Advanced electronic signature
An advanced electronic signature (AdES) is an enhanced type of electronic signature defined under the European Union's eIDAS Regulation (EU) No 910/2014, which ensures a higher level of assurance through specific technical and procedural requirements, including unique linkage to the signatory, reliable identification, sole control by the signatory, and detectability of any post-signature alterations to the data.[1] The eIDAS Regulation, adopted in 2014 and effective since 2016, establishes a harmonized framework for electronic identification and trust services across EU member states, categorizing electronic signatures into three levels: simple, advanced, and qualified, with AdES positioned as an intermediate tier offering greater security than basic signatures but without the mandatory hardware or certification of qualified ones.[2] To qualify as an AdES, the signature must satisfy four core requirements outlined in Article 26 of the regulation: it must be uniquely linked to the signatory to prevent unauthorized use; capable of identifying the signatory through verifiable means such as cryptographic keys; created using electronic signature creation data under the signatory's sole control with high confidence in its exclusivity; and linked to the signed data in a manner that any subsequent change is detectable, often achieved via public-key infrastructure (PKI) technologies. These attributes make AdES suitable for scenarios requiring moderate to high assurance without the full rigor of qualified electronic signatures (QES).[2] Legally, an AdES is not denied effect or admissibility as evidence in EU legal proceedings solely because it is electronic or lacks qualified status, providing cross-border recognition and interoperability within the internal market.[1] In contrast to simple electronic signatures (SES), which are basic attachments like scanned images or typed names with minimal verification, AdES incorporates cryptographic protections to enhance integrity and non-repudiation.[2] A QES, however, builds on AdES by requiring creation via a qualified electronic signature creation device (QSCD)—such as a secure hardware token—and a qualified certificate issued by a trusted service provider, granting it equivalence to a handwritten signature in all respects.[1] Compliance with AdES standards is supported by standardized formats like XAdES (XML), CAdES (CMS), and PAdES (PDF), as specified in EU Implementing Decision (EU) 2015/1506, facilitating validation tools and services across member states.[2] AdES is widely applied in business and administrative contexts within the EU, such as signing contracts, invoices, and employment agreements, where it provides sufficient legal validity for most non-high-risk transactions while streamlining digital processes and reducing reliance on paper-based methods.[2] Its adoption supports the EU's digital single market goals by enabling secure remote signing and identity verification, particularly in sectors like finance, healthcare, and public administration, though recognition outside the EU may vary based on bilateral agreements or national laws.[4] As of 2025, ongoing eIDAS 2.0 updates aim to further integrate AdES with emerging technologies like cloud signatures to enhance scalability and user accessibility.[1]Definition and Overview
Definition
An advanced electronic signature, as defined under Regulation (EU) No 910/2014 (eIDAS), is an electronic signature that meets specific criteria to ensure its reliability and integrity. It must be uniquely linked to the signatory, capable of identifying the signatory, created using electronic signature creation data that the signatory can use under their sole control with high confidence, and linked to the signed data in a manner that any subsequent alteration is detectable.[5] This distinguishes advanced electronic signatures from simpler forms, such as basic or simple electronic signatures, which lack these stringent identification and control requirements and do not provide the same level of assurance. While advanced signatures do not inherently require certification from a qualified trust service provider, they form the basis for qualified electronic signatures, which build upon these attributes to achieve legal equivalence with handwritten signatures across the European Union.[5] The primary purpose of advanced electronic signatures is to facilitate secure and efficient electronic transactions by enabling the validation of documents, contracts, and other data with cross-border recognition within the EU, thereby promoting trust in digital interactions without the need for physical presence.[5]Historical Development
The roots of advanced electronic signatures trace back to the 1990s, when Public Key Infrastructure (PKI) emerged as a foundational technology for secure digital communications and encryption key management, enabling the creation of digitally verifiable signatures.[6] In the European Union, early regulatory efforts began with Directive 1999/93/EC, adopted on December 13, 1999, which established a community framework to facilitate the use and legal recognition of electronic signatures across member states, distinguishing between basic and advanced forms to promote interoperability. This directive laid the groundwork for trust services but allowed varying national implementations, highlighting the need for a more unified approach. A pivotal milestone came with the adoption of the eIDAS Regulation (EU) No 910/2014 on July 23, 2014, which replaced the 1999 directive and took full effect on July 1, 2016, standardizing electronic identification and trust services—including advanced electronic signatures—across all EU member states to ensure mutual recognition and seamless cross-border transactions. This regulation defined advanced electronic signatures as those uniquely linked to the signatory, capable of identifying the signatory, created using electronic signature creation data under the signatory's sole control with high confidence, and linked to the signed data in such a manner that any subsequent change is detectable, providing legal recognition and admissibility as evidence in legal proceedings (though equivalence to handwritten signatures is reserved for qualified electronic signatures).[7] Post-2020 developments further advanced the framework through eIDAS 2.0, proposed by the European Commission on 3 June 2021 and entering into force on May 20, 2024, which amends the original regulation to introduce European Digital Identity Wallets for secure, user-controlled management of digital credentials and signatures.[8] Further implementing regulations were published on 30 July 2025, entering into force 20 days later. Member states must ensure that at least one such wallet is made available to natural and legal persons by 3 October 2026.[9][10] Concurrently, the digital signature market has experienced robust growth, projected to reach USD 13.4 billion in 2025, driven by increasing adoption in business processes.[11] This evolution has accelerated the shift from paper-based signing to digital alternatives, improving efficiency in cross-border business by reducing processing times, costs, and logistical barriers while maintaining legal validity.[12]Technical Specifications
Core Requirements
An advanced electronic signature (AdES) under the eIDAS Regulation must satisfy specific mandatory criteria to ensure its reliability, security, and integrity, as outlined in Article 26 of Regulation (EU) No 910/2014. These requirements distinguish AdES from simpler forms by emphasizing the signatory's unique association with the signature and the protection of the signed data against tampering.[1] The four core requirements are:- Uniquely linked to the signatory: The signature must be exclusively associated with the signatory, enabling clear identification and preventing attribution to others.[1]
- Capable of identifying the signatory: It must reliably verify the identity of the individual performing the signing action.[1]
- Created under the signatory's sole control: The signature is generated using electronic signature creation data, such as a private key, that the signatory can employ with a high level of confidence under their exclusive control.[1]
- Detectable alterations to signed data: The signature binds to the data in a manner that any subsequent modification to the data becomes detectable, thereby invalidating the integrity of the signature if changes occur.[1]