Notifications
Clear all
Topic starter
11/07/2026 8:40 pm
TL;DR: eIDAS separates simple, advanced, and qualified electronic signatures, with qualified signatures carrying explicit legal equivalence to handwritten signatures in the EU and requiring stronger identity verification, certificate controls, and trusted creation devices, according to GlobalSign. The governance lesson is that document signing is an identity assurance problem as much as a legal one.
NHIMG editorial — based on content published by GlobalSign: a guide to simple, advanced, and qualified electronic signatures under eIDAS
By the numbers:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
Questions worth separating out
Q: What breaks when a simple electronic signature is used for a high-risk transaction?
A: The main failure is evidentiary weakness.
Q: When should organisations require a qualified electronic signature instead of a basic one?
A: Require a qualified electronic signature when the transaction has legal, financial, or cross-border consequences that could be challenged later.
Q: How do identity teams know whether a signing flow is actually trustworthy?
A: Trustworthy signing flows bind a verified signer to a specific document using controlled credentials, tamper-evident cryptography, and an auditable issuance path.
Practitioner guidance
- Map signing tiers to transaction risk Classify signatures by legal, financial, and operational exposure, then require SES, AdES, or QES according to the highest consequence of dispute or repudiation.
- Align identity proofing with legal materiality Require stronger signer identity verification for contracts, consent records, procurement, and property-related workflows.
- Validate certificate issuance and key control Confirm that the certificate lifecycle, signer control, and key storage model support the assurance level you claim.
What's in the full article
GlobalSign's full article covers the legal and technical detail this post intentionally leaves for the source:
- Definitions and examples of SES, AdES, and QES in practical business workflows.
- The eIDAS legal distinctions that determine when a signature is equivalent to a handwritten one.
- How PKI, qualified certificates, and QSCD requirements shape trusted signing operations.
- Use-case guidance for documents such as contracts, proposals, patents, and consent forms.
👉 Read GlobalSign's explanation of SES, AdES, and QES under eIDAS →
eIDAS signature levels: where trust and identity verification diverge?
Explore further
11/07/2026 9:08 pm
Signature assurance is an identity assurance problem, not a formatting problem. The article’s core distinction is that the legal and security value of a signature comes from who was verified, how the key was controlled, and what evidence is attached to the document. For identity teams, that means signing should be governed as a trust decision, not treated as a document-UX feature. The practitioner conclusion is simple: if the signer cannot be reliably bound to the action, the signature is weak regardless of how polished the workflow looks.
A question worth separating out:
Q: Who is accountable when a signature is challenged in court or audit?
A: Accountability sits with the organisation that selected the signing tier, defined the verification policy, and operated the trust service relationship. Legal teams, IAM owners, and compliance stakeholders should jointly own the control design so that the evidence standard matches the business risk and regulatory requirement.
👉 Read our full editorial: eIDAS signatures depend on identity assurance, not just document signing
