If somebody has asked whether your e-signatures are “advanced” or “qualified”, they are using terms with legal definitions rather than marketing ones. This page sets out where the three tiers come from, what each actually requires, which one a UK business needs and what the higher tier costs in money and in friction.
Where the three tiers come from
All three are defined in the eIDAS Regulation, Regulation (EU) No 910/2014 on electronic identification and trust services for electronic transactions in the internal market, retained in UK law after the transition period and amended by the Electronic Identification and Trust Services for Electronic Transactions (Amendment etc.) (EU Exit) Regulations 2019. What remains in force here is usually called the UK eIDAS Regulation, and it is readable on legislation.gov.uk with the UK amendments marked. Alongside it sits section 7 of the Electronic Communications Act 2000, which makes an electronic signature admissible in evidence as to the authenticity or integrity of a communication. Neither instrument tells a UK business to use a particular tier.
| Tier | What it takes to produce | Legal position |
|---|---|---|
| Simple (SES) | A typed name, a tick box or a finger-drawn squiggle: any electronic data used to sign | Valid and admissible; proving it was that person is entirely your problem |
| Advanced (AES) | Cryptography binding the signature to the signer and to the document, meeting Article 26 | Valid and admissible, with far stronger evidence behind it |
| Qualified (QES) | A qualified trust service provider, a certificate issued to a verified individual, a certified device | Equivalent legal effect of a handwritten signature |
Tier one: the simple electronic signature
Article 3(10) defines an electronic signature as “data in electronic form which is attached to or logically associated with other data in electronic form and which is used by the signatory to sign”. That is the whole test: a typed name at the bottom of an email qualifies, and so does a tick box or a finger-drawn mark on a phone. Article 25(1) then says such a signature “shall not be denied legal effect and admissibility as evidence in legal proceedings solely on the grounds that it is in an electronic form or that it does not meet the requirements for qualified electronic signatures”. A simple electronic signature is not second-class law. Its weakness is evidential: if the other side denies signing, you have a screenshot and a story, and they have a denial.
Tier two: what makes a signature “advanced”
An advanced electronic signature is one meeting Article 26, which sets out four requirements. A signature is advanced if:
- it is uniquely linked to the signatory;
- it is capable of identifying the signatory;
- it is created using signature creation data the signatory can, with a high level of confidence, use under their sole control; and
- it is linked to the data signed such that any subsequent change in that data is detectable.
The fourth is the one cryptography can settle: a PAdES seal over the document’s bytes makes any later change to the signed content detectable. The first three are about people and process, and they are where the harder questions sit.
The awkward requirement is sole control. On a remote signing platform the signer holds no signing key of their own: they are identified by a single-use link sent to an address only they should control, and the platform records what they do and seals the result. Whether that amounts to sole control is an argument supported by evidence, not a property of the maths. It is why the audit trail matters as much as the seal: who opened the document, from what address, when, from which IP and device, each event hash-chained to the one before, with the chain’s final value printed on the evidence certificate every party is sent.
Tier three: what a qualified signature actually requires
Article 3(12) defines a qualified electronic signature as “an advanced electronic signature that is created by a qualified electronic signature creation device, and which is based on a qualified certificate for electronic signatures”. In practice that takes three things, and all three must be present: a qualified provider, a qualified certificate that only such a provider can issue, and a qualified device.
A qualified trust service provider
Qualified status is granted by the supervisory body, and the Secretary of State publishes who holds it (Article 22 as it now reads in UK law). You cannot self-declare into this category: the status is conferred, supervised and revocable.
A qualified certificate
Issued by a qualified provider and meeting Annex I, it identifies a named human being whose identity the provider has verified before issue: in person, or by a method giving equivalent assurance. This is the tier’s real substance: an identity somebody regulated has checked and stands behind.
A qualified signature creation device
Annex II requires that the confidentiality of the signature creation data is reasonably assured, that the data cannot with reasonable assurance be derived, that the signatory can reliably protect it against use by others, and that the device neither alters the data to be signed nor prevents it being shown to the signatory beforehand. Annex II also states that generating or managing signature creation data on the signatory’s behalf may only be done by a qualified trust service provider. In practice that means a smart card, a USB token or a certified remote signing service holding the key in hardware.
The one legal difference that matters
It is a single sentence, Article 25(2): “A qualified electronic signature shall have the equivalent legal effect of a handwritten signature.” What that does not do is reverse the burden of proof: the regulation attaches no presumption to a signature, and a handwritten signature can itself be denied. What a QES changes is the strength of the evidence. A regulated provider verified the signer’s identity before issuing the certificate, so a denial is very hard to sustain. With an AES you bring that evidence yourself and argue it. For most commercial documents the evidence is strong and the argument short.
A cross-border point that is rarely mentioned: Article 25(3), which required every EU member state to recognise a QES issued in any other, was omitted from the UK version by the 2019 EU Exit Regulations. A qualified signature from a UK provider no longer carries an automatic right of recognition across the EU, so a European counterparty asking for a QES will usually want one from a provider qualified in the EU.
When a UK business genuinely needs QES
Rarely, and almost always because somebody asked. There is no general UK statutory requirement for a qualified electronic signature. The Law Commission’s 2019 report on the electronic execution of documents concluded that an electronic signature is capable in law of being used to execute a document, including a deed, provided the person signing intends to authenticate it and any formalities relating to execution are satisfied. That is a conclusion about intention and formalities, not about tiers. The formalities are the real constraint: a deed signed by an individual still needs a witness physically present, whatever the signature is made of.
- A counterparty, regulator or scheme has asked for it in writing. The common case, and not really a question about evidence quality: somebody has a rule.
- An EU transaction under a national law that requires it. Several member states mandate QES for particular acts. Those requirements are national and specific, so check the one in front of you.
- A high-value or high-risk instrument where identity checked in advance by a regulated provider is worth the cost and the onboarding delay.
The cost and the friction
QES is uncommon because the friction lands on the wrong person. A qualified certificate is issued to an individual human, so every signer (your customer, your subcontractor, the director on holiday) has to pass identity verification with a qualified provider before signing anything: a video session or an in-person check, then a certificate, then a device or a remote signing account. There is a per-signer cost, and onboarding can take days. For a subcontractor on site at seven in the morning that is not a high bar, it is a closed door, and a QES nobody completes is worth less than a simpler signature everybody does.
Where the other side has a real incentive to deny signing later, identity is the question that matters. Answer it with evidence (full timeline, IP and approximate location, device, hashes before and after sealing), and where the stakes justify it, use a qualified provider. That is the trade, stated plainly.
Where Pixasign sits
Pixasign produces electronic signatures recognised under UK law (section 7 of the Electronic Communications Act 2000 and Article 25(1) of the UK eIDAS Regulation), each on a finished PDF sealed with a DigiCert timestamp and backed by an evidence certificate. They are not qualified electronic signatures: for the everyday paperwork this guide covers, they do not need to be.
Every finished document is sealed with an independent timestamp from DigiCert that covers the whole file: a PAdES document timestamp under ETSI EN 319 142. DigiCert is an independent timestamp authority, so the time your document was sealed is attested by somebody other than us. With it comes an evidence certificate: a hash-chained audit trail, SHA-256 fingerprints before and after sealing, and the signer’s IP, approximate location and device. Anyone can check a sealed document at our free public checker, without an account: it tells you whether Pixasign sealed a file and whether it has changed since.
For everyday business paperwork
Pixasign is £19, £59 or £99 a month inc VAT for 50, 200 or 500 documents, with unlimited users, or free for 1 user and 3 documents a month. Signers never pay and never need an account. If your situation genuinely calls for QES, we will say so rather than sell you this.
See how it works UK company. Documents stored in the EEA.Questions
- Is an advanced electronic signature legally binding in the UK?
- Yes. Under Article 25(1) of the UK eIDAS Regulation an electronic signature cannot be denied legal effect or admissibility simply because it is electronic or because it is not qualified, and section 7 of the Electronic Communications Act 2000 makes electronic signatures admissible as to authenticity and integrity. The Law Commission concluded in 2019 that an electronic signature is capable in law of executing a document, including a deed, where the signatory intends to authenticate it and the relevant formalities are met. What an advanced signature adds over a simple one is the quality of the evidence behind it.
- Do I need a qualified electronic signature to sign a contract in the UK?
- For ordinary commercial contracts, no. There is no general UK requirement for one, and using one would not make a contract more enforceable in an English court than an advanced signature with good evidence behind it. You need QES when a counterparty, a regulator or a scheme asks for it, or when a national law elsewhere mandates it for that act. Some documents carry their own formalities regardless of tier, such as the physically present witness a deed signed by an individual requires, and HM Land Registry sets its own rules about which deeds it accepts electronically. Check the specific requirement in front of you rather than any supplier’s general assurance, ours included.
- What is the practical difference between AES and QES in a dispute?
- Mostly the strength of the identity evidence. A qualified electronic signature has the equivalent legal effect of a handwritten signature under Article 25(2), and a regulated provider verified the signer’s identity before issuing the certificate, so a denial is very hard to sustain. With an advanced electronic signature you establish the link between the signature and the person from your own evidence: the audit trail, delivery to a controlled address, the timeline, the timestamp and the integrity of the document itself. For most commercial documents that settles it quickly.
- Is Pixasign a qualified trust service provider?
- No. Pixacomms Ltd is not a qualified trust service provider and holds no qualified status under the UK eIDAS Regulation, so nothing Pixasign produces is a qualified electronic signature. What it produces are electronic signatures recognised under UK law, on a finished PDF sealed with an independent timestamp from DigiCert, with an evidence certificate that summarises a hash-chained audit trail.