How to Apply for a QSeal: DPP Verification Paths and Material Checklist

The applicant attends in person. This is the route a QTSP will usually propose to a company based outside the Union, because it produces a verifiable record without depending on another country's identity infrastructure.

Remote identification is permitted only where the electronic identification means was issued under a scheme notified under Article 9 and reaches a substantial or high level of assurance under Article 8.

An existing qualified electronic signature or qualified electronic seal certificate can serve as the basis for issuing another qualified certificate.

Member States may accept other identification methods, but the method has to be confirmed by a conformity assessment body. Email addresses and SMS codes fall into none of these four categories.

Because a QTSP generally cannot verify a Chinese company's legal existence directly, it authorises a local registration authority (RA) to carry out verification and forward an encrypted record. Three facts are established: the identity documents are originals, the person presenting them is the person named in them, and the application is made at the applicant's own initiative. The verification record is archived as audit evidence.

Either the legal representative attends in person, or the attending person holds a power of attorney that has been notarised and legalised. The language, the notary and the legalisation route each carry their own requirements, so the document is prepared before the verification appointment rather than at it.

The business licence in original or a stamped copy, plus the original second-generation ID card and passport of the legal representative or authorised agent. The person attends in person; originals are returned after verification and compliant copies are archived.

The business licence translated into English with a sworn translation. China has applied the Hague Apostille Convention since 7 November 2023, so an Apostille covers most cases and consular legalisation is no longer required; where the receiving jurisdiction is not a party to the Convention, the legalisation route is confirmed separately.

English legal name, registered address, official email address and telephone number. This layer is the most underestimated, because the seal certificate has to match the declaration character for character and the Registry reports one error per mismatched field.

A legal person's first choice is the National Trade Register identifier (NTR). Non-EU operators may use a Legal Entity Identifier (LEI, ISO 17442). A VAT number can be supplied as a supplement but is not mandatory. The identifier is capped at 50 characters and must match the corresponding certificate attribute in full, not partially.

The uploaded PDF must contain exactly two signatures: the Commission institutional seal and the organisation's countersignature or counterseal. Adding a third seal removes the declaration's validity, and the original PDF has to be downloaded again.

The organisation name, identifier or country recorded in the seal certificate differs from the value entered on the form. A single submission can return several errors here because every field is checked separately.

A seal that was not issued by a QTSP, or a signing tool without qualified status, is rejected. Holding a qualified certificate is not enough on its own: a software certificate in .p12 or .pfx form only produces an advanced signature. Creation has to go through a QSCD, meaning a smart card or a USB token, or through a QTSP's qualified remote signing service.

The Registry expects PAdES Baseline B, T, LT or LTA. Adobe Acrobat's default signing format has to be changed to CAdES-Equivalent before signing, otherwise the file is rejected.

Only PDF is accepted, up to 1 GB, with a filename of no more than 100 characters. Batch upload is available, but it is not atomic: errors are reported per DPP, including its unique product identifier, and can be exported as CSV.

A baseline signature relies on the certificate being valid at the moment of verification. Once the certificate expires, the signature chain can no longer be completed, which is why the format level is chosen when the seal is issued rather than when the archive is built.

A long-term archival signature embeds the validation chain and appends archive timestamps, so the signature stays verifiable after the original certificate expires. Under eIDAS, qualified electronic timestamps bind a date and time to data using a UTC time source and are signed or sealed by a QTSP (Article 42).

The Batteries Regulation requires manufacturers to keep technical documentation and the EU declaration of conformity available to national authorities for 10 years after the battery is placed on the market (Article 38(4)), and ESPR requires the data in a digital product passport to be accurate, complete and up to date (Article 9(1)). Signature validity has to span that window, not just the signing event.

A successful validation report includes the expiry date of the signature or seal. That date is the renewal trigger, and renewal involves re-verification rather than an automatic extension.

eSign.AI supports the verification stage through registration authority services that coordinate document collection, identity verification appointments and comparison of certificate attributes against the data that will be declared. Issuance itself is performed by the connected QTSP.

Three capabilities run after the seal exists: document signing in PAdES for declarations and document-based approvals; structured data signing in XAdES and JAdES at archival level for the XML and JSON used in DPP content files; and long-term validation support with qualified timestamps and retained evidence. Organisations with low signing volume can raise and confirm documents in the SaaS interface, while system-triggered signing connects through SDK or API and keeps per-record status and evidence.

Winner Medical, a medical device manufacturer whose products reach more than 110 countries with production sites in North America and Southeast Asia, runs domestic operations on e签宝 and its overseas entities on eSign.AI. Board resolutions, corporate announcements and internal letters previously moved as files and offline countersignature rounds, which left confirmation order and progress untracked. The overseas entities now initiate those documents from a SaaS interface, and global participants confirm and sign online with automatic archiving. What transfers to a QSeal application is not the seal itself but the handling of organisation identity and authority: when more than one entity signs for a group and regional authority boundaries differ, the certificate data and the authorisation record have to line up the same way they do for a Registry declaration.