eIDAS Regulation Explained: A Practical Guide for EU Businesses

eIDAS — short for electronic IDentification, Authentication and trust Services — is the EU regulation that makes electronic signatures legally binding across all 27 member states. If you sign contracts digitally with anyone in Europe, eIDAS is the framework that determines whether those signatures hold up in court.

What is eIDAS?

eIDAS is Regulation (EU) 910/2014, in force since 1 July 2016. It replaced the earlier 1999 e-Signatures Directive, and unlike the directive it applies directly in every member state without needing national implementation. That's what makes an eIDAS-compliant signature enforceable in France, Germany, Italy, Spain, and every other EU country without additional formalities.

The regulation covers three things: electronic identification schemes, trust services (signatures, seals, timestamps, registered delivery), and the legal admissibility of electronic documents in EU courts.

What eIDAS regulates

The parts of eIDAS most businesses care about:

• Electronic signatures — three levels of legal weight (see below)
• Electronic seals — the organisational equivalent of a signature, used by legal persons rather than individuals
• Electronic timestamps — proof that data existed at a specific time, typically issued under RFC 3161
• Qualified Trust Service Providers (QTSPs) — supervised organisations that issue qualified certificates. The full list is published in the EU Trust List (EUTL)
• Cross-border recognition — a qualified signature issued in one member state must be accepted in all others

The three levels of electronic signature

eIDAS defines three tiers, each with progressively stronger identity binding and legal weight:

Simple Electronic Signature (SES)

The baseline. Data attached to or logically associated with other data, used by the signer to sign. Legally valid for most commercial contracts — NDAs, SOWs, consulting agreements, vendor contracts. A PAdES B-T PDF signature with an RFC 3161 timestamp is a solid SES.

Advanced Electronic Signature (AES)

Uniquely linked to the signer, capable of identifying them, created with data under their sole control, and detectably tampered if the document changes after signing. Typically implemented with a signer-issued certificate. Required for higher-value contracts or where regulators demand stronger proof of identity.

Qualified Electronic Signature (QES)

An AES created with a qualified signature creation device and backed by a qualified certificate from a QTSP on the EU Trust List. Legally equivalent to a handwritten signature under Article 25 of eIDAS. Required for notarised documents, real estate transactions, and other statutory-form contracts.

For a deeper comparison, see our SES vs AES vs QES guide.

Cross-border recognition

Article 25(3) is the key provision: a QES issued in one member state must be recognised as equivalent to a QES in every other member state. No additional legalisation, no apostille, no re-signing. This is what makes eIDAS actually useful for pan-European business — a French QTSP-issued signature is as valid in Ireland as one issued locally.

SES and AES signatures don't get the same automatic recognition, but they cannot be denied legal effect or admissibility solely because they're electronic (Article 25(1)). In practice this means courts across the EU will consider them, weighing them like any other piece of evidence.

eIDAS 2.0 and the European Digital Identity Wallet

eIDAS 2.0 — Regulation (EU) 2024/1183, in force from May 2024 — extends the original with the European Digital Identity Wallet (EUDI Wallet). Every member state must offer one to its citizens by 2026. The wallet lets citizens store credentials (driving license, diplomas, health cards) and sign documents from their phone using QES-level cryptography.

Practical impact for businesses: over the next few years, expect signing flows that let counterparties sign with their national wallet, producing a QES automatically, no separate QTSP account needed. eIDAS 2.0 also expands the recognised trust services (electronic archiving, electronic ledgers, remote QSCDs).

What this means for signing PDFs

For standard commercial contracts, an SES-tier PAdES B-T signature is legally sufficient across the EU. That's what eSeal produces: a signature embedded in the PDF using ETSI PAdES B-T, timestamped via RFC 3161 — verifiable with the ETSI PAdES conformance checker.

If your contract requires a QES (real estate, notarial acts, some employment contracts), you need a QTSP-issued certificate — not eSeal, at least for now. For everything else, SES is the right tool.