What is an electronic signature on an invoice and what are the legal requirements?
An electronic signature on an invoice is a digital mechanism used to authenticate the identity of the invoice issuer and verify that the invoice has not been altered since signing. EU eIDAS Regulation defines three levels: Simple Electronic Signature (SES), Advanced Electronic Signature (AdES), and Qualified Electronic Signature (QES). For VAT invoice integrity purposes, an Advanced Electronic Signature is sufficient in most EU member states.
What types of electronic signatures are used on invoices?
Invoice signature formats: (1) XAdES (XML Advanced Electronic Signature): XML-based signature for XML invoices (e.g., Italian FatturaPA, ZATCA UBL); (2) PAdES (PDF Advanced Electronic Signature): PDF-embedded signature for PDF invoices; (3) CAdES (CMS Advanced Electronic Signature): PKCS#7/CMS-based detached or enveloped signature. For Peppol invoices, the AS4 transport layer provides message-level signing; individual invoice-level signatures are optional. EU Directive 2006/112/EC (VAT Directive) permits advanced electronic signature as one method of ensuring invoice authenticity and integrity.
Frequently Asked Questions
- Is a Qualified Electronic Signature required for VAT-compliant invoices in the EU?
- A Qualified Electronic Signature (QES) is not universally required for VAT-compliant invoices in the EU. The VAT Directive allows any reliable method that ensures invoice authenticity and integrity, including Advanced Electronic Signatures (AdES) and EDI transmission with agreed controls. QES is typically required only in specific country implementations or for specific document types (e.g., some B2G submissions).
- What certificate is used for signing Italian FatturaPA invoices?
- Italian FatturaPA invoices must be signed using a qualified certificate issued by an Italian Certification Authority (CA) accredited by AgID (Agenzia per l'Italia Digitale). The signature must be an XAdES-BES or CAdES-BES format. The certificate is typically attached to a smartcard or HSM (hardware security module) token. The Agenzia delle Entrate's SDI verifies the signature as part of the invoice validation process.