legiscope
5. NIS2 Technical Implementation Guidance v1.0 — ENISA (26 June 2025)
6. NIS2 Directive Transposition in EU Countries — European Commission