Electronic Signatures Under eIDAS: Simple, Advanced, Qualified, and When Each Is Enough

The three levels under eIDAS

Under Article 3(10) eIDAS, a simple electronic signature is data in electronic form that is attached to or logically associated with other electronic data and that the signatory uses to sign. That covers almost anything: a typed name under an email, a ticked box in a form, an image of your handwritten signature in a PDF.

An advanced electronic signature must meet the four requirements of Article 26. It is uniquely linked to the signatory, capable of identifying them, created using signature creation data that the signatory can, with a high level of confidence, use under their sole control, and linked to the signed data in such a way that any subsequent change is detectable. In practice this means a cryptographic signature with a certificate that identifies you as a person.

A qualified electronic signature is an advanced signature created by a qualified signature creation device and based on a qualified certificate. Qualified trust service providers issue such certificates after verifying your identity, and the key sits on a signature card or in a certified remote signing service.

• Simple: any electronic signature, such as an image or a typed name
• Advanced: cryptographic, identifies the signatory, detects changes
• Qualified: additionally a qualified certificate and a certified creation device

What this means legally

Article 25 eIDAS sets out two principles. First, an electronic signature may not be denied legal effect or admissibility as evidence solely because it is electronic or does not meet the requirements for qualified signatures. Second, only a qualified electronic signature has the equivalent legal effect of a handwritten signature.

In Germany, most contracts require no particular form. A service agreement, an order confirmation or a freelance contract is validly concluded by email or with an inserted signature image. The question is then not validity but proof. If the other party denies signing, a court weighs simple and advanced signatures freely as evidence. A qualified signature, by contrast, benefits under section 371a of the German Code of Civil Procedure (ZPO) from a presumption of authenticity that only facts raising serious doubts can rebut.

Written form, electronic form and text form in Germany

Where German law prescribes written form, the document must be signed by hand (section 126 BGB). Written form can be replaced by electronic form unless the law says otherwise. Under section 126a BGB, electronic form requires the issuer's name and a qualified electronic signature; for contracts, each party signs an identical document. A scanned or pasted signature image does not satisfy written form.

For some declarations, electronic form is expressly excluded. Terminating an employment relationship and signing a termination agreement require written form on paper under section 623 BGB, and so does a guarantee (Bürgschaft) under section 766 BGB. A qualified signature does not help here either.

Text form under section 126b BGB is far less demanding: a legible declaration on a durable medium that names the person making it. An email or a PDF satisfies it, and no signature is needed.

Which signature Toolula produces

Sign PDF produces a simple electronic signature. You draw your signature with a mouse, trackpad or finger and click Use drawing, or choose Upload PNG. Then you tap the page, drag the signature into place and click Sign & download; the signature is flattened into the page. If the PDF contains ZUGFeRD e-invoice data, the embedded XML and the PDF/A format are kept.

Digital Signature produces a cryptographic PAdES signature. You choose a .p12 or .pfx file, enter the certificate password and open it. The private key stays in the browser tab as a non-exportable key. You can place a visible stamp or sign invisibly, and add a handwritten signature, a reason and a location. With the trusted RFC 3161 timestamp switched on, the signing time comes from a time-stamp authority that receives only a 32-byte fingerprint; the signature level is then PAdES B-T, otherwise PAdES B-B. Existing signatures stay valid, because the new one is appended as an incremental update.

With a certificate from a recognised authority that identifies you, the result is an advanced electronic signature. A qualified signature is not possible this way, because it requires a qualified signature creation device, and a .p12 file is not one. A test certificate only proves that the file is unchanged, not who signed it.

Choosing the right level

For quotes, order confirmations and most service contracts, a simple signature is enough. Keep the process traceable, for example by keeping the email that carried the signed PDF. If you want to prove that a document has not been altered since it was signed, an advanced signature with a timestamp is the better choice.

Where the law requires written form and allows electronic form, you need a qualified signature from a trust service provider. The amended eIDAS Regulation also obliges member states to provide European Digital Identity Wallets that let natural persons create qualified signatures by default and free of charge; member states may limit the free use to non-professional purposes. And where electronic form is excluded, only paper and pen will do.

Frequently asked questions