Termination plan

The plan a qualified trust service provider must keep for the day it stops: who keeps records and revocation data available, and who is told when.

The plan a QTSP must have ready for the end of its own service. eIDAS requires it in Article 24(2)(i): an up-to-date termination plan to ensure the continuity of service, in accordance with provisions that the supervisory body verifies under Article 46b(4), point (i) - the article that replaced the old supervision provisions when eIDAS was amended in 2024. It is one of the requirements that separates a qualified provider from a well-run one.

It does not stand alone. Article 24(2)(h) requires the provider to record and keep accessible, for as long as necessary after its activities have ceased, all relevant information about the data it issued and received - for evidence in legal proceedings and for continuity of the service. Together those two points answer the question a customer should always ask: if you disappear, what happens to the proof I already have?

So a real plan names things. Who takes over the records and the revocation information, and under what agreement. How long CRL and OCSP responders keep answering, since a certificate chain that cannot be checked breaks every validation below it. How subscribers and relying parties are informed, and when. How the EU Trusted List entry is withdrawn. And who pays for all of it, which is why the plan and the financial resources requirement belong in the same conversation. For a customer with long-lived documents this is also the strongest argument for long-term validation: evidence you keep yourself does not depend on somebody else's survival.