Last updated: 5 October 2026
Getting a qualified electronic signature takes three things: a provider on the EU Trusted List, a verified identity, and a qualified certificate issued to you personally. For most people it is now done remotely from a phone in minutes, with no smart card, no USB token and no appointment. This guide covers what the regulation actually requires, so you can tell a genuine qualified signature from a product that only calls itself one.
What a Qualified Electronic Signature Actually Is
The eIDAS Regulation defines it precisely in Article 3(12): a qualified electronic signature is "an advanced electronic signature that is created by a qualified electronic signature creation device, and which is based on a qualified certificate for electronic signatures".
That definition is worth unpacking, because getting a QES means obtaining all three parts:
- A qualified certificate. Under Article 3(15) this is a certificate "issued by a qualified trust service provider" meeting the requirements in Annex I. It ties the signature to you as a named person.
- A qualified signature creation device. Article 3(23) requires it to meet Annex II. This is the part people assume means hardware, and it no longer does.
- Identity verification. The provider must establish who you are before issuing anything, to a standard set by law rather than by the provider.
The result carries real legal weight. Article 25(2) states that "a qualified electronic signature shall have the equivalent legal effect of a handwritten signature", and because eIDAS is a regulation rather than a directive, that applies in every Member State.
Step 1: Choose a Provider on the EU Trusted List
Only a Qualified Trust Service Provider can issue a qualified certificate. Every one of them is published on a national trusted list, and Article 22 requires Member States to maintain and publish those lists, in a form "suitable for automated processing".
This gives you a simple test that cuts through marketing. Search the EU Trusted List browser for your provider. If they are not listed, they cannot issue a qualified certificate, and whatever they sell you is an advanced signature at best. There is no partial qualification and no "qualified-equivalent".
A provider in any Member State can issue to you. You are not restricted to one in your own country, and a certificate issued elsewhere in the EU is valid for use across the Union.
Step 2: Prove Your Identity
This is the step that decides how long the whole thing takes, and it is the one most guides get wrong. Article 24(1a) sets out the permitted methods, and there are four. A provider may use one or a combination.
| Method under Article 24(1a) |
What it means in practice |
What you need |
| (a) European Digital Identity Wallet, or a notified electronic identification means at assurance level high |
You identify yourself using a national eID scheme or the EU wallet once it is available in your country |
A notified eID at assurance level high, which not every Member State has |
| (b) An existing qualified certificate |
You already hold a qualified signature or seal and use it to obtain another |
A current qualified certificate |
| (c) Other identification methods confirmed by a conformity assessment body |
Remote identification from a phone: reading the chip in your passport or ID card, a document scan, and a liveness check |
A smartphone and an identity document |
| (d) Physical presence |
You attend in person, or send an authorised representative |
Travel, an appointment, and time |
Route (c) is why remote issuance is possible at all. The regulation does not describe the technology, it sets the bar: the method must identify the person "with a high level of confidence", and that conformity must be "confirmed by a conformity assessment body". A provider using route (c) has been audited against that standard by an independent body, which is a stronger guarantee than a vendor asserting its own accuracy.
Route (a) will broaden as the European Digital Identity Wallet becomes available, though more slowly than the headlines suggest. If your organisation will be obliged to accept wallets rather than simply use one, that obligation and its real timing are set out in what the EUDI Wallet obligation actually requires.
Step 3: Receive Your Certificate and Sign
Once identity is established, the provider issues the qualified certificate to you. It belongs to you as a natural person, not to your employer, and it has a fixed validity period after which it must be renewed.
Signing then requires a qualified signature creation device. Here is where the regulation has moved, and most guidance has not caught up. eIDAS 2.0 added Article 3(23a), defining a "remote qualified electronic signature creation device" as one "managed by a qualified trust service provider". In other words, the device can be operated by your provider and authorised by you from a phone. The hardware is no longer something you hold.
What Getting a QES Does Not Require
Three assumptions cause people to abandon the process or overpay for it. All three were true a decade ago and none are now.
- You do not need to appear in person. Physical presence is route (d) of four, not a requirement. Remote identification under route (c) is expressly provided for.
- You do not need a smart card or USB token. Article 3(23a) recognises remote signature creation devices managed by the provider.
- You do not need a national eID. Route (a) is one option. A provider using route (c) can identify someone who has no eID in their country, which matters for non-residents and for anyone whose national scheme does not reach assurance level high.
That last point is the one that catches people. A signing process built around a single national eID works until the signer is a foreign director or a colleague in another Member State. For what that means when onboarding clients rather than yourself, see what cross-border onboarding actually requires for identity.
How to Check What You Are Actually Buying
Before committing to a provider, four questions settle it:
- Are they listed on the EU Trusted List, and can you find the entry yourself?
- Which route under Article 24(1a) do they use to verify identity, and is it confirmed by a conformity assessment body?
- Is the output a qualified electronic signature, or an advanced one with identity checks bolted on?
- Can they identify people who hold no national eID in the country where they live?
Most signing platforms fail question three. For why that happens so often, see our explainer on what a qualified electronic signature actually is and why your signing platform probably does not provide one. If the signature is for a public tender, the submission rules are covered in how to submit a public tender with a qualified signature.
Getting a Qualified Electronic Signature from ZealiD
ZealiD is a Qualified Trust Service Provider on the EU Trusted List, listed under Sweden and supervised by the Swedish Post and Telecom Authority, with annual conformity assessment against the relevant ETSI standards including ETSI TS 119 461 for identity proofing.
Identity is established remotely under route (c), from a smartphone, without a video call and without hardware. The certificate is issued to you personally and signing is authorised from the app, so the same verified identity can be reused for later signatures rather than repeating the process each time.
References
- Regulation (EU) No 910/2014 (eIDAS), Article 3(12), 3(15), 3(23), 3(23a) (definitions), Article 22 (trusted lists), Article 24(1a) (identity verification methods), Article 25(2) (legal effect). European Union, 2014, as amended by Regulation (EU) 2024/1183. eur-lex.europa.eu
- Regulation (EU) 2024/1183 amending Regulation (EU) No 910/2014 as regards establishing the European Digital Identity Framework. European Union, 2024. eur-lex.europa.eu
- EU Trusted List browser. European Commission. eidas.ec.europa.eu
Learn more:
.svg "ZealiD Logo New (1)"){kind=small}
