Advanced electronic signature (AES)

What does Advanced electronic signature mean?

An advanced electronic signature (AES) is the middle tier of electronic signature defined by the EU's eIDAS regulation, sitting between simple and qualified signatures. To count as an advanced e-signature, it must meet four requirements set out in Article 26: it is uniquely linked to the signatory, it is capable of identifying the signatory, it is created using signature creation data the signatory can use under their sole control with a high level of confidence, and it is linked to the signed data so that any subsequent change is detectable.

In practice, most AES implementations rely on digital signature technology. The signer's identity is verified in some way, a key pair is associated with them, and the document is cryptographically signed so tampering breaks the signature. The level of identity checking varies by provider; it might involve an ID document check, a bank login, or a certificate issued after verification.

Consider a recruitment agency in the Netherlands placing contractors with clients across the EU. For higher-value framework agreements, the agency's clients ask for signatures that tie each contractor to a verified identity. An AES workflow, with ID verification before signing and a certificate-based signature on the PDF, gives both sides more confidence than a typed name.

A common misconception is that an AES has the same legal effect as a handwritten signature everywhere in the EU. That automatic equivalence belongs only to the qualified electronic signature. An AES is still just admissible evidence under Article 25, though generally stronger evidence than a simple signature because of the identity and integrity guarantees. Another myth is that AES is a US concept. US law under the ESIGN Act and UETA does not define tiers at all.

People also sometimes think that recording a document hash is enough to make a signature advanced. Detecting changes is only one of the four criteria. Without reliable identification of the signer and sole control over the signing data, a signature remains simple, however good its audit trail.

Our take: AES is a useful middle ground for cross-border deals and documents with real money or regulatory exposure. It is overkill for most routine paperwork, and vendors that label every signature advanced without explaining how they meet each criterion deserve some scepticism.

eSignSimple does not provide advanced electronic signatures today. We offer simple electronic signatures backed by an audit trail, a certificate of completion and a SHA-256 hash checkable on our /verify page. Identity verification features are on our roadmap.

What is an example of advanced electronic signature?

A German bank asks a business customer to sign a credit agreement with an advanced electronic signature. The customer verifies their identity by video call with the bank's provider, receives a certificate bound to their identity, and signs; the resulting PDF detects any later change. eSignSimple does not offer this level: our signatures are simple electronic signatures without identity checks or signer certificates.

How is each AES requirement met in practice?

Uniquely linked to the signatory and capable of identifying them: providers verify identity before issuing signing credentials, using an ID document check, a video call, a bank login or a national eID, then bind a certificate to that verified person. Under the signatory's sole control with a high level of confidence: the private key sits on a smart card or token the signer holds, or on a remote server where using it requires the signer's own strong authentication, typically a one-time code or app approval on top of a password. Linked to the data so changes are detectable: the signature is a cryptographic seal over the document's hash, usually embedded in the PDF in a standard format such as PAdES.

The weak point in many implementations is the second requirement. If the provider could sign on the user's behalf without their authentication, or if keys are shared across users, it becomes hard to argue the signer had sole control. That is a technical detail worth asking about rather than assuming.

AES vs a simple signature with a strong audit trail: where is the real gap?

A well-run simple signature already covers integrity and much of the timeline: a recorded hash shows the file is unchanged, and the audit trail shows the email, IP address, device and time. The gap is identity. A simple signature shows that someone with access to a particular inbox signed; an advanced one shows that a person whose identity was checked, using credentials only they control, signed. If your realistic risk is someone denying they were the person behind an email address, that gap matters. If your realistic risk is a dispute about what was agreed, it usually does not.

That is why AES is common in financial onboarding and high-value cross-border deals and rare in freelance contracts or HR acknowledgments. Before paying for it, ask whether anyone has ever actually disputed identity on that type of document in your business. Our simple electronic signature page covers what strengthens the lower tier.

How can you tell whether a vendor's signature is really advanced?

Ask four questions, one per requirement. How do you verify the signer's identity, and is that check done before every signature or once at enrolment? Where is the signing key kept, and can anyone other than the signer trigger its use? What certificate is issued, by whom, and does it appear in the signed PDF? And in what format is the signature embedded, and can a standard PDF reader validate it without your platform?

If the answers are vague, or the advanced label rests only on an audit trail and a hash, the product is most likely offering simple signatures with good evidence, which is fine but not the same thing. A signed sample you can open in an independent PDF reader is the quickest test: a genuine AES shows the signer's certificate and its issuer. Our PKI entry explains the certificate chain you should see.

Which terms are related?

• Digital signature: A digital signature is a cryptographic mechanism that uses public key infrastructure to prove who signed a document and that it has not changed.
• eIDAS: eIDAS is the EU regulation (No 910/2014) on electronic identification and trust services, including electronic signatures.
• Simple electronic signature (SES): A simple electronic signature is the basic eIDAS level: data in electronic form used by a signer to sign, such as a typed or drawn signature.
• Qualified electronic signature (QES): A qualified electronic signature is an advanced signature created with a qualified device and backed by a qualified certificate from a QTSP.
• Public key infrastructure (PKI): PKI (public key infrastructure) is the system of certificate authorities, digital certificates and key pairs that binds public keys to real identities.