Services
We write the rules. We assess compliance.
We assess the conformity of trust service providers under the eIDAS Regulation and ETSI technical standards. Our scope covers qualified trust services and digital identification processes; and, in preparation, the audit of artificial intelligence systems, digital traceability and the cybersecurity of the food chain.
What we do
Five domains where independent verification is critical.
Two established, with a track record; three emerging, in active preparation.
eIDAS and Trust Services
Spain has the highest number of qualified providers in Europe. We have assessed them since 2016, when we were among the first bodies accredited by ENAC for eIDAS. With eIDAS 2.0, our scope extends to the EUDI Wallet.
Digital Identity
Digital onboarding has replaced the counter. We assess identity verification processes, assisted and automated, against ETSI TS 119 461 (whose editorial team we are part of) and SEPBLAC requirements.
AI Audit
The AI Act requires independent conformity assessments for high-risk systems. We are members of the AI Act Advisory Forum, took part in the Spanish AI regulatory sandbox, the first in Europe, and contribute to the ETSI groups defining the technical standards.
Digital traceability
Knowing where a product comes from and how it has been transformed is a growing regulatory obligation. We assess that traceability processes meet the requirements and that their attributes can be made verifiable as electronic attestations.
Food cybersecurity
The food chain is critical infrastructure and the NIS2 Directive expressly includes it. We assess the conformity of food operators and their suppliers with the applicable cybersecurity risk management measures.
Assessment process
Certification is a process. There are no shortcuts.
A conformity assessment has defined phases. We do not advise on how to comply, because our accreditation requires independence, but we can explain what to expect from the process.
01
Application and scope
The provider describes the service it offers and the scheme under which it seeks certification.
02
Document review
We analyse policies, procedures and documentary evidence.
03
Technical assessment
Tests, verifications and analysis of the implementation.
04
Conformity report
We document findings and, where applicable, non-conformities.
05
Decision
The technical management issues its decision.
06
Certificate
If everything is in conformity, we issue the certificate, the CAR or the documentation each scheme requires.
07
Surveillance
Periodic assessments to keep the certification in force.