Electronic Seal

An electronic seal is the organisation's counterpart to a personal signature. Article 3(25) of the eIDAS Regulation defines it as data in electronic form, attached to or logically associated with other electronic data, to ensure the origin and integrity of that data. Article 3(24) says the creator of a seal is a legal person.

A seal therefore answers two questions about a document. Which organisation did it come from? Has it changed since? It does not record that a particular individual read or approved the content. The definition of an electronic signature speaks of data used by the signatory to sign. The definition of a seal has no such words.

The usual comparison is with a company stamp. A sealed PDF invoice tells the reader that the named company issued it and that nobody edited it on the way.

The difference is who stands behind it. A signature belongs to a natural person. A seal belongs to a legal person. The regulation builds the two in parallel, and the table shows the four points where they part.

A qualified electronic seal is not the equivalent of a handwritten signature. Where a rule calls for a signature, eIDAS gives a seal no standing as one. A person then signs for the company, under the authority that national law gives them.

There are three, mirroring the levels of signature. The basic electronic seal is the bare definition in Article 3(25). An advanced electronic seal also meets the four requirements of Article 36. It is uniquely linked to the creator of the seal. It is capable of identifying the creator. It is created with data that the creator can, with a high level of confidence, use under its control. It is linked to the sealed data in such a way that any later change is detectable.

A qualified electronic seal is an advanced seal with two additions (Article 3(27)). It is created by a qualified electronic seal creation device. It is based on a qualified certificate for electronic seal, which only a qualified trust service provider can issue (Article 3(30)). Article 38 and Annex III set out what the certificate must contain. The list includes the name of the creator of the seal, its registration number where applicable, and the beginning and end of the certificate's period of validity.

Before issuing the certificate, the provider must verify the identity of the legal person (Article 24(1)). One of the permitted methods is the physical presence of an authorised representative of the legal person (Article 24(1a)). For the device, Article 39 applies the rules on qualified signature creation devices to seals. A qualified provider can also manage the device remotely on the seal creator's behalf (Article 39a).

No electronic seal can be refused as evidence merely because it is electronic or not qualified, and a qualified one carries a presumption. Under Article 35(1), an electronic seal shall not be denied legal effect or admissibility as evidence in legal proceedings solely because it is in electronic form or because it is not qualified. Under Article 35(2), a qualified electronic seal enjoys the presumption of integrity of the data and of correctness of the origin of the data to which it is linked.

A presumption changes who has to do the work in a dispute. The party relying on a qualified seal does not begin by proving that the document is intact and came from the named organisation. With a non-qualified seal, it does.

The effect crosses borders. A qualified electronic seal based on a qualified certificate issued in one member state is recognised as a qualified electronic seal in all the others (Article 24a(1)). For cross-border use of an online public service, a member state may not ask for a seal at a higher security level than the qualified electronic seal (Article 37(3)).

A seal is checked in the same way as a signature. Article 40 applies the validation and preservation rules for qualified electronic signatures to qualified electronic seals. The provider behind the certificate can be looked up in the European Commission's Trusted List browser.

It is used where a document comes from an organisation and no individual needs to sign it. Typical cases are documents issued in volume or by an automated system: invoices, account statements, payslips, certificates, diplomas, extracts from a register, confirmations of receipt. In each case the reader wants to know that the document is authentic and unaltered. Which employee produced it does not matter.

A seal suits automation because it is tied to the organisation, not to one person. Trust service providers can seal their own output in this way. Annexes I and III require every qualified certificate for signatures or seals to carry the advanced electronic signature or advanced electronic seal of the provider that issued it.

A seal is the wrong tool where a rule or a counterparty expects a person to commit, as with a contract or a power of attorney. Whether a seal alone would do is a question for national law, which eIDAS leaves untouched (Article 2(3)).