What is eIDAS?

Why it is a regulation and not a directive

A directive tells member states to achieve a result and leaves the drafting to them, which is what the 1999 electronic signatures directive did, producing twenty eight variations. A regulation applies as written in every member state at the same time. That change is the practical heart of the 2014 reform: a qualified certificate issued in one country has to be recognised in all of them, and a business no longer has to survey national laws before accepting a signature from another member state.

Trust service providers and the lists

The regulation creates a supervised class of provider and a public register of who holds which status. Each member state publishes a trusted list, and the Commission publishes a browser over all of them. That machinery is what makes qualified status checkable rather than assertable: a receiving party can look up the issuer, see which services it was qualified for and from when. Providers that are not qualified may still operate, and their output is perfectly usable, but it carries no presumption and no cross border guarantee.

What the 2024 amendment changed

Regulation 2024/1183 extended the framework rather than replacing it. The headline addition is the European Digital Identity Wallet, a member state issued app for holding identity attributes and using them across services, along with new trust services for electronic attestation of attributes and archiving. The three signature levels survive unchanged. The practical effect over the next few years is on how a signer proves who they are before signing, which is exactly the step most signing processes are weakest at.

Reach beyond the European Union

The regulation binds member states, and the European Economic Area applies it as well. The United Kingdom retained a version in domestic law after leaving, so the vocabulary is shared but the trusted lists and the recognition rules are not identical. Elsewhere the influence is by imitation: several jurisdictions have adopted tiered models with similar language. None of that makes a European qualified signature automatically special in Sydney or Toronto, where the local statute decides.

What this means for a signing service

Ordinary signing here produces a simple electronic signature under this vocabulary, with the identity evidence coming from an emailed link, an access code or an emailed one time code, and the process evidence from an audit trail of eighteen event types. The finished PDF is sealed with a PAdES signature at DocMDP level one so tampering is detectable. Nothing is issued from a qualified trust service, so where a transaction requires a qualified signature or seal, that has to come from a listed provider.

What the regulation deliberately leaves alone

Reading the scope is as useful as reading the articles. It does not require anybody to sign electronically, so a party can still insist on paper as a commercial term. It does not harmonise contract law, so whether an agreement is valid, who had authority and what the words mean remain questions for national law. It does not set data protection rules, which sit in a separate regulation, even though signing collects personal data and the two are often discussed together. It does not govern the internal workings of a private signing platform, only the trust services it defines. And it does not reach beyond the European Union and the European Economic Area, so a European qualified signature carries no special status in Sydney, Toronto or New York unless the local law or the contract says so. Vendors sometimes present eIDAS compliance as a product feature. The regulation regulates providers of trust services and the legal effect of signatures, so for most software the honest claim is compatibility with a level rather than compliance with the regulation. The distinction matters in procurement, because a buyer who asks for an eIDAS compliant product and receives one may still find that the signatures it produces sit at the simple level, which was never what the question meant.

Questions people ask