Epoche and Espri, as an eIDAS Regulation (EU) 910/2014 Conformity Assessment Body assessing Trust Service Providers in compliance with ISO/IEC 17065 and ETSI EN 319 403, provides evaluation and compliance certification services, issuing both eIDAS Conformity Certificates and Conformity Assessment Reports.
Granting an eIDAS Conformity Certificate and a Conformity Assessment Report is based on evidence of successful implementation of all applicable requirements, both for the trust service provider and the qualified trust service(s) it intends to provide.
The Conformity Assessment Report must prove the compliance with the requirements of the Regulation, and not necessarily with Standards. Standards are in any case our main tool to verify compliance with the requirements of the eIDAS Regulation (EU) 910/2014.
Conformity Certificates and Conformity Assessment Reports are valid for two years from their issue date. Changes affecting certification may require a new evaluation or a new review, and can lead to a new Certificate decision, confirming or withdrawing certification. Changes in the scope of the certificate follow the same process, upon request from the Trust Service Provider.
Epoche and Espri is a privately-owned Conformity Assessment Body, and charges audit and evaluation fees as required to perform the requested assessment. Fees collected as part of this activity are the only income of financial support to this service.
Trust Service Providers may apply for certification, maintenance or scope change. Certified Trust Service Providers commit to making claims regarding certification consistent with the scope of certification.
E&E may be notified of incorrect references to the certification scheme, or misleading use of licenses, certificates, marks, or any other mechanism for indicating a product is certified, found in documentation or other publicity, by its own means, by User notification, or by any other means, this is considered a reported misuse.
Some forms of misuse, not inclusive, include:
- A certificate of conformity has been expired and was cancelled by E&E.
- Changes were made on the product without prior information to E&E in writing. Supplementary testing or type testing and amendments of certificates can result from these changes.
- The E&E certificate of conformity is placed next to other services (e.g. in brochures) which are not certified.
In the case of E&E being aware of unauthorized / misleading use or misuse of the certificate of conformity, we will:
- Verify the claim, require evidence from the certificate owner, collect samples, to the extend require having a sound analysis of the nature and scope of the misuse;
- If the claim is sustained, inform the Certification Committee of the related misuse, including the evidence and analysis.
Carry out following measures according to the
degree of severity:
- written notice to the holder with request for immediate remedial measures and with caution, that the omission of remedial measures or repeated incorrect / misleading use or misuse of certificate of conformity will result in withdrawal of the certificate or suspension the certificate.
- withdrawal of the certificate.
- disclosure of trespass.
- other legal action where appropriate.
E&E maintains a public list with valid certificates. This list includes a link to a downloadable Conformity Certificates, which provides the identification of the scope of certification and the identification of the relevant trust service policy (or policies) and/or trust service(s) where applicable.
Complaints and appeals may be submitted to Epoche and Espri in written form, to our main address. On receiving any complaint or appeal, we record and track them, and will investigate diligently to determine actions to undertake to resolve them.