Signature levels: a comparison of simple, advanced and qualified electronic signatures

Key points at a glance: The eIDAS Regulation recognises three levels of signature. The simple electronic signature (EES) has the lowest level of evidential value; the advanced electronic signature (FES) uniquely links the signature to a person; and the qualified electronic signature (QES) is the only level that satisfies the legal requirement for written form. For most business processes, an AES is sufficient. Which level you need depends solely on the type of document in question.

Not every document requires the same level of legal protection. An internal approval entails fewer requirements than a loan agreement: a bank requires a higher level of security for the latter than a public authority does for an internal approval note. The eIDAS Regulation (EU) No 910/2014 reflects this distinction through three tiered levels of signature. The basic idea behind this gradation is not new: the earlier EU Signature Directive 1999/93/EC already recognised these three levels. Since 2016, eIDAS has made them mandatory across the EU and supplemented them with provisions for remote signatures. For businesses, this means they can deliberately choose the level required by law for the transaction in question, rather than automatically opting for the highest and most expensive level.

A brief note on terminology: in technical terms, ‘digital signature’ refers to a cryptographic process, whilst ‘electronic signature’ is the legal term as defined by eIDAS. In everyday language, the two terms are used interchangeably. In this article, we are referring to the electronic signature in the legal sense.

A simple electronic signature comprises any digital mark that can be attributed to a specific person. This includes a scanned handwritten signature, a signature at the bottom of an email, or an image of a signature inserted into a PDF. The EES requires no identity verification and no technical security measures. Its evidential value is correspondingly low: in the event of a dispute, it is not possible to reliably prove who signed the document, nor whether it has been altered subsequently. It is sufficient for informal transactions involving small sums, but is unsuitable for serious contracts.

An advanced electronic signature uniquely links the signature to a specific person. A signotec signature pad records biometric characteristics such as pressure, writing speed, time and acceleration for this purpose. Alternatively, unique attribution can be established via authentication using a one-time SMS password or an ID check. It is not biometrics that ensures subsequent changes to the document remain detectable, but rather the certificate-based, cryptographic signature with which the software seals the PDF. For the vast majority of business processes without a statutory requirement for written form, the FES is legally sufficient. Banks use it, for example, for opening accounts; insurance companies for application forms; and HR departments for most employment contracts.

The qualified electronic signature is the highest level. It is based on a qualified certificate issued by a qualified trust service provider and requires prior identity verification, for example via video identification. Technically, it works in the same certificate-based way as the FES – the difference being that the certificate must be issued by a qualified provider. The QES is the only form of signature for which the law provides for a presumption of validity. This means that, under Article 25(2) of the eIDAS Regulation, the signature is initially deemed genuine in the event of a dispute, so that the opposing party would have to prove otherwise. The QES is therefore equivalent to a handwritten signature and satisfies the written form requirement under Section 126a of the German Civil Code (BGB).

Most contracts in day-to-day business are not subject to any formal requirements and can be concluded in a legally valid manner using an electronic signature (FES). A qualified electronic signature (QES) is only mandatory where the law requires the written form and permits electronic submission. This applies, for example, to consumer loan agreements under Section 492 of the German Civil Code (BGB) and fixed-term tenancy agreements lasting more than one year under Section 550 of the BGB. Certain fixed-term employment contracts under Section 14(4) of the Part-Time and Fixed-Term Employment Act also fall into this category – a situation that regularly affects HR departments, for example. In a few cases, the electronic form is entirely excluded. Under Section 766, second sentence, of the German Civil Code (BGB), a guarantee declaration by a private individual must be signed by hand on paper. Even a qualified electronic signature (QES) is not sufficient in this case.

The practical implication: before digitising a process, check which signature level the relevant document type actually requires. This will help you avoid unnecessary effort caused by the blanket use of QES whilst ensuring legal compliance.

Is a simple electronic signature legally valid at all?
Yes, it is admissible as evidence, but it carries the least weight as evidence. It may suffice for transactions not subject to any formal requirements where the amount in dispute is small.

How do I know which level I need?
The key factor is whether the document type is subject to a statutory requirement for written form. Where there is no such requirement, a simple electronic signature (FES) is usually sufficient; where a written form requirement applies, a qualified electronic signature (QES) is required.

Can a signature pad generate a QES?
Not directly, as this requires a certificate from a qualified trust service provider. The process can be implemented in combination with signoSign/Universal from signotec and a connected provider.

Is the FES less secure than the QES?
Technically, the FES also offers protection against tampering and unambiguous identification of the signatory. The difference is primarily of a legal nature: only the QES replaces the written form and carries the legal presumption of evidence.

Is a German signature also valid in other EU countries?
Yes. The mutual recognition of electronic signatures across all EU Member States is a core objective of the eIDAS Regulation and applies to all three levels.

The three levels of signature provide a logical progression from informal day-to-day transactions to contracts requiring written form. For the majority of business processes, the FES is the appropriate and cost-effective choice, whilst the QES is reserved for specific cases where the law requires the written form. signotec covers all three levels with its hardware and software and helps companies to select the correct level for each type of document.

Primary sources: Regulation (EU) No 910/2014 (eIDAS Regulation); Directive 1999/93/EC; Section 126a of the German Civil Code (BGB); Section 492 of the German Civil Code (BGB); Section 550 of the German Civil Code (BGB); § 766, second sentence, of the German Civil Code (BGB); § 14(4) of the German Part-Time and Fixed-Term Employment Act (TzBfG). Recommended schema: Article Schema + FAQ Schema.