QTSPs face end-2026 deadline for biometric attack testing under eIDAS

Qualified trust service providers (QTSPs) doing remote identity verification must complete mandatory biometric testing under ETSI TS 119 461 by the end of 2026 as part of the revised eIDAS framework. The requirements cover presentation attack detection (ISO/IEC 19989-3), biometric data injection attack detection (CEN/TS 18099) and matching performance (ISO/IEC 19795-1).

• Deadline is end-2026 for remote identity proofing under ETSI TS 119 461
• PAD testing follows ISO/IEC 19989-3 in an accredited laboratory
• Injection attacks assessed under CEN/TS 18099, accuracy under ISO/IEC 19795-1
• Extended level maps to eIDAS high and is mandatory for QTSPs