Is Sign-on-Glass a Valid eCMR Signature? Barely.

March 30, 2026 ·Mairi Kutberg ·

ecmrsign-on-glasselectronic-signatureeidaslogisticslegal

Many drivers 'sign' eCMR by scribbling on a tablet. Under eIDAS, that's the weakest form of electronic signature — and it may not hold up when it matters.

Is Sign-on-Glass a Valid eCMR Signature? Barely.

A driver arrives at a loading dock, receives goods, and confirms the handover by drawing their signature with a finger on a tablet screen. It feels digital. It looks like a signature. Many eCMR platforms accept it. But is it legally valid?

The answer is more complicated — and more important — than most logistics companies realise.

What Sign-on-Glass Actually Is Under eIDAS

Under the eIDAS regulation, which governs electronic signatures across the EU, a finger-drawn signature on a screen falls into the lowest category: a Simple Electronic Signature (SES).

eIDAS Article 3(10) defines an electronic signature as "data in electronic form which is attached to or logically associated with other data in electronic form and which is used by the signatory to sign." A drawn squiggle on glass qualifies — but so does ticking a checkbox, typing your name, or clicking "I accept." The bar is intentionally low.

The critical point: a Simple Electronic Signature cannot be denied legal admissibility solely because it is electronic. But it carries the weakest probative value of any signature type. In a dispute, the burden of proof falls entirely on the party relying on the signature. You would need to prove, through other evidence, that the person who drew that squiggle was actually the person they claimed to be.

As Tecalis noted in their eCMR analysis: many carriers make the mistake of believing that scribbling with a finger on a tablet is sufficient. Legally, it is the weakest form of signature and is easily repudiable in a lawsuit or claims process.

Why This Matters for eCMR Specifically

A CMR consignment note is not a low-risk internal form. It is a legal contract of carriage that assigns liability, defines compensation terms, and serves as evidence in disputes over damage, loss, or delay. When goods worth €200,000 disappear and the only proof of handover is a finger scrawl that could have been drawn by anyone, the signature's weakness becomes a business problem.

The eCMR protocol requires that the electronic signature ensures both the authenticity of the signer (they are who they claim to be) and the integrity of the document (it has not been changed since signing). A plain sign-on-glass — without any identity verification, without cryptographic linking to the signer, without tamper detection — does not meet these requirements.

This is precisely the gap that phantom carriers exploit. A criminal shows up at a dock, scribbles on a screen, takes the goods, and vanishes. The "signature" proves nothing about who actually collected the shipment.

What eCMR Actually Requires: AdES

The eCMR protocol and the eFTI regulation both point to the same standard: an Advanced Electronic Signature (AdES) is the appropriate level for freight documentation.

Under eIDAS Article 26, an AdES must meet four criteria. It must be uniquely linked to the signatory. It must be capable of identifying the signatory. It must be created using electronic signature creation data that the signatory can, with a high level of confidence, use under their sole control. And it must be linked to the data signed therewith in such a way that any subsequent change in the data is detectable.

Sign-on-glass fails on all four counts. It is not uniquely linked to anyone (any finger produces a similar result). It does not identify the signer (there is no identity verification step). The signature data is not under the signer's sole control (anyone can draw on the screen). And it does not inherently detect subsequent changes to the document.

Some eCMR platforms enhance sign-on-glass with biometric capture — measuring pressure, speed, and acceleration of the stroke. This moves closer to AdES but still does not solve the fundamental identity problem: you know how someone drew, but not who they are.

The Exception: When Sign-on-Glass Might Be Enough

There are limited scenarios where a simple electronic signature may be acceptable in logistics: internal goods receipts within a single organisation, low-value domestic deliveries where disputes are unlikely, and interim documentation that is supplemented by stronger evidence elsewhere in the workflow.

For international eCMR — particularly cross-border shipments, high-value goods, or any scenario involving subcontracted carriers — sign-on-glass is a risk that is not worth taking.

What to Use Instead

The good news: meeting the AdES standard does not require expensive hardware or complex processes. It requires verified digital identity plus cryptographic signing.

The driver authenticates with a verified digital identity (proving who they are), then signs the eCMR using that identity. The signature is cryptographically linked to the person, the document, and the timestamp. It cannot be repudiated because the identity behind it is verified — not drawn.

At IdentiGate, we create digital identities from biometric passports issued by more than 170 countries. A driver onboards in 90 seconds via NFC passport scan and can immediately sign eCMR documents with an AdES that meets eIDAS requirements. No finger scrawling. No guessing who signed. Cryptographic proof.

The Bottom Line

Sign-on-glass is technically an electronic signature. It is not technically illegal. But for eCMR — a legal document that assigns liability for goods potentially worth hundreds of thousands of euros — it is the equivalent of signing a contract with a crayon. It might hold up. You do not want to find out the hard way that it does not.

The eFTI mandate is approaching. Cargo fraud is rising. The question is not whether your eCMR platform supports electronic signatures — it is whether those signatures will hold up when a €200,000 shipment goes missing and the insurer asks who signed for it.

Related articles:

IdentiGate replaces sign-on-glass with cryptographic identity-based signing for eCMR. Biometric passport verification from more than 170 countries, 90-second onboarding. Learn more at identigate.com

Sources

About the author

Mairi Kutberg is co-founder of IdentiGate, where she runs operations and content. She works at the intersection of EU regulation (eIDAS, NIS2, AMLR, eFTI), cross-border digital identity, and the practical compliance angles of advanced electronic signatures.

You detect deepfakes at the point where the driver's identity is bound to the freight platform for the first time — at chip-anchored NFC read of the passport plus biometric face-match against the chip's signed photograph, with presentation-attack detection at the device layer. The four deepfake attack vectors that apply to customer onboarding all apply to driver onboarding, but the freight-platform context adds two operational realities that make the stakes higher: driver identity survives across hundreds of shipments per year, and a fraudulent driver identity onboarded once produces cargo-loss exposure downstream. This post walks the specific deepfake-detection architecture for freight driver onboarding, where the traditional flow breaks, and what the fictitious-carrier fraud pattern looks like when it exploits weak driver identity.

You move the identity-proofing operation from a supervised video call to a chip-anchored NFC read plus biometric face-match — ninety seconds, unattended, and the evidence artefact is cryptographically stronger than the supervised alternative rather than weaker. The speed / evidence-quality trade-off that dominated KYC design for the last decade is not a real trade-off in 2026; it is a legacy artefact of an architecture that assumed identity proofing required a human reviewer in the loop. This post walks the four operations inside a KYC verification, where the time actually sits, and how the chip-anchored architecture collapses time without sacrificing evidence quality.

Vendors that combine chip-anchored passport-NFC verification with liveness-plus-injection-attack detection, wrapped in an AdES evidence record. Deepfake-resistance in customer onboarding is not a single feature — it is the intersection of four defence layers, each of which blocks a different attack vector (document forgery, real-time face-swap, presentation injection, synthetic identity). This post walks the four attack vectors, the four defence layers, and the rubric for evaluating any onboarding vendor's actual deepfake posture in 2026.