Electronic Signatures Explained: SES, AES and QES

Every handwritten signature has a digital counterpart – but not just one. Under the EU's eIDAS Regulation (No 910/2014), there are three levels: simple (SES), advanced (AES) and qualified (QES) electronic signatures. Which level you choose decides what your signature is worth if it is ever disputed. This guide explains the differences in plain language – and clears up the most common misunderstanding right away: a scanned signature image is not a strong signature.

What is an electronic signature?

The eIDAS Regulation defines three levels of electronic signatures that build on each other. The common core: data linked to a document that shows who signed it – and, from the second level up, proof that nothing in the document was changed after signing. The higher the level, the stricter the identity verification, and the greater the evidentiary value.

The three levels at a glance

• Typical example: SES – scanned signature or clicking "Sign"; AES – signing after two-factor login; QES – signing with verified identity and certificate.
• Identity verification: SES none, AES yes, QES yes (e.g. via video identification).
• Later changes detectable: SES no, AES yes, QES yes.
• Evidentiary value: SES low, AES high, QES same as a handwritten signature.

Simple electronic signature (SES). The lowest level covers any data attached to a document that someone uses to sign – a scanned signature, initials under an email, or clicking a signature field (Art. 3(10) eIDAS). It suits internal approvals, simple agreements, or low-risk documents. The catch: anyone who disputes the signature forces the other side to prove it.

Advanced electronic signature (AES). It must be uniquely linked to the signatory, identify them, be created with data under their sole control, and make any later change to the document detectable (Art. 26 eIDAS). In practice this usually means a two-factor login plus a sealed document with a signing log. Typical uses: B2B contracts, quotes, or non-disclosure agreements – documents where provability matters.

Qualified electronic signature (QES). The highest level is an AES based on a qualified certificate and created with a qualified signature creation device. The certificate is issued by a qualified trust service provider – after verifying the person's identity, for example via video identification with an ID document. The QES has the same legal effect as a handwritten signature (Art. 25(2) eIDAS) and is recognised in all EU member states.

Scanned signature or electronic signature?

This is where the most common misunderstanding lives – and it starts with the words themselves. In forums and help pages, users draw a clear line: "signature" means the image of your own handwriting, "digital signature" the certificate-based process. Mixing the two up is what causes most of the confusion.

Technically, a scanned signature in a PDF is a simple electronic signature – nothing more. It only proves that someone pasted an image into a document. The image can be copied, cut out, and reused in another document without anyone noticing. For internal purposes – a signature under a notice, an internal form, a read receipt – that is usually fine. The moment contracts, quotes, or anything that might later need proving is involved, it is not.

If that is exactly what you need – the graphical signature as an image: create your signature here for free. For anything that has to count legally, you need one of the two higher levels from a signature provider.

Which level do I need?

Three rules of thumb:

1. Low risk, internal effect – read receipt, internal approval, simple consent: the simple signature is usually enough.
2. Business agreement – quote, B2B contract, NDA: the advanced signature is the usual standard, because it proves both the signatory and the document's integrity.
3. Statutory written form – where the law requires written form, it can be replaced by electronic form; the qualified signature is the designated instrument for that (§ 126a of the German Civil Code, BGB).

One note: this article is an orientation aid, not legal advice. When in doubt, check with your contracting party or a legal professional which level your document requires.

Frequently asked questions

Is a scanned signature an electronic signature? Yes – but only the simplest form (SES). Its evidentiary value is low: anyone disputing it forces the other side to prove the signature.

Is a qualified electronic signature valid across the EU? Yes. The eIDAS Regulation gives it the same legal effect as a handwritten signature – in all member states (Art. 25(2) eIDAS).

What does a qualified electronic signature cost? QES offerings are paid services, because identity verification and certification stand behind them. Simple and advanced signatures, by contrast, are often already included in the software you use.

Can I create a QES myself? No. You need a qualified trust service provider to verify your identity and issue the certificate.