IT and Compliance Teams
How do digital signatures ensure invoice authenticity and integrity?
Digital signatures on electronic invoices provide two compliance properties: authenticity (the invoice was issued by the named supplier) and integrity (the invoice has not been modified since signing). Advanced electronic signatures using X.509 certificates from accredited trust service providers (TSPs) satisfy EU eIDAS requirements. For e-invoicing mandates requiring digital signatures (ZATCA, India), the signature must use specific cryptographic standards and certificate types.
What types of electronic signatures apply to e-invoices?
EU eIDAS defines three levels of electronic signature with different legal weights:
- Simple electronic signature: Basic e-signature (e.g., typed name or image); limited legal weight for invoicing
- Advanced electronic signature (AES): Linked to the signatory, created with data under signatory's sole control, detects changes
- Qualified electronic signature (QES): AES created with a qualified certificate from an accredited TSP; highest legal weight
- XAdES: XML Advanced Electronic Signature standard used for XML-format invoices
- PAdES: PDF Advanced Electronic Signature standard used for PDF/A-3 invoices
- Country requirements: Saudi Arabia (ZATCA) requires a CSID cryptographic stamp; India (IRP) requires SHA-256 hash
Frequently Asked Questions
- Is a digital signature always required on e-invoices?
- Digital signature requirements vary by jurisdiction and transmission channel. EU e-invoicing via Peppol does not require the invoice XML itself to be digitally signed; authenticity is provided by the certified access point. France's mandate does not require digital signatures on invoice XML; authenticity is ensured by the PDP or PPF. ZATCA (Saudi Arabia) requires a cryptographic stamp (CSID) on every invoice. Italy's FatturaPA requires signing with a qualified certificate. Organizations must check the specific requirements of each jurisdiction.
- How long are digital certificate validity periods for invoice signing?
- X.509 digital certificates used for invoice signing typically have validity periods of 1-3 years. Organizations must monitor certificate expiry dates and renew certificates before expiry to avoid interruption of invoice signing capability. Certificate rotation must be tested and coordinated with any systems that validate signatures. Some jurisdictions require that a valid certificate was in place at the time of signing, even if the certificate has since expired; this is verified by checking OCSP or CRL certificate revocation lists for the signing date.