QES vs AES: Four AES Tests and When Validation Risk Justifies QES

A Qualified Electronic Signature (QES) is the only electronic signature that eIDAS treats as automatically equivalent to a handwritten signature across every EU member state. An Advanced Electronic Signature (AES) meets strict technical tests but does not carry that automatic equivalence, so its weight can depend on courtroom evidence and validator support. In practice, AES covers most commercial contracts, while QES applies when law or filing rules specifically demand wet-signature equivalence.

TL;DR:

• An AES must link uniquely to the signer, identify them, rely on signing data under their sole control, and expose any later document changes.
• QES adds a qualified certificate from a supervised QTSP and a certified QSCD; identity checks, hardware tokens, or remote signing can add onboarding steps.
• Public tenders and regulated filings often specify QES; high value contracts may also justify it when reducing dispute risk outweighs onboarding effort.
• Test validation in every jurisdiction where documents will be relied upon, because unrecognized issuers or delayed Trusted List updates can make valid QES results indeterminate.
• Keep timestamp and revocation data with each signed document; without them, long term verification can become harder as certificates age.

Table of Contents

• How AES and QES compare on legal weight and friction
• What makes a signature an advanced electronic signature
• What turns an advanced signature into a qualified one
• Why QES gets automatic legal recognition and AES does not
• How validators check a signature and where implementations break
• Choosing between AES and QES: a short checklist
• A risk-based view on signature choice
• FAQ
• Sources

How AES and QES compare on legal weight and friction

The two signature levels share a technical family but diverge sharply on legal certainty and the effort needed to get there. A side-by-side view makes the trade-offs easier to weigh before you commit to a workflow.

A few patterns stand out once the comparison is laid out:

• AES fits high-volume, lower-risk agreements where speed matters more than courtroom certainty.
• QES fits regulated filings, cross-border disputes, or any case where a statute names a specific signature form.
• Validation predictability, not signing experience, is often the real reason organizations upgrade to QES.
• Cost and onboarding friction rise with QES, so it’s worth reserving for cases that actually require it.

What makes a signature an advanced electronic signature

Article 26 of eIDAS sets four conditions a signature must meet to qualify as advanced. Each one targets a specific weakness in ordinary electronic signatures like a typed name or a scanned image.

• It must be uniquely linked to the signatory, not reusable by anyone else.
• It must be capable of identifying the signatory with enough specificity to tie the act to a person.
• It must be created using signature-creation data that the signatory can use under sole control, typically a private key.
• It must be linked to the signed data so that any later change to the document is detectable.

In practice, these requirements show up as PKI-based workflows: a locally held private key, a server-side signing service with strong authentication and key custody controls, or a signed document in a standard format such as PAdES, CAdES, or XAdES. These formats embed the cryptographic proof directly into the file, which is part of why AES has become the default for contract platforms handling thousands of signatures a month.

Pro Tip: If your signing volume is high and your legal exposure is moderate, AES with a reputable AdES-compliant provider usually gives you the best balance of speed and defensibility.

What turns an advanced signature into a qualified one

A QES starts as an AES and adds two further conditions: it must rest on a qualified certificate, and it must be created using a Qualified Signature Creation Device (QSCD), hardware or software certified to protect the signing key from extraction or misuse.

Qualified certificates can only be issued by a Qualified Trust Service Provider (QTSP), an entity that has passed conformity assessment and is supervised by a national authority. That supervisory layer is what separates a QTSP from an ordinary certificate authority.

• QTSPs must undergo audits and ongoing supervision before their certificates count toward QES status.
• QSCDs can be physical tokens, smart cards, or certified remote signing services hosted by the QTSP itself.
• Identity verification for a qualified certificate is typically stricter than for AES, often requiring in-person or video-based checks.

Operationally, this means more onboarding steps for signers: a one-time identity check, sometimes a hardware token, and occasionally a dedicated app or portal for remote qualified signing. That friction is deliberate. It is the cost of a signature that courts and public bodies across the EU must accept without further proof.

Why QES gets automatic legal recognition and AES does not

Article 25(2) of eIDAS states that a qualified electronic signature has the equivalent legal effect of a handwritten signature, and that effect applies automatically in every member state. AES does not get this presumption. It remains admissible as evidence, but a court may still need to evaluate how it was created and whether the technical safeguards held up in that specific case.

Cross-border recognition is where this distinction matters most. Trusted Lists, maintained by each member state and aggregated through mechanisms published by the European Commission, let a relying party in one country confirm that a certificate issued in another country came from a supervised QTSP. That structure is what makes QES validation deterministic across the EU, rather than dependent on each country’s own evidentiary rules.

• QES carries a presumption of validity that shifts the burden of proof away from the signer.
• AES validity often depends on national law and the specific facts of how the signature was generated.
• Trusted Lists give QES a cross-border recognition path that AES does not have.

National Trusted Lists, published and kept current by EU member states, are the mechanism that lets a validator in any member state confirm a qualified certificate’s status without relying on bilateral agreements.

How validators check a signature and where implementations break

Validators don’t inspect a signature by eye. They run an algorithm, and the CEF eSignature Building Block’s DSS validation guidance describes the core logic in three steps: detect whether the certificate is qualified, determine its type, and confirm whether the private key was protected by a QSCD at signing time.

For QES, this check is straightforward inside the EU because the certificate traces back to an entry on a national Trusted List. For AES, there is no equivalent lookup, so the relying party’s own validation policy carries more weight.

• Issuer chain recognition: a validator that doesn’t recognize the certificate issuer will flag the signature as indeterminate rather than valid.
• Missing Trusted List entries: a newly approved QTSP or a delayed list update can cause a legitimate qualified certificate to fail validation.
• Indeterminate results: ambiguous outcomes are common for AES when the relying party lacks a robust validation policy.
• Timestamping and long-term archival: signatures validated today can become harder to verify years later without proper timestamp and revocation data preserved alongside the document.

Pro Tip: Test your validation flow in every jurisdiction where the signed document will actually be relied upon, not just where it was signed.

Choosing between AES and QES: a short checklist

Work through these questions before locking in a signature level for a given workflow:

1. Does a specific law, regulation, or filing rule name a required signature type?
2. Will the document be filed with a public body or court that expects automatic equivalence?
3. Does the transaction cross borders in a way that needs deterministic recognition?
4. What is the realistic evidentiary risk if the signature is ever challenged?
5. How does signing volume and cost tolerance weigh against the friction of QES onboarding?

A few concrete patterns help translate those answers into a decision:

• Tenders and public procurement often specify QES directly in the call for submissions.
• Regulated filings, such as certain financial or notarial documents, frequently require QES by statute.
• High-value commercial contracts sometimes justify QES even without a legal mandate, simply to reduce dispute risk.
• Standard B2B purchase orders and routine agreements are well served by AES, where speed and low friction matter more than automatic equivalence.

Outside the EU, UNCITRAL’s Model Law on Electronic Signatures promotes functional equivalence and technology neutrality rather than a fixed hierarchy like eIDAS, so jurisdictions may use different labels and tests entirely. If a workflow spans the EU and a non-EU market, validate the signature requirements in each target jurisdiction separately rather than assuming one standard travels everywhere.

A risk-based view on signature choice

The biggest mistake we see in signature policy isn’t choosing the wrong level. It’s treating the choice as fixed rather than risk-based. eIDAS is technology-neutral by design, and QES is not mandatory for most business dealings. Many organizations default to QES “to be safe,” then absorb unnecessary onboarding friction on contracts that never needed automatic equivalence in the first place.

The more useful habit is mapping signature requirements to each document type once, then applying AES by default and reserving QES for the specific filings, tenders, or cross-border cases that actually demand it. Teams managing public tenders and grant applications across multiple countries, where filing rules vary and change, often find this mapping exercise harder than the signing itself. Better Presence helps small and mid-sized teams track which filings carry specific signature or submission requirements as part of preparing applications for public funding and contracts, so the compliance check happens before it becomes a last-minute problem.

— Matevz

FAQ

Is DocuSign a QES signature?

DocuSign supports multiple signature levels, including standard electronic signatures, AES, and QES depending on the account configuration and the identity verification method used. Whether a given DocuSign envelope qualifies as QES depends on whether a Qualified Trust Service Provider and QSCD were used for that specific signature.

What is a qualified electronic signature (QES)?

A qualified electronic signature is an advanced electronic signature created with a qualified certificate issued by a Qualified Trust Service Provider and generated using a Qualified Signature Creation Device. Under Article 25(2) of eIDAS, it carries automatic legal equivalence to a handwritten signature in every EU member state.

What are the three types of electronic signatures?

Under eIDAS, the three recognized types are the simple electronic signature, the Advanced Electronic Signature (AES), and the Qualified Electronic Signature (QES). Each builds on technical and legal requirements that increase from simple to qualified.

What are the four types of signatures?

Common classifications list four forms: wet-ink handwritten signatures, simple electronic signatures, Advanced Electronic Signatures (AES), and Qualified Electronic Signatures (QES). Definitions and groupings vary by jurisdiction, so it’s worth checking the specific law or filing rule that applies to your document.

Sources

• Regulation (EU) No 910/2014 (eIDAS) — eur-lex
• Legislation
• Qualified electronic signature (QES) validation algorithm — CEF eSignature / DSS
• UNCITRAL Model Law on Electronic Signatures — UNCITRAL