eIDAS explained: Europe's architecture of trust.

Wherever electronic signatures come up in the world, sooner or later an acronym appears: eIDAS. The European framework has become an essential reference, even for countries that have no legal relationship with the European Union. Not because it is perfect, but because it gave an orderly answer to a difficult question: how to get twenty seven countries with different laws, languages and technologies to trust one another's signatures and identities.

From a directive to a regulation

The first attempt was Directive 1999/93/EC on electronic signatures. Like every directive, each country transposed it into its own law, and the result was a patchwork: a signature valid in one country was not always recognized next door. Regulation (EU) 910/2014, known as eIDAS, changed the instrument. A regulation applies directly in every Member State, with the same text. That was its first major contribution: a single rule for the entire market. In 2024 it was expanded by Regulation (EU) 2024/1183, which keeps the architecture and extends it to new services and to a digital identity wallet for every citizen.

Two pillars

• Electronic identification. The national digital identity schemes that a country notifies can be used to access public services in other countries, according to their assurance level: low, substantial or high.
• Trust services. Signatures, organization seals, timestamps, electronic registered delivery, website authentication certificates, and the validation and preservation of signatures. The 2024 reform added, among others, electronic attestations of attributes, electronic archiving and electronic ledgers.

Three levels of signature

The same scheme applies to organization seals, which the regulation calls “electronic seals” and which are the equivalent for legal persons: an organization does not sign, it applies its organization seal.

Supervision: what underpins trust

Qualified status cannot simply be claimed. A provider that wants to offer qualified services must be audited by a conformity assessment body at least every twenty four months and must obtain that status from a national supervisory body. Once granted, it appears on its country's trusted list, which is public and machine readable. Validators consult these lists to decide automatically whether a signature is qualified.

1. Technical standards. ETSI and CEN describe in detail what formats, devices and processes must look like.
2. Audit. An accredited body verifies that the provider complies with them.
3. Supervision. The State grants, supervises and can withdraw qualified status.
4. Publication. The trusted list tells everyone, at all times, who is authorized.

What other countries can take from it

The lesson of eIDAS lies not in copying its text but in its architecture: neutrality at the basic level, clear presumptions at the higher levels, open technical standards, independent audits and public trusted lists. The regulation itself provides that signatures and services from countries outside the Union can be recognized through international agreements, provided they offer equivalent guarantees. A country that builds its framework from these pieces makes that recognition easier down the road.

← All notes