Topic starter
11/07/2026 8:42 pm
TL;DR: AdES and QES differ on identity assurance, device controls, and legal equivalence, with QES requiring a qualified trust service provider, a qualified signature creation device, and stronger identity verification under eIDAS, according to GlobalSign. The governance issue is not the signature label itself but whether the underlying identity proofing, issuance, and compliance controls actually meet the risk and jurisdictional requirements.
Editorial analysis by NHI Mgmt Group, based on content published by GlobalSign: “Firma electrónica avanzada frente a firma electrónica cualificada: Elección del proveedor adecuado”.
Key questions
Q: When does AdES fail to provide enough assurance for business transactions?
A: AdES falls short when the transaction needs stronger evidentiary weight, regulated identity proofing, or legal equivalence to a handwritten signature.
Q: What should organisations verify before accepting a QES implementation?
A: They should verify the provider’s qualified trust service status, evidence of QSCD use, and the strength of identity proofing behind enrolment.
Q: What are the most common governance mistakes with electronic signatures?
A: The most common mistakes are assuming all digital signatures are legally equivalent, accepting weak onboarding checks, and failing to confirm whether the provider actually supports the required trust model.
Practitioner guidance
- Define signature assurance tiers by use case Map transaction types to AdES or QES based on legal effect, evidentiary need, and jurisdiction before selecting a service.
- Validate qualified trust provider status Confirm that the provider appears on the relevant trusted list and can evidence qualified certificate issuance, not just digital signing capability.
- Require proof of QSCD use Ask how the signing process is protected by a qualified signature creation device and what controls prevent bypass of that device.
Bottom line: AdES and QES are different trust models, not interchangeable digital signature labels.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 9:08 pm
Signature assurance is an identity governance problem before it is a document-signing problem. The article shows that the meaningful control boundary sits in proofing, issuance, and device assurance, not in the visual presence of an electronic signature. For identity programmes, that means the signing workflow should be governed like any other trust chain with explicit assurance levels. Practitioners should classify signing use cases by risk and legal consequence, then map them to the minimum acceptable assurance level.
A question worth separating out:
Q: How should IAM and identity teams decide between AdES and QES?
A: They should decide based on the transaction’s risk, the jurisdiction involved, and the evidence standard the organisation must defend later. AdES is often enough for routine business use, while QES is the better fit when legal equivalence and stronger identity assurance are required. The decision belongs in governance, not in a feature comparison.
👉 Read our full editorial: AdES vs QES: what signature assurance means for identity governance