Kommisjonens gjennomføringsforordning (EU) 2025/1568 av 29. juli 2025 om fastsettelse av regler for anvendelse av europaparlaments- og rådsforordning (EU) nr. 910/2014 med hensyn til prosedyreordninger for fagfellevurderinger av elektroniske identifiseringsordninger og for samarbeid om organisering av slike vurderinger innen Samarbeidsgruppen, og om oppheving av Kommisjonens gjennomføringsbeslutning (EU) 2015/296
eIDAS-forordningen: prosedyreordninger for fagfellevurderinger av elektroniske identifiseringsordninger
Kommisjonsforordning publisert i EU-tidende 30.7.2025
Tidligere
- Utkast til forordning lagt fram av Kommisjonen 15.4.2025 med tilbakemeldingsfrist 13.5.2025
Bakgrunn
(fra kommisjonsforordningen)
(1) Regulation (EU) No 910/2014 provides for a peer review mechanism with respect to electronic identification schemes that are to be notified, in which Member States can participate on a voluntary basis. Peer reviews should enable Member States to understand the electronic identification schemes to be notified in accordance with Article 9(1), point (a), of Regulation (EU) No 910/2014 and effectively cooperate with a view to ensuring interoperability of those schemes and building trust across the Union. Peer reviews should be organised in such a way as to ensure equitable distribution of efforts and broad representation of all Member States and should not be understood as audits.
(2) Commission Implementing Decision (EU) 2015/296 (2) established the procedural arrangements for cooperation on electronic identification schemes within the context of the former eIDAS Cooperation Network, including for peer reviews conducted by members of that network. Since the peer review tasks are now to be organised by the European Digital Identity Cooperation Group established pursuant to Commission Decision C(2024)6132 of 5.9.2024 establishing the European Digital Identity Cooperation Group and amending Implementing Decision (EU) 2015/296, following Article 46e(1) of Regulation (EU) No 910/2014 (‘Cooperation Group’), Implementing Decision (EU) 2015/296 should be repealed.
(3) To make peer reviews easily accessible, any Member State should be able to request the initiation of a peer review. The request should indicate the reasons for requesting the peer review and contain sufficient information to corroborate that the peer review may contribute to the interoperability or security of electronic identification schemes to be notified. To this end, creating uniform rules for the minimum required information is necessary to ensure that the peer review can be completed in an efficient and timely manner. The Commission may organise meetings of the Cooperation Group to facilitate the timely initiation and conclusion of a peer review.
(4) Where a Member State provides information to the other Member States on an electronic identification scheme in accordance with Article 7, point (g) of Regulation (EU) No 910/2014 (‘pre-notification’), that action should formally be considered as a request by the notifying Member State to perform a peer review of its electronic identification scheme.
(5) To ensure effective preparation and execution of the peer review, standardised roles and responsibilities in the peer review should be identified. Member States should have the possibility to appoint representatives to fulfil those roles and responsibilities. As it is critical to ensure that all peer reviews run smoothly and are conducted in a streamlined and expeditious manner, the practicalities of each peer review, indicatively its exact scope and timing, should be agreed among the Member States involved in that peer review.
(6) To ensure that all Member States contribute to the implementation of the peer review mechanism, as well as to enable them to benefit from peer learning, representatives of each Member State should contribute to an equitable distribution of efforts among Member States across all peer reviews to be conducted.
(7) To foster a high level of trust in peer reviewed electronic identification schemes, Member States should provide the minimum required information, while ensuring the confidentiality of potentially sensitive information. Such information should be evaluated by three working groups in the peer reviews, each with a mandate corresponding to the central topics for evaluating an electronic identification scheme as set out in Commission Implementing Regulation (EU) 2015/1501 (3) and Commission Implementing Regulation (EU) 2015/1502 (4).
(8) As Implementing Decision (EU) 2015/296 already established English as the language of cooperation, unless otherwise agreed, it is existing practice of Member States to undertake the peer review process in English. Therefore, Member States should provide relevant information for the peer review at least in English. However, translation should not cause unreasonable administrative or financial burdens. In this respect, Member States are free to use automated translation tools, including the ones provided by the Commission.
(9) Taking into account the importance of peer reviews as a tool to ensure the trustworthiness of notified electronic identification schemes, a streamlined process should be established for the adoption of a clear and comprehensive final peer review report. During that process, the Cooperation Group and the Member States participating in the peer review should have the possibility to put additional questions to the Member State whose electronic identification scheme is being peer reviewed, while that Member State should have the opportunity to provide additional observations. To ensure transparency, the process should be completed with the publication of the Cooperation Group’s opinion on the conclusion of the peer review.
(10) Since electronic identification schemes may undergo changes after conclusion of their peer review, it is also necessary to set up a process for initiating an update of prior peer reviews if such changes can impact the interoperability, security or trustworthiness of the notified electronic identification scheme. This would enable the peer reviews to remain relevant over time as electronic identification schemes evolve.
(11) Regulation (EU) 2016/679 of the European Parliament and of the Council (5), and, where relevant, Regulation (EU) 2018/1725 of the European Parliament and of the Council (6), Directive 2002/58/EC of the European Parliament and of the Council (7) apply to the personal data processing activities under this Regulation.
(12) The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 and delivered its opinion on 28 May 2025.
(13) The measures provided for in this Regulation are in accordance with the opinion of the committee established by Article 48 of Regulation (EU) No 910/2014,