Remote Qualified Signature Creation Device (rQSCD), re-tendering

The Danish Agency for Digital Government (Digitaliseringsstyrelsen) operates on behalf of the Danish State a national qualified trust service for the management of remote qualified electronic signature creation devices under Regulation (EU) No 910/2014 as amended by Regulation (EU) 2024/1183 (eIDAS2). As part of modernising the signing service to meet the requirements of eIDAS2, the Agency is procuring a Remote Qualified Signature Creation Device (rQSCD) — a certified combination of Hardware and Standard Software — to be installed and operated within the Agency's data centers (currently two). The Contract includes an Option to upgrade the throughput capacity of the rQSCD and an Option to extend the deployment to a third data centre. The Contract covers the Initial Delivery of the certified rQSCD, comprising certified HSM devices (Hardware) and the associated Signature Activation Module software (Standard Software), certified as a composite in accordance with eIDAS2. The Initial Delivery includes all Licences, Documentation, and support necessary for the Agency to install and operate the rQSCD as part of its qualified remote signing service. The rQSCD must integrate with the Agency's existing signing infrastructure, including the Agency's certificate authority, authorisation server, and signing components. The Supplier's principal obligations comprise: (a) the Initial Delivery of Hardware and Standard Software, sized and configured for operation across two data centres in an active/active configuration with a minimum throughput of 16 signatures per second, together with deployment in the Agency's production, staging, and test environments; (b) Ongoing Services, including support and maintenance of the Standard Software and Hardware, security patching, and up to two replacements of Hardware during the contract term to maintain valid certifications; and (c) Ordered Services, comprising Time-Based Services (services for installation, configuration, key ceremonies, and similar tasks) and Options and (d) Cross-cutting Services, comprising Documentation and security, provided as an integral part of the Ongoing Services and Ordered Services throughout the term of the Contract. The contract term is 120 months. The service supports the national qualified signing volume — estimated at 5,100,000 signatures per year across two data centres — and the procured capacity is dimensioned to provide headroom above current demand for growth, peak load, and resilience.