Under eIDAS 2.0, a qualified electronic signature (QES) must be created using a qualified signature creation device (QSCD) and based on a qualified certificate issued by a Qualified Trust Service Provider (QTSP) listed on an EU Member State’s trusted list. This makes QES the highest legally recognised form of electronic signature in the EU, carrying the same legal weight as a handwritten signature across all Member States. The sections below set out the specific requirements, technical standards, and practical steps organisations need to know.
How do eIDAS 2.0 requirements differ from the original eIDAS?
eIDAS 2.0, Regulation (EU) 2024/1183, amends the original Regulation (EU) 910/2014. It introduces several important updates that raise the bar for qualified electronic signatures. The core legal definition of QES remains the same, but the new regulation strengthens requirements around trust service providers, brings remote qualified signature creation devices fully into the regulatory framework as a recognised category, and aligns QES more closely with the European Digital Identity Wallet ecosystem.
Regulation (EU) 910/2014, in force since 2016, established the legal framework for electronic signatures, seals, and other trust services across the EU. It worked reasonably well for cross-border recognition, but it left gaps. Not every Member State built interoperable digital identity infrastructure, and the private sector was largely excluded from the trust ecosystem.
eIDAS 2.0 addresses these gaps by:
- Introducing the EUDI Wallet as a recognised means of identity verification and signature initiation
- Expanding the scope of qualified trust services to include new categories such as electronic archiving and electronic ledgers
- Strengthening supervision and certification requirements for Qualified Trust Service Providers
- Bringing remote qualified signature creation devices fully into the regulatory framework
- Improving interoperability between national identity systems and trust services
For organisations already using QES under the original regulation, the underlying legal validity of existing signatures is not affected. However, systems and processes may need to be updated to remain compliant with the new technical standards and supervision requirements that apply from 2026 onward.
What technical standards must a qualified electronic signature meet?
A qualified electronic signature under eIDAS 2.0 must meet four core technical requirements: it must be uniquely linked to the signatory, it must be capable of identifying the signatory, it must be created using data under the signatory’s sole control, and any subsequent change to the signed data must be detectable. These requirements are enforced through a combination of cryptographic technology and certified infrastructure. A QES additionally requires a QSCD and a qualified certificate from a listed QTSP.
In practice, this means a QES relies on public key infrastructure (PKI). The signatory holds a private key, and the corresponding public key is embedded in a qualified certificate. When a document is signed, a cryptographic hash is generated and encrypted with the private key. Anyone can verify the signature using the public certificate, confirming both the identity of the signer and the integrity of the document.
The European Commission has published a series of implementing regulations that set out legally binding requirements, and the Architecture and Reference Framework (ARF) provides the technical elaboration of those requirements. Together, these cover areas including:
- Formats for qualified certificates for electronic signatures
- Qualified validation services for QES
- Qualified preservation services to ensure long-term verifiability
- Protocols and interfaces for interoperability between trust services
- Standards for qualified signature creation devices
These requirements are not optional. Compliance with the implementing regulations is what distinguishes a QES from a lower-level advanced electronic signature (AdES). The implementing regulations contain the legally binding requirements, and the ARF provides the technical elaboration organisations need to implement those requirements correctly. Organisations integrating QES into their workflows should verify that their chosen solution aligns with both the current ARF and the relevant implementing regulations under eIDAS 2.0.
Who is allowed to issue qualified electronic signatures under eIDAS 2.0?
Only Qualified Trust Service Providers (QTSPs) that are officially listed on a Member State’s national trusted list are authorised to issue the qualified certificates required for a QES. These providers must pass a conformity assessment conducted by an accredited body and are subject to ongoing supervision by national supervisory authorities.
Being a QTSP is not a self-declared status. The certification process involves a rigorous audit against the requirements set out in eIDAS 2.0 and the associated implementing regulations. Once certified, a QTSP appears on the relevant national trusted list. These national trusted lists are brought together in the EU List of Trusted Lists (LOTL), which is publicly accessible and machine-readable. The LOTL is the authoritative source for verifying whether a trust service provider is genuinely qualified.
Under eIDAS 2.0, QTSPs can also offer remote qualified signature creation devices as a qualified trust service. This is an important development because it enables signatories to create QES without needing a physical smart card or USB token. The private key is instead managed securely in a cloud-based environment operated by the QTSP, with the signatory retaining sole control through strong authentication mechanisms. Remote signing was already possible under the original regulation, but eIDAS 2.0 gives remote QSCDs an explicit and fully elaborated place in the framework.
For organisations procuring QES solutions, the practical implication is straightforward: always verify that your provider appears on the relevant national trusted list, as reflected in the LOTL, before deploying their services for legally binding signatures.
How does the EUDI Wallet affect qualified electronic signatures?
The European Digital Identity Wallet introduces a new channel through which qualified electronic signatures can be initiated and delivered. Under eIDAS 2.0, the EUDI Wallet can store a person’s verified identity attributes and connect them to qualified signature services, making it easier to sign documents with a QES directly from a mobile device without separate hardware tokens.
Previously, QES typically required a physical signing device or a separate authentication step through a QTSP’s own interface. The EUDI Wallet streamlines this by acting as a trusted identity container that is already linked to a person’s verified national identity. When a signature is needed, the wallet can authenticate the user and trigger the signature creation process through a connected QTSP.
EUDI Wallet governance is a shared responsibility across multiple actors. The European Commission manages the legal framework and adopts implementing acts. EU Member States are responsible for providing or mandating wallet solutions, certifying and notifying them, and supervising actors within their jurisdiction. The European Digital Identity Cooperation Group supports cross-border alignment and cooperation between Member States. National competent authorities, wallet providers, issuers of Person Identification Data and attestations, qualified trust service providers, and relying parties each carry distinct responsibilities within this framework.
For organisations, this means the user experience around QES is set to improve considerably as wallet adoption grows. Customers and employees will no longer need to manage separate certificates or tokens. The wallet handles identity verification for each signing scenario, and that verified identity can be reused across signing scenarios. This aligns with the broader eIDAS 2.0 goal of reducing friction in digital interactions while maintaining the highest levels of trust and legal certainty.
Member States are legally required to make EUDI Wallets available to all citizens, residents, and businesses by 24 December 2026. This is the legal deadline for Member States’ wallet obligations. Practical interoperability and national rollout are likely to develop in phases, and the level of maturity across different national wallets and cross-border use cases may vary beyond that date. Organisations should plan for a phased integration. As wallet adoption grows, organisations that integrate QES workflows compatible with the EUDI Wallet ecosystem will be better positioned for scalable digital signing across borders.
Are qualified electronic signatures from other EU Member States legally valid?
Yes. Under eIDAS 2.0, a qualified electronic signature issued in one EU Member State must be legally recognised in all other Member States. This cross-border recognition is one of the core principles of the eIDAS framework and applies without any additional requirements or formalities from the receiving country.
This mutual recognition is what makes QES genuinely useful for cross-border business. A contract signed with a QES issued by a QTSP in Germany carries the same legal weight in France, the Netherlands, or any other EU Member State as it does in Germany itself. Organisations operating across multiple jurisdictions can rely on a single QES solution rather than managing country-specific signing processes.
There is one important practical consideration: the QES must be based on a qualified certificate from a provider that appears on the relevant national trusted list, as reflected in the LOTL. If the issuing QTSP is not listed, the signature does not qualify for automatic cross-border recognition. This is why checking the LOTL before selecting a provider is essential.
Cross-border recognition of the signature itself does not remove all national or sector-specific requirements. eIDAS 2.0 determines the legal effect of electronic signatures, but national formal requirements continue to apply where they exist. Sector-specific legislation also continues to apply in areas such as financial services and healthcare. Mutual recognition of QES removes legal barriers to signature validity across borders, but organisations should verify which additional requirements apply in each jurisdiction and sector. For sectors such as financial services or healthcare, where cross-border transactions and regulatory compliance go hand in hand, this mutual recognition significantly reduces legal complexity and the cost of managing multiple local signing solutions, even as sector-specific obligations remain in place.
What do organisations need to do to comply with eIDAS 2.0 QES requirements?
To comply with eIDAS 2.0 QES requirements, organisations need to verify that their electronic signature solution uses certificates from a listed QTSP, meets the current technical reference standards, and integrates correctly with their identity verification and document management workflows. Compliance is an ongoing responsibility as implementing regulations continue to be updated.
A practical compliance checklist includes the following steps:
- Audit your current signing solution: Check whether your existing provider is listed on the relevant national trusted list, as reflected in the LOTL, and whether their service qualifies as a QES under eIDAS 2.0.
- Review your identity verification process: QES requires a verified identity. Ensure your onboarding or identity proofing process meets the assurance level required for qualified certificate issuance.
- Align with current technical standards: Review the implementing regulations and the ARF relevant to your use case, including those covering certificate formats, validation, and preservation. The implementing regulations contain the legally binding requirements; the ARF provides the technical elaboration.
- Prepare for EUDI Wallet integration: As wallet adoption develops in phases across Member States toward the 24 December 2026 deadline for public availability, plan for how your signing workflows will connect with wallet-based identity attributes and which use cases are relevant to your sector and jurisdiction.
- Maintain an audit trail: Ensure every signed document is accompanied by a complete and tamper-evident record of the signing event, including identity verification data and a timestamp.
- Monitor regulatory updates: eIDAS 2.0 is accompanied by a large set of implementing regulations that are still being finalised. Assign responsibility for tracking these updates within your compliance team.
Organisations in regulated sectors face additional complexity because QES requirements intersect with other regulations such as GDPR, AML, KYC, and sector-specific rules. A coordinated approach that addresses identity, compliance, and signing as a connected workflow is more effective than treating each requirement in isolation.
How TrustTech supports eIDAS 2.0 qualified electronic signatures
Navigating the eIDAS 2.0 QES requirements is complex, particularly when your organisation also needs to meet overlapping obligations around KYC, AML, GDPR, and sector-specific regulations.
The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
For QES workflows specifically, the ID Connector handles:
- Identity-linked signatures: Every qualified electronic signature is tied to a cryptographically verified identity, giving you a complete and tamper-evident record of who signed what and when.
- Reusable verified identity: Once a customer or employee is verified, that verified identity can be reused across signing scenarios, reducing friction and eliminating repeated checks.
- Verification against trusted lists: The ID Connector verifies issuer signatures against the relevant national trusted lists as reflected in the LOTL, checks revocation status through issuer-provided status information, and validates wallet unit attestations to confirm that a presenting wallet runs on a certified wallet solution.
- Qualified signing via a connected QTSP: The ID Connector connects to a QTSP for qualified signature creation, keeping the signing process within the eIDAS 2.0 framework.
- Registered attribute scope: The ID Connector operates within the attribute scope registered by the relying party under CIR (EU) 2025/848, so only the data that has been declared for a given intended use is requested from the wallet.
TrustTech works with organisations in financial services, government, healthcare, and pharma. Get in touch with TrustTech to discuss your QES requirements and find out how the ID Connector fits into your digital signing workflow.