Electronic signatures: what’s changing with eIDAS 2

European digital identity, remote qualified signatures, new trust services… Despite its rather dry title, eIDAS 2 is changing the way businesses enter into contracts, verify and archive their documents. For IT directors, finance directors and legal professionals, the issue goes far beyond simply clicking the «Sign» button. An overview of the latest developments.

A contract with a German partner, a remote supplier on the approved list, a delegation of signing authority to be verified: everything is now done online. But how can you verify the identity of the person you’re dealing with, their authority and the validity of the evidence?

It is this chain of trust that eIDAS 2 addresses. Regulation (EU) 2024/1183, which came into force on 20 May 2024, revises the 2014 text. The first eIDAS recognised electronic signatures, whilst the second establishes end-to-end trust, from identity verification through to the retention of evidence.

The European wallet: your identity in your pocket

This is the key measure in the bill. The European digital identity wallet (EUDI Wallet) is a smartphone app. Each Member State must make at least one such app available to its citizens by 24 December 2026. Its use remains optional for members of the public, and those who choose not to use it must not face any discrimination.

What can we do with it?

• Proving one’s identity online or at the counter
• Submit supporting documents : driving licence, qualification, professional certificate
• Sign electronically documents, at a qualified level
• Share only what is strictly necessary : a website can verify that a customer is of legal age without knowing their date of birth

In France, the France Identité app, which had over 2 million users in May 2025, is set to serve as the foundation. However, a memorandum of understanding signed in relation to France Titres sets out the official launch of the French portfolio in 2027, that is, after the European deadline.

Example

A manufacturer in Lyon is registering a Spanish subcontractor. At present, they require a copy of the company’s registration certificate, social security and tax certificates, and a power of attorney… then follow up three times and check each document manually. In future, these supporting documents will be able to be submitted in the form of verifiable electronic certificates, which can be checked in a matter of seconds and are dated with certainty.

Please note, however, that a verified identity does not constitute a delegation of authority. The director of an SME and an intern in the company’s procurement department both have equally verifiable identities. Yet they do not bind the company in the same way.

And what about businesses? A dedicated portfolio is in the pipeline

The digital identity wallet is primarily intended for individuals. For legal entities, Brussels is developing a specific tool. On 19 November 2025, the Commission presented a proposal for a regulation establishing the European corporate portfolios (European Business Wallets), built on the same framework as eIDAS 2.

The idea is to enable a company to store and present its identification details and supporting documents (registration, powers of attorney, certificates) to both its partners and public authorities. Once the legislation comes into force, public authorities would have two years to accept it.

The text is still under negotiation: it is not yet a requirement. However, it specifically addresses the issue of powers, which is the most sensitive aspect of B2B. This is an issue that legal departments will need to monitor closely.

Electronic signatures: what’s changing… and what isn’t

Let’s dispel a common misconception: eIDAS 2 does not create any new signature levels. The three historical categories remain in place.

One point is worth emphasising: no signature may be rejected by a judge on the sole ground that it is electronic. In France, Article 1367 of the Civil Code and the Decree of 28 September 2017 recognise only the qualified electronic signature as having presumption of reliability. In practical terms, the burden of proof is reversed: with an advanced electronic signature, it is up to you to prove that it is reliable; with a qualified electronic signature, it is up to your opponent to prove that it is not.

The real innovation: qualifications for all

The European digital wallet should enable every citizen to produce qualified signatures, free of charge, by default. However, Member States may restrict this free access to non-commercial use. There are two technical options:

• a secure system included in the portfolio
• a device distant, managed by a qualified service provider

This remote management is becoming a fully-fledged qualified trust service. The law thus recognises the «cloud-based» signature, which is already widely in use.

And what about the company? This free service is primarily intended for members of the public. An employee signing on behalf of their company may not necessarily be able to benefit from it, as governments may restrict it to non-business use. As for the company itself, it signs using an electronic seal or via a business-to-business service provided by a qualified service provider. Signature budgets are therefore not disappearing; it is the customer-facing side that is being simplified, with signatories better equipped and smoother processes.

Do you have to sign everything with a qualified signature?

No, and it would actually be counterproductive: more friction, higher costs, and rising drop-out rates. The right approach is to weigh up three criteria: the financial stakes, the legal requirements specific to the transaction, and the risk of a dispute. A recurring purchase order for 2,000 euros is perfectly adequately covered by a well-documented electronic signature. A first-demand guarantee for 2 million, on the other hand, warrants formalisation.

Beyond the signature: checking the signatory’s authority

For legal professionals, the most significant contribution may lie elsewhere. The electronic attribute certificates form part of the family of regulated trust services. They certify a quality or a right: a qualification, an authorisation, and even the power of representation where an appropriate certificate has been issued. Qualified certificates, such as those issued by authentic public sources (official registers, civil status records), have enhanced legal effect throughout the EU.

Knowing who signed an order only solves part of the problem. Was the purchaser authorised to commit their company to that amount? Was their authorisation still valid on that day? With eIDAS 2, these checks can be partly automated, provided that the contracting company has issued the relevant certificates. The technology opens the door; it does not exempt us from looking at what lies behind it.

4 building blocks of trust you should know about

• The electronic stamp : this is a legal entity’s «signature». It guarantees that a document does indeed originate from that particular company and has not been altered. Invoices, statements, reports and certificates issued in bulk are its natural domain.
• Qualified electronic archiving : the documents are presumed to be authentic and to be of genuine origin throughout the retention period.
• Qualified electronic registers : inspired by distributed ledger technologies, they are presumed to be integrity-preserving and to adhere to the chronological order of the records.
• Remote management of signature devices : it enables you to create a qualified digital signature without a USB stick or smart card.

There is one important caveat, however: these assumptions relate to preservation, not to truthfulness. A lie that has been perfectly archived remains a lie.

The underlying message is crystal clear: simply signing is no longer enough. Five or ten years down the line, we must be able to demonstrate what was signed, by whom, with what powers and under what conditions.

Electronic invoicing: two overlapping initiatives

In France, this is a very timely topic. Since the 1 September 2026, all businesses subject to VAT must be able to receive electronic invoices, and both large companies and mid-sized enterprises must issue them. SMEs and micro-enterprises will follow the 1 September 2027.

The two reforms remain separate, but they are based on the same requirement: to ensure the authenticity of the source and the integrity of the content of a document. In the case of an invoice, tax regulations permit several methods, including a reliable audit trail and a qualified electronic signature or seal.

The pitfall to avoid: to run the two projects in isolation. The inevitable result: two service providers, two formats for supporting documentation and two systems that do not communicate with one another. A company currently reviewing its invoicing processes would be well advised to take this opportunity to rethink its policy on signatures, stamps and archiving.

CIO: preparing the systems

Electronic signatures have already become commonplace: 74 % organisations are equipped with them, and 86 % professionals in the finance, legal and HR sectors place their trust in it (Ipsos Digital for Yousign, 2025).

The questions an IT department needs to ask itself right now:

• How to receive and check a certificate presented from a digital wallet?
• How to link a certified identity to an existing customer account, without creating a duplicate?
• How to check, in real time, the validity of a certificate, whether it has been revoked, and the status of the service provider on the European trusted lists ?
• How can we ensure that the evidence remains still legible in ten years’ time, when formats and software have changed?

The solution lies in interoperable interfaces, effective incident management and fallback solutions when a user’s wallet fails. The GDPR also plays a part in the design process: requiring a full identity when a simple attribute would suffice contravenes the principle of data minimisation. Finally, an open and reversible architecture is preferable to a locked-in approach with a single provider. Trusted service providers are also subject to the NIS 2 Directive, which raises the bar for cybersecurity requirements across the entire chain.

DAF: measurable benefits, not a magic solution

On the financial front, the expected benefits are tangible: faster contract finalisation, verified authorisations without back-and-forth emails, less data re-entry, and improved traceability. Supplier onboarding files, which are currently populated with Kbis extracts and URSSAF certificates that need to be renewed every six months, could be significantly streamlined as a result.

But beware of overconfidence. The figures from the latest Allianz Trade survey, carried out in collaboration with Odoxa, speak for themselves:

• 85 % mid-sized and large companies, and 60 % SMEs have been the target of at least one attempted fraud in the past year
• 52 % Medium-sized and large companies are reporting an increase in such attempts
• in 40 % In some cases, at least one attempt resulted in a confirmed case of fraud

However, an authenticated identity does not validate either a change to bank details or a transfer instruction. Supplier impersonation fraud does not require a forged signature if it can convince a genuine signatory. Authorisation limits, segregation of duties and verification call-backs remain essential.

Return on investment, on the other hand, is measured using specific indicators: the cost of processing a case, the time taken to sign, the drop-out rate for online processes, and the number of disputes.

Legal professionals: developing a proper evidence policy

For the Legal Department, eIDAS 2 provides an opportunity to formalise what is often left implicit. Three questions underpin the work:

1. What level of authorisation is required for which document? A simple matrix, combining amount, type of transaction and risk, avoids the need for case-by-case discussions.
2. What should you keep? The signed document, as well as the certificates, the time stamp, the validation report, proof of consent and proof of the signatory’s authority.
3. For how long? The Regulation facilitates cross-border recognition, but it does not override national procedural rules, requirements for authentic instruments, or the retention periods applicable to certain documents.

The same rigour should be applied when selecting service providers. A qualification must be verified; it cannot be inferred from a logo. Qualified services are included on the trusted lists published by each Member State; in France, ANSSI maintains its own list. Reversibility, the export of evidence in a usable format and service continuity in the event of a failure are all key elements of the contracts.

eIDAS 2: key dates to bear in mind

With eIDAS 2 and the reform of electronic invoicing, the deadlines are drawing ever closer. By the end of 2027, both initiatives will be fully in force.

Timeline for eIDAS 2 and electronic invoicing · 2024–2027

From December 2027, certain private companies will be required to accept the digital wallet when users choose to use it. This applies where the law or a contract requires them to use strong authentication to identify their customers online. Banks, insurance companies and financial services providers are at the forefront, but the telecoms, energy, healthcare and transport sectors are also affected. Very large online platforms are subject to specific rules. Micro-enterprises and small businesses, however, are exempt from this obligation.

To summarise: neither a single wallet imposed on all sites, nor a requirement for a qualified digital signature everywhere. But waiting until 2027 to start thinking about this would be a mistake. Identity and archiving projects take time, and suppliers are already adapting their offerings.

Not all Member States will meet the December 2026 deadline, and the Commission itself acknowledges this. The early months of the European digital wallet are likely to resemble those of FranceConnect: low usage, a tentative start, followed by a sudden surge in adoption. Businesses that have prepared their systems during this quiet phase will not have to improvise when their customers turn up with their digital wallets.