SES, AES and QES: Understanding Electronic Signature Levels

The EU's eIDAS Regulation defines three levels of electronic signatures: Simple Electronic Signature (SES), Advanced Electronic Signature (AES), and Qualified Electronic Signature (QES). Each level adds requirements that increase the signature's reliability and legal weight. Many non-EU jurisdictions use a similar three-tier framework.

Signature level does not determine privacy compliance; use the [GDPR-compliant electronic signature workflow](/insight/gdpr-compliant-electronic-signature) guide to review the surrounding personal-data processing.

The most basic form of electronic signature. No specific technology or identity verification is required.

Definition. Any data in electronic form attached to or logically associated with other data, used by the signatory to sign. This covers typed names, clicked checkboxes, email confirmations, and scanned signature images.

Legal validity. SES is valid for most transactions under eIDAS Article 25(1). However, it does not carry any special legal presumption. Its evidentiary weight in court depends on the surrounding circumstances: was the signer's email verified? Was an audit trail maintained?

Typical use cases. Internal approvals, NDAs, policy acknowledgements, low-value transactions, consumer click-to-accept. Anywhere the risk of repudiation is low and the cost of stronger signatures is not justified.

Limitations. SES does not prove signer identity (anyone with email access could sign), does not detect document tampering, and is easily repudiated in court. Not suitable for high-value contracts, regulated filings, or documents likely to be disputed.

AES and QES add specific technical and procedural requirements that make signatures more reliable and harder to challenge.

AES — Advanced Electronic Signature. AES must be: (1) uniquely linked to the signatory, (2) capable of identifying the signatory, (3) created using electronic signature creation data under the signatory's sole control, and (4) linked to the document so that any subsequent change is detectable. AES typically uses PKI-based digital signatures but does not require a qualified certificate.

QES — Qualified Electronic Signature. QES meets all AES requirements plus: it is created by a qualified electronic signature creation device (QSCD) and based on a qualified certificate issued by an accredited Trust Service Provider (QTSP). Under eIDAS Article 25(2), QES has the same legal effect as a handwritten signature.

When QES is legally required. Some EU member state laws require QES for specific document types: certain employment contracts, consumer credit agreements, land transfers, and documents requiring notarisation. Outside the EU, similar requirements exist: China's reliable e-signature, Singapore's QES for certain filings, Malaysia's DSA digital signature.

The cost-benefit tradeoff. SES is nearly free. AES adds modest cost (PKI infrastructure, identity verification). QES is the most expensive (qualified certificate, QSCD, QTSP fees). Match the tier to transaction risk: SES for low-risk, AES for standard commercial, QES for high-value or regulated.

Concrete identity proofing requirements and costs for each tier.

Identity proofing time by tier. SES: 0 seconds (no identity proofing required). AES: 30-60 seconds via eKYC (document photo + selfie). AES via national eID: 5-15 seconds (Singpass, iAM Smart). QES: 2-10 minutes first-time (one-time registration with QTSP), then <5 seconds for subsequent signatures. For high-volume operations (100+ signatures/day per signer), QES one-time registration amortises to near-zero per-transaction cost.

Regulatory mapping by document type. EU: consumer credit agreements require QES (Consumer Credit Directive). Employment contracts: AES sufficient in most EU countries. Real estate: QES required in Germany, Spain, Italy; AES accepted in France, Netherlands. APAC: Singapore MAS-regulated products require QES for account opening. Hong Kong: AES for most commercial; QES not available locally (no QTSP). China: CA-backed reliable signature for government filings.

eIDAS keeps identity proofing and signature level as two independent dials.

eIDAS identity levels and the FranceConnect+ edge case. eIDAS separates identity assurance from signature level, into low, substantial and high. France's FranceConnect+ is a useful edge case: it produces a Simple Electronic Signature (SES), yet French authorities treat that SES as equivalent to an Advanced Electronic Signature (AES) based on a qualified certificate, because it layers substantial-level identity authentication on top. It is still not a QES — it lacks a Qualified Signature Creation Device (QSCD) and a qualified certificate from a QTSP.