Select a Qualified Trust Service Provider (QTSP) from the EU Trust List (accessible via ec.europa.eu/tools/lotl/eu-lotl.xml) — only QTSPs on the Trust List may issue qualified certificates for QES; commercial examples include Atos, Namirial, and others
Complete the QTSP's identity vetting process (face-to-face or video identification as required by eIDAS); the QTSP issues a qualified certificate stored on a Qualified Signature Creation Device (QSCD) on behalf of the signer
Integrate with the QTSP's remote signing API (each QTSP exposes its own API — consult your chosen QTSP's developer documentation); compute a hash of the document to be signed and submit it along with the signature activation data
The QTSP returns a signed hash (the signature value); embed this value into the document using a standards-compliant container format such as PAdES for PDFs, XAdES for XML, or CAdES for arbitrary data
Timestamp the signature using a Qualified Timestamp Authority (also from the EU Trust List) by submitting a timestamp request to the TSA; embed the timestamp token in the signature container to enable long-term validation
Validate the final signed document against the ETSI signature validation standards using a validation service; confirm that the certificate chain traces to a trust anchor on the EU Trust List and that no revocation events have occurred
Known gotchas
A QES is the only electronic signature level that is automatically equivalent to a handwritten signature across all EU member states under eIDAS; AES and SES have lower legal standing and cross-border equivalence is not guaranteed
The eIDAS 2.0 framework (EU Digital Identity Wallet) is being phased in; check whether your jurisdiction has enacted national implementing measures before relying on EUDI Wallet-based credentials
QTSPs charge per-signing or subscription fees; integrate fee tracking and handle API errors that signal signature quota exhaustion separately from general API errors
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp