EU law recognizes three levels of electronic signature: simple (SES), advanced (AdES) and qualified (QES). All three are legally valid, but only a qualified electronic signature automatically has the same legal effect as a handwritten one. For most business contracts a simple or advanced signature does the job; a QES is for when a law, a regulator or the other party insists on it.
What does eIDAS actually say about electronic signatures?
eIDAS, Regulation (EU) No 910/2014, sets one baseline rule and one top-tier rule for electronic signatures across the EU. It has applied since 1 July 2016, and it’s a regulation rather than a directive, so the core rules are the same text in every Member State.
The key provision is Article 25, and it’s short enough to read in full. As adopted in 2014 it said:
- “An electronic signature shall not be denied legal effect and admissibility as evidence in legal proceedings solely on the grounds that it is in an electronic form or that it does not meet the requirements for qualified electronic signatures.”
- “A qualified electronic signature shall have the equivalent legal effect of a handwritten signature.”
- “A qualified electronic signature based on a qualified certificate issued in one Member State shall be recognised as a qualified electronic signature in all other Member States.”
The 2024 amendment deleted paragraph 3; the first two are unchanged in the consolidated text of 18 October 2024. Everything else in the Regulation is detail about what puts a signature on each of the three levels.
What is a simple electronic signature (SES)?
A simple electronic signature is any data in electronic form attached to or logically associated with other electronic data and used by the signatory to sign. That’s the Article 3(10) definition, and it’s very broad. A typed name, a drawn signature on a touchscreen, a scanned signature pasted into a PDF, a click on “I agree”: all electronic signatures.
Small side note: the Regulation never uses the word “simple.” It just says “electronic signature.” SES is industry shorthand for “an electronic signature that doesn’t meet the advanced or qualified requirements.”
The legal protection here is the non-discrimination rule in Article 25(1): a court can’t throw out your signature merely because it’s electronic. That is not the same as a promise that it will win the argument. The recitals to eIDAS say it’s for national law to define the legal effect of electronic signatures, apart from the rule that a QES equals a handwritten signature. So in a dispute, the evidence around a simple signature (who received the link, from which email, when, with what audit trail) does most of the work.
Picture a small design studio in Dublin sending a €3,500 statement of work to a marketing manager in Lyon, who signs by drawing her name in a browser. That’s an SES, and for a routine services contract it’s what most businesses use.
What makes a signature “advanced” (AdES)?
An advanced electronic signature is an electronic signature that meets all four requirements in Article 26:
- “it is uniquely linked to the signatory;”
- “it is capable of identifying the signatory;”
- “it is created using electronic signature creation data that the signatory can, with a high level of confidence, use under his sole control; and”
- “it is linked to the data signed therewith in such a way that any subsequent change in the data is detectable.”
In plain English: the signature has to point to one specific person, it has to let you work out who that person is, the signer has to be able to keep whatever produces it under their sole control “with a high level of confidence,” and the document has to be tamper-evident afterwards.
That last requirement is basically a description of what a cryptographic digital signature does, which is why advanced signatures in practice lean on certificates and keys rather than just a picture of a name. (If the difference between electronic and digital signatures is fuzzy, this explainer sorts it out.) The identity part usually means some verification step before or during signing.
An AdES gets the same protection under Article 25(1) as any electronic signature, and the Regulation gives it no separate legal-effect rule of its own. What you’re really buying with AdES is stronger evidence.
What is a qualified electronic signature (QES)?
A qualified electronic signature is an advanced electronic signature that is created by a qualified electronic signature creation device and based on a qualified certificate for electronic signatures. That’s Article 3(12), and it’s the only level with a built-in legal equivalence: under Article 25(2), a QES has the equivalent legal effect of a handwritten signature.
Two pieces make it “qualified”:
The qualified certificate. It must be issued by a qualified trust service provider and meet the requirements in Annex I of the Regulation. Before issuing one, the provider has to verify the identity of the person it’s issued to (Article 24(1)). Qualified providers appear on the EU Trusted Lists, which you can browse on the Commission’s eIDAS Dashboard.
The creation device. This is the hardware or software that creates the signature, and for a QES it has to meet the requirements in Annex II. People used to picture this as a smart card or USB token. The 2024 amendment made remote signing explicit: a “remote qualified electronic signature creation device” is one “managed by a qualified trust service provider” on behalf of a signatory. So a QES can happen in a browser or on a phone, with the key held by the provider.
The tradeoff is friction. Every signer needs a qualified certificate, which means an identity check with a provider. That’s fine for a property deal or a regulated filing. It’s overkill for getting a freelance illustrator to approve a scope of work.
Which type do you need for which documents?
eIDAS itself doesn’t publish a list saying “use QES for X.” It sets the legal effect of each level and leaves the rest to national law and to whatever the parties agree. Adobe’s summary of EU signature law makes the same point and notes that Member States can carve out areas such as real estate, court-related documents, suretyship and family or succession matters.
A reasonable way to think about it:
- SES for everyday commercial paperwork: quotes, NDAs, sales orders, service agreements, HR acknowledgements.
- AdES when you want stronger proof of who signed and that nothing changed, for example higher-value contracts or where you expect scrutiny.
- QES when a national law requires a handwritten-equivalent signature, a public body demands it, or the other side’s legal team asks for it.
If you’re unsure about a specific document in a specific country, that’s a question for a local lawyer, not a blog post.
What changed with the 2024 amendment (eIDAS 2)?
Regulation (EU) 2024/1183, adopted on 11 April 2024 and in force since 20 May 2024, amended eIDAS to set up the European Digital Identity Framework. People often call it eIDAS 2. The headline change for signatures is the European Digital Identity Wallet.
Under the new Article 5a, each Member State must provide at least one wallet within 24 months of the Commission’s implementing acts coming into force. The European Commission says wallets will be available to every citizen, resident and business by the end of 2026. The wallets are supposed to offer all natural persons the ability to sign with qualified electronic signatures “by default and free of charge,” though Member States may limit the free use to non-professional purposes.
If that rolls out as planned, getting a QES could stop being an exotic, paid, per-person setup and become something a lot of Europeans have on their phones. That would make QES much more practical for consumer-facing agreements. It’s worth watching, but I wouldn’t redesign your contract process around it until wallets are actually in people’s hands in the countries you work with.
Which level does SignWren give?
SignWren gives electronic signatures under Article 3(10), the level people call simple. They are not advanced or qualified electronic signatures. Each finished PDF also gets a digital seal so any later change shows, but that seal is the platform’s own, not the signer’s, and it doesn’t turn a signature into an advanced or qualified one. The certificate of completion says the same thing in the same words.
Does any of this matter if you’re a US business?
It matters if you sign with people in the EU or your contracts are governed by an EU country’s law. In the US, the ESIGN Act and state laws take a more technology-neutral approach and don’t have a formal three-tier system (see are electronic signatures legally binding). A US freelancer invoicing a German client under a contract governed by US law is in a different position from one signing under German law.
SignWren is for everyday signing: people sign on any device and everyone gets back a sealed PDF with an audit trail. That’s the simple electronic signature end of this scale, not a qualified trust service. If that fits what you need, you can start free.
This article is general information, not legal advice. For a specific contract or dispute, talk to a lawyer licensed where you are.