What is a simple electronic signature (SES)?

The definition is a floor, not a description

Article 3 of the regulation defines an electronic signature without adjectives, and everything that fails the advanced tests lands here. A name typed into a field qualifies. So does a drawn mark, a click on a button, and a scanned image dropped into a PDF. Because the category is defined by what it does not require, two signatures at the same level can be worlds apart in practice: one collected through a checked link with a full event log, another pasted into a document by anybody who had the file. The level tells you what was not required, not what was done.

Why courts still take it seriously

The regulation says a signature cannot be denied legal effect or admissibility merely because it is electronic or because it fails to meet the higher levels. That non discrimination rule is the working protection for ordinary business. The rest is evidence. If the other side denies signing, the question becomes what the record shows, and a simple signature with a solid trail routinely beats an advanced one with a thin one. Judges are assessing whether this person agreed to this document, which is a factual question rather than a classification exercise.

Where the risk actually concentrates

Three places. Shared inboxes, where nobody can say which employee clicked. High value or high dispute documents, where the counterparty has an incentive to test the record. And documents whose form is prescribed by law, where the level may not be the issue at all because the act itself has to be executed a particular way. For everything else, the cost of upgrading the process usually outruns the risk, and the sensible move is to spend on identity checks for the small number of documents that warrant them.

Making a simple signature harder to deny

Send to a named individual rather than a role address. Add a second factor when the value justifies it. Record consent with its wording and version, so the signer's agreement to sign electronically is provable. Keep an event log that cannot be quietly rewritten. Hash the document at the moment of signing so the version is fixed. None of that changes the eIDAS level, and all of it changes the outcome of an argument, which is the only measure that matters once a dispute starts.

What a signing service records at this level

Choosing the email link only method leaves the level simple and the record dependent on the mailbox. Adding an access code of at least four characters, or an emailed six digit code that expires in ten minutes, adds a factor without changing the classification. Every step lands in an audit trail of eighteen event types chained with sha256, and the certificate of completion prints the verification method used, the signing time, the address, and the consent version accepted for each signer.

Writing a policy instead of deciding each time

Teams that sign regularly do better with a short written rule than with case by case judgement, because the judgement always happens under time pressure at the end of a negotiation. A workable policy fits on half a page. List the document types the business actually sends. Against each, name the verification method required, whether a second person must be in the signing order, and who may approve an exception. Set the trigger for stepping up: a value threshold, an indemnity or restraint clause, a counterparty nobody has dealt with before, or anything a regulator might read. Say what happens with shared mailboxes, since that single habit undoes more evidence than any technical choice. Review it once a year rather than after an incident. The point is not the level, which stays simple in almost every case, but consistency: a process applied the same way every time is far easier to defend than one that was tightened only for the document somebody happened to worry about on the day.

Questions people ask