Digital processes have become standard practice in most companies and public authorities. Whether contracts, official notices, certificates or approval workflows: more and more processes are being handled digitally. But when a document no longer exists in physical form, the requirements for trustworthiness, legal certainty and verifiability increase. This is where eIDAS comes into play: the European legal framework defines how Digital identities, signatures, seals and other trust services must be designed to be legally binding and secure.
eIDAS provides the foundation for trustworthy digital transactions. It is therefore essential for companies and public authorities that want to make their processes not only digital, but also legally compliant and scalable. The question is not whether eIDAS will become relevant, but how organizations can implement its requirements in practice.
That is why it is worth clarifying the following questions early on:
- Which processes are affected by eIDAS?
- Which trust services are suitable?
- Which technical, legal and organizational questions must be answered before implementation?
This article provides practical guidance, focusing on what really matters to you.
eIDAS stands for electronic Identification, Authentication and trust Services. The regulation establishes the European framework for electronic identification and Trust services. The regulation has applied in all EU member states since 2016 and defines standards for:
- Electronic signatures (for natural persons)
- Electronic seals (for organizations and public authorities)
- Timestamps (to provide evidence of when a document existed)
- Digital certificates (for identities, keys and chains of trust)
- Validation services (for verifying signatures and seals)
Since May 20, 2024, the revised eIDAS 2.0 has been in force, providing a modernized legal framework for digital processes. Perhaps the biggest change is that, alongside existing trust services, digital identities and tamper-resistant credentials are now also regulated by law. Both are particularly relevant for digital wallets, especially d-you , which is scheduled to become available to all citizens of Germany on January 1, 2027.
Important to understand: eIDAS compliance is not an end in itself. It is not simply about ticking a compliance box. It is about designing digital processes that are:
- legally robust (for example, able to withstand scrutiny in court),
- secure (protected against manipulation),
- verifiable (who signed or approved what, and when?),
- scalable (able to operate reliably even at high volumes).
Which processes are typically affected?
Not every digital process needs to be eIDAS compliant. The legal framework becomes particularly relevant when dealing with legally reliable evidence , meaning documents or transactions that may have legal or organizational significance later on.
Relevant documents and processes for companies (examples):
- Digital contract signing (e.g. with customers, suppliers or partners)
- Customer and supplier onboarding (identity verification, compliance evidence)
- Internal approval workflows (e.g. invoices, budgets, HR documents)
- Compliance evidence (e.g. for audits, certifications or regulatory requirements)
- Digital product and quality certificates (e.g. in industry or healthcare)
- Archiving processes (long-term storage with proof of integrity)
Relevant documents and processes for public authorities and institutions (examples):
- Digital official notices (e.g. tax assessments, building permits)
- Register extracts (e.g. commercial registers, land registers)
- Administrative procedures (e.g. applications, permits)
- Certificates and diplomas (digital credentials with seals)
- Digital records management (e.g. in the judiciary or social administration)
📝 eIDAS becomes relevant whenever digital processes must build trust and ensure legal validity – whether for customers, partners, public authorities or internal stakeholders. It is not just about the signature itself, but also who performed an action, which organization issued a document, and whether its contents have remained unchanged.
Which trust services play a role?
Not every digital process requires the same trust services. The right solution depends on its purpose, target audience and legal requirements. Here is an overview of the most important services and when they are used:
Electronic signatures
Electronic signatures enable individuals to sign documents digitally – from simple approval processes to contracts with demanding legal requirements.
Learn more about electronic signatures
- EES: Easy to implement, but offers a lower level of evidential assurance.
- FES: Meets additional requirements for attribution to the signatory and for detecting subsequent changes.
- QES: Requires a qualified certificate and a qualified signature creation device. Under eIDAS, it has the same legal effect as a handwritten signature. Identification of the person is required.
Electronic seals
Electronic seals confirm the origin and integrity of digital documents and data on behalf of an organization.
Benefits and use cases
- Not linked to a natural person.
- Ideal for automated processes involving large document volumes.
- Under eIDAS, qualified seals benefit from a presumption of data integrity and the correctness of the indication of origin.
Timestamps
Electronic timestamps provide evidence that specific digital data existed at a verifiable point in time.
Learn more about timestamps
- Evidence of a specific point in time.
- Support for documenting time-critical processes.
- Qualified timestamps benefit from the legal presumption of the accuracy of the date and time and of the integrity of the linked data.
Certificates
Digital certificates link identity or organizational information to cryptographic keys, creating a verifiable basis of trust.
What types of certificates are there?
- Qualified certificates: For qualified electronic signatures and seals.
- Seal certificates: For linking a certificate to a legal entity.
- Technical certificates: For example, for servers, systems and secure connections.
Validation services
Validation services verify the validity of electronic signatures and seals and help assess the trustworthiness of digital credentials.
What is checked during validation?
- Integrity of signed or sealed data.
- Validity and status of the relevant certificates at the applicable point in time.
- Compliance with the relevant technical and legal requirements.
Process design: Which questions should organizations clarify first?
- Business and operational questions
- Which process should be digitized? (Prioritize by urgency and benefit)
- Which steps are legally or organizationally critical? (e.g. approvals, evidence)
- Who must sign, seal, verify or approve? (Roles and responsibilities)
- Which records must be auditable later on? (e.g. for compliance or court proceedings)
- What volumes are expected? (Scalability is crucial)
- Legal and compliance questions
- Which type of signature or seal is required? (Simple, advanced or qualified?)
- Are there industry-specific requirements? (e.g. in healthcare, financial services or critical infrastructure)
- What evidence and retention obligations apply? (e.g. GoBD, GDPR)
- Which requirements apply in the EU, Switzerland or other jurisdictions? (eIDAS vs. ZertES)
- How is data protection addressed? (e.g. when storing signature data)
- Technical questions
- Which systems must be connected? (DMS, ERP, CRM, specialized applications)
- Are APIs required? (For integration into existing workflows)
- How are certificates and keys managed? (Key management is critical for security)
- How are validation and status checks performed? (Automatically or manually?)
- How are timestamps integrated? (For verifiability and compliance)
- Which deployment models are possible? (Cloud, private cloud, hybrid, on-premises)
Why electronic seals are particularly relevant for organizations
While electronic signatures primarily concern natural persons, electronic seals play a central role for organizations. The reason: seals are not tied to an individual but to the legal entity itself – ideal for automated processes that handle large numbers of documents.
Typical use cases for electronic seals:
- Automatically generated documents, e.g. insurance policies and official certificates
- Register extracts, e.g. commercial registers and land registers
- Invoices and delivery documents
- Digital credentials and certificates, e.g. certificates or proof of quality,
Benefits of electronic seals:
✅ Scalable – ideal for high volumes.
✅ Legally reliable – comparable to an official authority seal or company stamp
✅ Automatable – no manual signature required.
✅ Organization-based – linked to the institution rather than an individual.
For companies and public authorities implementing automated processes at scale, electronic seals are often a better choice than signatures. They enable efficient, legally reliable workflows without manual intervention.
Scaling and integration: Why infrastructure matters
eIDAS-compliant processes must not only meet legal requirements but also run reliably from a technical perspective, particularly with high volumes or complex integrations. An infrastructure designed for trust services can provide substantial support. When setting up such an infrastructure, the following requirements should be considered:
| Requirement | Why is it important? |
|---|---|
API capability | Enables seamless integration with DMS, ERP, CRM or specialized applications. |
Performance | Must operate reliably and consistently even at high volumes, such as several thousand signatures per day. |
Multi-tenancy | Enables separate management of multiple organizations, for example for service providers or corporate groups with subsidiaries. |
Monitoring & SLAs | Supports high availability, early detection of disruptions and contractually agreed response times. |
Audit logging | Provides traceable records of relevant activities and supports compliance requirements and process verifiability. |
Key management | Critical to security: Cryptographic keys must be securely generated, stored and managed, and protected against unauthorized access. |
Deployment models | Cloud, private cloud, hybrid or on-premises – depending on individual security, infrastructure and compliance requirements. |
eIDAS 2.0, the EUDI Wallet and digital credentials: What is changing?
eIDAS is evolving. With eIDAS 2.0, digital identities and verifiable credentials are moving into focus. Here is a brief overview of the most important developments:
EUDI-Wallet (European Digital Identity Wallet), known as “d-you” in Germany
The EUDI Wallet is a digital wallet that allows citizens to securely manage and present their identity and credentials, such as driving licences or professional qualifications, across borders. All EU member states are required to provide at least one wallet.
For companies and public authorities, the EUDI Wallet enables fast, secure digital identification and the paperless issuance, provision and verification of digital credentials. This simplifies and accelerates processes while eliminating breaks between digital and paper-based workflows.
Verifiable Credentials
Verifiable Credentials (VCs) are digital, machine-readable and cryptographically verifiable credentials, such as university certificates or vaccination records. They enable quick, automated verification of authenticity and integrity, reduce manual verification work and can be easily integrated into digital processes.
How they work with existing trust services
Electronic signatures, seals and timestamps will remain relevant and will be complemented by digital identities and credentials. For example, an official digital notice could be electronically sealed and then provided in a citizen’s EUDI Wallet.
What does this mean for companies and public authorities?
Companies and public authorities should check at an early stage whether their existing signature, seal and certificate processes are wallet-compatible. Flexible API interfaces, integration of Verifiable Credentials and compliance with the new eIDAS 2.0 requirements are key. This enables organizations to lay the foundations for future-proof digital processes.
Checklist: What should companies and public authorities review now?
Before implementation, this checklist can help clarify the most important points:
✅ Process analysis
Which processes require legally reliable digital evidence? Where are paper, PDFs or manual checks still used today?
✅ Trust services
Which processes require signatures, seals or timestamps? Which security level (simple, advanced or qualified) is required?
✅ Technical integration
Which systems (DMS, ERP, CRM) must be connected? Are APIs needed for automation?
✅ Scalability & performance
What volumes are expected? What performance requirements (e.g. response times) apply?
✅ Compliance & audit
Which legal requirements (e.g. GoBD, GDPR) apply? What retention periods and evidence obligations exist?
✅ Key and certificate management
How are certificates and keys managed securely? Who is responsible for issuance, renewal and revocation?
✅ Deployment model
Should the solution be operated in the cloud, private cloud, hybrid or on-premises? Are there specific compliance requirements (e.g. for critical infrastructure)?
✅ Future readiness
Will processes need to be wallet-ready or credential-ready in the future? Should the infrastructure support multiple tenants (e.g. subsidiaries)?
Which questions should organizations clarify before starting a Verifiable Credentials project?
Before companies or public administrations start using Verifiable Credentials, they should clarify several questions:
Which credentials should be digitized?
Not every credential is suitable for digitization. Organizations should first identify which processes are especially complex and where digital credentials would deliver the greatest benefits.
Who issues the credentials?
The trustworthiness of a credential largely depends on its issuer. Organizations must clarify whether they will act as the issuer themselves or rely on external certification bodies, such as qualified trust service providers.
How are credentials verified?
Verification of VCs should be as automated as possible. Organizations must determine which systems and APIs are required.
Which legal requirements apply?
Verifiable Credentials often have to meet specific legal requirements, for example under eIDAS 2.0 or national regulations such as German signature legislation.
How is the infrastructure operated?
Organizations must decide whether to operate the infrastructure themselves, use a standard solution or work with a partner.
The questions listed above represent only a selection of the issues that may need to be addressed. Successful implementation requires a systematic review of business, technical, legal and economic considerations.
d-you and eIDAS 2.0: What lies ahead for companies and public authorities?
Both developments will significantly advance the use of digital credentials across Europe. For companies and public administrations, this means making their processes wallet-compatible.
d-you will enable citizens to store digital credentials in a standardized wallet, opening up new use cases such as driving licences, professional qualifications and official certificates. Companies and public authorities must ensure that their credentials are technically compatible with the wallet.
eIDAS 2.0 establishes the legal framework for digital identities and trust services in Europe. Organizations must ensure that their credentials comply with the regulation.
Organizations should already be examining the requirements of the EUDI Wallet and eIDAS 2.0. This includes:
- Ensuring that their credentials are wallet-compatible.
- Integrating Trust Services such as signatures and seals.
- Connecting to digital identity ecosystems.
How SIGN8 can support you
eIDAS-compliant digital processes can be complex to implement – but organizations do not have to tackle this alone. SIGN8 provides companies and public authorities with scalable trust service infrastructure that addresses the issues that matter most in practice:
✅ Electronic signatures and seals for legally reliable, automated processes
✅ Certificate management for secure keys and chains of trust.
✅ Timestamp services for verifiable points in time.
✅ APIs & integrations for seamless connections to existing systems.
✅ Timestamp services for verifiable points in time.
✅ Validation services for checking signatures and seals.
✅ Deployment models from Cloud to On-premises, depending on compliance requirements.
✅ EUDI Wallet readiness for future-proof digital identity processes.
Whether your focus is digital contracts, official certificates, compliance evidence or automated high-volume processes, the right infrastructure can help you not only meet eIDAS requirements but also turn them into an opportunity for more efficient and secure operations.
Frequently asked questions about eIDAS-compliant processes
Is eIDAS only relevant to EU companies?
No. Swiss companies that do business with EU partners or operate in the EU must also take eIDAS into account. Switzerland also has the ZertES legislation, which imposes similar requirements.
Do I need a qualified signature for every digital process?
Not necessarily. A qualified signature is only necessary where the law explicitly requires one (e.g. for certain notarized documents). In many cases, advanced signatures or electronic seals are sufficient.
How long are electronic signatures and seals valid?
The legal effect of a signature or seal can remain in place even after its certificate expires, provided the document was signed using a valid certificate at the time. However, timestamps and validation services are important for long-term archiving.
What is the difference between an electronic seal and an electronic signature?
An electronic signature is created by a natural person (e.g. for contracts). An electronic seal is created by an organization or public authority (e.g. for certificates or invoices). Seals are ideal for automated processes.
How can I prepare for eIDAS 2.0 and the EUDI Wallet?
- Review existing processes: Are they wallet-ready?
- Use open standards: APIs and systems should be able to process Verifiable Credentials.
- Plan ahead: eIDAS 2.0 introduces new requirements – early action provides an advantage.
Conclusion
eIDAS forms the foundation for trustworthy digital processes. For companies and public authorities, this means that digitization should focus not only on efficiency, but also on legal certainty, scalability and future readiness.
Implementing regulatory requirements is a strategic process involving legal, technical and organizational considerations alike. Clarifying early on which processes are affected, which trust services are needed and what the infrastructure should look like helps save time and costs and reduce compliance risks later.
This is where the opportunity lies: eIDAS-compliant processes are not just an obligation – they can also provide a competitive advantage. Organizations that make digital workflows secure, verifiable and scalable build trust among customers, partners and public authorities alike.
The first step? Ask the right questions. The next? Build the right infrastructure. Contact us today.
