eIDAS: electronic identification and trust services

eIDAS is the European Union regulation governing electronic identification and trust services. Formally Regulation (EU) No 910/2014, it has applied since July 2016 and it sets the rules for what counts as a trustworthy electronic signature anywhere in the EU. A 2024 amending regulation — often called eIDAS 2.0 — extended the framework toward a European Digital Identity Wallet.

Unlike the U.S. approach, which is deliberately technology-neutral and sets one general standard, eIDAS defines tiers and attaches a specific legal effect to the top tier.

The three tiers

Simple electronic signature

Any electronic data attached to or logically associated with other electronic data that the signatory uses to sign. This is the broad category — a typed name, a scanned signature, a click. It is the default, and it carries no presumption of legal effect across borders under eIDAS itself; admissibility and evidential weight are matters for national law.

Advanced electronic signature (AES)

An advanced signature must meet four requirements:

It is uniquely linked to the signatory.
It is capable of identifying the signatory.
It is created using data the signatory can use under their sole control.
It is linked to the signed data so that any subsequent change is detectable.

That fourth requirement is the substantive one: an AES must make tampering detectable. This is why advanced signatures are built on cryptographic keys rather than images.

Qualified electronic signature (QES)

A qualified signature is an advanced signature created by a qualified signature creation device and based on a qualified certificate for electronic signatures. The certificate must come from a trust service provider on a national trusted list, and the creation device must meet certification requirements.

The payoff is the legal effect: a qualified electronic signature has equivalent legal effect to a handwritten signature in all member states. That cross-border equivalence is unique to the qualified tier — a simple or advanced signature does not get it automatically.

Choosing a tier

Tier	Assurance	Typical use
Simple	Low — depends entirely on the implementation	Internal approvals, low-risk acknowledgements, consumer click-accept
Advanced	Medium — identifies signer, detects tampering	Commercial contracts where both sides are commercial, standard vendor agreements
Qualified	High — identity proofed at issuance, certified device, trusted list	Regulated filings, high-value transactions, anything requiring handwritten-equivalent effect

Where a U.S. process falls short

A platform built for ESIGN compliance typically offers what eIDAS would classify as a simple or, at best, advanced signature. That is often enough. But if a counterparty, regulator, or internal policy requires a qualified signature, a mainstream e-signature product will not satisfy it unless it specifically offers qualified certificates — which usually means a separate trust service provider.

Two practical checks before you commit:

Is the certificate issued by a provider on a member state's trusted list?
Is the signature creation device qualified, or is it a general-purpose implementation that fails the certification requirement?

The identity layer

eIDAS also governs electronic identification through notified national eID schemes. Under the original regulation, member states were required to recognise notified schemes from other member states for access to public services. The 2024 amendments push this further with the European Digital Identity Wallet framework, which is intended to give individuals a portable, government-backed digital identity usable across the EU.

If you build for European markets, this is the direction of travel: signature assurance and identity assurance converging on a shared, state-backed infrastructure.

Not legal advice. eIDAS compliance depends on the specific service, certificate, and transaction. Trust service requirements are detailed and enforced nationally.