eIDAS: simple, advanced and qualified signatures

The eIDAS Regulation (EU) No 910/2014 defines three distinct tiers of electronic signature for use across the European Union — simple, advanced, and qualified — and the difference between them isn't about how the signature looks, but about specific technical and procedural requirements that each tier has to meet. Most everyday commercial documents only need a simple or advanced signature; qualified signatures are reserved for a narrower set of formal use cases.

Why eIDAS defines tiers at all

Unlike the US ESIGN Act, which treats electronic signatures as a single category covered by the same baseline rules, eIDAS recognizes that different documents carry different levels of legal risk, and gives each tier a matching level of technical assurance. This lets lower-stakes agreements use a lightweight process, while higher-stakes filings — the kind that would traditionally need a notary or a government-issued ID check — can require a correspondingly stronger signature.

Simple electronic signature

A simple electronic signature is the broadest category: essentially any data in electronic form that's logically associated with other data and used by the signer to sign. In practice, this covers things like clicking "I agree," typing a name into a form, or drawing a signature with a finger or mouse, combined with basic identification such as a unique link sent to the signer's own email address.

What it requires: minimal — identification of the signer and an action showing intent to sign.
Typical use cases: commercial contracts, internal agreements, NDAs, onboarding forms, most day-to-day business documents.

Advanced electronic signature

An advanced electronic signature (AdES) has to meet four specific conditions under eIDAS Article 26: it must be uniquely linked to the signer, capable of identifying the signer, created using data the signer has sole control over, and linked to the signed data in a way that makes any later change detectable. In practice, this usually means the signature is tied to the signer through a more robust identification and authentication process than a simple email link, and the signed document is cryptographically bound to the signature so tampering is detectable.

What it requires: unique link to the signer, sole control over the signature-creation data, tamper-evidence built into the signature itself.
Typical use cases: employment contracts, agreements where stronger evidentiary weight matters, business-to-business contracts with higher value or risk.

Qualified electronic signature

A qualified electronic signature (QES) is the highest tier. It has to meet all the requirements of an advanced signature, plus two additional conditions: it must be created using a qualified signature-creation device (specific hardware or software certified to EU technical standards), and it must be backed by a qualified certificate issued by a qualified trust service provider listed on an EU member state's trusted list. A QES is the only tier that eIDAS explicitly grants the same legal effect as a handwritten signature across all EU member states, without any further proof needed.

What it requires: everything an advanced signature requires, plus a certified signature-creation device and a qualified certificate from an accredited provider.
Typical use cases: notarial acts, filings with public administrations, certain real estate transactions, and other formal procedures that traditionally required an in-person, notarized signature.

Comparing the three tiers

Tier	Signer identification	Tamper detection	Certificate required	Typical use
Simple	Basic (email link, click-to-accept)	Not required	No	Commercial contracts, internal agreements
Advanced	Strong, sole control over signing data	Required, built into the signature	Not required	Employment contracts, higher-value agreements
Qualified	Strong, verified identity	Required	Yes, from an accredited provider	Notarial acts, public administration filings

Which tier do most businesses actually need?

For the large majority of commercial documents — service agreements, confidentiality agreements, vendor contracts, HR onboarding paperwork — a simple or advanced electronic signature is sufficient under eIDAS, and simple signatures are not automatically denied legal effect just for being the lightest tier; eIDAS explicitly states that even a simple signature can't be refused legal validity solely because it's electronic. A qualified signature is typically only required when a specific law, regulation, or counterparty explicitly demands it — most commonly for interactions with government bodies or for transactions that traditionally required a notary.

It's not just about which tier is "stronger"

It's tempting to assume you should always use the highest tier available, but qualified signatures come with real friction: they require the signer to have (or obtain) a qualified certificate, which isn't something most individual customers or employees already have on hand. For documents that don't legally require a qualified signature, insisting on one can slow down or block a signing process that a simple or advanced signature would have handled smoothly. The right tier is the one that matches what the document and the applicable law actually require — not simply the most technically demanding option available.

How this relates to what a signing platform actually does

A signing platform's job is to make the identification, intent, and integrity requirements of whichever tier you need auditable and reliable. Document hashing, a timestamp conforming to RFC 3161, and a chained audit trail of every signing event are the building blocks that support simple and advanced signatures in particular; qualified signatures additionally require integration with an accredited trust service provider for the certificate itself.

See how it works in practice

If most of your documents fall into the simple-to-advanced range — contracts, agreements, onboarding paperwork — see how Esignapi's signing flow works: a secure link per signer, positioned fields, and a completion certificate with a hash-chained audit trail.

Frequently asked questions

Is a qualified electronic signature always required in the EU?

No. Qualified signatures are only required for specific use cases defined by law or by a particular counterparty, such as certain notarial acts or filings with public administrations. Most commercial documents are valid with a simple or advanced signature.

Can a simple electronic signature be challenged more easily than a qualified one?

In principle, a simple signature can be challenged on evidentiary grounds more easily than an advanced or qualified one, since it carries fewer built-in technical safeguards. In practice, a well-documented audit trail — identity, intent, timestamp, and document hash — significantly strengthens a simple signature's evidentiary weight even though it remains technically in the "simple" tier.

Does eIDAS apply outside the European Union?

eIDAS is EU law, so it directly governs transactions within the EU and EEA. Businesses outside the EU dealing with EU counterparties may still need to account for it depending on where the transaction is considered to take place.

Is an advanced electronic signature the same as a digital signature?

They overlap but aren't identical terms. "Digital signature" usually refers to the underlying cryptographic technology (public-key cryptography) that can be used to implement an advanced or qualified signature. See Electronic vs digital signature for the full distinction.

How do I know which tier a specific document needs?

Check whether a specific law or regulatory requirement applies to that document type, or whether the counterparty has explicitly required a particular tier. In the absence of a specific requirement, a simple or advanced signature is generally sufficient for standard commercial use.