eIDAS Regulation: EU E-Signature Guide

eIDAS (Electronic Identification, Authentication and Trust Services) is a European Union regulation (EU No 910/2014) that took effect on July 1, 2016. It establishes a comprehensive legal framework for electronic signatures, electronic seals, time stamps, electronic documents, electronic delivery services, and website authentication across all EU member states.

eIDAS replaced the earlier EU Electronic Signatures Directive (1999/93/EC) and was designed to solve a critical problem: the original directive was implemented differently by each member state, creating legal uncertainty for cross-border electronic transactions. As an EU Regulation rather than a Directive, eIDAS is directly applicable in all member states without requiring national implementing legislation, creating a single, harmonized framework.

For businesses, eIDAS provides legal certainty that electronic signatures are valid and enforceable across the entire European Union, the European Economic Area (EEA), and -- through post-Brexit legislation -- the United Kingdom. It is the foundation of digital trust in European commerce.

One of the most important aspects of eIDAS is its three-tiered classification of electronic signatures. Each tier provides a different level of legal assurance and technical requirements, allowing businesses to choose the appropriate level based on their specific needs and risk profile.

Unlike the US ESIGN Act, which treats all electronic signatures equally, eIDAS creates a hierarchy: Simple Electronic Signatures (SES) provide basic legal recognition, Advanced Electronic Signatures (AES) add identity verification and tamper detection, and Qualified Electronic Signatures (QES) provide the highest level of assurance and are legally equivalent to handwritten signatures across the entire EU.

A Simple Electronic Signature (SES) is the broadest category under eIDAS. It is defined as "data in electronic form which is attached to or logically associated with other data in electronic form and which is used by the signatory to sign." This definition is intentionally broad and covers virtually any electronic indication of intent to sign.

Examples of SES include typing your name in an email, clicking an "I Accept" button on a website, drawing a signature with your mouse or finger on a touchscreen, and pasting a scanned signature image into a document. SES signatures require no specific technology, identity verification, or security measures.

An Advanced Electronic Signature (AES) must meet four specific requirements defined in eIDAS Article 26. These requirements add identity verification and tamper detection beyond what a Simple Electronic Signature provides.

The four requirements are: (1) the signature is uniquely linked to the signatory, (2) the signature is capable of identifying the signatory, (3) the signature is created using electronic signature creation data that the signatory can, with a high level of confidence, use under their sole control, and (4) the signature is linked to the data signed in such a way that any subsequent change in the data is detectable.

A Qualified Electronic Signature (QES) is the gold standard under eIDAS. It is the only type of electronic signature that is explicitly given the legal equivalent of a handwritten signature across all EU member states, as stated in eIDAS Article 25(2). A QES from one member state must be recognized as a QES in all other member states.

To create a QES, two conditions must be met: the signature must be based on a qualified certificate for electronic signatures issued by a qualified trust service provider (QTSP) listed on the EU Trusted List, and the signature must be created using a qualified electronic signature creation device (QSCD) -- a hardware or software component that meets strict security standards certified under eIDAS.

While both eIDAS and the US ESIGN Act establish the legal validity of electronic signatures, their approaches differ significantly. Understanding these differences is crucial for businesses operating across the Atlantic.

One of eIDAS's most important achievements is establishing mandatory cross-border recognition of electronic signatures within the EU. Under Article 25(3), a Qualified Electronic Signature based on a qualified certificate issued in one member state must be recognized as a QES in all other member states. This eliminates the fragmented recognition that existed under the previous Directive.

For Advanced and Simple Electronic Signatures, cross-border recognition is also supported but with less legal certainty. An AES from one member state is admissible as evidence in another, and courts should give it appropriate weight based on the security measures used. An SES is admissible everywhere but carries the least presumptive weight.

Since January 2021, the United Kingdom has operated under its own version of eIDAS (UK eIDAS), incorporated through the European Union (Withdrawal) Act 2018. UK-issued QES certificates are still recognized within the UK, but their status in the EU is no longer guaranteed. UK businesses doing EU transactions should consider obtaining certificates from EU-based trust service providers to ensure seamless cross-border recognition.

US companies that do business with EU customers, partners, or subsidiaries need to understand how eIDAS affects their electronic signature practices. While there is no single "eIDAS certification" that a US company can obtain, there are practical steps to ensure compliance.

For most B2B transactions with EU counterparties, a Simple Electronic Signature (SES) through a platform like eSignTap is legally sufficient. eIDAS explicitly states that SES cannot be denied legal effect simply because it is electronic, and most EU businesses accept SES for standard contracts and agreements.

If your EU counterparty requires an Advanced Electronic Signature (AES), you will need to use a platform that provides stronger identity verification and tamper detection -- features that eSignTap includes in its standard workflow through email authentication, audit trails, and document integrity hashing.