eIDAS Regulation eIDAS

It covers two subjects: how people prove who they are online across borders, and the services that make electronic documents trustworthy. Article 1 sets out both.

The first is electronic identification. Member states can notify their national electronic identity schemes to the European Commission. Where a public body in one member state requires electronic identification for an online service, it must then accept notified means from other member states at assurance level substantial or high (Article 6).

The second is trust services: electronic signatures, seals, time stamps and the other services in the table below. The regulation says what each one is, who may provide it and what legal effect it has. It applies to trust service providers established in the EU, and not to services used only inside a closed system (Article 2).

Most of the duties fall on providers and on member states. A firm that signs documents with clients meets the regulation as a user. It relies on the legal effects the regulation gives.

It recognises signatures, seals, time stamps, registered delivery, attestations of attributes, archiving and ledgers, along with certificates for website authentication. Each exists in an ordinary and a qualified form. The table shows what the qualified form adds in law.

Only a qualified trust service provider can supply the qualified form. The ordinary form still counts as evidence. A court cannot reject it solely because it is electronic or not qualified (Article 25(1) says so for signatures, and the other services have matching rules).

It defines three levels and gives the highest one the standing of a handwritten signature. An electronic signature is any electronic data that a person uses to sign. An advanced electronic signature is uniquely linked to the signer, can identify them, is created under their sole control, and shows any later change to the document. A qualified electronic signature is an advanced signature created with a qualified signature creation device and based on a qualified certificate (Articles 3 and 26).

Under Article 25(2), a qualified electronic signature has the equivalent legal effect of a handwritten signature. One based on a qualified certificate issued in any member state is recognised as qualified in all the others (Article 24a).

Regulation (EU) 2024/1183, often called eIDAS 2.0, amended the original text in three main ways. It has been in force since 20 May 2024.

It created the European Digital Identity Wallet. Each member state must provide at least one wallet within 24 months of the implementing acts that set its technical rules (Article 5a). The wallet is free for individuals and voluntary to use. It must let them sign with a qualified electronic signature free of charge, although member states may limit that to non-professional use. Private businesses that are required to use strong user authentication, other than micro and small enterprises, will have to accept the wallet when the user asks (Article 5f).

It added trust services. Electronic archiving, electronic attestations of attributes, electronic ledgers and the management of remote signature creation devices now sit beside the original list (Article 3(16)).

It tightened the rules for qualified providers. Their audits now also cover the cybersecurity requirements of the NIS2 Directive (Article 20(1)). The methods for verifying a person's identity before issuing a qualified certificate are set out more precisely (Article 24(1a)). Providers that were already qualified had until 21 May 2026 to show they meet them (Article 51(4)).