What is a qualified electronic signature (QES)?

What the regulation actually promises

Article 25 does two separate things. It says no electronic signature may be denied legal effect merely for being electronic, which covers every level, and then it gives qualified signatures a specific status: the same legal effect as a handwritten signature, recognised in every member state. That second promise is the reason the level exists. It converts a question of evidence into a question of law, so a party receiving a qualified signature from another country does not have to argue about whether the process behind it was good enough.

Who is allowed to issue one

Only a qualified trust service provider, supervised by a national body and published on that country's trusted list. The lists are machine readable and browsable, which matters in practice: a claim to be qualified is checkable in a minute rather than taken on trust. The provider verifies the applicant's identity to a defined standard, typically in person or through an equivalent remote process, then issues a certificate tied to a device that keeps the private key out of the holder's general purpose computer.

When it is genuinely required

Less often than vendors imply. Ordinary business to business contracts in the European Union do not require a qualified signature. It becomes necessary where national law prescribes a form for a particular act, in a set of public sector dealings, and in regulated areas such as certain notarial, tax and healthcare processes that differ by country. The other common driver is counterparty policy: a large institution may require it as a matter of procurement rather than because a statute says so. Either way the requirement should be traced to a named rule before anyone buys a device.

The cost of the guarantee

Every element that makes the level strong also adds friction. Identity has to be verified before the first signature, not during it, which rules out sending a link to a stranger and having them sign in five minutes. The key sits in hardware or a remote signing service, so the signer needs that device or an account with the provider. Certificates expire and are renewed. For a business signing hundreds of routine agreements, that overhead is the reason most of them stay at the advanced level, with the qualified level reserved for the handful of documents that need it.

What this product does and does not do

It is not a trust service provider and it issues no certificates to signers, so nothing it produces is a qualified electronic signature. Signing here identifies people through an emailed link, an access code or an emailed one time code, and records the result in a chained audit trail. The finished PDF is then sealed with the service's own PAdES certificate at DocMDP level one, which proves the file has not changed since completion. If a transaction genuinely requires a qualified signature, it needs a qualified provider instead.

What obtaining one involves

Procurement runs on a different clock from software. First comes choosing a provider that appears on a member state trusted list for the service required, since being a well known vendor is not the same as being qualified. Then identity verification of each signer, historically in person and now often through a supervised video process or an existing electronic identity scheme, which takes days rather than minutes and has to be repeated for every named individual. Then the signing method: either a physical device holding the key, which means card readers and drivers, or a remote signing service where the provider holds the key in certified hardware and the signer authorises each use. Pricing is usually per certificate with a term, sometimes with a per signature charge on top. Certificates expire, typically after one to three years, so somebody has to own renewals. None of that is difficult, but it is the reason the level is chosen deliberately rather than by default.

Questions people ask