eIDAS Electronic Signatures: A Complete Guide to the Three Levels, Legal Effect, and National eIDs

eIDAS stands for electronic IDentification, Authentication and trust Services. Formally it is Regulation (EU) No 910/2014, which is directly applicable across every EU member state. That means the same baseline rules apply whether a contract is signed in Vilnius, Riga, Tallinn, Berlin or Madrid, rather than each country setting its own terms. It replaced an older 1999 directive and gave electronic signatures a single, harmonised legal foundation across the Union.

For anyone signing contracts, the practical payoff is twofold. First, eIDAS establishes that a signature cannot be dismissed simply because it is electronic. Second, it creates a clear hierarchy of three signature levels, each with a defined legal standing, so you can match the strength of the signature to the importance of the document instead of guessing.

eIDAS sits alongside the GDPR in the EU's digital rulebook. One governs how signatures are recognised; the other governs how personal data is handled. A serious contract workflow has to respect both, which is why where your data is stored and how a signature is evidenced are not afterthoughts but part of the same compliance picture.

eIDAS defines three levels of electronic signature, and the difference between them comes down to how strongly the signer's identity is verified and how tightly the signature is bound to the document. The Simple (or standard) Electronic Signature (SES) is the broadest category. It covers any data in electronic form attached to or logically associated with other data and used to sign, from a typed name to a click-to-agree checkbox. It is easy to apply but carries no built-in proof of who actually signed.

The Advanced Electronic Signature (AES) raises the bar. Under Article 26, an AES must meet four requirements: it is uniquely linked to the signatory, it is capable of identifying the signatory, it is created using signature data the signatory can use under their sole control, and it is linked to the signed data so that any later change is detectable. In practice this means an AES ties a verified identity to a specific document and protects that document's integrity, giving it stronger evidential weight than a simple signature.

The Qualified Electronic Signature (QES) is the highest level. A QES is an advanced electronic signature that is additionally created by a qualified electronic signature creation device (QSCD) and based on a qualified certificate issued by a qualified trust service provider. Those two extra ingredients, a vetted device and a vetted certificate, are what move a signature from advanced to qualified, and they are the reason a QES carries the strongest legal effect eIDAS provides.

The legal heart of eIDAS sits in Article 25. Article 25(1) sets the floor for all three levels: an electronic signature shall not be denied legal effect or admissibility as evidence in legal proceedings solely because it is in electronic form, or because it does not meet the requirements for a qualified signature. In other words, even a simple electronic signature cannot be thrown out just for being electronic, though how much weight a court gives it is a separate question.

Article 25(2) is what makes the qualified level special: a qualified electronic signature has the equivalent legal effect of a handwritten signature. This is the only one of the three levels that eIDAS explicitly equates with a wet signature across the EU. Article 25(3) adds cross-border force: a QES based on a qualified certificate issued in one member state must be recognised as a QES in all other member states, which is what makes genuinely pan-European signing workable.

The practical takeaway is that the three levels form a ladder of probative value. SES is admissible but proves little on its own about who signed. AES carries stronger evidence because identity and document integrity are built in. QES is treated as the legal equal of a handwritten signature and is hardest to repudiate. Choosing a level is really a question of how much you may later need to prove, and how high the stakes are if a signature is challenged. Note that some national laws still reserve specific formalities, for example certain real-estate or family-law deeds, so even a QES is broadly but not universally sufficient.

The word that turns an advanced signature into a qualified one is qualified, and it has a precise meaning under eIDAS. A qualified certificate for electronic signatures is a certificate that binds signature-validation data to a person and confirms that person's identity. Crucially, it must be issued by a qualified trust service provider (QTSP), an organisation that has been formally assessed and granted qualified status by a national supervisory body and listed on an official EU Trusted List.

The second ingredient is a qualified electronic signature creation device (QSCD). This is hardware or a certified service that meets strict eIDAS security requirements and ensures the signature creation data stays under the signer's sole control. A signature only reaches the qualified level when both pieces are present together: a qualified certificate from a QTSP and a QSCD. Miss either and the result is an advanced signature, not a qualified one.

This is also where honesty about product claims matters. A platform can be qualified-ready, meaning its architecture is designed so qualified certificates and qualified devices can be plugged in, without itself being a QTSP or issuing qualified certificates. Those are different statements, and the distinction is worth checking before relying on any tool to deliver a true QES.

The signature levels describe legal strength; national electronic identity schemes describe how a real person proves who they are at the moment of signing. In the Baltics, the two most widely used schemes are Smart-ID and Mobile-ID, the rails that roughly three million people across the region already use for banking, public services and signing. They let a signer authenticate with credentials they already trust, rather than creating yet another account.

These schemes connect the abstract eIDAS levels to everyday signing. Smart-ID, for example, is a certified Qualified Signature Creation Device, which means signatures created through it can qualify as a QES and are accepted EU-wide under the mutual-recognition rules in Article 25(3). National eIDs therefore act as the bridge between a verified citizen identity and a signature that holds up legally, including at the qualified level.

DokDesk is designed around these rails. Signers receive a secure, no-account secure link and can sign at the SES, AES or QES level using national eIDs, while every signature is captured in a court-ready evidence base recording who signed, when, how and from where. QES support is architecture-ready, built so that qualified certificates and qualified devices can be plugged in, rather than something we claim is already live. Data stays in the EU under GDPR throughout.