eIDAS electronic signature (simple, advanced, qualified)

Regulation (EU) No 910/2014, known as eIDAS, has set since 2016 a single framework for trust services across the Union: signatures, seals, timestamps, electronic registered delivery. It was revised by Regulation (EU) 2024/1183, which creates the European Digital Identity Wallet and keeps the three signature levels.

Under French law, article 1366 of the Civil Code gives an electronic document the same evidential weight as a paper one, provided its author can be identified and its integrity is guaranteed. Article 1367 defines the electronic signature as the use of a reliable identification process. Decree No 2017-1416 of September 28, 2017 reserves the presumption of reliability for the qualified signature within the meaning of eIDAS.

The signature does not create the contract: under French law, a contract is formed by the exchange of consents and binds the parties (articles 1103 and 1104 of the Civil Code). The signature proves who consented, to what, and when. The debate over signature levels is therefore a debate about evidence, not about validity.

The simple signature is the broadest category: electronic data attached to a document and used by the signatory to sign. Clicking “I agree”, ticking a box, entering a code received by email, or drawing with a finger on a screen all fall into it.

The advanced signature meets the four conditions of article 26 of the regulation: uniquely linked to the signatory, it identifies them, it is created with data they keep under their sole control, and any later change to the document is detectable. In practice, a certificate is issued to the signatory, often for the duration of the signing ceremony, after an identity check.

The qualified signature is an advanced signature created with a qualified device and based on a qualified certificate, issued by a qualified trust service provider listed on the EU trusted list, after face-to-face or equivalent identity verification. Under article 25 of the regulation, it alone has the legal effect of a handwritten signature throughout the Union.

Article 25 of the eIDAS regulation forbids denying legal effect or admissibility in court to a signature solely because it is electronic or not qualified. All three levels are therefore admissible before a French court. What the level changes is how reliability is established if the signature is challenged.

For a qualified signature, reliability is presumed: the party challenging it has to show otherwise. For a simple or advanced signature, the party relying on it has to prove that it identifies the signatory and that the document has not changed. That proof rests on the evidence file built during signing: declared identity, email address, one-time code, timestamp, IP address, document hash.

The eIDAS regulation sets no level per type of contract; national law and risk analysis guide the choice. For everyday B2B contracts, non-disclosure agreements, services, terms and conditions, purchase orders, amendments, as for employment contracts and their amendments, French companies generally use the simple or advanced level, backed by a solid evidence file.

Some instruments call for a higher level, because the law requires it or because their stakes justify the presumption of reliability: instruments subject to specific formalities, high-value transactions, documents intended for a foreign authority. In French public procurement, the order (arrêté) of March 22, 2019 requires an advanced signature based on a qualified certificate, not a qualified signature.

The document is first frozen: its digital hash is computed and any later version becomes a different document. The signatories and their order are designated. Each receives an invitation, authenticates with a one-time code received by email or text message, reviews the document, gives consent, then signs. The final PDF is sealed and timestamped, and the evidence file is archived with it.

Common mistakes rarely come from the technology: changing the document after sending it for signature, mixing handwritten and electronic signatures on the same original, letting someone sign from a shared mailbox, failing to archive the evidence file. One more point: the signature proves a person’s consent, not their authority to bind the company, which is checked separately.

For a legal department, it eliminates scanned versions and missing originals: one final file, verifiable, linked to its evidence file. For sales and procurement teams, the signing cycle is measured in hours rather than days, and the counterparty signs without creating an account.

In CLM (contract lifecycle management), signature closes the negotiation conducted against the playbook, follows the approval workflow and opens performance. The signed document joins the contract repository with its versions and its evidence file. An amendment is signed under the same rules and attached to it; the contract manager relies on the sealed PDF to track auto-renewal and the termination notice period.