eIDAS Guide: how to achieve compliance?

What is eIDAS?

eIDAS creates a single framework for electronic identities and trust services to be recognised across the entire Union. Its objective: to secure digital transactions and give them clear legal value, by replacing the fragmentation of national rules.

It distinguishes between electronic identification (proving who you are online, with low, substantial, and high assurance levels) and trust services (signature, seal, timestamping, electronic registered delivery, website authentication certificates).

The 2024 revision, known as eIDAS 2, marks a turning point: it introduces the European Digital Identity Wallet, which will allow every citizen and business to store and present identity attributes in a secure and interoperable manner.

Electronic signature levels

The choice of signature level is decisive: it determines the legal value and the level of proof. Using a level ill-suited to the stakes is a common and risky mistake.

The higher the legal stakes, the higher the signature level must be: the qualified signature offers the strongest presumption of reliability.

Trust services

eIDAS covers several trust services, each of which may be 'qualified' (subject to strict requirements and benefiting from a reinforced legal presumption).

• Electronic signature: commitment by a natural person.
• Electronic seal: equivalent for a legal entity (guarantees origin and integrity).
• Electronic time stamp: proof of the date and time of a document.
• Electronic registered delivery service: equivalent of registered postal mail.
• Website authentication certificates: guarantee the identity of a website.

eIDAS 2 and the digital identity wallet

The eIDAS 2 revision extends the framework and introduces a major building block: the European Digital Identity Wallet (EUDI Wallet).

• Each Member State will be required to offer a digital identity wallet to citizens and businesses.
• The wallet will enable users to identify themselves and share attributes (qualifications, licences, etc.) in a secure manner.
• Many services (including certain major private players) will be required to accept this wallet.
• Data protection (GDPR) is central to its design.

What penalties apply in the event of non-compliance?

eIDAS combines legal considerations (probative value) with obligations for trust service providers, whose infringements may lead to penalties and loss of qualified status.

How to achieve compliance: the 6-step roadmap

Step 1 — Map your trust requirements

Identify the processes that require signature, seal, timestamp or electronic identity: contracts, HR, invoices, legal deeds, access to services.

For each one, assess the legal stakes and the level of proof required.

• List the documents and processes to be signed or sealed.
• Assess the legal stakes of each one.
• Identify your electronic identification needs.

Step 2 — Choose the right signature level

Match the level (simple, advanced, qualified) to the stakes: a simple consent does not require a qualified signature, but a high-stakes deed does. This is the most structurally significant choice.

Document your internal rules to avoid level errors.

• Reserve the qualified signature for high-stakes deeds.
• Use the advanced signature for most contracts.
• Formalise an internal signature policy.

Step 3 — Select appropriate service providers

Select reliable trust service providers and, for qualified use cases, qualified providers listed on the national trust lists.

Qualified status carries a strong legal presumption.

• Verify the provider's status (qualified or not).
• Consult the official trust lists.
• Align the provider with the required level.

Step 4 — Deploy and integrate the tools

Integrate signature and trust services into your workflows (contracts, HR, invoicing) and train your teams on their proper use.

Proper integration prevents workarounds and preserves evidential value.

• Integrate trust services into your processes.
• Train teams on the correct use of signatures.
• Retain the associated evidence and logs.

Step 5 — Prepare for eIDAS 2 and the digital wallet

Prepare for the arrival of the European digital identity wallet: identify whether you will be required to accept it, and how to integrate it into your services and data management.

Stakeholders concerned have every interest in anticipating this structurally significant development.

• Assess whether you will be required to accept the identity wallet.
• Prepare the technical integration and user journey.
• Align this integration with GDPR.

Step 6 — Align with GDPR

Electronic identity and trust services process personal data: secure the legal basis, information obligations, data minimisation and security.

The identity wallet, in particular, calls for strong vigilance on data protection.

• Link these processing activities to your GDPR register.
• Apply minimisation to identity data.
• Secure the processing of shared attributes.

Common mistakes to avoid

• Choosing a signature level unsuited to the stakes, exposing the document to challenge.
• Believing that any electronic signature is equivalent to a handwritten signature (only the qualified signature carries that equivalence by law).
• Using a non-qualified provider for a use case that requires qualified status.
• Overlooking the interplay with GDPR regarding identity data.
• Ignoring eIDAS 2 and the forthcoming European digital identity wallet.
• Failing to retain the evidence and logs associated with signatures.