eIDAS
Legal Framework for Digital Signatures
eIDAS creates a common European framework for electronic identification and trust services.
It defines the only electronic signature that has the same legal effect as a handwritten signature —
the Qualified Electronic Signature (QES).
Legal equivalence
Highest strength
Recognition across EU
Supervised providers
What is eIDAS?
eIDAS (electronic IDentification, Authentication and trust Services) is the EU Regulation
that creates legal certainty and interoperability for electronic identification and trust services
across the European Union and associated markets.
Electronic Identification
Mutual recognition of national eID schemes across Member States. Foundation for secure remote identification.
Trust Services
Electronic signatures, seals, timestamps, registered delivery services and website authentication — all under a common legal regime.
Cross-border effect
A Qualified Electronic Signature issued in one Member State is recognised as a QES in all other Member States.
Legal certainty
Clear rules that prevent electronic signatures from being denied legal effect solely because they are electronic.
Three levels of electronic signature
eIDAS defines a clear hierarchy. Only the top level carries full legal equivalence to a handwritten signature.
Simple / SES
Any electronic data attached to or logically associated with other electronic data and used by the signatory to sign.
- Limited evidentiary value
- Easily challenged
- Not suitable for high-value banking documents
AES / AdES
Uniquely linked to the signatory, capable of identifying the signatory, created under sole control, and detects any subsequent change to the data.
- Strong evidence of origin & integrity
- Widely used in banking processes
- Still not legally equivalent to wet-ink
QES
An Advanced Electronic Signature that is created by a Qualified Signature Creation Device and based on a Qualified Certificate issued by a QTSP.
- Equivalent legal effect to handwritten signature
- Strongest non-repudiation
- Recognised across the entire EU
eIDAS Article 25 — Legal effects
Art. 25(1) — Non-discrimination
An electronic signature shall not be denied legal effect and admissibility as evidence in legal proceedings solely on the grounds that it is in electronic form or that it does not meet the requirements of a Qualified Electronic Signature.
Art. 25(2) — Equivalence
A Qualified Electronic Signature shall have the equivalent legal effect of a handwritten signature.
Art. 25(3) — Mutual recognition
A Qualified Electronic Signature based on a qualified certificate issued in one Member State shall be recognised as a Qualified Electronic Signature in all other Member States.
Banking impact
Only QES gives banks the highest possible legal certainty for mortgages, large loans, guarantees and other high-value contracts that must remain enforceable for decades.
Three mandatory building blocks
A signature is a Qualified Electronic Signature only when all three elements are present.
1. Qualified Certificate
Issued by a Qualified Trust Service Provider (QTSP) supervised by a national body and listed on the official EU Trusted List.
Contains the minimum content required by eIDAS Annex I (identity of signatory, validity period, status service location, etc.).
2. Qualified Signature Creation Device (QSCD)
A certified device or secure environment that ensures the private key is under the sole control of the signatory,
remains confidential and cannot be derived. Remote QSCDs operated by a QTSP are explicitly permitted.
3. Advanced Signature properties
The signature must be uniquely linked to the signatory, capable of identifying the signatory,
created under sole control, and detect any subsequent change to the signed data.
High-assurance identity
The QTSP (or Registration Authority acting on its behalf) must verify the identity of the person
with a high level of assurance before the qualified certificate is issued.
Role of the QTSP
Only a supervised Qualified Trust Service Provider can issue the certificates that make a QES possible.
Supervision & Trusted List
Must be supervised by a national supervisory body and appear on the EU Trusted List. Only certificates from listed QTSPs produce a legally valid QES.
Identity proofing
Must verify the identity of the person with a high level of assurance before issuing the qualified certificate.
Liability
Carries liability for damage caused by failure to comply with eIDAS requirements.
Certificate lifecycle
Securely manages issuance, revocation and status information (OCSP / CRL) for the entire validity period of the certificate.
How rSign modules meet QES requirements
Three of the four modules deliver full Qualified Electronic Signatures.
OQES — On-site
Identification: Face-to-face by bank clerk.
Certificate: One-time QDC from QTSP.
Creation: Controlled branch environment + QTSP QSCD.
IQES — In-App
Identification: Previous high-assurance KYC + Bank as Registration Authority + current SCA session.
Certificate: Short-lived one-time QDC from QTSP.
Creation: App session + remote QSCD of the QTSP.
RQES — Remote
Identification: Trusted cloud identity provider or national eID.
Certificate: Existing or session-based qualified certificate.
Creation: Remote QSCD operated by the QTSP.
PAES — On-site AES
Delivers an Advanced Electronic Signature with biometric evidence and qualified timestamp.
High evidentiary value, but intentionally positioned as AES (not QES) when full QES is not required.
eIDAS 2.0 highlights
The European Digital Identity Regulation strengthens the original framework and introduces new trust services.
European Digital Identity Wallet
Every Member State must offer a digital identity wallet. Citizens and businesses can store and present identity attributes and credentials.
Qualified Electronic Attestations
New trust service for electronic attestations of attributes (age, diploma, company data, etc.) with legal effect.
Stronger trust services
Clearer rules for qualified electronic signatures, seals, timestamps and electronic archiving — higher assurance and better interoperability.
Mandatory acceptance
Public and many private relying parties must accept the EUDI Wallet for identification and authentication.
Full eIDAS QES across every channel
rSign enables OQES, IQES and RQES to deliver Qualified Electronic Signatures
with the legal effect of a handwritten signature — on-site, in-app or fully remote.