Sole control

Sole control is the eIDAS requirement, under Annex II, that only the signatory can use their private key, even when held by a QTSP for remote signing.

Sole control is the eIDAS requirement - set out in Article 26(c) and Annex II - that the signature creation data (private key) can be used by the signatory alone, protected against use by others. It applies to both advanced and qualified electronic signatures, and even when the key is stored at a QTSP for remote signing. It is what makes a signature personally attributable. Under eIDAS 2.0, the same requirement applies to the qualified signing key held in an EUDI Wallet.

CEN EN 419 241-1 defines two assurance levels: SCAL1 (the service enforces authorisation) and SCAL2 (the signer's strong authentication is cryptographically bound to each key activation, enforced inside the certified environment). Remote QES requires SCAL2.