Article 29a

The management of remote qualified electronic signature creation devices as a qualified service shall be carried out only by a qualified trust service provider that: (a) generates or manages electronic signature creation data on behalf of the signatory; (b) notwithstanding point (1)(d) of Annex II, duplicates the electronic signature creation data for back-up purposes only, provided that the following requirements are met: (i) the security of the duplicated datasets must be at the same level as for the original datasets; (ii) the number of duplicated datasets must not exceed the minimum needed to ensure continuity of the service; (c) complies with any requirements identified in the certification report of the specific remote qualified electronic signature creation device issued pursuant to Article 30.

By 21 May 2025 , the Commission shall, by means of implementing acts, establish a list of reference standards and, where necessary, specifications and procedures for the purposes of paragraph 1 of this Article. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).