Understanding eIDAS Regulation

eIDAS, short for Electronic Identification, Authentication, and Trust Services, is an EU regulation, in force since July 2016, that standardizes electronic identification and trust services such as electronic signatures, seals, and timestamps across all EU member states.

eIDAS is Regulation (EU) No 910/2014, effective since July 1, 2016, that gives qualified electronic signatures, seals, and timestamps the same legal standing as their paper equivalents across the EU. It defines three signature tiers, mandates Qualified Trust Service Providers, and is being extended by eIDAS 2.0, which adds the European Digital Identity Wallet.

Key Takeaways

• eIDAS replaced the fragmented, incompatible national eSignature and eID systems that existed across EU member states before 2016.
• Electronic signatures fall into three tiers: Simple (SES), Advanced (AES), and Qualified (QES), each with a different level of legal weight.
• A Qualified Electronic Signature (QES) carries the same legal effect as a handwritten signature, provided it is created via a Qualified Signature Creation Device and a Qualified Trust Service Provider’s certificate.
• Qualified Website Authentication Certificates (QWAC) verify the operator of a website and reduce phishing risk for site visitors.
• eIDAS 2.0, introduced in 2021, adds the European Digital Identity (EUDI) Wallet, with the European Commission targeting 80% of EU citizens using a digital ID by 2030.

Why was eIDAS created?

Before eIDAS, each EU member state ran its own electronic identification and eSignature rules, which made cross-border digital transactions slow and legally uncertain. eIDAS, formally Regulation (EU) No 910/2014, took effect July 1, 2016 and replaced the earlier eSignatures Directive 1999/93/EC with one unified legal framework.

What are the three tiers of electronic signature under eIDAS?

Tier	Legal weight	Requirement
Simple Electronic Signature (SES)	Minimal	Any digital mark, such as typing a name or clicking “I agree”
Advanced Electronic Signature (AES)	Moderate	Uniquely linked to the signer, using a private key the signer alone controls
Qualified Electronic Signature (QES)	Equivalent to a handwritten signature	Created via a Qualified Signature Creation Device and a certificate from a Qualified Trust Service Provider

What trust services does eIDAS define?

• Electronic seals: verify the origin and integrity of documents issued by an organization rather than an individual.
• Electronic timestamps: confirm a document existed, unchanged, as of a specific date, often used as legal or financial evidence.
• Electronic Registered Delivery Services (ERDS): provide verifiable proof of sending, receiving, and integrity for transmitted data.
• Qualified Website Authentication Certificates (QWAC): verify the identity of a website operator to reduce phishing and impersonation risk.

A Trust Service Provider becomes a Qualified Trust Service Provider (QTSP) only after passing an eIDAS audit and appearing on the EU Trust List, which lets relying parties confirm a provider’s qualified status before trusting its certificates.

What is eIDAS 2.0?

eIDAS 2.0, proposed by the European Commission in 2021, centers on the European Digital Identity (EUDI) Wallet, a government-backed digital wallet for identity credentials, health records, and banking details. It also broadens trust services to include electronic archiving and ledger services, and strengthens interoperability requirements for both public and private sector use.

What happens if an organization does not comply with eIDAS?

Non-compliance carries real legal and financial risk even though eIDAS itself does not levy direct fines. Unqualified electronic signatures used in binding contracts have been rejected in EU court proceedings, and national regulators can penalize failures tied to related regulations such as GDPR.

How Encryption Consulting Helps

Encryption Consulting’s PKI-as-a-Service and Compliance Advisory Services help organizations implement Qualified Electronic Signatures, deploy QWAC certificates, and build the PKI infrastructure eIDAS’s trust services require. Backed by ISO/IEC 27001:2022 and SOC 2 certified practices.

Frequently Asked Questions

What does eIDAS stand for?

eIDAS stands for Electronic Identification, Authentication, and Trust Services. It is EU Regulation (EU) No 910/2014, in force since July 1, 2016, and it standardizes electronic identification and trust services across all EU member states.

What is the difference between an Advanced and a Qualified Electronic Signature?

An Advanced Electronic Signature (AES) is uniquely linked to the signer through a private key they control, but it does not carry the same legal weight as a handwritten signature. A Qualified Electronic Signature (QES) does, because it must be created through a Qualified Signature Creation Device and a certificate from a Qualified Trust Service Provider.

What is a Qualified Trust Service Provider (QTSP)?

A QTSP is a Trust Service Provider that has passed an eIDAS compliance audit and appears on the EU Trust List. Only QTSPs can issue certificates and services that carry eIDAS’s full legal recognition, such as QWAC certificates and Qualified Electronic Signatures.

What is eIDAS 2.0 and when is it coming?

eIDAS 2.0 is the European Commission’s 2021 update to the original regulation, centered on the European Digital Identity (EUDI) Wallet. The Commission’s goal is for 80% of EU citizens to actively use a digital ID under this framework by 2030.

Implement eIDAS-Compliant Trust Services

Take the next step
Encryption Consulting helps you deploy Qualified Electronic Signatures, QWAC certificates, and the PKI backbone eIDAS requires for legally binding digital transactions. Explore PKI-as-a-Service to get started.