eIDAS, stated plainly

Qualified vs advanced electronic signature: what the law actually says

“Advanced” and “qualified” describe electronic signatures in the same regulation. Which one you have changes what you can assert about it — and neither category is what most summary pages say.

The short answer

Article 25(1) of Regulation (EU) No 910/2014 protects every electronic signature: none may be denied legal effect and admissibility as evidence in legal proceedings solely for being electronic. The distinction is not lawfulness. It is what each signature can assert at face value, and which one carries a statutory presumption.

An advanced electronic signature (article 3(11)) has met the article 26 requirements. A qualified electronic signature (article 3(12)) is an advanced one created by a qualified signature creation device, based on a qualified certificate. Only the qualified signature has, under article 25(2), the equivalent legal effect of a handwritten signature.

The four requirements article 26 sets

Article 26 requires that the signature (a) is uniquely linked to the signatory, (b) is capable of identifying the signatory, (c) is created using signature creation data the signatory can, with a high level of confidence, use under their sole control, and (d) is linked to the signed data so that any subsequent change is detectable.

Whether a given signing flow meets each of the four is a factual question about the flow. It is exactly where an e-signature service should be able to show the receipts: how the link was issued, whether one-time codes were bound to a single signer, what the record ties to the document. The honest answer to "is this an advanced signature?" is a demonstration, not a claim.

What changes, legally, between the two

Both are electronic signatures, so both get the article 25(1) floor: no denial of legal effect or evidentiary admissibility merely for being electronic. Beyond that floor, the regulation gives nothing to the advanced signature by name.

The qualified signature carries the equivalence rule: article 25(2) states it has the equivalent legal effect of a handwritten signature. The word "equivalent" is doing statutory work — it is the reason member-state regimes that require a qualified signature will not settle for an advanced one.

The same asymmetry appears on the timestamp side: an electronic time stamp cannot be denied effect (article 41(1)); a qualified one enjoys the presumption of accuracy and data integrity (article 41(2)). Proof quality is graded; lawfulness is not.

Portugal, specifically

Decreto-Lei n.º 12/2021 regulates electronic documents in national law. Its article 3(2) attaches a legal presumption to the qualified electronic signature, and article 3(5) gives electronic documents the probative force of signed private documents under article 376 of the Civil Code.

For documents that are not tied to a qualified trust service, article 3(10) leaves the evidentiary assessment to general law — unless the parties agreed on the document's probative value in the contract itself. In practice: an advanced signature with strong evidence is normal working matter for commercial contracts; a notarial deed or an act where civil law requires qualified assurance is not in that bucket.

The United States, for contrast

Federal law has no tier. The ESIGN Act, 15 U.S.C. §7001(a), provides that a signature or record relating to a transaction in or affecting interstate or foreign commerce may not be denied legal effect, validity, or enforceability solely because it is in electronic form. There is no U.S. equivalent of the qualified layer; the questions there are about consent to electronic form under §7001(c) and about state law where applicable.

When a qualified signature is genuinely required

Where the receiving party or the member state's law asks for it: notarial deeds and instruments, civil-register acts, some public-sector services. The right question before any signing project is "what does the counterparty's regime require here?" — not "which tier sounds stronger?".

One more honest distinction: if a workflow needs qualified signatures, a service that only produces advanced signatures should say so (this one does, on its own homepage). If someone insists every signature needs a certificate from a qualified provider "to be binding", ask them for the article of law, because article 25(1) does not say that.

Three myths, one line each

"Advanced signatures are not legally valid." Wrong article: article 25(1) protects their legal effect and admissibility explicitly.

"Everything must be qualified." Article 25(2) grants equivalence to the qualified signature; it nowhere makes the qualified tier a condition for enforceability.

"Electronic means equally strong." No: admissibility is the floor; the presumption and equivalence rules depend on the tier and on the instruments involved (articles 25(2) and 41(2)).

Sources

  • Regulation (EU) No 910/2014, articles 3(11), 3(12), 25, 26, 41 — CELEX 32014R0910.
  • Decreto-Lei n.º 12/2021 (Portugal), article 3.
  • Código Civil português, artigo 376.º.
  • ESIGN Act, 15 U.S.C. §7001.

This is an explanation of the legal framework, not legal advice.

Read next

What a PAdES B-T signature actually proves (and what it does not)

The technical half: what a PAdES B-T evidence pack asserts, byte by byte.