SES vs AES vs QES: The Practical Difference Between the Three eIDAS Levels (and How to Choose per Document)

The three letters all end in "ES" for Electronic Signature, and the first letter is the level. SES is a Simple Electronic Signature: a click, a typed name, a consent box, a drawn squiggle. Under eIDAS, an electronic signature cannot be denied legal effect or rejected as evidence purely because it is electronic (Article 25(1)). So an SES is genuinely valid — it simply carries the least built-in proof of who signed and whether the document changed afterwards.

AES is an Advanced Electronic Signature. eIDAS Article 26 sets four conditions it must meet: it is uniquely linked to the signer, it can identify the signer, it is created using data the signer keeps under their sole control, and it is linked to the signed data so that any later change is detectable. In plain terms, an AES ties a specific identified person to a specific unaltered document, which gives it noticeably stronger evidential weight than an SES.

QES is a Qualified Electronic Signature — an AES built on top of two qualified ingredients: a qualified certificate issued by a qualified trust service provider (QTSP), and a qualified signature creation device. That extra layer is what earns it the highest legal standing. The plain hierarchy is QES, then AES, then SES, in descending order of how much each one proves on its own.

Think of the three levels as answering two questions with increasing confidence: "Are we sure who signed?" and "Are we sure the document wasn't changed after signing?" An SES answers both weakly — it is fine when you already trust the parties and the stakes are low, but if a dispute ever turned on identity, you would be leaning on surrounding context (emails, an audit trail, IP logs) rather than the signature itself.

An AES answers both questions far better. Because it uniquely identifies the signer and breaks if the document is tampered with, it shifts the practical burden: instead of you proving the signature is genuine, a challenger has to explain how an identity-bound, tamper-evident signature could be wrong. For most commercial contracts where the counterparty's identity matters, that is the level worth reaching for.

A QES goes one step further in law, not just in evidence. Under eIDAS Article 25(2), a Qualified Electronic Signature has the legal effect of a handwritten signature, and a QES valid in one member state must be recognised in all the others. That cross-border, handwritten-equivalent status is the whole point of the top tier — and the reason some documents specifically demand it.

Start from consequence, not convenience. Ask three questions about the document in front of you. First, what happens if the signer later denies signing — is it a minor annoyance or a serious financial and legal problem? Second, does the law or your counterparty *require* a particular level? Third, how much do you trust the other side and how well do you already know their identity? The answers point you to a level.

As a working rule of thumb: use SES for low-risk, internal or routine items — acknowledgements, simple consents, internal sign-offs, NDAs between parties who already know each other. Reach for AES on the bulk of real commercial agreements — supplier contracts, service agreements, partnership terms — where you want the signer's identity firmly bound to an unaltered document. Reserve QES for high-value, regulated or strangers-at-a-distance situations where you need handwritten-equivalent effect and unquestionable cross-border recognition.

One caution that overrides any rule of thumb: some documents and jurisdictions mandate a specific level by law, and certain categories (for example particular real-estate, notarial or employment formalities in some countries) may require QES or are excluded from electronic signing altogether. When a level is legally prescribed, choosing a lower one to save a step is a false economy — and worth checking with a qualified adviser before you sign.

A QES is only as reachable as the trusted identity behind it, which is why the Baltics are unusually well placed. National eID schemes such as Smart-ID and Mobile-ID give millions of people across the region an identity rail strong enough to produce qualified signatures, without each signer needing to buy and manage a separate certificate. Smart-ID is certified as a Qualified Signature Creation Device, so signatures made with it can qualify as QES and are accepted across the EU.

That matters for choosing a level in practice: the cost and friction gap between AES and QES is smaller where these rails exist than where every signer must be onboarded individually. A counterparty who already uses their national eID daily can step up to a qualified signature with a familiar tap-and-PIN flow rather than a procurement project. The level you can realistically ask for depends partly on which identity rails your signers already have.

On DokDesk specifically, we are honest about the line: SES and AES sit within the contract workflow, and the platform is built so qualified rails like Smart-ID, Mobile-ID and national eIDs plug into the QES tier. QES is architecture-ready rather than something we claim is fully live today — and we would rather tell you that than overstate it.

A signature level is a claim about identity and integrity, but a claim is only useful if you can back it up later. The difference between SES, AES and QES shows up most when something is disputed — and at that moment what you have is whatever record you kept at signing time. A higher level bakes more proof into the signature itself; a lower level leans more heavily on the surrounding audit trail.

That is why pairing the right level with a court-ready evidence base is the real goal, not the acronym alone. Capturing who signed, when, which version, by what method, and on which identity rail turns a signature from a button-click into something you can stand behind. Choose the level for the risk of the document — then make sure the record around it is complete enough to make that level count when it has to.

None of this is legal advice, and DokDesk is not a law firm. Treat this guide as a practical map of the eIDAS levels and a starting point for the conversation; for a specific, high-stakes agreement, confirm the required level and formalities with a qualified professional in the relevant country.