Executive Summary: What is it?
eIDAS (Electronic IDentification, Authentication and Trust Services) is EU Regulation 910/2014, updated by Regulation 2024/1183 (eIDAS 2.0). Unlike the technology-neutral US ESIGN Act, eIDAS is prescriptive: it defines three signature tiers with distinct legal weight, mandates government-supervised Qualified Trust Service Providers (QTSPs), and gives qualified signatures, seals and certificates automatic recognition in every member state. A Qualified Electronic Signature (QES) carries the legal equivalence of a handwritten signature in every member state. Enforcement is handled by national supervisory bodies (e.g., ANSSI in France, BNetzA in Germany). A self-hosted signing platform can carry the "eIDAS Ready" label in a solution profile (see below); the label is this hub's, not a legal status. A signing platform holds no qualified status of its own: a supervisory body grants qualified status to trust service providers (Article 3(20)), and bodies designated by member states certify qualified signature creation devices, which can be hardware or configured software (Articles 3(22) and 30).
CFO / Business Impact: What does it cost/risk?
- EU Market Access: Where a member state requires an advanced electronic signature for an online public service, it must recognize advanced and qualified signatures in at least the formats set by Commission implementing acts (Article 27). A qualified signature based on a qualified certificate issued in one member state is recognized as qualified in all others (Article 24a).
- Legal Certainty: A QES has the equivalent legal effect of a handwritten signature (Article 25(2)); the presumption of data integrity and correct origin belongs to the qualified electronic seal (Article 35(2)). Other electronic signatures cannot be denied legal effect or admissibility as evidence solely because they are electronic or not qualified (Article 25(1)); national law sets their further legal effect (recital 49 of Regulation 910/2014).
- eIDAS 2.0 Wallet: By 24 December 2026, every member state must offer an EU Digital Identity Wallet. Very large online platforms that require users to log in must accept the wallet when a user chooses it (Article 5f(3)), and by 24 December 2027 so must private services that law or contract obliges to use strong user authentication, such as banks, except microenterprises and small enterprises (Article 5f(2)).
Technical Reality: How does it work?
- Three Signature Tiers: Simple (SES: click/type, minimal bar), Advanced (AES: PKI-based, uniquely linked to signer, tamper-evident), and Qualified (QES: an AES created by a qualified signature creation device and based on a qualified certificate, which a QTSP issues after verifying the signer's identity).
- ETSI Formats: From 23 February 2027, where a member state requires an advanced signature for an online public service, it must recognize one in the XAdES, CAdES, PAdES or JAdES baseline profiles, or in an ASiC container (Article 27(1); Implementing Regulation (EU) 2026/248). eIDAS does not bind signing software itself; supporting these profiles is what lets its signatures be accepted.
- QTSP Integration: For QES, software must work with a certified qualified signature creation device (a local card or token, or a remote device managed by a QTSP) and a qualified certificate from a QTSP on a member state's trusted list (Article 22).
- Long-Term Validation: Signatures must embed revocation data (OCSP/CRL) and qualified timestamps to remain verifiable beyond certificate expiry.
What the Label Means in a Solution Profile
- Self-Hosted line: "eIDAS Ready" means the free self-hosted build creates advanced electronic signatures in the EU standard formats, tied to the signer, with verification that shows any change made after signing, and has the basic security controls (encryption, role-based access, audit logs and data export). A qualified signature, legally equal to a handwritten one, also needs a qualified certificate from a qualified trust service provider and a certified signing device.
- Managed service line: "eIDAS (Audited)" means the provider or its signing service has qualified status on the EU trusted list. With Inherited, the label names a qualified trust service provider after the dot, whose qualified certificates or signing device the service uses. "eIDAS (Self-Assessed)" means the vendor's own statement that it creates advanced electronic signatures; a qualified-signature claim never rests on the vendor's word alone.