Digital Signature in Procurement

A digital signature in procurement is a legally binding electronic authentication mechanism that serves two functions simultaneously: it proves who signed a document and it proves that the document has not been changed since it was signed. In European public procurement, digital signatures are governed by the eIDAS Regulation (EU 910/2014), which establishes three levels of electronic signature, the highest of which carries equivalent legal weight to a handwritten signature and is mutually recognised across all EU member states.

What is a Digital Signature in Procurement?

The eIDAS Regulation defines three levels of electronic signature relevant to procurement:

Simple electronic signature. Any data in electronic form that is attached to or logically associated with other electronic data and used by the signatory to sign. Typing your name at the bottom of a PDF constitutes a simple electronic signature. This level is legally valid but provides minimal identity assurance and no integrity protection.

Advanced electronic signature (AdES). A signature uniquely linked to the signatory, capable of identifying the signatory, created using data under the signatory's sole control, and linked to the signed data in a way that detects any subsequent change. Advanced signatures use asymmetric cryptography (a private key held by the signatory and a public key in a certificate issued by a trust service provider). This level provides meaningful identity assurance and tamper detection.

Qualified electronic signature (QES). An advanced electronic signature created by a qualified electronic signature creation device and based on a qualified certificate for electronic signatures, issued by an accredited trust service provider. Under Article 25(2) of eIDAS, a QES has the equivalent legal effect of a handwritten signature and must be accepted by contracting authorities across all EU member states. QES certificates are issued by trust service providers listed on each member state's national trusted list.

In procurement, the level of signature required depends on the member state, the platform, and the specific document. Some member states (notably Germany and Italy) require a QES for tender submissions or specific contract documents. Others accept advanced signatures or platform-internal authentication. The contracting authority's tender instructions specify the requirement.

For cross-border bidding, the eIDAS mutual recognition rules mean a QES issued by a trust service provider in Ireland, for example, must be accepted by a contracting authority in Poland (see interoperability).

The UK retained eIDAS concepts through the Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 (UK eIDAS). Qualified electronic signatures created under UK-recognised trust service providers are legally valid for UK procurement purposes. Cross-recognition between UK and EU trust service providers post-Brexit is governed by bilateral arrangements rather than automatic mutual recognition.

Why it matters for bidders

The practical implications for European bidders are:

• Before bidding on a cross-border contract, check whether the buyer's platform requires a QES for submission. This is specified in the tender instructions or platform documentation.
• Obtaining a QES certificate requires identifying and contracting with an accredited trust service provider in your country. The process typically takes days, not hours, so plan ahead.
• Some platforms apply their own internal authentication (username, password, and sometimes two-factor authentication) as a substitute for document-level signatures. In those cases, a separate QES certificate may not be needed.
• Signing a contract electronically with a QES has the same legal effect as signing in person. This enables fully remote contract execution without physical document exchange.

Example

A Croatian architecture firm wins a design services contract with a Slovenian municipality. The contract requires a QES from both parties. The Croatian firm's director uses a QES certificate stored on a smart card issued by a Croatian accredited trust service provider. Signing the PDF contract with this certificate produces a signature that the Slovenian authority's legal team can verify using standard PDF signature validation tools, and which is legally equivalent to a wet ink signature under eIDAS.

Frequently Asked Questions

How do I obtain a qualified electronic signature certificate?

Contact a trust service provider listed on your country's national trusted list (available through the EU Trust Services Dashboard). Typical options include national ID card infrastructure (in countries such as Estonia, Belgium, and Austria), a separate smart card issued by a post office or bank, or a cloud-based signing service. Costs range from free (where QES is embedded in a national ID card) to a few hundred euros annually for a dedicated business signing certificate.

Is a PDF with a digital signature always a qualified signature?

No. A digitally signed PDF may carry a simple, advanced, or qualified signature depending on how the signature was created and which certificate was used. Adobe Acrobat and similar tools show signature details, including whether the certificate is qualified. A valid QES will typically display as verified against a trusted certificate issued by a provider on a national trusted list.

Do I need a separate certificate for each country I bid in?

No. A QES certificate issued by an accredited trust service provider in your home country is mutually recognised across all EU member states under eIDAS. You do not need a separate certificate for each country, provided the certificate is a qualified one from a provider on the EU Trust Services Dashboard.