eIDAS signature legal effect selector workflow

Under eIDAS, an electronic signature cannot be denied legal effect or admissibility as evidence solely because it is electronic or not qualified. That rule prevents automatic rejection; it does not guarantee that any electronic signature proves identity, intent, integrity, or compliance with a national form requirement.

Choose QES when the process needs the eIDAS rule that a qualified electronic signature has the equivalent legal effect of a handwritten signature. Choose AES or AES based on a qualified certificate when the applicable rule and risk accept that level. A qualified certificate adds certificate and QTSP evidence, but AES-QC is not QES unless a qualified electronic signature creation device was also used and all QES conditions are met.

Run the selector before choosing a vendor or signature widget. Record the governing law, transaction type, any statutory or contractual form requirement, the relying party's acceptance rule, and the evidence needed if the signature is challenged.

Then record the selected level and the evidence that supports it. Do not call an outcome QES from the product label alone; the validation record must support the advanced-signature requirements, qualified certificate, issuing QTSP, certificate validity at signing time, QSCD use, and signed-data integrity.

For AES-QC and QES, validation evidence should show more than a cryptographic pass or fail. It should show whether the certificate was qualified at signing time, whether the QTSP and service had qualified status, whether the certificate was valid for the relevant moment, and whether the signature was created with a QSCD where QES is claimed.

Use trusted lists as part of the evidence chain. eIDAS requires Member States to establish, maintain, and publish trusted lists with information about qualified trust service providers and their qualified services; ETSI TS 119 612 defines trusted-list status fields used by validation systems.

Escalate the selector when the transaction is cross-border, public-sector facing, high value, subject to a statutory form, or likely to be disputed. Legal review should determine the governing form rule and whether electronic execution is permitted. Technical and procurement review should then determine whether QES is required, whether AES-QC is enough, whether a non-EU trust service can be recognised, and whether the relying party can validate the evidence.

Do not label a signature as QES unless the record supports all three parts: advanced-signature requirements, qualified certificate status, and QSCD creation. A qualified certificate alone is not enough for QES if the device evidence is missing.