Concept Definition
What is a qualified electronic signature?
A Qualified Electronic Signature (QES) is the highest level of electronic signature under the EU eIDAS Regulation. It is created using a Qualified Electronic Signature Creation Device (QESCD) and a Qualified Certificate issued by an EU Trust Service Provider. QES has the same legal effect as a handwritten signature across all EU member states.
What is required to create a QES?
A QES requires three components under eIDAS:
- Qualified Certificate: Issued by an EU Trusted List (EUTL) Trust Service Provider (TSP) after identity verification.
- QESCD: A Qualified Electronic Signature Creation Device (typically a smart card or USB token or cloud HSM).
- Signing application: Software that uses the QESCD to create the signature.
Frequently Asked Questions
- Is a QES required for e-invoicing?
- No. QES is not mandatory for standard e-invoicing. The EU VAT Directive permits multiple methods to ensure invoice authenticity and integrity. QES is one option but most e-invoicing implementations use audit trails, EDI controls, or transport security rather than document-level QES.
- Where can Qualified Trust Service Providers be found?
- The European Union Trusted List (EUTL) published by each member state and the EU Commission lists all qualified trust service providers. These providers are authorized to issue qualified certificates, timestamps, and other qualified trust services within the EU.