eIDAS electronic signatures: simple, advanced and qualified

Plenty of e-signature vendors market "eIDAS compliant" signing as if it's a single feature you either have or don't. It isn't. eIDAS itself sets up three distinct tiers, each with a different legal weight and a different amount of setup behind it, and knowing which one you actually need saves you from either underpreparing a high-stakes document or overpaying for certainty you didn't need.

The three levels, and when each is needed

Simple (or standard) electronic signature. This is the broadest category: a typed name, a drawn signature on a touchscreen, a clicked acceptance box. Under eIDAS, no electronic signature, including this basic tier, can be denied legal effect or kept out of court purely for not being advanced or qualified. For the large majority of everyday business contracts across the EU, service agreements, NDAs, vendor terms, this tier is genuinely sufficient.

Advanced electronic signature (AdES). This tier has to meet specific technical conditions: it must be uniquely linked to the signatory, created using signature-creation data that the signatory, and only the signatory, controls, and built so that any later change to the signed data is detectable. In practice, this usually means a certificate-based signing process with identity verification behind it, stronger than a simple signature but not requiring the specific device and provider certification that qualified signatures do. Electronic versus digital signatures explains the certificate side.

Qualified electronic signature (QES). A QES is an advanced signature created using a qualified signature creation device and backed by a qualified certificate issued by a trust service provider that meets eIDAS's specific accreditation standards. This is the only tier eIDAS explicitly states must be given the same legal effect as a handwritten signature across every EU member state, which makes it the tier of choice for high-stakes or cross-border situations where you want zero ambiguity.

What a small business usually needs

For ordinary commercial contracts, quotes, consulting agreements, supplier terms, a simple electronic signature with a genuine audit trail, who signed, when, from what device, with confirmation the document wasn't altered, is enough in the vast majority of cases. I'd push a client toward the advanced or qualified tier specifically when: the contract is with a government body or regulated institution that requires it directly, the counterparty's own policy or industry regulation specifies a minimum tier, the deal is large enough or the relationship new enough that you genuinely want the strongest possible evidence behind the signature, or you're dealing with a cross-border transaction where a qualified signature removes any argument about which country's weaker domestic rule might otherwise apply. For a worked case, see how to send signatures a legal team can check.

Cost and effort of each level

Simple electronic signatures are effectively free or included in the base tier of almost every e-signature tool on the market, with no extra setup for the signer beyond opening a link and signing. Advanced electronic signatures typically require some form of identity verification during the signing process, an SMS code, an email verification step, sometimes an ID document check, which adds a small amount of friction but usually no meaningful extra cost on most modern e-signature platforms. Qualified electronic signatures are the real cost and effort jump: they require the signer to hold, or be issued, a qualified certificate from an accredited trust service provider, which can mean a separate identity verification process entirely outside the e-signature tool itself, sometimes an in-person or video identity check, and often a per-signature or subscription cost specifically tied to the qualified certificate service, on top of whatever the underlying e-signature platform charges. That's real friction to put in front of a signer, which is exactly why I'd reserve it for situations that actually require that level of certainty rather than defaulting to it.

The part worth knowing before you choose

A genuinely common mistake is assuming "eIDAS compliant" automatically means the qualified tier. It usually doesn't. Most tools that advertise eIDAS compliance are describing their ability to support all three tiers, or simply confirming that their basic signing process satisfies the simple tier, which, again, is already legally sufficient for most contracts. If a specific transaction genuinely requires QES, that should be a deliberate, explicit choice you or your counterparty makes, not something you assume is already happening because a vendor's homepage uses the word "eIDAS."

A worked example

Say your company is based outside the EU and signs a distribution agreement with a German partner. The partner's legal team mentions they'd prefer a "qualified" signature. Before assuming you need to overhaul your entire signing process, it's worth clarifying exactly what they mean and why: is this a hard compliance requirement on their end tied to a specific regulation, or a preference they'd be comfortable relaxing for a routine commercial contract? In my experience, a surprising number of these requests soften once you ask directly, because the person requesting it is often repeating a general internal policy rather than citing a rule that actually applies to this specific deal. If it turns out to be a genuine requirement, you'd need to find an accredited qualified trust service provider, there are lists of these maintained by EU member states, and build that into your signing process for that specific counterparty, rather than assuming your existing e-signature tool's standard tier covers it. Whether overseas clients trust an e-signature is worth checking before you send.

Common eIDAS misconceptions worth clearing up

• "eIDAS compliant" doesn't mean "qualified." Most tools advertising eIDAS compliance support all three tiers or are simply confirming their basic signing process meets the simple tier, which is already legally sufficient for most contracts.
• A qualified signature isn't just "more secure encryption." The qualification comes from a specific accreditation chain, the device, the certificate, and the trust service provider all have to meet eIDAS's defined standards, not just strong technical security in a general sense.
• eIDAS doesn't require every EU transaction to use advanced or qualified signatures. The simple tier remains valid and enforceable EU-wide; the higher tiers exist for situations that specifically call for them, not as a general upgrade everyone should default to.

QES and businesses outside the EU

If your business isn't EU-based but you deal with EU counterparties, it's worth knowing that eIDAS's qualified tier is specifically an EU framework, non-EU businesses generally aren't required to obtain an EU qualified certificate themselves just to sign a contract with an EU party, unless that specific counterparty requires it. In most cases, both sides can agree on whatever signature level suits the transaction, a simple electronic signature for a routine deal, or you can seek out an EU-recognized qualified trust service provider specifically for the rare transaction that genuinely calls for it. The UK, having retained its own version of the eIDAS structure after Brexit, sits in a similar position: UK qualified signatures and EU qualified signatures aren't automatically interchangeable across the two systems, which is a detail worth checking for any UK-EU cross-border deal that specifically requires the qualified tier on either side.

A quick self-check for choosing a tier

Ask three questions before defaulting to the simple tier or escalating to something stronger: does a specific law, regulator, or the counterparty's own stated policy require a particular tier for this document? Is this a cross-border transaction where a qualified signature would remove ambiguity about which country's weaker domestic standard might apply? And is the relationship or deal value high enough that the extra friction of a stronger tier is worth it purely for your own evidentiary comfort, independent of any external requirement? If the answer to all three is no, the simple tier is the right, and cheaper, choice.

How I'd approach this

When I'm setting up document signing for a client doing business in or with the EU, I start by asking whether anyone involved, a regulator, a specific counterparty, an industry rule, actually requires advanced or qualified signatures for this particular document. If the answer is no, which it usually is, a simple electronic signature with a solid audit trail is the right call, and adding QES on top would just be friction without a real benefit. If the answer is yes, that's worth confirming precisely which tier and which accredited provider is acceptable before you build the signing process around it, rather than guessing.

Frequently asked questions