What is an advanced electronic signature (AES)?

Why the tests are written as outcomes

The regulation avoids naming any technology, so the four requirements describe results rather than methods. That keeps the definition alive as tooling changes, and it means two very different systems can both qualify. It also means nobody can hand you a certificate saying your process is advanced: the assessment is about your arrangements, judged against the tests, in the context of the transaction. Vendors who describe their output as advanced are usually describing the components they supply rather than the whole arrangement, which includes how you identify signers and how you keep the record.

Where ordinary signing processes fall short

Usually on the third test. An emailed link is held by whoever can read that inbox, which is not the same as data under one person's sole control, and a shared mailbox breaks it outright. The first test is often weak for the same reason. Detectability is the easiest to satisfy, because a hash over the finished document does it, and identification is a matter of recording the check that was performed. Reading the tests in that order tells you where to spend money: on how signers prove who they are, not on the cryptography at the end.

What an audit trail can and cannot add

A chained event log answers questions about the process: which address opened the link, when each step happened, what identity check was passed, which version of the consent wording was accepted. That evidence supports the identification test and makes the whole record hard to rewrite quietly, since each entry's hash includes the previous one. What it cannot do is turn a shared credential into sole control, or manufacture a link between a mark and a person where none was established. The log is a witness to the process, not a substitute for it.

Advanced is a floor, not a badge

Nothing in the regulation gives an advanced signature the automatic effect of a handwritten one. Its practical value is that it puts your evidence in a shape a court or counterparty recognises, and that many national rules and contractual policies name the level as the standard to meet. Treat it as the minimum for anything valuable and the ceiling for most ordinary agreements, with the qualified level reserved for the narrow set of transactions where a rule demands it.

Reading this product against the four tests

Detectability is met: the completed PDF is certified with PAdES at DocMDP level one, so any edit shows. Identification depends on which of the three verification methods was chosen, from an email link only, through a four character minimum access code shared out of band, to a six digit emailed code that expires in ten minutes. Sole control is the honest gap, because the credential is an inbox or a shared code rather than a key in the signer's possession. The audit trail records eighteen event types in a sha256 chain to evidence the rest.

Writing the four tests down before anyone asks

Auditors, insurers and large counterparties increasingly ask how a signing process meets the advanced tests, and the answer is much easier to give if it was written when the process was designed. A workable note runs to one page for each document type. Name the credential the signer used and say who controls it. Describe the identity check performed before signing and what evidence of it survives. State how the document is bound to the signature, which for a PDF means the hash and the certification level. Point at the log that records the events, and say who can alter it and how alteration would be detected. Then note the gaps honestly, because a claim that every test is perfectly met tends to invite scrutiny that a candid assessment avoids. The exercise usually surfaces one fixable weakness, most often shared mailboxes, and fixing that is worth more than any upgrade to the cryptography at the end of the process.

Questions people ask