← Back to the blog Blog · Compliance

Electronic signatures on attendance records: what the three eIDAS levels actually prove

Published on By the ScolaSign team (Ad Cognita)Reading time ~6 min

The European regulation that governs the qualified electronic signature, with its certificates, its trust lists and its certified devices, devotes a single sentence to protecting the humblest signature of all.

Article 25(1) of Regulation (EU) No 910/2014, known as eIDAS, reads: "An electronic signature shall not be denied legal effect and admissibility as evidence in legal proceedings solely on the grounds that it is in an electronic form or that it does not meet the requirements for qualified electronic signatures." A learner who signs an attendance record with a finger on a phone screen has produced an electronic signature in the sense of the regulation, and nobody may throw it out of court for that reason alone.

That sentence is often read as a guarantee. It is a floor. It says that the signature may be heard; it says nothing about whether it will be believed.

Three definitions, one presumption

The regulation defines three levels, in Article 3.

An electronic signature, the simple kind, is "data in electronic form which is attached to or logically associated with other data in electronic form and which is used by the signatory to sign". A name typed in a box, a tick next to a statement, a drawn signature, a click on a button in an authenticated session: all of these qualify, provided they are used to sign.

An advanced electronic signature is one that meets four requirements listed in Article 26: it "is uniquely linked to the signatory"; it "is capable of identifying the signatory"; it "is created using electronic signature creation data that the signatory can, with a high level of confidence, use under his sole control"; and it "is linked to the data signed therewith in such a way that any subsequent change in the data is detectable".

A qualified electronic signature is "an advanced electronic signature that is created by a qualified electronic signature creation device, and which is based on a qualified certificate for electronic signatures". Article 25(2) gives it the only presumption the regulation attaches to a level of signature: it "shall have the equivalent legal effect of a handwritten signature".

What separates the levels is therefore not admissibility, which all three share, but the burden of proof. A qualified signature arrives with its value attached. An advanced signature arrives with four properties that can be checked. A simple signature arrives with nothing but its admissibility, and the party relying on it has to show what it is worth. Recital 49 says so in terms: "it is for national law to define the legal effect of electronic signatures", except for the equivalence granted to the qualified level.

Why the qualified level is the wrong answer for attendance

The obvious reaction is to aim high. The arithmetic argues otherwise.

Before issuing a qualified certificate, the provider must verify the identity of the person, and Article 24(1a), as amended in 2024, lists the accepted methods: the European Digital Identity Wallet or a notified electronic identification means at assurance level high, an existing qualified certificate, another method confirmed by a conformity assessment body, or "the physical presence of the natural person". Every learner would have to go through one of these before signing anything.

Then comes the volume. A centre with 300 learners who sign twice a day for 100 days of training produces 60,000 signatures a year. Each qualified signature is created with a certified device and a certificate issued by a qualified trust service provider. Whatever that costs per signature, the cost is multiplied by 60,000, for a document whose purpose is to say that someone was in a room on a Tuesday morning.

And the gain is smaller than it looks. A qualified signature proves, with a legal presumption, that this person signed. It does not prove that the person signed in the room rather than from the bus, nor that the sheet has not been altered since by whoever holds the file. The questions that funders and auditors actually ask about attendance lie mostly outside the signature.

It is also worth recalling that the regulation, as amended in 2024, "does not affect Union or national law related to the conclusion and validity of contracts, other legal or procedural obligations relating to form, or sector-specific requirements relating to form" (Article 2(3)). If a funder or a ministry in your country requires a particular form of attendance record, that requirement stands, and eIDAS neither adds to it nor removes it.

Three levels, and the evidence around a simple signature Left: the three eIDAS levels of electronic signature and what the regulation presumes for each. Right: the four pieces of evidence that give a simple signature its weight. What eIDAS presumes Qualified Equivalent to a handwritten signature (Art. 25(2)) Advanced Four checkable requirements (Art. 26), no presumption Simple Admissible as evidence (Art. 25(1)), value to be proved What makes a simple one convincing Simple signature Who signed own account or link When server clock Unchanged since fingerprint at closing Later changes trail of corrections Simple, advanced and qualified are all admissible. Only the burden of proof differs.
The three levels differ in what the regulation presumes. A simple signature is admissible but presumes nothing; its weight comes from four pieces of evidence kept around it: who signed, when, that the record has not changed since, and what happened to it afterwards.

What makes a simple signature convincing

If the simple signature presumes nothing, its value is whatever the centre can show about it. Four things carry almost all of the weight, and the regulation itself, in the definition of the advanced level, has already named most of them.

The first is the identification of the signer. A signature given from a personal account, or through a personal link sent to one address, can be tied to one person far more firmly than a signature drawn on a shared tablet passed along a row. The question a sceptical reader will ask is simple: how do you know it was her? The answer should be a fact about the sign-in, not a belief about the learner.

The second is time. The regulation defines an electronic time stamp as "data in electronic form which binds other data in electronic form to a particular time establishing evidence that the latter data existed at that time", and Article 41(1) protects even a non-qualified one in the same terms as the simple signature. A time recorded by a server clock, and not by the learner's phone, is worth much more than a time typed by hand. Only a qualified time stamp enjoys, under Article 41(2), "the presumption of the accuracy of the date and the time it indicates".

The third is integrity. The fourth requirement of the advanced signature, a link to the data "in such a way that any subsequent change in the data is detectable", is not reserved to advanced signatures as a technique. A centre can close each attendance record at the end of the session, compute a fingerprint of it, and keep that fingerprint where it cannot be quietly rewritten. Whoever later doubts the record can then be shown that it has not moved.

The fourth is the trail: who opened the session, who signed and how, who corrected what afterwards, and why. Corrections are legitimate (a learner arrives late, an absence is justified), but a correction that overwrites the original leaves nothing to show. A record that keeps both the first entry and its correction answers the question before it is asked.

For the organisation itself, the regulation offers a separate instrument: the electronic seal, defined as data "to ensure the latter's origin and integrity", and created by a legal person. A qualified seal, under Article 35(2), enjoys "the presumption of integrity of the data and of correctness of the origin of that data". Sealing the final attendance record once, at the level of the centre, buys a presumption that 60,000 individual qualified signatures would not have bought.

Outside the Union

eIDAS is a regulation of the European Union. Switzerland, the United Kingdom and other countries have their own rules on electronic signatures, and the three levels described here do not apply there as such. The reasoning about evidence travels better than the vocabulary: in any system that leaves the value of an ordinary signature to be proved, the same four questions (who, when, unchanged since, what happened afterwards) will be asked.

The question to put to any attendance tool

Ask it to show, for one signature chosen at random from last term, who signed, by which means, at what time according to which clock, whether the record has changed since, and if so, who changed it. The answers matter more than the name of the level printed on the brochure.

The tool we publish provides a simple electronic signature, neither advanced nor qualified, given from the learner's own account or personal link, with the time recorded by the server.

Sources

Every feature,
from the very first plan

Try the complete platform for 14 days, free of charge and with no credit card.

14-day free trial