Electronic Signature Legality by Country

Electronic signature law is more settled than most procurement conversations assume. The great majority of jurisdictions recognise electronic signatures for ordinary commercial agreements, and have done for two decades.

The useful questions are narrower: what assurance level does a given document need, which categories are excluded by statute, and what evidence would you actually produce if a signature were disputed.

The two regulatory models#

Broadly, two approaches exist.

Tiered frameworks define assurance levels with different evidential consequences. The European Union's eIDAS Regulation is the reference example, with three: simple, advanced and qualified. A qualified electronic signature has the legal equivalence of a handwritten signature across all member states and carries a reversed burden of proof — the party disputing it must show it is invalid.

Technology-neutral frameworks treat any electronic signature as valid where intent and attribution can be shown, without formal tiers. The United States operates this way under the federal ESIGN Act and state adoptions of UETA, and much of the common-law world follows a similar model.

Neither model makes signature technology the deciding factor. Both make intent, attribution and integrity the deciding factors.

The three tiers, and what they cost#

Worth understanding even outside the EU, because the distinctions describe real differences in evidence.

A simple electronic signature is any electronic data attached to or logically associated with a document, signifying agreement. A typed name, a drawn mark, a click. Valid in most contexts, and the weakest evidentially.

An advanced electronic signature is uniquely linked to the signatory, capable of identifying them, created using means under their sole control, and linked to the data such that subsequent change is detectable. In practice this means authenticated identity plus a tamper-evident seal — achievable with modest friction and sufficient for the large majority of commercial documents.

A qualified electronic signature is an advanced signature created by a qualified signature creation device, based on a qualified certificate issued by a trust service provider on a supervised list. It requires identity verification of the signatory, which means the signing experience includes an identity step and the cost per signature is materially higher.

Choosing a tier per document class#

The mistake in both directions is applying one tier to everything.

Standard tier for internal approvals, acknowledgements, routine consents and low-value authorisations. Advanced for commercial contracts, employment documentation, supplier agreements and anything with real financial consequence. Qualified where legislation prescribes a form, where a public authority or counterparty requires it, or where the transaction value justifies the strongest available evidence.

Defaulting everything to qualified adds cost and abandonment to processes that do not need it. Defaulting everything to simple leaves your most valuable agreements resting on the weakest evidence you could have chosen.

The excluded categories#

Every jurisdiction excludes some documents, and the lists differ. Common exclusions include wills and testamentary instruments, certain transfers of real property, some family law documents, and instruments requiring notarisation or a specified statutory form.

Some jurisdictions also require particular forms for specific instruments — a handwritten clause, a witnessed signature, or a registered deed. These requirements are document-specific rather than general, which is why the only reliable approach is a per-class review with local advice for the jurisdictions you operate in. A general statement that electronic signatures are valid is true and insufficient.

Cross-border signing#

Where parties are in different jurisdictions, the governing law clause matters but does not settle everything: formality requirements can attach to the location of an asset or the place of performance regardless of the chosen law.

The practical approach for cross-border agreements is to sign at the highest assurance level any relevant jurisdiction would require, since a stronger signature is not invalidated by a jurisdiction that would have accepted a weaker one.

What is actually disputed#

In a challenge, the technology is almost never the issue. Three questions arise.

Was the signatory who they claimed to be? Answered by the authentication method and the identity evidence captured at signing. Did they intend to be bound? Answered by what they were shown, what they clicked, and the sequence recorded. Has the document changed since? Answered by the integrity seal and the hash.

All three are audit trail questions. Which means the signature record — timestamps, IP addresses, authentication events, the document hash, the exact version presented, and every action in sequence — is the part worth being particular about.

The retention point people miss#

The signature evidence must be retained as long as the agreement is enforceable, and often longer. A signed contract retained without its audit trail is materially weaker evidence than one retained with it, and the trail is frequently held by the signature provider rather than by you.

Which raises a question worth asking before you select a provider: if the relationship ended tomorrow, could you export the complete signature evidence for every document you have signed, in a form usable without their platform? For agreements with long enforceability windows, that is a more consequential question than the per-signature price.