Qstamp / European Union
Regulatory alignment · European Union

European Union obligations for AI, trust services, cybersecurity and data.

The European Union has set binding duties for logging by high risk AI systems, recognised electronic ledgers and time stamps in law, required cryptographic controls for essential entities and the financial sector, and published a coordinated roadmap for post quantum migration. This page maps each to the mechanisms of the Qstamp family.

Artificial intelligence

The AI Act, Regulation (EU) 2024/1689.

InstrumentRequirementHow the Qstamp family supports itDates
Article 12Automatic recording of events over the lifetime of high risk AI systemsAgent and model events sealed as they occur and anchored in batchesHigh risk duties from 2 December 2027 and 2 August 2028
Articles 18, 19 and 26Retention of documentation for ten years and of automatically generated logs for at least six months by providers and deployersReceipts that remain verifiable for the full retention periodAs above
Article 50Marking of AI generated content in a machine readable formatQTrace provenance bound to content and anchoredContent marking from 2 December 2026
Trust services

eIDAS and eIDAS 2.

InstrumentRequirementHow the Qstamp family supports itDates
Regulation (EU) No 910/2014, Articles 41 and 42Legal effect of electronic time stamps and requirements for qualified time stampsTime evidence from a post quantum network, which is not a qualified serviceIn force
Regulation (EU) 2024/1183, Articles 45h and 45iLegal effect of electronic ledgers and requirements for qualified electronic ledgersAn electronic ledger with ordered, unique and immutable recordsIn force since 20 May 2024
Cybersecurity

Network, product and financial sector resilience.

InstrumentRequirementHow the Qstamp family supports itDates
NIS2, Directive (EU) 2022/2555, Article 21Risk management measures including policies on cryptography and supply chain securityNIST standardised post quantum cryptography and signed software fingerprintsTransposition due 17 October 2024
DORA, Regulation (EU) 2022/2554ICT risk management including integrity of data and cryptographic controls in the financial sectorIntegrity evidence for ICT logs and financial recordsApplies since 17 January 2025
Cyber Resilience Act, Regulation (EU) 2024/2847Essential requirements for products with digital elements, including integrity protectionSigned and anchored fingerprints of software releasesReporting from 11 September 2026, main duties from 11 December 2027
NIS Cooperation Group post quantum roadmapCoordinated migration of public key cryptographyNo classical public key algorithm to migrateHigh risk systems by the end of 2030, medium risk by the end of 2035
Data and public sector

Data protection, procurement and taxation.

InstrumentRequirementHow the Qstamp family supports itDates
GDPR, Articles 5, 25 and 32Data minimisation, data protection by design and security of processingRecords stay with their owner, and only salted commitments are publishedIn force
Directive 2014/24/EU, Article 22(3)Integrity of data and confidentiality of tenders until the time limit expiresQProcure bid commitmentsIn force
VAT in the Digital Age packageMandatory electronic invoicing and digital reporting for intra Union suppliesQTax invoice and claim recordsElectronic invoicing from 1 July 2030
Scope

How to read this page.

Dates and requirements reflect the published position as of October 2026. Qstamp supplies technical evidence of integrity, authorship and time that supports these duties. It does not by itself make any organisation compliant, and each organisation remains responsible for its own obligations.