Article 42Amendment of Regulation (EU) No 910/2014

Article 42 deletes Article 19 of Regulation (EU) No 910/2014 (eIDAS) with effect from 18 October 2024. That article required qualified and non-qualified trust service providers to take measures to manage security risks to their services, and to notify the supervisory body of a breach of security or loss of integrity with significant impact within 24 hours.

The duty moves rather than disappears. Trust service providers fall within this Directive: Article 21 for security measures and Article 23 for incident reporting, as implemented in national law. Article 23 gives trust service providers 24 hours for the incident notification, against 72 hours for others, although every entity sends its early warning within 24 hours. This article deletes only Article 19 and leaves the rest of eIDAS in place.