TDRA Decision on the approval of QSCD in the context of the UAE Trust Services Framework

TDRA Resolution on the rules and conditions regulating the qualified signature/seal creation devices, their certification and approval, adopted pursuant to Article (21) of Federal Decree-Law No. (46) of 2021 on Electronic Transactions and Trust Services published on September 20, 2021, and pursuant to Articles (26) and (27) of Federal Executive Regulation No. (28) of 2023, is laying down the rules and conditions regulating the qualified signature creation devices and qualified seal creation devices, their certification and approval.

In order for devices to be eligible for use by (Q)TSPs or for provisioning by QTSPs as qualified signature/seal creation devices (QSCDs), the conformity of those devices with the requirements of the Resolution on the rules and conditions regulating the qualified signature/seal creation devices must be certified by TDRA-approved certification bodies, be further approved by TDRA and consequently be included in a register of TDRA-approved QSCDs.

In accordance with the Resolution on the rules and conditions regulating the qualified signature/seal creation devices, Article 7, paragraph 11, and considering the currently limited number of devices available on the market that meet the requirements set of in Article 2 of the Resolution on the rules and conditions regulating the qualified signature/seal creation devices, in particular those requirements applicable to the certification of the conformity of these devices with the Resolution on the rules and conditions regulating the qualified signature/seal creation devices, TDRA has decided to consider:

• as pre-approved UAE QSCDs of Type I, i.e. devices held in an entirely but not necessarily exclusively user-managed environment, conformant to Article 2 of the Resolution on the rules and conditions regulating the qualified signature/seal creation devices: Devices that have been certified in accordance with ISO/IEC 15408, ISO/IEC 18045:2008, and CEN EN 419 211 or CEN EN 419 221-5.

• as pre-approved UAE QSCDs of Type II, i.e. devices where a QTSP manages the electronic signature/electronic seal creation data on behalf of a signatory, conformant to Article 2 of the Resolution on the rules and conditions regulating the qualified signature/seal creation devices: Devices that have been certified on the basis of a certification procedure based on a security evaluation process carried out in accordance with a process using comparable security level to the one(s) that would have been used to certify the device in accordance with ISO/IEC 15408, ISO/IEC 18045:2008, and CEN EN 419 241-2 (i.e. with the HSM being certified in accordance with CEN EN 419 221-5).

As a consequence, qualified signature devices and qualified seal creation devices that have a valid certification in accordance with the above and are listed in the list compiled by the European Commission and made available from https://eidas.ec.europa.eu/efda/browse/notification/qscd-sscd are considered as pre-approved UAE QSCDs and may be notified to the TDRA for their approval and inclusion in the register of approved UAE QSCDs.

Stakeholders, in particular CSPs, TSPs and QTSPs established in the UAE, are invited to inform TDRA about their intention to request a device to be approved by TDRA and included in the register of approved UAE QSCDs, together with:

• The full references unambiguously identifying the device.
• The certificate of conformity and the certification report in line with the above requirements.
• The relevant information regarding the certification body having issued those certificate of conformity and certification report.
• Where applicable, the confirmation of its appearance in the above-mentioned list of the European Commission.
• Their intended use of such device, including whether it is meant to be used by the stakeholder, including as part of the provision of a (qualified) trust service, and/or provided as a qualified trust service.

Requests to be submitted to the email: Trust Services <trust.services@tdra.gov.ae>

TDRA shall review and validate the notified request for QSCD approval within a month from the submission date. In cases where more time is needed for the review, TDRA will inform the applicant of the additional time.

In case of positive validation, TDRA will update the register of approved QSCDs accordingly. TDRA may additionally update the register of approved Certification Bodies in accordance with the Resolution on the rules and conditions regulating the qualified signature/seal creation devices.