Remote Signing

Remote signing is signing with a key that the signer does not physically hold. The key sits in hardware operated by a trust service provider. The signer sends an authorisation from a phone or browser, the provider's device creates the signature, and the signed document comes back. The same thing is sometimes called server signing or cloud signing.

The eIDAS Regulation does not use the phrase. It describes the arrangement through the device. A remote qualified electronic signature creation device is one that a qualified trust service provider manages on behalf of a signatory (Article 3(23a)). Managing such devices is also a trust service in its own right, listed in Article 3(16)(f) next to issuing certificates and creating time stamps.

The alternative is local signing, where the key lives in a chip on a smart card or USB token that the signer keeps. That model depends on the signer having the card, a reader and working driver software on the day a document needs signing. Remote signing removes the hardware from the signer's side. It is the reason a qualified electronic signature can be made on an ordinary phone.

The convenience comes with a question. If someone else holds the key, in what sense is the signature still the signer's own? Most of the rules on remote signing exist to answer that.

Remote signing works in two stages: an enrolment that happens once, then a short exchange for every signature. The steps below follow the common pattern. Steps one and two are the enrolment.

1. The provider verifies the signer's identity and registers the means the signer will use to authenticate, for example an app on the signer's phone.
2. A key pair is generated inside the provider's signing device for that signer. The provider issues a certificate that links the public key to the signer's name.
3. When a document is ready, the signing application calculates its hash, a short fingerprint that changes if the document changes.
4. The signer is shown what is to be signed and confirms it by authenticating, usually with two factors such as the phone itself plus a PIN or a fingerprint.
5. The signing device checks that the authorisation comes from the right signer and refers to that particular hash. Only then does it use the signer's key to sign the hash.
6. The signature value is returned and built into the document together with the certificate, normally with a time stamp.

Two details are worth noticing. In most services the document does not need to reach the signing device at all, because only its hash is signed. The authorisation in step four is also tied to one document or one batch. It is designed so that it cannot be saved and replayed to sign something else.

European standards bodies have written this pattern down. CEN publishes the standards for the signing device and the component that checks the signer's authorisation. ETSI publishes the standards for the provider that operates the service. The regulation itself stays at the level of principle.

The signer keeps control because the service is built so that the key cannot be used without the signer's own authentication, even though the hardware belongs to someone else. The provider stores the key. The design is meant to stop the provider from signing with it.

Sole control is a legal requirement, and remote signing has to meet it like any other method. Article 26 requires an advanced electronic signature to be created using signature creation data that the signatory can, with a high level of confidence, use under their sole control. Annex II requires a qualified device to ensure that the legitimate signatory can reliably protect that data against use by others. Article 29(1a) adds the rule that is specific to remote signing. Generating or managing the data may be carried out only on behalf of the signatory and at the request of the signatory.

With a smart card, control means possession plus a PIN. With remote signing it means authentication. Services of this kind are commonly built around a component inside the tamper-protected signing device. Its job is to release a key only after it has verified the signer's authentication and the link to the data being signed. The aim is that nobody at the provider, administrators included, can activate a signer's key.

This shifts the weak point. The key is hard to steal from a certified device in a guarded data centre. The signer's phone and PIN are easier targets. A signer who loses the phone, or suspects that someone else knows the PIN, should tell the provider at once so that the certificate can be revoked.

It is when three conditions are met, the same three as for a signature made with a card. Article 3(12) requires an advanced electronic signature, created by a qualified electronic signature creation device, based on a qualified certificate. The definition does not ask where the device is. A remote device that is certified and managed under the regulation counts.

The legal effect is the same as well. Article 25(2) gives a qualified electronic signature the equivalent legal effect of a handwritten signature, and Article 24a(1) requires every member state to recognise a qualified signature based on a qualified certificate issued in another. Neither provision distinguishes remote signatures from local ones. Nothing in the signed document needs to say which method was used.

Not every remote signature is qualified, though. Remote signing is a technique, and it is used at lower levels too. A platform may keep signing keys on its own servers without a certified device, or issue certificates that are not qualified. The result can be an advanced electronic signature, sometimes less. The word "remote" says where the key is. It says nothing about the level of the signature.

The level shows on validation. One of the conditions for confirming a qualified signature is that it was created by a qualified electronic signature creation device (Article 32(1)(f)), and validation software reads this from the signer's certificate.

Only a qualified trust service provider, and only one whose management of remote devices is itself a qualified trust service. Article 29(1a) reserves the generating, managing and backing up of signature creation data on a signatory's behalf to "a qualified trust service provider providing a qualified trust service for the management of a remote qualified electronic signature creation device".

Article 29a, added by the 2024 amendment, sets three conditions for that service. The provider generates or manages the signature creation data on behalf of the signatory. It duplicates the data for back-up purposes only, under strict limits. It complies with any requirements identified in the certification report of the specific device it uses. The Commission was given until 21 May 2025 to list reference standards for the service.

Article 51(3) allowed qualified providers that already managed remote devices to continue without separate qualified status for the management service until 21 May 2026.

Two practical consequences follow. A signing platform that is not a qualified provider cannot hold its users' keys for qualified signatures. It has to connect to a qualified provider that does. A service qualified in one member state is also recognised in all the others (Article 24a(3)), so a firm may use a remote signing provider established anywhere in the EU. The EU Trusted List shows which providers hold the status.

Remote signing asks less of the signer and more of the provider. The signature that results is of the same legal quality, so the choice is a practical one.

On the signer's side, remote signing needs no card, reader or driver. It works on whatever device the signer has to hand. That matters most across borders. A national identity card with a signing chip is of little use to a counterparty's director who lives in a country that does not issue one. A remote service can enrol that person online.

On the security side, the key rests in certified hardware under audit, not in a drawer. Every use of it passes through the provider's systems, which leaves a record. Against that, the signer's protection depends on how well the authentication means is guarded.

The limits are those of any online service. Remote signing needs a connection, and it needs the provider to be available at the moment of signing. It also ties the signer's key to the provider's continued operation. The regulation addresses that last point by requiring every qualified provider to keep an up-to-date termination plan (Article 24(2)(i)). Signatures already made do not depend on the key. They remain verifiable from the signed document and the certificate.