(iii)

the following points are inserted: notwithstanding Article 21 of Directive (EU) 2022/2555, have appropriate policies and take corresponding measures to manage legal, business, operational and other direct or indirect risks to the provision of the qualified trust service, including at least measures related to the following: registration and onboarding procedures for a service; procedural or administrative checks; the management and implementation of services; notify the supervisory body, the identifiable affected individuals, other relevant competent bodies where applicable and, at the request of the supervisory body, the public if it is of public interest, of any security breaches or disruptions in the provision of the service or the implementation of the measures referred to in point (fa)(i), (ii) or (iii) that have a significant impact on the trust service provided or on the personal data maintained therein, without undue delay and in any event within 24 hours of the incident;’;

← (e) · All articles · ‘(fa) →

Source: EUR-Lex (Cellar) · retrieved 2026-11-10 · Text as adopted (Official Journal); later amendments are not incorporated in this text.