The eIDAS Regulation and the Digital Signatures Act for businesses

Key points at a glance: The eIDAS Regulation sets out, across the EU, when an electronic signature is legally equivalent to a handwritten signature. It recognises three levels: simple, advanced and qualified electronic signatures (QES). Under Article 25 of the eIDAS Regulation, all three levels are admissible as evidence in court, but only the QES can replace the legal requirement for written form under Section 126a of the German Civil Code (BGB). For most business processes, the advanced electronic signature (AES) is sufficient.

Regulation (EU) No 910/2014, published in the Official Journal of the European Union in 2014, has been directly applicable in all EU Member States since July 2016. It has replaced both the former German Digital Signatures Act and the underlying EU Digital Signatures Directive 1999/93/EC. It is interesting to note that the three levels of digital signatures known today have essentially existed since the 1990s and have remained largely unchanged since then. The main novelty of eIDAS is that these levels are now binding in all EU Member States, whereas the old Directive left Member States some leeway. In addition, eIDAS introduced new provisions for remotely created signatures, as well as for electronic seals, time stamps and delivery services. In practical terms, this means for businesses that a document bearing a qualified electronic signature in Germany is automatically recognised in France or Spain as well.

A preliminary note on terminology: ‘digital signature’ refers technically to a cryptographic process, whilst ‘electronic signature’ is the legal term as defined by eIDAS. In everyday language, the two terms are often used interchangeably. In this article, we will follow the legal definition of ‘electronic signature’ as set out in eIDAS, whilst pointing out technical differences where appropriate.

A simple electronic signature (EES) comprises any digital mark that can be attributed to a person, such as a scanned signature. It has the lowest level of evidential value and does not require identity verification. It is therefore unsuitable for serious business processes involving disputes over monetary claims.

The advanced electronic signature (AES) uniquely associates the signature with a specific person. It can be generated in various ways: a signotec signature pad records biometric characteristics such as pressure, writing speed, time and acceleration. Alternatively, the unique attribution can also be achieved via authentication using a one-time password (OTP) sent by SMS or through identity verification. In both cases, it is the certificate-based, cryptographic signature of the PDF – not the biometric data itself – that ensures any subsequent changes to the document remain detectable. For the vast majority of business processes without statutory formal requirements, this level of security is legally sufficient.

The qualified electronic signature (QES) is based on a qualified certificate from a trust service provider and requires prior identity verification, for example via video identification. It is the only form of signature for which the law provides for a relaxation of the burden of proof: under Article 25(2) of the eIDAS Regulation, the QES has the same legal effect as a handwritten signature, and, in conjunction with Section 371a of the German Code of Civil Procedure (ZPO), a validly verified QES gives rise to a presumption of authenticity – meaning that, in the event of a dispute, the opposing party must substantiate serious doubts as to its authenticity, rather than the signatory having to prove it. The QES is thus treated as equivalent to a handwritten signature and satisfies the written form requirement under Section 126a of the German Civil Code (BGB).

Most contracts in day-to-day business are not subject to any formal requirements. Contracts for the supply of goods, services and most sales contracts can be concluded in a legally valid manner using a FES. Accordingly, banks frequently use FES for opening bank accounts and credit agreements where no specific formal requirements apply; insurance companies use it for concluding contracts; the healthcare sector uses it for declarations of consent; and human resources departments use it for most employment contracts.

A QES, on the other hand, is mandatory where the law requires the written form and permits electronic form: for example, in the case of consumer loan agreements (Section 492 of the German Civil Code (BGB)) or fixed-term employment contracts under Section 14(4) of the Part-Time and Fixed-Term Employment Act. It should also be noted that: for fixed-term tenancy agreements lasting more than one year, the written form is required under Section 550 of the German Civil Code (BGB), and for certain types of document – such as a guarantee declaration by private individuals under Section 766, second sentence, of the German Civil Code (BGB) – the electronic form is completely excluded by law; in these cases, a handwritten signature on paper remains mandatory; even a QES is not sufficient.

The practical implication is that, before digitising a process, companies should check what level of formalisation the relevant document type actually requires, rather than resorting to the more complex QES out of uncertainty. A legally compliant signature process requires three technical components: reliable biometric or certificate-based capture, a tamper-proof link between the signature and the document content, and a complete audit trail. signoSign/2 meets these requirements for local FES processes; for QES and remote cases, signoSign/Universal is used in conjunction with an external trust service provider.

With the eIDAS 2.0 amendment, which came into force in May 2024, the EU is introducing a state-recognised ‘digital wallet’, the European Digital Identity Wallet (EUDI Wallet). Member States must provide at least one such wallet app by 2026, which will enable citizens to verify their identity and apply qualified electronic signatures across Europe. For businesses with high volumes of qualified electronic signatures (QES), it may be worth taking an early look at this development, as it is likely to simplify identification processes in the medium term.

Is a scanned signature legally valid?

It is regarded as a simple electronic signature with the lowest level of evidential value and is difficult to prove in the event of a dispute.

Does the eIDAS Regulation supersede national law?

No, it supplements it. Formal requirements such as Section 126a of the German Civil Code (BGB) continue to determine which level of signature is required in individual cases.

Can a qualified electronic signature (QES) be created using a signature pad?

Not directly, as this requires a certificate-based procedure. However, the process can be combined by using a trust service provider together with signoSign/Universal.

Is a German electronic signature also valid in other EU countries?

Yes. The mutual recognition of electronic signatures across all EU Member States is the core purpose of the eIDAS Regulation and applies to all three signature levels, not just the QES.

How much does a qualified electronic signature cost?

A QES without identification generally costs one to two euros per signing transaction. On top of this, depending on the provider, there is the cost of the identification procedure, which is often between ten and twenty euros. These costs make the QES uneconomical for many day-to-day business transactions – another reason to use it only where the law requires it.

The eIDAS Regulation provides clarity on when electronic signatures are legally valid, without automatically forcing businesses to adopt the most expensive solution. By selecting the appropriate signature level for each document type, signing processes can be accelerated without compromising legal validity. signotec has been supporting businesses for over 25 years with hardware and software that covers all requirements, from simple to qualified electronic signatures.

Primary sources: Regulation (EU) No 910/2014 (eIDAS Regulation); Directive 1999/93/EC; Section 126a of the German Civil Code (BGB); Section 492 of the German Civil Code (BGB); Section 550 of the German Civil Code (BGB); Section 766, second sentence, of the German Civil Code (BGB); Section 14(4) of the German Part-Time and Fixed-Term Employment Act (TzBfG); Section 371a of the German Code of Civil Procedure (ZPO).