Qualified Electronic Signature QES

Three things, all set out in Article 3(12) of the eIDAS Regulation. The signature must meet the four requirements for an advanced electronic signature in Article 26. It must be created by a qualified signature creation device, which is hardware or software certified to keep the signing key under the signer's control (Annex II). It must also be based on a qualified certificate, which only a qualified trust service provider can issue (Article 3(15)).

The certificate is what ties the signature to a named person. Before issuing one, the provider has to verify the identity of the person it is issued to (Article 24(1)). That check, carried out by a supervised provider, is the practical difference between a qualified signature and every other kind.

It has the equivalent legal effect of a handwritten signature. Article 25(2) says so in one sentence, and because eIDAS is a regulation it applies directly in all member states. A court in Lisbon and a court in Tallinn start from the same rule.

There is one limit. eIDAS does not change national or EU rules about the form a document must take (Article 2(3)). If a national law requires a notarial deed for a transaction, a qualified signature stands in for the handwritten signature. It does not stand in for the notary.

The three levels differ in what the signature must meet, in who checks the signer's identity, and in the legal effect the regulation attaches. The table sets them side by side. The last row is the one to look at.

Only the qualified level has its legal effect fixed by the regulation. For the other two, eIDAS guarantees that a court will look at the signature. It does not say how much weight the signature carries.

From a qualified trust service provider. These are providers that a national supervisory body has granted qualified status, and each member state publishes them on its trusted list (Articles 3(20) and 22).

The provider first verifies who you are. Article 24(1a) allows four routes: a European Digital Identity Wallet or a notified electronic ID at assurance level high, an existing qualified certificate, physical presence, or another method that identifies the person with a high level of confidence, as confirmed by a conformity assessment body. A remote check of an identity document falls under the last of these. ZealiD, for example, issues qualified signatures after a remote identity check in its app, without a video call.

The signing key does not have to sit on a card or a USB token. Under Article 29a, a qualified provider may manage a remote signature creation device on the signer's behalf, which is how signing from a phone works.

Validate the signed file. A signing platform's own label is not proof. Article 32(1) lists what validation has to confirm, including that the certificate was qualified and valid at the time of signing, that a qualified provider issued it, that a qualified device created the signature, and that the signed data has not changed since.

Two public tools cover most cases. The European Commission signature validator reads a signed file and reports what it finds. The EU Trusted List browser shows whether the provider named in the certificate holds qualified status for signature certificates.