What's the Difference Between Digital Signature and Electronic Signature?

June 28, 2026 ·Mairi Kutberg ·

electronic-signaturedigital-signatureeidasadesqessessignature-terminologybatch-signingcross-border-e-signatureauthentication

Electronic signature is the legal term — any data attached to other data to sign, under eIDAS Article 3(10). Digital signature is the technical term — a cryptographic primitive using public-key cryptography. Every digital signature is an electronic signature; not every electronic signature is a digital signature. eIDAS adds three legal tiers on top: SES, AdES, QES.

What's the Difference Between Digital Signature and Electronic Signature?

Electronic signature is the legal term — any data attached to or logically associated with other data, used by the signer to sign, under eIDAS Article 3(10). Digital signature is the technical term — a cryptographic primitive using public-key cryptography. Every digital signature is an electronic signature; not every electronic signature is a digital signature. eIDAS adds three legal tiers on top: Simple Electronic Signature (SES), Advanced Electronic Signature (AdES), Qualified Electronic Signature (QES).

From the compliance desk, the digital-vs-electronic question is the single most common terminology confusion I see in cross-border contracting conversations. A Munich-based industrial importer we worked with this winter asked a Tallinn manufacturing SME for a "digital signature" on the framework agreement; the SME's procurement officer heard "use Adobe Sign" because that's what the marketing copy calls digital signatures; the German importer's compliance team rejected the signed document because what they actually meant was an Advanced Electronic Signature at a minimum. The contract drafting process restarted with new terminology — and the same confusion would have recurred three months later with the next counterparty had the SME's GC not pulled both teams into an alignment call. The cleanest fix is to know the distinction once. This post is the distinction. The follow-up question — how long does the signed document stay verifiable after it has been signed — is the topic of our long-term validity post, and the procurement-side framing of identity vs wallet sits in our Digital ID vs Digital Wallet post.

What does "electronic signature" actually mean in law?

Any data attached to or logically associated with other data, used by the signer to sign. That is the literal text of eIDAS Article 3(10).

The definition is deliberately broad. It covers everything from a typed name at the bottom of an email, through a check-box "I agree to the terms", through a hand-drawn signature on a tablet, through a cryptographic signature using a private key, through a Qualified Electronic Signature backed by a Qualified Trust Service Provider. All of these are electronic signatures under EU law. The terminology is one umbrella term, not a specific technology.

What I see in procurement conversations is that the broadness of the definition is what causes the confusion. When a German importer says "we need a digital signature", they almost certainly mean a specific technology (cryptographic primitive) at a specific legal level (AdES or higher); when an Estonian SME's office manager says "we use digital signatures every day", they mean the national eID signing app on their phone — which produces a real cryptographic signature, but the conversation is sitting on top of a vocabulary mismatch that the parties don't always notice until the lawyer reads the file.

The eIDAS Regulation 2024/1183 amendments to the original Regulation 910/2014 kept the Article 3(10) definition unchanged. The broad-umbrella approach is deliberate and has been since 2014: the EU wanted to be technology-neutral about what counts as an electronic signature, and then layer assurance levels on top for specific legal purposes.

What does "digital signature" actually mean technically?

A specific cryptographic technique — public-key cryptography, typically hash-and-sign — that produces a signature mathematically bound to both the signed data and the signer's private key.

The technical definition is standardised across IETF, ISO, and ETSI specifications. A digital signature in the technical sense involves a cryptographic key pair (private + public), a hash function (such as SHA-256), and a signing algorithm (such as RSA-PSS, ECDSA, or Ed25519). The signer holds the private key; the verifier uses the public key (typically attached to a digital certificate from a trusted Certificate Authority) to verify that the signature matches both the document hash and the public key. If either changes, verification fails.

Examples of digital signatures in 2026:

A PDF signed using PAdES (PDF Advanced Electronic Signatures, ETSI EN 319 142) with an X.509 certificate
An XML document signed using XAdES (XML Advanced Electronic Signatures, ETSI EN 319 132)
A CMS-signed file using CAdES (CMS Advanced Electronic Signatures, ETSI EN 319 122)
An email signed with S/MIME or OpenPGP
A Bitcoin transaction signed with an ECDSA key pair
An eIDAS-compliant signature using a Smart Card, USB token, or remote-signing platform with HSM-backed keys
A national eID signing event under a notified Member State scheme (the Article 6 EU-recognised assurance assertion underneath the cryptographic event)
An IdentiGate AdES signature anchored on a chip-read identity primitive — passport NFC for the 179 ICAO 9303 countries or document authenticity plus biometric face match (FaceTec liveness) for every remaining country, with the AdES record bound to the verified identity under eIDAS Article 26

What I'd push back on is the assumption that "digital signature" automatically means "secure" or "legally binding". The cryptographic primitive guarantees mathematical integrity — the document hasn't been altered, the signer held the private key at signing time — but it says nothing about whether the signer's identity was properly authenticated before the certificate was issued. Identity authentication and document signing are different operations, and a digital signature only encodes the second. That's the question eIDAS layers on top through the SES/AdES/QES hierarchy.

Where do they overlap and where don't they?

Every digital signature is an electronic signature. Not every electronic signature is a digital signature.

The Venn-diagram framing helps in vendor conversations. The outer set is "electronic signatures" — everything from typed names through QES, all legally recognised under eIDAS Article 25 non-discrimination. The inner set is "digital signatures" — the subset of electronic signatures that uses public-key cryptography to produce a mathematically verifiable signature. There is no digital signature that is not an electronic signature; there are many electronic signatures (typed names, scanned signatures, clicked checkboxes) that are not digital signatures.

The practical implication: when a vendor says "our product produces digital signatures", that is a technical claim about the cryptographic primitive used. It is not, by itself, a claim about which legal eIDAS tier the signature reaches. A digital signature using an RSA-2048 key pair certified by an unaccredited CA produces a cryptographically valid digital signature that is still only a Simple Electronic Signature in eIDAS terms. The legal tier depends on the assurance the certificate and signing process meet, not just on whether public-key crypto was used.

From inside the compliance audit, the question that always comes up at month fourteen is whether the signature on the file in front of the auditor was an AdES or only an SES. A digital signature is eligible to be AdES — it carries the cryptographic primitive — but it is not automatically one. The signing process has to also satisfy the eIDAS Article 3(11) requirements: uniquely linked to the signatory, capable of identifying the signatory, created using signature-creation data the signatory can use with high confidence under their sole control, and linked to the data so any later change is detectable. A digital signature meets the technical bar; the surrounding process has to meet the legal bar.

What does eIDAS layer on top: SES, AdES, QES?

Three tiers of legal assurance, in ascending order. Each tier subsumes the requirements of the tier below it.

Simple Electronic Signature (SES). Any electronic signature that meets the Article 3(10) definition without meeting the AdES requirements. Typed name, scanned signature image, clicked checkbox, free-form e-signature platform without identity proofing — all SES. Admissible as evidence under eIDAS Article 25 ("an electronic signature shall not be denied legal effect and admissibility as evidence in legal proceedings solely on the grounds that it is in an electronic form"), but the evidential weight is the lowest of the three tiers. In practice, suitable for low-risk internal documents, expense approvals, internal HR forms.

Advanced Electronic Signature (AdES). A digital signature that additionally satisfies the four Article 3(11) criteria above — signer-linked, signer-identifying through authentication that survives audit, sole-control, change-detectable. AdES is the workhorse of the EU signing economy. Most cross-border contracts, supplier agreements, employment contracts, regulator filings under NIS2 or DORA — all signed at AdES level under ETSI EN 319 102-1 procedures using PAdES, XAdES, or CAdES formats. AdES does not require a Qualified Trust Service Provider; the signature-creation device can be a USB token, a smart card, or an HSM-backed remote signing platform. The certificates used can be commercial CA-issued X.509 with strong identity proofing.

Qualified Electronic Signature (QES). An AdES that additionally uses a Qualified Signature Creation Device (QSCD) and a Qualified Certificate issued by a Qualified Trust Service Provider (QTSP) listed on the EU Trusted List. QES is the only tier eIDAS Article 25(2) gives "the equivalent legal effect of a handwritten signature" across all Member States automatically. It is also the tier with the highest procurement cost, the most stringent identity-proofing requirements at certificate issuance, and the most regulatory ceremony around key management. QES is required for specific public-service flows (Article 27); it is the legal ceiling, not the legal floor, for most commercial signing.

IdentiGate is not a QTSP and does not issue QES — see our earlier post on AdES vs QES positioning. What we ship as the Signatures product is AdES under eIDAS Article 26, bound to a verified identity through the Identity Verification product (passport NFC for 179 ICAO 9303 countries plus document and biometric face match for every remaining country). For workflows that need to sign many documents in a single session — supplier batch contracts, employee onboarding paperwork, multi-document approvals — the Batch Signing product layers this same AdES-bound signing on top of a multi-document flow, retaining each signature with its own audit-defensible record.

Tiered signature hierarchy — at the broadest base, all electronic signatures under eIDAS Article 3(10); narrowed above, the digital signature subset using public-key cryptography; narrower again, Advanced Electronic Signature (AdES) satisfying Article 3(11); narrowest at the top, Qualified Electronic Signature (QES) backed by a QTSP and EU Trusted List.

What this means for your contracts and procurement

Three practical implications, in roughly the order they come up in the procurement conversation.

Contract drafting should specify the eIDAS tier, not just the technology family. "Signed with a digital signature" is ambiguous; "signed at AdES level under eIDAS Article 26 using PAdES format, with the signer's identity verified through a [name your identity-proofing primitive] flow" is unambiguous. The contract should also specify the retention format and the verifiability window — AdES signatures lose verifiability when the underlying certificates expire unless wrapped with a timestamp (PAdES-LTA, XAdES-A, CAdES-LTA) for long-term validation. This is exactly the question Reddit topic #31 "How long do digital signatures remain valid?" lands on — we will cover it in a follow-up post in this cluster.

Cross-border counterparties may have a higher floor than you think. What I see in the SME exporter conversations is that German, Austrian, and Dutch importers have moved to requesting AdES-minimum across most procurement; French and Italian importers are less standardised but increasingly aligned; UK importers since the Online Safety Act and adjacent regulatory work in 2024-2025 have started asking for AdES on some service contract categories. The trap most SMEs walk into is shipping a Simple Electronic Signature (typed name, free-form platform) and then having to re-sign at AdES level after the counterparty's compliance team rejects the original — which costs time, money, and counterparty confidence.

Batch and multi-document workflows compound the terminology problem. When the procurement is for a single document, the eIDAS-tier specification is checked once. When the procurement is for 200 supplier agreements or 50 employee onboarding documents, the signing system has to apply the same legal-tier guarantee to every document in the batch, retain a separate audit-defensible signature record for each, and not collapse the batch into a single signature that loses per-document traceability. The architectural question for batch signing is whether the platform produces N independent AdES records or one meta-signature with documents enumerated underneath. Auditors prefer the first; many platforms ship the second.

The cleanest procurement language I've seen is to specify: technology family (digital signature using PAdES/XAdES/CAdES), legal tier (AdES or QES, with the specific eIDAS Article reference), identity-proofing primitive (e.g. chip-anchored proof at admission), retention format (AdES-LTA for long-term archival), and per-document audit record requirement (one AdES record per document in batch flows). When all five are specified, the digital-vs-electronic confusion stops being a problem.

Sources

Primary — eIDAS and signature framework

Primary — ETSI signature standards

Primary — international and cross-jurisdiction

About the author

Mairi Kutberg is co-founder of IdentiGate. She focuses on identity-proofing operations under eIDAS, NIS2, AMLR, the AI Act, the EHDS, and adjacent regulatory frameworks, and on the institutional reality of running cross-border identity verification at scale.

The signature carries the burden of proof — but the burden falls back on whoever relied on it if the evidence chain behind the signature isn't complete. Under eIDAS Article 25(2), Qualified Electronic Signatures presume authenticity unless the challenger rebuts it. For Advanced signatures, the party asserting the signature has to demonstrate identity binding, integrity, and time — and courts have been consistent since 2020 that thin proofing evidence loses the case.

Strictly speaking, digital signatures don't encrypt anything — they use asymmetric cryptography to sign a hash of the data. The signer's private key transforms the hash into a signature; the corresponding public key verifies it. In 2026 production: RSA-PSS with SHA-256 (RFC 8017), ECDSA over P-256 or P-384 (RFC 6979), and Ed25519 (RFC 8032). ETSI TS 119 312 sets which cryptographic suites are acceptable for AdES, and the post-quantum migration is starting to reshape the algorithm shortlist through 2030.

Three things stacked in the right order under eIDAS Article 25: non-discrimination in principle for any electronic signature, equivalence to a handwritten signature only for Qualified Electronic Signatures under Article 25(2), and successful validation under the Article 32 procedure. The gap that costs cases in court is between 'the signature exists' and 'the signature validates against Article 32 requirements' — and the identity-proofing under the signing certificate is where most legal-validity claims quietly break.