SES, AES and QES: differences between the three levels of electronic signature

There isn't just one "electronic signature." The eIDAS Regulation distinguishes three levels: simple, advanced and qualified. All of them are electronic, but they don't offer the same guarantees of identity, control and integrity.

Understanding this scale helps avoid two opposite mistakes: thinking a drawn signature has no value at all, or believing that any signature on a screen automatically equals a handwritten signature.

Informational content, not legal advice. The choice depends on the document, the risk and the applicable regulations.

Quick comparison

Aspect	SES: simple	AES: advanced	QES: qualified
Illustrative example	Drawn signature, typed name, acceptance click	Signature uniquely linked to the signer, with later changes detectable	AES with a qualified certificate and qualified device
Identification	Basic or contextual	Must allow the signer to be identified	Identity verified according to qualified requirements
Signer control	No specific technical requirement under eIDAS	Creation data under their control with a high level of confidence	Reinforced requirements and qualified device
Integrity	Depends on evidence added by the process	Any later change must be detectable	Higher technical and legal guarantees
Key effect under eIDAS	Cannot be rejected solely for being electronic or not qualified	Same non-discrimination rule, with higher technical requirements	Explicit equivalence with a handwritten signature across the EU
Typical use	Everyday low- or moderate-risk processes	Agreements with greater need for identification and evidence	Procedures or transactions requiring maximum assurance or a QES

The table is indicative. An AES isn't automatically mandatory for every important contract, and an SES isn't automatically insufficient just for being simple.

1. Simple electronic signature (SES)

eIDAS defines an electronic signature broadly: electronic data attached to other data and used by the signer to sign. SES is the form that doesn't necessarily meet the additional requirements of AES or QES.

Examples include:

• drawing a signature with a finger or mouse;
• typing a name into a signature field;
• pressing an acceptance button with clear wording;
• accepting terms via an unchecked checkbox;
• expressing unambiguous acceptance by email.

The strength of SES is ease of use. It reduces friction and can be suitable for authorizations, everyday consents and agreements between known parties. Its weakness is that, on its own, it can provide less certainty about identity and integrity.

That's why it's important to support it with a record: document version, date and time, sending channel, explicit consent, hash, and event history.

2. Advanced electronic signature (AES)

Article 26 of eIDAS requires an AES to meet four cumulative conditions:

1. it must be uniquely linked to the signer;
2. it must allow the signer to be identified;
3. it must be created using data the signer can use under their sole control with a high level of confidence;
4. it must be linked to the signed data in such a way that any subsequent modification is detectable.

Adding just any password or storing a hash in a database isn't enough to claim an AES. The entire creation, authentication, linking and verification system must be assessed.

AES is useful when identity or a possible challenge carry more weight. It can rely on certificates, electronic identity systems, or other mechanisms specifically designed to meet the four requirements.

3. Qualified electronic signature (QES)

A QES is an AES that, in addition, is based on a qualified certificate and is created using a qualified signature creation device. Qualified services are linked to providers included on the European trusted lists.

Article 25.2 of eIDAS grants it explicit legal equivalence with a handwritten signature. A QES based on a qualified certificate issued in one member state must be recognized as a QES in the other member states.

This higher level of assurance comes with more verification steps and, typically, more friction. It isn't required by default for every process.

How to choose the right level

You can apply this decision order:

1. Check the applicable rule. Is a specific level or formality required?
2. Assess the risk. What impact would impersonation, modification or a challenge have?
3. Assess the relationship. Do the parties already know each other? Is the contact channel reliable?
4. Define the evidence. What will you keep to prove consent, contextual identity and integrity?
5. Avoid unnecessary friction. More complexity doesn't always mean a better experience, nor is it proportional to the case.

A routine authorization for an activity may fit well with a properly tracked SES. A regulated, high-value transaction, or one with formal requirements, may need AES, QES, or even other formalities outside electronic signatures altogether.

Where does Sygnau fit?

Sygnau uses a simple electronic signature (SES) reinforced with process evidence: the signer draws the signature on the screen (or hands in a scanned paper), with no account required. The system keeps the version of the authorization, generates a PDF with the responses, calculates a SHA-256 hash and offers a public verification page.

Sygnau does not offer an advanced (AES) or qualified (QES) signature, nor does it act as a qualified trust service provider. If your case requires these levels, you need a suitable certified solution.

Sources

• Consolidated eIDAS Regulation — EUR-Lex
• What is eSignature? — European Commission
• Trusted List Browser — European Commission

---