What Is an Advanced Electronic Signature? Common Mistakes to Avoid
An advanced electronic signature is a specific type of electronic signature defined under the EU's eIDAS framework.
It is designed to provide stronger evidence about who signed and whether the signed data was changed afterward.
That does not mean every electronic signature used for a contract needs to qualify as an advanced electronic signature, and it does not mean the same terminology applies everywhere.
In the United States, laws such as the federal ESIGN Act and state electronic-transactions laws generally take a technology-neutral approach. They do not divide electronic signatures into the same SES, AES, and QES tiers used under eIDAS.
So the practical question is not simply:
“Do I have an AES?”
It is:
“What signature standard does this transaction actually require, and does my signing process provide the evidence and controls I need?”
This guide explains the difference.
At a glance
| Details | |
|---|---|
| What AES means | A defined advanced electronic-signature standard under eIDAS |
| Core AES requirements | Signer linkage, identification, signer control, change detection |
| US equivalent | No direct AES category under ESIGN/UETA |
| Higher eIDAS level | Qualified electronic signature, or QES |
| Main practical risk | Calling a signing method “AES” without meeting Article 26 |
| US focus | Intent, applicable consent rules, attribution/evidence, and record retention requirements |
| Not automatically guaranteed by AES | Contract validity, notarization, authority to sign, or acceptance for every document |
What Is an Advanced Electronic Signature?
An advanced electronic signature, commonly abbreviated AES, is an electronic signature that satisfies the requirements in Article 26 of the EU's eIDAS Regulation.
Under the current consolidated eIDAS text, an AES must:
- be uniquely linked to the signatory;
- be capable of identifying the signatory;
- be created using electronic-signature creation data that the signatory can, with a high level of confidence, use under their sole control; and
- be linked to the signed data so that any subsequent change is detectable. Eur-Lex
Those are the actual legal criteria.
What this means in normal language
An AES is intended to create a stronger connection between:
the person → the signature → the signed data
than a very basic electronic signing method might provide.
For example, simply typing a name into a document can qualify broadly as an electronic signature in some legal contexts if it is used with intent to sign.
But that does not automatically make it an advanced electronic signature under eIDAS.
Note: “Advanced electronic signature” is a defined European legal term. It should not be used as a generic synonym for “good electronic signature” or “secure electronic signature.”
The Four Requirements for an Advanced Electronic Signature
1. It must be uniquely linked to the signer
The signature must have a connection to the particular person signing.
The regulation does not say that every AES must use one specific authentication technology.
Instead, the overall signing method must satisfy the legal requirement.
2. It must be capable of identifying the signer
The process needs to provide a way of identifying the signatory.
How that is accomplished can vary depending on the signature technology and implementation.
3. The signature-creation data must remain under the signer's control
Article 26 requires the signature to be created using electronic-signature creation data that the signer can, with a high level of confidence, use under their sole control. Eur-Lex
That wording is more precise than saying:
“AES requires a private key or OTP.”
Those may be used in some implementations, but eIDAS does not define AES simply by requiring either of those technologies.
4. Changes to the signed data must be detectable
The signature must be linked to the signed data so that a subsequent change can be detected.
That is why document integrity is an important part of an AES implementation.
It does not necessarily mean the document becomes technically impossible to modify.
The requirement is about detectability of subsequent change.
Tip: When evaluating a platform, ask how it satisfies all four Article 26 requirements rather than asking only whether it offers “identity verification.”
Simple vs Advanced vs Qualified Electronic Signatures
Under eIDAS, people commonly distinguish between simple electronic signatures, advanced electronic signatures, and qualified electronic signatures.
| Factor | Simple electronic signature | Advanced electronic signature | Qualified electronic signature |
|---|---|---|---|
| Defined technical threshold | Does not meet the specific AES/QES requirements | Must satisfy Article 26 | AES plus additional qualified requirements |
| Signer identification | Depends on method | Must be capable of identifying signer | Supported by qualified certificate requirements |
| Change detection | Not inherently required by AES criteria | Required | Required |
| Qualified certificate required | No | No | Yes |
| Qualified signature-creation device required | No | No | Yes |
| Handwritten-signature equivalence under eIDAS | No automatic equivalence | No automatic equivalence | Yes |
eIDAS states that a qualified electronic signature has the equivalent legal effect of a handwritten signature. Eur-Lex
It does not give AES that same automatic equivalence.
That is an important distinction.
Simple Electronic Signature
eIDAS defines an electronic signature broadly as electronic data attached to or logically associated with other electronic data and used by the signatory to sign.
A typed name, checkbox-based process, signature image, or other method may fall within that broad category depending on how it is used.
But calling something “simple” does not automatically mean it is legally worthless.
Article 25 says an electronic signature may not be denied legal effect or admissibility solely because it is electronic or because it does not meet the requirements for a qualified signature. Eur-Lex
Advanced Electronic Signature
An AES adds the four requirements from Article 26.
Its defining feature is not merely:
“better audit trail.”
It is compliance with those specific criteria.
Qualified Electronic Signature
A QES is an advanced electronic signature that also satisfies additional requirements.
eIDAS defines a QES as an AES that:
- is created using a qualified electronic signature creation device; and
- is based on a qualified certificate for electronic signatures. Eur-Lex
The qualified certificate must be issued by a qualified trust service provider.
So the original line saying that QES simply involves a “face-to-face or equivalent identity check” was too narrow. Pasted text
Identity verification is important, but the legal definition of QES depends on the qualified certificate and qualified creation-device requirements.
Advanced Electronic Signature: A Step-by-Step Guide
If your transaction actually requires or calls for an AES, use a process like this:
- Determine the jurisdiction and applicable signature requirements.
- Confirm whether AES is actually required for the transaction.
- Choose a signing method capable of meeting all four Article 26 requirements.
- Configure the appropriate signer-identification and authentication process.
- Make sure the signing method links the signature to the signed data.
- Verify that later changes to that data can be detected.
- Preserve the signed record and supporting evidence according to your legal and business requirements.
Notice what is not on this list:
“Use SMS OTP and you automatically have AES.”
No single authentication feature by itself proves that all Article 26 requirements have been met.
How AES Fits Into US Electronic-Signature Law
This is where the original draft needed the most separation between jurisdictions. Pasted text
AES is not a US ESIGN category
The federal ESIGN Act does not create legal tiers called:
- SES;
- AES;
- QES.
Instead, ESIGN establishes a general rule that a signature, contract, or record relating to a transaction in or affecting interstate or foreign commerce may not be denied legal effect solely because it is electronic. U.S. Code
Likewise, the Uniform Law Commission describes UETA as establishing legal equivalence between electronic and paper records and signatures. Uniform Law Commission
So a US electronic signature does not need to satisfy eIDAS Article 26 just to qualify as an electronic signature under US law.
What ESIGN actually says
The ESIGN Act's basic rule is technology-neutral.
It says electronic form alone is not a reason to deny legal effect.
It also preserves other legal requirements surrounding the transaction.
For certain consumer transactions where another law requires information to be provided in writing, ESIGN contains specific requirements around affirmative consent to electronic records and disclosures about paper copies and withdrawal of consent. U.S. Code
That is more accurate than saying:
“ESIGN always requires consent to do business electronically for every electronic signature.”
The consumer-consent provisions are more specific than that.
Record retention
When another law requires a transaction record to be retained, ESIGN says an electronic record can satisfy that requirement if it:
- accurately reflects the information in the original record; and
- remains accessible in a form capable of accurate reproduction for the required period. U.S. Code
That is why reliable record preservation matters.
Does an AES Automatically Satisfy ESIGN and UETA?
Do not state this categorically.
The original draft said:
“An AES built to eIDAS standards will satisfy ESIGN and UETA.”
That is too broad. Pasted text
An AES may provide strong evidence around identity and document integrity, but a transaction can still be subject to other legal requirements.
For example:
- the signer must have authority to enter the agreement;
- the transaction itself must be lawful;
- certain documents may fall under statutory exceptions;
- consumer disclosure requirements may apply;
- another law may impose separate procedural requirements.
So meeting eIDAS Article 26 does not automatically prove that every US statutory requirement for every transaction has been satisfied.
7 Common Advanced Electronic Signature Mistakes
Mistake 1: Calling a signature AES without testing it against Article 26
A platform can offer electronic signatures without necessarily providing an eIDAS-compliant AES for every signing method.
The correct question is:
Does this particular signing workflow satisfy all four Article 26 criteria?
Not:
Does the marketing page use the term AES?
Fix
Review the actual signature method, authentication, signer control, and integrity protections.
Mistake 2: Treating identity verification as the whole AES standard
Identifying the signer is only one requirement.
AES also requires:
- unique linkage;
- signer control over signature-creation data;
- detectable changes to signed data.
Fix
Assess the full process rather than only the login or identity-check step.
Mistake 3: Assuming an OTP automatically makes a signature advanced
An OTP can form part of an authentication or signing process.
But eIDAS does not say:
OTP = AES.
Fix
Evaluate whether the overall mechanism satisfies Article 26.
Mistake 4: Ignoring document integrity
If later changes cannot be detected, one of the AES requirements is missing.
Fix
Confirm that the signature remains linked to the exact signed data in a way that makes subsequent modifications detectable.
Mistake 5: Confusing AES with QES
They are not interchangeable.
AES satisfies Article 26.
QES goes further and requires a qualified certificate and qualified signature-creation device. Eur-Lex
Fix
Use the correct terminology in contracts, product pages, and legal documentation.
Mistake 6: Assuming AES replaces other formalities
Electronic-signature level and document formalities are different questions.
A transaction may still require additional steps under applicable law.
Fix
Check requirements for the specific document and jurisdiction.
Mistake 7: Treating an audit trail as proof that the signature is AES
Audit information can be useful evidence.
But an audit trail alone does not establish compliance with all four eIDAS requirements.
Fix
Keep the audit evidence, but evaluate the actual signature architecture separately.
What an Advanced Electronic Signature Cannot Do
An AES can strengthen evidence surrounding a signature, but it does not solve every legal issue.
It does not guarantee that the underlying agreement is valid
A technically strong signature cannot fix:
- illegal contract terms;
- lack of contractual capacity;
- fraud;
- absence of authority;
- another defect in contract formation.
The signature method and the validity of the underlying transaction are separate issues.
It does not automatically equal a handwritten signature under eIDAS
That automatic equivalence is specifically attached to qualified electronic signatures under Article 25(2). Eur-Lex
AES does not receive the same automatic rule.
It does not automatically replace notarization
The original draft said a notary “verifies identity in person” and AES “does neither.” Pasted text
That is too absolute.
Notarization procedures vary, and remote electronic notarization exists in many jurisdictions.
Even ESIGN itself says that where a law requires notarization, acknowledgment, verification, or an oath, an electronic process can satisfy that requirement if the electronic signature of the authorized person and the other legally required information are properly associated with the record. U.S. Code
So the better rule is:
An AES by itself does not substitute for a legally required notarization.
The notarization requirement still has to be satisfied through an authorized process.
It does not prove more identity than the process establishes
AES must be capable of identifying the signer.
But the evidentiary strength of that identification depends on the implementation.
Different authentication and credential mechanisms can provide different levels of assurance.
Which Documents Cannot Be Signed Electronically?
This section of the original article was too broad because it mixed ESIGN statutory exclusions with state-specific formalities. Pasted text
There is no accurate universal list saying:
“These documents can never be electronically signed in the United States.”
The rules depend on federal law, state law, and the particular document.
ESIGN expressly excludes some categories
The federal ESIGN Act's general validity rule does not apply to certain records governed by laws concerning:
- wills;
- codicils;
- testamentary trusts;
- adoption;
- divorce and other family-law matters;
- certain Uniform Commercial Code matters;
- court orders, notices, and official court documents required in court proceedings. U.S. Code
There are additional statutory exceptions as well.
But that does not necessarily mean every document in one of those categories must always be signed on paper forever.
States can have separate legislation authorizing electronic execution in areas otherwise excluded from ESIGN.
For example, the Uniform Law Commission has separately developed an Electronic Wills Act. Uniform Law Commission
Practical rule
Check:
- the exact document type;
- the state or country involved;
- the law governing that document;
- the receiving authority's requirements.
Do not rely on a generic “wet-signature list.”
A Pre-Send Checklist for Advanced Electronic Signatures
Before sending a document using an AES workflow, check these six items:
- Jurisdiction: Which law governs the signature?
- Signature level: Is AES actually required?
- Signer identification: How will the signer be identified?
- Signer control: How does the creation mechanism remain under the signer's control?
- Document integrity: Will subsequent changes be detectable?
- Record keeping: Can the final signed record and supporting evidence be retained appropriately?
If the transaction is primarily US-based, also check whether any ESIGN, state-law, consumer-disclosure, notarization, or document-specific requirements apply.
Tip: Keep your internal terminology precise. Calling every electronic signature “AES” can create unnecessary legal and product claims that are harder to support later.
Where LoreSign Fits
LoreSign is designed to help senders prepare documents, add recipients and fields, collect signatures, track signer progress, and retain completed signing records.
Those features can support a more organized electronic-signing workflow.
However, the article should not claim that every LoreSign signature is automatically an eIDAS Advanced Electronic Signature unless the specific LoreSign signing method has been assessed against all four Article 26 requirements.
The original introduction says:
“LoreSign handles the AES mechanics correctly…”
and the closing says LoreSign ensures “the advanced electronic signature you request is the one you actually get.” Pasted text Pasted text
I would remove those statements unless you have product/legal documentation confirming eIDAS AES compliance.
A safer product mention is:
LoreSign provides document preparation, recipient signing, signer tracking, and audit evidence for electronic-signature workflows. For transactions requiring a specific legal signature level such as eIDAS AES or QES, verify that the chosen signing method satisfies the applicable requirements.
Frequently Asked Questions
What is an advanced electronic signature?
An advanced electronic signature is an electronic signature meeting the four requirements in Article 26 of eIDAS: unique linkage to the signer, ability to identify the signer, use of signature-creation data under the signer's sole control with a high level of confidence, and linkage to the signed data so subsequent changes are detectable. Eur-Lex
What is the difference between AES and QES?
A QES is an advanced electronic signature that additionally uses a qualified electronic-signature creation device and is based on a qualified certificate for electronic signatures. Under eIDAS, a QES has the equivalent legal effect of a handwritten signature. Eur-Lex
Does US law require an advanced electronic signature?
Not as a separate ESIGN category. The US ESIGN Act does not use the eIDAS SES/AES/QES tier system. It establishes general legal recognition of electronic records and signatures while preserving other applicable legal requirements. U.S. Code
Does an OTP automatically make a signature AES?
No. An OTP may be part of a signing or authentication process, but AES requires the entire process to satisfy all four Article 26 criteria.
Can an advanced electronic signature replace notarization?
Not by itself. If the transaction legally requires notarization, the notarization requirement still needs to be satisfied by an authorized process. ESIGN allows electronic notarization where the authorized person's electronic signature and other required information are properly associated with the record. U.S. Code
Can every document be electronically signed?
No single universal rule applies to every document. ESIGN contains statutory exceptions, and state or other laws can impose separate requirements. Check the specific document type and governing jurisdiction. U.S. Code
Final Thoughts on Advanced Electronic Signature Mistakes
Most advanced electronic signature mistakes come from confusing three separate questions:
Is this an electronic signature?
Does it meet the eIDAS requirements for AES?
Is this signing method legally appropriate for this particular transaction?
Those questions are related, but they are not interchangeable.
Under eIDAS, AES has four specific requirements. Under US law, ESIGN and state electronic-transactions laws use a different framework and generally do not require an eIDAS-style AES tier.
So before describing a signature as advanced, verify what the signing process actually provides.
For routine electronic-document workflows, LoreSign can help teams prepare documents, add recipients, collect signatures, track completion, and retain signing evidence. For transactions that require a formal AES, QES, notarization, or another specialized signature standard, confirm the applicable requirements before sending.
Sources and further reading
- EUR-Lex — eIDAS Regulation, Articles 25 and 26: legal effects and requirements for advanced electronic signatures. Eur-Lex
- EUR-Lex — eIDAS definitions: definitions of AES, QES, qualified certificates, and qualified signature-creation devices. Eur-Lex
- U.S. Code — 15 USC §7001: ESIGN's general validity, consumer-consent, retention, and electronic-notarization provisions. U.S. Code
- U.S. Code — 15 USC §7003: statutory exceptions to ESIGN's general rule. U.S. Code
- Uniform Law Commission — Electronic Transactions Act: UETA's technology-neutral treatment of electronic records and signatures. Uniform Law Commission
About LoreSign
LoreSign helps businesses, freelancers, and teams prepare documents and contracts for electronic signature. Add recipients and signing fields, send documents, track signer progress, and retain completed signing records.
For transactions requiring a specific statutory signature level, confirm that the signing method meets the applicable legal and technical requirements.
