eIDAS explained: Europe's architecture of trust.
Identification, trust services, tiers and supervision: how the European model fits together.
Wherever electronic signatures come up in the world, sooner or later an acronym appears: eIDAS. The European framework has become an essential reference, even for countries that have no legal relationship with the European Union. Not because it is perfect, but because it gave an orderly answer to a difficult question: how to get twenty seven countries with different laws, languages and technologies to trust one another's signatures and identities.
From a directive to a regulation
The first attempt was Directive 1999/93/EC on electronic signatures. Like every directive, each country transposed it into its own law, and the result was a patchwork: a signature valid in one country was not always recognized next door. Regulation (EU) 910/2014, known as eIDAS, changed the instrument. A regulation applies directly in every Member State, with the same text. That was its first major contribution: a single rule for the entire market. In 2024 it was expanded by Regulation (EU) 2024/1183, which keeps the architecture and extends it to new services and to a digital identity wallet for every citizen.
Two pillars
- Electronic identification. The national digital identity schemes that a country notifies can be used to access public services in other countries, according to their assurance level: low, substantial or high.
- Trust services. Signatures, organization seals, timestamps, electronic registered delivery, website authentication certificates, and the validation and preservation of signatures. The 2024 reform added, among others, electronic attestations of attributes, electronic archiving and electronic ledgers.
Three levels of signature
| Level | What it requires | Legal effect |
|---|---|---|
| Simple electronic signature | Data in electronic form that the signatory uses to sign. | Cannot be rejected solely because it is electronic; its weight is assessed case by case. |
| Advanced electronic signature | Uniquely linked to the signatory, capable of identifying them, created using means under their sole control, and linked to the data in such a way that any change is detectable. | Stronger as evidence, with no general legal presumption. |
| Qualified electronic signature | An advanced electronic signature based on a qualified certificate and created with a qualified signature creation device. | Legal effect equivalent to a handwritten signature, and recognition in every Member State. |
The same scheme applies to organization seals, which the regulation calls “electronic seals” and which are the equivalent for legal persons: an organization does not sign, it applies its organization seal.
Supervision: what underpins trust
Qualified status cannot simply be claimed. A provider that wants to offer qualified services must be audited by a conformity assessment body at least every twenty four months and must obtain that status from a national supervisory body. Once granted, it appears on its country's trusted list, which is public and machine readable. Validators consult these lists to decide automatically whether a signature is qualified.
- Technical standards. ETSI and CEN describe in detail what formats, devices and processes must look like.
- Audit. An accredited body verifies that the provider complies with them.
- Supervision. The State grants, supervises and can withdraw qualified status.
- Publication. The trusted list tells everyone, at all times, who is authorized.
What other countries can take from it
The lesson of eIDAS lies not in copying its text but in its architecture: neutrality at the basic level, clear presumptions at the higher levels, open technical standards, independent audits and public trusted lists. The regulation itself provides that signatures and services from countries outside the Union can be recognized through international agreements, provided they offer equivalent guarantees. A country that builds its framework from these pieces makes that recognition easier down the road.
eIDAS is a European regulation with two pillars, electronic identification and trust services. It defines three levels of signature, simple, advanced and qualified electronic signature, with increasing legal effects, and underpins the qualified level with audits, supervision and public trusted lists. That architecture is its most exportable contribution.