Qualified Electronic Signature (QES): A Practical eIDAS Guide

Introduction

A qualified electronic signature (QES) is the highest defined electronic-signature assurance category in the EU’s eIDAS framework. It is not simply a document signed online. A QES combines an advanced electronic signature with a qualified certificate and a qualified signature-creation device. Under eIDAS, a QES has the equivalent legal effect of a handwritten signature.

That legal effect does not mean every agreement needs a QES, or that a QES answers every legal question. The right level depends on the transaction, applicable law, the parties’ requirements, and the evidence a team needs to retain. This guide is practical information, not legal advice; use qualified counsel where a transaction’s formality requirements are unclear.

What Is a Qualified Electronic Signature?

The eIDAS framework distinguishes electronic signatures by assurance. A QES is a defined category with specific technical and trust-service conditions. It is intended for situations where a signing process needs a strong, standardised basis for trust across EU Member States.

The key legal point is narrow but important. eIDAS says an electronic signature cannot be rejected solely because it is electronic or does not meet QES requirements. It separately gives a QES the equivalent legal effect of a handwritten signature. Those two statements help teams avoid a common error: treating every electronic signature as invalid unless it is qualified, or treating every QES as automatically sufficient for every transaction.

For the current framework and policy context, consult the European Commission’s eIDAS Regulation overview.

What makes a signature qualified under eIDAS

At a high level, a QES has three connected parts:

An advanced electronic signature. Article 26 requires it to be uniquely linked to the signatory, capable of identifying the signatory, created using signature-creation data that the signatory can use under their sole control with a high level of confidence, and linked to the signed data so a later change is detectable.
A qualified certificate for electronic signatures. This is issued within the qualified trust-services framework.
A qualified signature-creation device. The signature must be created using the kind of device required for QES under eIDAS.

The parts matter together. A team cannot infer QES status from a familiar signing screen, a document audit trail, or a claim that a provider supports electronic signatures. It must assess the actual signing method, certificate, trust-service status, and the applicable transaction requirements.

QES, Advanced Electronic Signatures, and Other Electronic Signatures

“Electronic signature” is a broad eIDAS term for electronic data attached to or logically associated with other electronic data and used by a signatory to sign. It is not, by itself, a separate eIDAS assurance category or a statement that a particular signing method meets the requirements for an advanced or qualified signature.

An advanced electronic signature adds defined links between the signer, the signature process, and the signed data. A QES adds the qualified certificate and qualified-device conditions described above. The practical question is not which label sounds strongest. It is whether the required evidence and legal effect for the specific transaction call for that level.

Teams should also keep the distinction between a natural person’s signature and an organisation’s evidence in view. A signature is about a natural person’s act of signing. Evidence of document origin or integrity may involve other trust services or controls. Conflating these purposes can create an incomplete requirements brief.

When Should a Team Assess Whether QES Is Needed?

Assess the requirement before choosing a signing flow, not after a document is ready to send. Start with these questions:

Which country’s rules and which transaction type apply?
Does a law, regulator, public body, counterparty, or internal policy specify a signature form?
Is the signer acting as a natural person, and what identity evidence is necessary?
Will the document need to be recognised or relied on across EU Member States?
What evidence must be available later to validate the signature and explain the process?

The answer may be a QES requirement, another acceptable electronic-signature method, or a process that needs separate advice. Avoid a blanket rule based solely on document value, an industry label, or the other party’s location. Formality requirements can vary by transaction and jurisdiction.

Electronic signature assurance-level checklist

Use this short brief to turn a vague “we need a secure signature” request into reviewable requirements.

Decision question	What to document	Why it matters
Which jurisdiction and transaction govern?	Governing law, transaction type, and parties’ locations	The relevant rules may differ by transaction and country.
Which assurance level is required?	Statutory, regulatory, counterparty, or policy requirement	It prevents choosing a workflow based on assumption.
Who is the signatory?	Natural person, authority to sign, and signer journey	A signature is a natural person’s act; authority may need separate evidence.
What identity evidence is needed?	Required identity checks and their owner	Identity requirements should be decided before launch.
Must eIDAS QES conditions apply?	Advanced-signature, certificate, and creation-device requirement	These are the conditions that distinguish QES in the eIDAS framework.
How are validation records retained?	Validation process, responsible team, and retention rule	Evidence must remain understandable after the signing event.

How to Verify the Qualified-Service Context

When QES is in scope, verification should be a defined step rather than a marketing check. Assign an owner to confirm the relevant qualified trust-service status, the certificate and validation path, and the evidence to retain with the executed document.

The EU trusted-list system is part of that context: a provider and service obtain qualified status only when they appear as qualified in the relevant trusted list. A practical process should record the checked list, date, service, and validation result, then keep those records with the signing file as appropriate for the organisation’s retention policy.

Because trusted-list status alone does not decide whether a QES is necessary for a particular agreement, keep the legal-requirement assessment and the technical-validation record as separate items in the requirements brief.

Designing a QES-Ready Signing Process

Once the requirement is clear, design the signing flow around evidence rather than convenience alone.

First, map the signer journey. Identify who signs, the authority they need, how identity evidence is collected, and where exceptions go. Second, define the document controls: final-version approval, recipient details, signing order, and what happens if the document changes. Third, define the evidence package: signed document, validation result, relevant certificate and trust-service records, timestamps where applicable, and retention ownership.

Run one representative transaction before scaling. The goal is to test the whole evidence chain: requirement, signer experience, execution, validation, and retrieval. A clean pilot exposes unresolved handoffs much earlier than a broad rollout.

Final Recommendation

Treat QES as a specific assurance requirement under eIDAS, not a generic synonym for an electronic signature. Start with the transaction and jurisdiction, write down the assurance requirement, then test whether the selected signing process can produce and retain the required evidence. Escalate unclear formality questions to qualified legal advice.

If your team is mapping a signing process, contact Nota Sign to discuss the workflow requirements. Define the assurance requirement before designing the signing flow.