What is a qualified electronic signature under eIDAS 2.0?

A qualified electronic signature (QES) is the highest level of electronic signature recognised under the eIDAS regulation. It carries the same legal effect as a handwritten signature across all EU Member States and is the only signature type that automatically achieves this equivalence by law. Under eIDAS 2.0, which amends Regulation (EU) 910/2014, the rules around how QES is created and accepted are being updated to reflect new technologies, including the European Digital Identity Wallet. This article walks through the key questions organisations need to understand about qualified electronic signatures today.

How does a qualified electronic signature differ from other eIDAS signature types?

A qualified electronic signature is the strongest of the three signature types defined under eIDAS. The other two are simple electronic signatures (SES) and advanced electronic signatures (AdES). The key difference lies in the level of identity assurance, the technical requirements, and the legal presumption attached to each type.

A simple electronic signature is essentially any electronic indication of intent, such as typing your name in a form or clicking an “I agree” button. It offers minimal security and limited legal standing. An advanced electronic signature goes further: it must be uniquely linked to the signer, capable of identifying them, created using data under the signer’s sole control, and linked to the signed data in a way that makes any subsequent changes detectable. However, it does not automatically carry the same legal weight as a handwritten signature across all Member States.

A qualified electronic signature adds two further requirements on top of AdES: it must be created using a qualified electronic signature creation device (QSCD) and based on a qualified certificate issued by a Qualified Trust Service Provider (QTSP) listed on a national trusted list, with those lists brought together in the EU List of Trusted Lists (LOTL). This combination is what gives QES its automatic legal equivalence to a handwritten signature throughout the EU.

What legal value does a qualified electronic signature carry under eIDAS 2.0?

Under the eIDAS regulation, a qualified electronic signature has the same legal effect as a handwritten signature in all EU Member States. No Member State may refuse to recognise a QES that meets the regulation’s requirements, which makes it uniquely powerful for cross-border transactions. It is worth noting that eIDAS establishes the legal effect of the signature itself, while national form requirements for specific document types continue to apply alongside it.

This legal equivalence matters considerably in practice. A contract signed with a QES in the Netherlands is legally binding in Germany, France, or any other EU country without requiring additional authentication steps or local notarisation, provided that no national form requirement demands a different formality. For organisations operating across borders, this removes a significant source of legal uncertainty.

eIDAS 2.0, which amends Regulation (EU) 910/2014 through Regulation (EU) 2024/1183, reinforces and extends this framework. It does not weaken the legal standing of QES, but broadens the ecosystem in which it can be used, particularly by connecting it to the European Digital Identity Wallet. The regulation also strengthens oversight of Qualified Trust Service Providers, which further supports the reliability and enforceability of QES-based transactions.

What are the requirements for issuing a qualified electronic signature?

Issuing a qualified electronic signature requires meeting a specific set of technical and regulatory conditions. Three elements must be in place: a qualified certificate, a qualified electronic signature creation device, and a Qualified Trust Service Provider to issue the certificate.

• Qualified certificate: This is a digital certificate that binds the signer’s identity to a cryptographic key. It must be issued by a QTSP that appears on a national trusted list and must meet the requirements set out in eIDAS, including verification of the certificate holder’s identity.
• Qualified electronic signature creation device (QSCD): This is a secure hardware or software environment in which the private signing key is stored and used. The key must never leave the QSCD in a usable form. Common examples include hardware security modules (HSMs) and smart cards.
• Identity verification: Before a qualified certificate can be issued, the identity of the signer must be verified to a high level of assurance. This typically involves face-to-face verification or an equivalent remote process approved under eIDAS.
• Qualified Trust Service Provider (QTSP): Only a QTSP that is officially supervised and listed on a national trusted list may issue qualified certificates. These providers are subject to regular audits and conformity assessments.

Under eIDAS 2.0, remote management of QSCDs is being formally recognised as a qualified trust service. This means that cloud-based signing solutions can now qualify as QSCDs under certain conditions, making QES more accessible without reducing its security guarantees. Remote signing was technically possible under the original eIDAS regulation, but eIDAS 2.0 resolves previous ambiguity by explicitly classifying remote QSCD management as a qualified trust service.

Which use cases and documents require a qualified electronic signature?

Not every document requires a qualified electronic signature, but certain legal and regulatory contexts either require it explicitly or make it the most appropriate choice. QES is typically required or strongly recommended when the stakes are high, legal enforceability must be unambiguous, or cross-border recognition is essential.

Common use cases where QES is either required or highly recommended include:

1. Financial services contracts: Opening accounts, loan agreements, and investment mandates often require the highest level of signature assurance to meet KYC, AML, and PSD2 obligations.
2. Healthcare and pharmaceutical consent: Informed consent documents, clinical trial agreements, and prescription authorisations in regulated settings benefit from QES to ensure legal validity and auditability.
3. Government and public sector transactions: Applications for official documents, procurement contracts, and public service agreements increasingly require QES, particularly in cross-border contexts.
4. Employment contracts: In several EU Member States, employment agreements must be signed with a legally equivalent signature, making QES the appropriate choice for remote hiring.
5. Real estate and notarial acts: Some jurisdictions require QES or an equivalent for property transactions, especially when conducted digitally.

For organisations in financial services or healthcare, understanding exactly where QES is required versus where a lower signature type suffices is an important part of compliance planning. Using QES where it is not required adds unnecessary friction, while using a lower-grade signature where QES is required creates legal risk.

How does eIDAS 2.0 change the way qualified electronic signatures are created?

eIDAS 2.0 introduces two significant changes to how qualified electronic signatures are created. First, it formally recognises remote signing using cloud-based QSCDs as a qualified trust service. Second, it integrates QES creation with the European Digital Identity Wallet, enabling citizens and businesses to sign documents directly from their wallet.

Under the original eIDAS regulation, QSCDs were typically physical devices such as smart cards or USB tokens. Remote signing existed before eIDAS 2.0, but operated in a grey area regarding qualification. eIDAS 2.0 resolves this by explicitly classifying the remote management of QSCDs as a qualified trust service. This means a QTSP can now host and manage a signing key on behalf of a user in a certified cloud environment, and the resulting signature still qualifies as a QES.

The connection to the EUDI Wallet is equally significant. Citizens will be able to use their wallet to authenticate themselves and trigger a qualified signature without needing a separate smart card or token. Governance of the EUDI Wallet is a shared responsibility: the European Commission manages the legal framework and adopts implementing acts containing the binding requirements, while EU Member States are responsible for providing or mandating wallet solutions, certifying and notifying them, and supervising actors within their jurisdiction. The European Digital Identity Cooperation Group supports cross-border alignment, and qualified trust service providers, wallet providers, and relying parties each carry defined roles within the ecosystem. For organisations, this means that the user experience of signing with QES can become considerably smoother, while the legal and technical guarantees remain fully intact. The wallet becomes the interface through which identity is verified and signatures are authorised.

These changes lower the barrier to adoption. Cloud-based QES solutions are easier to integrate into digital workflows, and wallet-based signing reduces the need for users to manage physical devices. Organisations exploring digital identity solutions should factor these changes into their technology planning now.

How should organisations prepare to accept and issue qualified electronic signatures?

Organisations should start preparing for qualified electronic signatures by mapping their existing signature workflows against eIDAS requirements, identifying where QES is legally required, and selecting a Qualified Trust Service Provider that fits their technical and compliance needs.

A practical preparation roadmap looks like this:

1. Audit your current signing processes: Identify which documents and workflows use electronic signatures today and assess whether the current signature type meets legal requirements.
2. Determine where QES is required: Work with legal and compliance teams to clarify which transactions require QES under applicable law, sector regulation, or contractual obligation.
3. Select a Qualified Trust Service Provider: Choose a QTSP that is listed on a national trusted list and whose services align with your technical infrastructure, volume requirements, and sector-specific needs.
4. Plan for EUDI Wallet integration: The legal deadline for Member States to meet their wallet obligations is 24 December 2026. Practical interoperability and national rollout are expected to develop in phases, and the level of maturity across individual Member States may vary. Organisations should monitor national developments and assess how their signing workflows will connect with wallet-based authentication and signature initiation as rollout progresses, rather than waiting for a single European go-live moment.
5. Update your audit and record-keeping processes: QES requires a complete and long-term verifiable audit trail. Ensure your systems can store and retrieve signed documents in a way that preserves their legal validity over time.
6. Train relevant teams: Compliance, legal, IT, and customer-facing teams all need to understand what QES means, when to use it, and how to handle it in practice.

Organisations in government and other regulated sectors should also monitor national implementation of eIDAS 2.0, as Member States may introduce sector-specific requirements on top of the EU baseline. Cross-border use of the EUDI Wallet framework is designed so that a certified wallet from one Member State can be used with an appropriate relying party in another Member State, but this does not mean that every use case will be immediately available everywhere, that national registration requirements disappear, or that sector-specific legislation ceases to apply. Under CIR (EU) 2025/848, adopted on 6 May 2025, relying parties must register with the national authority of their Member State of establishment before requesting wallet data, and that registration is connected to the applicable national framework. Staying close to supervisory guidance and industry working groups will help organisations stay ahead of changes.

How TrustTech supports qualified electronic signatures

The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.

In the context of qualified electronic signatures, the ID Connector handles several concrete functions:

• Identity-linked signing: Every qualified signature initiated through the ID Connector is cryptographically tied to a verified identity, creating a tamper-evident record of who signed what and when.
• Verification against trusted lists: The ID Connector verifies issuer signatures against the relevant national trusted lists, checks revocation status using issuer-provided status information, and validates wallet unit attestations to confirm that the presenting wallet runs on a certified wallet solution.
• eIDAS 2.0 readiness: The ID Connector is built to align with eIDAS 2.0 requirements, including support for remote QSCD management and EUDI Wallet integration as it becomes available.
• Reusable verified identity: The ID Connector enables organisations to reuse verified identity data across workflows, reducing friction without compromising assurance levels.
• Qualified signing via a connected QTSP: The ID Connector connects to a QTSP for qualified signing workflows. TrustTech does not itself issue qualified certificates or qualified electronic signatures.
• Registered attribute scope: The ID Connector enforces the attribute scope registered by the relying party under CIR (EU) 2025/848, ensuring that only the data covered by the registered intended use is requested from the wallet.

The ID Connector is relevant for organisations in financial services, healthcare, pharma, and government, where QES workflows must meet both the technical requirements of eIDAS and the operational demands of regulated environments. If your organisation is ready to move from understanding qualified electronic signatures to implementing them, get in touch with TrustTech to discuss your specific situation.