EAA, QEAA, Pub-EAA and PID: the differences
By Stephan Bergmann, hashID. Updated
The difference is who issues an attestation and how much legal weight it carries. An EAA can come from any trust service provider. A QEAA comes only from a qualified trust service provider and has the same legal effect as a paper attestation. A Pub-EAA comes from the public body that holds the official register. PID is the identity data itself.
At a glance
| EAA | QEAA | Pub-EAA | PID | |
|---|---|---|---|---|
| Issued by | A trust service provider, on behalf of the source | A qualified trust service provider (QTSP) | A public sector body responsible for an authentic source, or a provider on its behalf | The member state, or a provider on its behalf |
| Legal effect (Art. 45b) | Cannot be refused only because it is electronic | Same as a lawfully issued paper attestation | Same as paper, recognised in all member states | Identifies the person |
| Typical content | Membership, course certificate, staff role | Attributes that need full legal weight, such as qualifications or mandates | Entries from official registers | Name, date of birth, nationality |
| Definition in eIDAS 2.0 | Art. 3, point 44 | Art. 3, point 45 | Art. 3, point 46 | Art. 3, point 3 |
What a QEAA must contain
Annex V of eIDAS 2.0 lists the requirements. A QEAA must:
- Be marked as qualified, in a form a machine can read
- Name the qualified trust service provider that issued it, and its member state
- Identify the person the attributes refer to
- List the attested attributes
- State its period of validity
- Carry a unique identity code
- Carry the provider's qualified electronic signature or seal
- Say where the certificate behind that signature or seal can be found, free of charge
- Say how to check whether it is still valid
What a qualified provider checks against official registers
At the user's request, a QTSP verifies certain attributes against public authentic sources (Article 45e and Annex VI). The minimum list:
- Address, age, gender, civil status, family composition
- Nationality or citizenship
- Educational qualifications, titles and licences
- Professional qualifications, titles and licences
- Powers and mandates to represent natural or legal persons
- Public permits and licences
- For legal persons: financial and company data
Which one do you need?
- EAA is enough when the checker trusts you as the source: membership of a club, a completed course, access to an event, a role inside your company.
- QEAA is needed when a law or the checker explicitly asks for a qualified attestation, or when the attestation has to stand in for a paper certificate with full legal effect.
- Pub-EAA fits when the fact lives in a public register and the public body behind it issues the attestation.
At EAA Broker
We issue EAA directly. QEAA come through a qualified partner, which we are preparing. If your case needs one, tell us early, and we will also tell you honestly when an EAA is enough. The basics are explained in What is an electronic attestation of attributes?