Which electronic signatures are legally valid in the EU? eIDAS SES, AdES and QES explained

If you work with people in more than one EU country, you will hear very different things about e-signatures. One client is happy with a signing link, another asks whether your signature will "hold up under eIDAS", and a public tender wants a "qualified" signature. It can look like a maze.

It is actually quite orderly. One EU regulation sets up three levels of electronic signature and says what each is worth. Each member state then decides which documents need which level, or still need paper and a notary.

The short answer

• The EU's framework is the eIDAS Regulation, Regulation (EU) No 910/2014, which has applied directly in every member state since 2016. It was substantially amended in 2024 by Regulation (EU) 2024/1183, often called eIDAS 2.
• eIDAS defines three levels: simple electronic signatures (SES), advanced electronic signatures (AdES) and qualified electronic signatures (QES).
• All three are legally valid. A court cannot refuse a signature as evidence just because it is electronic or is not qualified.
• Only a QES is guaranteed the same legal effect as a handwritten signature, and a QES based on a qualified certificate from one member state must be recognised as a QES in all the others.
• eIDAS does not decide which documents need a signature, or what form a contract must take. That is still national law, so a German will, a French property sale or an Italian long lease have their own rules.

The law: three levels of electronic signature

Simple electronic signature (SES)

Article 3 of eIDAS defines an electronic signature very broadly: data in electronic form attached to or logically associated with other electronic data, which the signatory uses to sign. A typed name at the end of an email, a scanned signature image pasted into a PDF, a tick box with "I agree", or a signature drawn with a finger on a tablet all qualify.

There are no technical requirements at this level. What counts in a dispute is evidence: who received the link, who opened it, when, from which device, and whether the document was changed afterwards.

Advanced electronic signature (AdES)

Article 26 sets four requirements for an advanced electronic signature. It must:

1. be uniquely linked to the signatory;
2. be capable of identifying the signatory;
3. be created using signature creation data that the signatory can, with a high level of confidence, use under their sole control; and
4. be linked to the signed data in such a way that any later change to the data is detectable.

In practice this almost always means public-key cryptography: the signer has a private key and a certificate, and the signature embedded in the PDF breaks visibly if anyone edits the file. The law is technology-neutral, though, so a provider can claim AdES status for other methods if it can show the four requirements are met.

Qualified electronic signature (QES)

A QES is an advanced electronic signature that is also:

• based on a qualified certificate for electronic signatures, issued by a qualified trust service provider (QTSP) after checking the person's identity; and
• created by a qualified signature creation device (QSCD): certified hardware that keeps the private key under the signer's control.

The QSCD is the part people often miss. It can be a smart card, a USB token, the chip of a national ID card, or a certified hardware module run by a provider for remote signing, where you authorise each signature with a one-time code or an app. What it cannot be is an ordinary file on your computer. A private key you can export as a .pfx or .p12 file is, by definition, not held in a QSCD, so a signature made with it can be an advanced signature, even one based on a qualified certificate, but not a QES.

Article 25: what each level is worth

Article 25 is the heart of eIDAS:

• Non-discrimination. An electronic signature shall not be denied legal effect and admissibility as evidence in legal proceedings solely because it is electronic or does not meet the requirements for a QES. A simple signature can win a case; it just has to be proved.
• Handwritten equivalence. A QES has the equivalent legal effect of a handwritten signature.
• Cross-border recognition. A QES based on a qualified certificate issued in one member state is recognised as a QES in all other member states.

What Article 25 does not do is fix the evidential weight of SES and AdES. That is left to national procedure law, which is why the same simple signature may be treated slightly differently in a German, Spanish or Italian court. Several countries also give a QES an extra procedural presumption (for example, that it really is the signer's and that the document is intact) so the person denying it carries the burden of proof.

eIDAS also says plainly that it does not affect national or EU law on the conclusion and validity of contracts or other legal or procedural obligations relating to form. When a country requires a notarial deed or a handwritten will, eIDAS leaves that rule untouched.

Qualified timestamps, seals and trusted lists

Signatures are only one of the trust services eIDAS regulates:

• Electronic seals are the equivalent of a signature for a legal person (a company or public body). A qualified electronic seal enjoys a presumption of the integrity of the data and the correctness of its origin.
• Electronic timestamps prove that data existed at a certain time. A qualified timestamp enjoys a presumption of the accuracy of the date and time it shows and of the integrity of the data.
• Trusted lists. Each member state's supervisory body publishes a trusted list of the QTSPs it supervises and the qualified services they provide, and the European Commission publishes the list of those lists. If you want to know whether a certificate is "qualified", this is where signature software looks.

The 2024 amendment added new qualified services, including electronic attestations of attributes, qualified electronic archiving and qualified electronic ledgers, and it brought the management of remote QSCDs expressly within the qualified trust services regime.

eIDAS 2 and the EU Digital Identity Wallet

Regulation (EU) 2024/1183 entered into force on 20 May 2024. Its best-known part is the European Digital Identity Wallet: an app, issued or recognised by each member state, that holds your verified identity data and other attestations (a driving licence, a diploma) and lets you prove who you are online.

For signatures, the key rule is that the wallet must let every natural person create qualified electronic signatures free of charge by default. Member states may limit free use to non-professional purposes.

Be clear about the status, though:

• The Commission adopted the first technical implementing acts in November 2024, and they entered into force on 24 December 2024. Article 5a gives each member state 24 months from that entry into force to provide at least one wallet, which puts the deadline at 24 December 2026.
• Rollout is uneven. Some countries run pilots and public wallets; others are still building. Whether you can already sign with a wallet depends on your country.
• The core signature rules: the three levels, Article 25, qualified certificates and QSCDs. Were not replaced. eIDAS 2 amended the 2014 Regulation rather than repealing it.

Documents you cannot sign electronically (or need a special signature)

Because form rules are national, there is no single EU list. But the same families of documents come up almost everywhere:

Our country guides go through the exact rules: Germany, France, Spain, Italy and, outside the EU, the United Kingdom.

Which level do you need?

• Everyday business: sales contracts, supplier terms, NDAs, freelance agreements, most employment offers and many leases. An SES with a good audit trail is legally valid and, for most people, enough.
• Higher-risk or regulated deals, or a counterparty who insists: an AdES, which ties the signature to a verified person and makes tampering detectable.
• A statutory "written form" requirement, a public tender, some banking and HR documents in certain countries, cross-border documents where you want handwritten equivalence everywhere: a QES.
• Wills, property deeds, notarial acts: follow the national procedure. No e-signature tool replaces the notary.

How to get a qualified certificate

A QES needs a qualified certificate from a QTSP on your country's trusted list. Typical routes are:

• a national ID or services card with signing certificates on its chip (available in some states, such as Spain's DNIe or Italy's CNS);
• a smart card or USB token bought from a QTSP after identity checks;
• a remote signing account with a QTSP, where you are identified by video or with your national eID, and your key sits in the provider's certified hardware; and, increasingly,
• the EU Digital Identity Wallet, once your country's wallet supports signing.

Some QTSPs also issue qualified certificates as software files. Signatures made with those are advanced signatures based on a qualified certificate, not QES, because the key is not in a QSCD. Spain's widely used FNMT citizen certificate is the best-known example; see our Spain guide.

How to sign with KovaPDF

KovaPDF does not issue certificates and is not a qualified trust service provider. Here is what each tool gives you in eIDAS terms:

• [Request Signatures](/request-signatures): send a PDF to one or many signers, in order or all at once. Each signer gets a private email link and signs in the browser without an account; you can add an access code per signer. When everyone has signed, all parties receive the signed PDF with a certificate of completion (document fingerprint, names, emails, open and sign times, IP address and browser), and the file is sealed with a trusted timestamp from an independent authority, so any later change shows up in a signature checker. In eIDAS terms these are simple electronic signatures with strong evidence: valid under Article 25, but not AdES or QES.
• [Sign PDF](/sign-pdf): draw, type or upload your signature and place it on a page. A simple electronic signature, fine for everyday forms. It cannot prove on its own that the file was not changed later.
• [Digital Signature](/digital-signature-pdf): sign with your own certificate as a .pfx or .p12 file. You get a cryptographic PAdES signature (the European standard for signatures in PDFs), a trusted timestamp by default, and long-term validation data when your certificate's issuer publishes revocation information. With a qualified certificate held as a file, the result is normally an advanced signature based on a qualified certificate. It is not a QES, because a QES key must stay in a QSCD (a smart card, token or remote signing service) and those keys cannot be uploaded to any website, KovaPDF included. For a QES, use your provider's own app or card software.
• [Verify PDF Signature](/verify-pdf-signature): check the signatures on a PDF you received: whether the file changed since signing, who signed, the certificate chain, revocation and timestamp. Trust status is reported separately, so you can see whether a certificate chains to a provider you recognise.

For background on how PDF signatures work, read what a digital signature in a PDF is and what a digital certificate is.