Blockchain Timestamps vs Qualified Electronic Timestamps - eIDAS

Blockchain Timestamping vs Qualified Electronic Timestamps Under eIDAS

A qualified electronic timestamp is a specific legal category in EU law. It is issued by a supervised trust service provider and carries a statutory presumption that the date, time and data integrity are correct. A blockchain timestamp is a technical record. It can be strong evidence that a file's hash existed by a certain moment, but it is not a qualified timestamp, and EU law does not give it the same automatic presumption.

That does not make blockchain timestamps useless in the EU. Under eIDAS, an electronic timestamp cannot be refused as evidence just because it isn't qualified. The difference is mostly about who has to prove what if the timestamp is challenged.

What eIDAS actually says about timestamps?

eIDAS is Regulation (EU) No 910/2014, amended in 2024 by Regulation (EU) 2024/1183. It sets two tiers for electronic timestamps.

The first tier is any electronic timestamp. It can't be denied legal effect or admissibility in court only because it is electronic or because it isn't qualified. A court can still weigh it however it sees fit.

The second tier is the qualified electronic timestamp. Only the qualified timestamp carries the presumption of accurate date and time and data integrity, so whoever disputes it bears the burden of proving otherwise. A qualified timestamp issued in one Member State must also be recognised in the others.

To qualify, a timestamp has to be issued by a qualified trust service provider (QTSP) that appears on an EU Trusted List for that service. Article 42 also requires that the timestamp bind the time to the data so that undetected changes are not possible, use an accurate time source linked to UTC, and be signed or sealed with an advanced electronic signature or seal of the provider. In practice most are RFC 3161 timestamp tokens, built to ETSI profiles.

The status comes from the provider's audited, supervised standing, not from how strong the cryptography is. A timestamp made with excellent cryptography by a provider that isn't qualified is still not a qualified timestamp.

How a blockchain timestamp works, and where it differs?

The mechanics are simple. A SHA-256 hash of the file is calculated. That hash is written into a blockchain transaction. Once the block is confirmed, anyone can check that the hash was recorded in that block, and the block carries a time. If someone later hashes the same file and gets the same value, the file has not changed since.

With Certelo, the hash is calculated locally on the user's device and the original file isn't uploaded to create the proof. The hash is anchored to the Electra Protocol blockchain, and the record can be checked later using the original file, the hash or the certificate information.

The trust models differ in a way that matters here.

A qualified timestamp asks you to trust an audited organisation. The provider is supervised, its time source and procedures are inspected, and the law attaches a presumption to what it issues. If the provider misbehaved, there would be a regulator and a liability regime.

A blockchain timestamp asks you to trust a public network and open verification. No single company vouches for the time. Anyone can check the record without asking the issuer's permission. That is a real strength, especially for long-term, independent verification. But the law doesn't hand it a presumption automatically.

Two other differences are easy to miss. Block time is not a precise clock reading. The honest way to describe a blockchain timestamp is "existed at or before the time of this block". And a qualified timestamp token depends on certificates that eventually expire, which is why long-term preservation practices such as re-timestamping exist. A blockchain record doesn't have certificate expiry, but it depends on the chain continuing to be available and verifiable.

Does eIDAS recognise blockchain at all?

Yes, since the 2024 amendment, and this is the part most older articles miss.

Regulation 2024/1183 added a new trust service: recording data in a qualified electronic ledger. Ledgers in general can't be denied legal effect or admissibility just because they're electronic or non-qualified. Data records in a qualified electronic ledger enjoy a presumption of unique and accurate sequential chronological ordering and of their integrity.

To be qualified, a ledger has to meet the requirements in Article 45l. It must be created and managed by one or more qualified trust service providers, establish the origin of data records, ensure their unique sequential chronological ordering, and record data so that any later change is immediately detectable. The Commission followed up with Implementing Regulation (EU) 2025/2531 of 16 December 2025, which sets reference standards and specifications for qualified electronic ledgers. That regulation also defines a "qualified distributed electronic ledger".

The key phrase is "created and managed by one or more qualified trust service providers". A public blockchain that anyone can write to is not a qualified electronic ledger just because it is a blockchain. The qualified status attaches to a supervised provider operating a ledger under the specified standards. Certelo anchors to the Electra Protocol blockchain and is not a qualified trust service provider, so its records are not qualified timestamps or qualified ledger records. We say so plainly because it is the single most important limit of this comparison.

A myth worth correcting: privacy and uploads

Blockchain timestamping is often sold on the idea that it avoids uploading your file, with qualified timestamps implied to need the opposite. That is mostly wrong. In the standard RFC 3161 flow, the client sends the provider a hash of the data, not the data itself, and the provider returns a signed token. Qualified timestamping can be just as private at the timestamp step.

Where uploads do happen is in bundled products, such as e-signature platforms or archiving services that process the document itself. So the honest comparison isn't "upload versus no upload". It is "which party do you rely on to vouch for the time, and what presumption does the law attach".

Which one fits which situation?

A qualified timestamp is the better choice when a statutory presumption matters. Examples are contracts and records that may be disputed before EU courts or authorities, regulated sectors with documented evidence requirements, and long-term archives where you want a recognised preservation chain. If an opponent would otherwise argue the date was backdated, the shift in burden of proof is valuable.

A blockchain timestamp is a good fit when you want independent, publicly verifiable evidence without relying on one vendor, for instance creative work in progress, research notes, prior-art style disclosures, internal audit trails, or AI-assisted content you want to fix in time. It is also useful where the cost or friction of a qualified service doesn't make sense for the volume of items.

They aren't mutually exclusive. Because both work on a hash, the same file can be timestamped with a qualified provider and anchored on a blockchain. If the stakes are high, that layering can be reasonable. A court doesn't have to see the blockchain record as a substitute for the qualified one, only as additional corroboration.

What neither one proves?

Neither a qualified timestamp nor a blockchain record proves who wrote a document, who owns it, or that it is original. Both show that a particular digital fingerprint existed at a particular time. Authorship and ownership still depend on other evidence, such as drafts, correspondence, contracts and registrations. Copyright and patent rights are decided under their own legal rules, and a timestamp doesn't register or create them.

Also, a timestamp only covers the exact bytes that were hashed. Change one character, re-export the file or let software rewrite its metadata, and the hash no longer matches. Keep the original file exactly as it was when you timestamped it.

How to verify a blockchain timestamp record?

1- Locate the original file, unchanged, along with the Certelo certificate or the recorded hash.

2- Recalculate the SHA-256 hash of the file locally.

3- Compare it with the hash in the certificate. If it differs, the file is not the one that was recorded.

4- Check that the hash appears in the referenced blockchain transaction and note the block time.

5- Keep the file, certificate and transaction details together, since they are what you would present if the record were questioned.

Let's clarify more

Is a blockchain timestamp legally valid in the EU?

It can't be refused as evidence merely because it is electronic or non-qualified. But it doesn't get the statutory presumption that a qualified timestamp gets, so its weight is for the court to assess.

What makes a timestamp "qualified"?

It has to be issued by a qualified trust service provider on an EU Trusted List and meet the Article 42 requirements: binding to the data, a UTC-linked time source, and a signature or seal by the provider.

Can a public blockchain be a qualified electronic ledger?

Not by itself. Qualified status requires the ledger to be created and managed by one or more qualified trust service providers, following the implementing standards.

Does a qualified timestamp require uploading my file?

Typically no. Standard RFC 3161 requests send a hash. Bundled signing or archiving services may process the document itself.

Does a timestamp prove I created the file?

No. It shows the file's hash existed at that time, not who made it.

Which should I use?

If you need the legal presumption in an EU dispute, use a qualified timestamp. If you need independently verifiable evidence of existence, a blockchain timestamp fits. For high-stakes material, consider both and ask a qualified lawyer in your jurisdiction.

Where this leaves you

The question isn't which technology is stronger. It's what you need the record to do if someone challenges it. Qualified timestamps give you a legal presumption. Blockchain timestamps give you open verification and no dependence on a single issuer. Be clear about which of those you need, and don't expect either to prove authorship.

If open, independently verifiable evidence of existence is what you need, you can create a Certelo record without uploading the original file.

This article is general information, not legal advice. It covers EU law only. Other jurisdictions work differently, and national courts decide how much weight any evidence gets.