Non-Repudiation

Non-repudiation is the quality of a signature that leaves the signer no believable way to disown it. To repudiate is to deny. A signer repudiates a signature by saying "I did not sign this", "somebody else used my account" or "the document I signed said something different".

The word comes from information security, where it stands beside confidentiality, integrity and availability as a property a system can be built to deliver. It also appears inside certificates. The technical standard for certificates has a usage flag called non-repudiation, in later editions also named content commitment, which marks a key as meant for signing documents and not for logging in.

It is not a legal term in the EU's signature rules. The articles of the eIDAS Regulation never use the word. The regulation reaches a similar result by other means: requirements that a signature must meet, legal effects for each level, and liability for the providers behind them.

Non-repudiation is never absolute. No technology stops a person from denying a signature. What changes is how much evidence stands against the denial.

Four pieces of evidence give a signature non-repudiation, and each one answers a different denial. The table sets them side by side.

The first three match the requirements for an advanced electronic signature in Article 26 of eIDAS. The signature must be uniquely linked to the signatory and capable of identifying them. It must be created using data that the signatory can, with a high level of confidence, use under their sole control. It must be linked to the signed data in such a way that any subsequent change is detectable.

Time is not in that list. It comes from an electronic time stamp, which Article 3(33) defines as data that binds other data to a particular time, establishing evidence that the data existed at that time. A certificate that is revoked loses its validity from the moment of revocation (Article 28(4)), so whether a signature counts can turn on which side of that moment it falls.

The four stand or fall together. A signature that proves integrity without identity shows only that somebody signed an unchanged document. A verified identity with weak control over the key leaves room to say that another person used it. The weakest of the four sets the strength of the whole.

The three levels differ in how much of the evidence is built into the signature and how much has to be gathered around it. Article 25(1) of eIDAS says that no electronic signature may be denied legal effect or admissibility as evidence solely because it is electronic or not qualified. Admissible is not the same as convincing.

A simple electronic signature is any data in electronic form that the signatory uses to sign (Article 3(10)). A typed name or a ticked box counts. None of the four pieces of evidence is part of the signature. If the signer denies it, the other party has to assemble the proof from outside: the email address the request went to, the platform's log, the messages around it.

An advanced electronic signature must meet the Article 26 requirements, so identity, sole control and integrity are claimed by design. The regulation does not say how the signer's identity is to be checked for this level, and no authority confirms in advance that a given product meets the requirements. In a dispute, the party relying on the signature may have to show how the identity was established and how the key was protected.

A qualified electronic signature adds three things. The certificate is issued by a qualified trust service provider, which must verify the person's identity first (Article 24(1)) by one of the methods the regulation lists. The key sits in a qualified signature creation device, which under Annex II must ensure that the signing data can be reliably protected by the legitimate signatory against use by others. The provider is audited by a conformity assessment body at least every 24 months (Article 20(1)) and must keep records of the data it issued and received for use as evidence in legal proceedings (Article 24(2)(h)). The relying party can point to a named certificate and a supervised provider.

eIDAS does not say who bears the burden of proof when a signature is repudiated. That is left to national law. For signatures the regulation sets a legal effect, not a rule of evidence: under Article 25(2), a qualified electronic signature has the equivalent legal effect of a handwritten signature. What a court does when a handwritten signature is disputed, and so what it does with a qualified electronic one, is a question for the procedural law of the country where the case is heard.

The wording is worth comparing with other trust services. A qualified electronic seal enjoys a presumption of the integrity of the data and of the correctness of its origin (Article 35(2)). A qualified electronic time stamp enjoys a presumption of the accuracy of its date and time (Article 41(2)). Article 25 does not use the word presumption for signatures.

Three questions are therefore worth putting to a litigator in the relevant jurisdiction before a dispute arises. Who has to prove that a contested signature is genuine? Does the answer change with the level of the signature? What kind of evidence do the courts accept on the point? Article 2(3) confirms that the regulation does not affect national law on the conclusion and validity of contracts or on procedural obligations relating to form.

What a firm controls is the evidence it will be able to produce. Suppose a client denies having signed a fee agreement two years after the event. With a simple signature, the firm brings platform logs and emails. With a qualified one, it brings the signed file, a validation report and a certificate issued in the client's name by a supervised provider. The legal test may be the same. The material put before the court is very different.

Article 13 covers the case in which repudiation is justified, for example where a certificate was issued to an impostor and the person named truthfully denies the signature. Under Article 13(1) of eIDAS, a trust service provider is liable for damage caused intentionally or negligently through a failure to comply with its obligations under the regulation. For a qualified provider, the intention or negligence is presumed unless the provider proves otherwise. The presumption goes no further. The party claiming must still show the failure to comply, the damage and the link between them, and Article 13(3) applies national rules on liability to the claim. This liability is one of the duties that come with being a qualified trust service provider.

No. A qualified electronic signature narrows the grounds for repudiation without removing them. A signer can still argue that the identity check was deceived, or that somebody else obtained the phone together with the PIN. Both arguments are harder to make than "that is not my email address", because they have to overcome a process that an independent body has assessed.

Other objections are not about the signature at all. A person may accept that they signed and say that they had no authority to bind the company, that they were pressured, or that they were misled about the content. Non-repudiation does not reach those. They are questions of contract and company law, decided under national rules.

The regulation also gives the signer a way to cut off misuse. A signer who loses control of a key can ask for the certificate to be revoked. The provider must publish the revocation within 24 hours of receiving the request, and it takes effect on publication (Article 24(3)). Signatures made before that moment stay valid. Signatures made after it do not validate. The revocation record then becomes evidence in its own right, since it shows when the loss was reported.

A firm strengthens non-repudiation by choosing the signature level to fit the document and by keeping the evidence.

Match the level to what a denial would cost. A routine acknowledgement can carry a simple signature. A guarantee, a share transfer or a settlement deserves one where a qualified provider has checked the signer's identity.

Validate each signed document when it arrives and save the report with the file. The report records the signer named in the certificate, the level of the signature and whether a time stamp is present.

Keep the evidence usable for as long as the document matters. Certificates expire, and a signature with nothing embedded may be impossible to check when the dispute finally comes.

Record authority separately. A signature proves which person signed. Whether that person could sign for the company is shown by other documents, such as a board resolution or a power of attorney, and those belong in the same file.