How to Sign a Document Electronically with a National eID (Smart-ID, Mobile-ID): A Baltic Step-by-Step Guide

Every electronic signature in the EU falls under eIDAS (Regulation (EU) No 910/2014), which defines three levels. A simple electronic signature (SES) is any electronic mark of agreement — a typed name, a click, a drawn squiggle. An advanced electronic signature (AES) must meet the four Article 26 requirements: it is uniquely linked to the signatory, capable of identifying the signatory, created using data the signatory can use under their sole control, and linked to the signed content so any later change is detectable. A qualified electronic signature (QES) is an AES based on a qualified certificate and a qualified signature-creation device, and under Article 25 it carries the legal effect of a handwritten signature across the entire EU.

Choose the level by asking one question: what happens if this signature is later challenged? Low-risk, high-volume documents — internal acknowledgements, routine consents — are usually fine at SES. Real business contracts deserve AES as the baseline, because the value of a contract is being able to prove who signed and that nothing changed afterwards, and an AES backed by a national eID delivers exactly that identity binding and tamper-evidence. Reserve QES for documents where national law specifically demands the handwritten equivalent, or where the stakes justify the strongest possible footing. For a fuller decision framework, see our guide on SES, AES or QES — which signature do you need.

One caution before you standardise: form requirements are national. eIDAS makes signatures valid EU-wide, but individual member states still decide which document types need written form, a qualified signature, or a notary. In the Baltics, most commercial paperwork signs comfortably at AES with a national eID, but property, inheritance, and certain corporate acts commonly sit outside ordinary e-signing. This is general information, not legal advice — for a specific document type, confirm the required level with a qualified lawyer in the governing jurisdiction.

The Baltic eID landscape gives you several ways to sign. Smart-ID is an app on your phone, used across Estonia, Latvia, and Lithuania. Mobile-ID stores your certificates on a special SIM card and is common in Estonia and Lithuania, where it is often called the mobile signature. National ID cards sign through a card reader and desktop software, and Latvia additionally offers the eParaksts mobile app. Any of these can produce a strong signature; the practical differences are convenience and — crucially — the level of the account or certificate behind them, because that level caps what your signature can legally be.

Not every eID account is equal. Smart-ID comes in two levels: a qualified Smart-ID account, registered against an identity document after a biometric or in-person identity check, and Smart-ID Basic, typically registered through an internet bank without that verification step. Only the qualified account can create qualified-level signatures; a Basic account cannot, no matter what the document needs. If you plan to sign contracts, open the app settings and check which account you actually hold before a signing deadline arrives — upgrading takes minutes, but it requires your identity document.

Mobile-ID certificates are issued through your mobile operator together with the special SIM, and national ID-card certificates come with the card itself. In both cases, keep your PIN codes private and remember which is which: PIN1 authenticates you, PIN2 signs. Entering PIN2 is the legally meaningful act, so guard it like your signature — because that is what it is. For a closer look at how these two methods work under the hood, see Smart-ID and Mobile-ID: signing with a national eID.

A modern signing flow starts with a secure link. In DokDesk's signing flow, the counterparty receives a link by email and needs no account to participate — the link opens the document in the browser, on desktop or phone. Before anything else, read the final text. The version behind the link is the single live, authoritative one, so what you see is exactly what you sign. If something is wrong, this is the moment to say so: after signing, changes mean a new signing round, not a quiet edit.

Next comes authentication — proving who you are. You choose your method (Smart-ID or Mobile-ID), enter your personal code, and a control code appears on the screen: a short number that must match the code shown in your app or on your phone. Check that the two match before entering anything — this simple habit defeats a whole class of session-substitution fraud. Then confirm with PIN1. From this point the platform knows, with eID-grade assurance, that the person at the keyboard is really you, and that assurance is recorded as part of the evidence.

Then the signature itself. The platform presents the signing request; your app or phone shows a fresh control code; you verify the match and enter PIN2. Technically, your device signs a digest of the document with a private key — you are not drawing anything, you are applying a key that only you control. When every party has done the same, the platform assembles the signed container, closes the round, and each side receives the completed document together with its evidence. The whole flow typically takes a few minutes per signer.

A real eID signature does not produce "a PDF with a picture on it." It produces a signature container — in the Baltics typically an ASiC-E file such as .asice, alongside national formats like .adoc in Lithuania and .edoc in Latvia, or a PAdES-signed PDF. Inside sit the original document, your certificate (which identifies you), the cryptographic signature bound to the document's content, a timestamp, and validation data. Any later change to the document breaks the signature mathematically — that is what tamper-evidence means in practice. Free national validation tools can verify these files independently of whoever created them, which is exactly what you want from a format meant to outlive the deal.

Around the container, a good workflow adds a second layer: the evidence base. DokDesk records who was invited, who opened and viewed the document, which identity method each signer used, and the precise timestamp of every step — a coherent, court-ready evidence trail that answers the questions a dispute would actually ask, with the data kept in the EU under GDPR. Two habits protect this value: keep the original container, not just a printout or a flattened copy, and store it somewhere durable. The container is the legally meaningful artefact; everything else is a picture of it.

The most common misconception is that a drawn or scanned signature image is "an electronic signature" in the strong sense. Legally it usually qualifies as an SES — admissible, but proving almost nothing by itself. An image can be copied from any document onto any other, it identifies nobody cryptographically, and it says nothing about whether the text changed after signing. If the agreement matters, sign it with an eID: the difference in evidential weight between a pasted image and an AES backed by Smart-ID or Mobile-ID is the difference between an assertion and proof.

Printing and scanning is the second classic mistake. The moment a digitally signed document is printed, the signature is gone — paper cannot carry the cryptography, and a scan of that paper is just an image again. The same applies to "flattened" PDFs exported for convenience. Circulate and archive the original signed container, and let anyone who needs certainty verify the file itself rather than trust a printout.

Finally, version confusion. When drafts fly around as email attachments, it is dangerously easy to sign the wrong one — and a perfect signature on the wrong text is still the wrong contract. Working from reusable templates and negotiating on one live version removes the ambiguity: the text behind the secure link is the text everyone signs. Add basic PIN hygiene — never share PIN2, and never enter it when the control codes do not match — and your signatures will be as strong as the technology allows.