EU trusted lists and 'qualified' signatures, in plain words

When you check a European signature in Verify PDF Signature, you may see a badge such as "Qualified electronic signature (EU)" or "eIDAS level: not qualified". Here is what those mean.

Who publishes the lists

Each EU country supervises the trust service providers based there, and publishes a signed list of them: who they are, what services they run, whether those services are approved right now, and since when.

On top of that sits a single list of all the national lists, published by the European Commission. Together they form a register any software can read.

Our verifier reads them the careful way. Each list is a signed document, and it is used only if its signature checks out. A national list that fails that test is left out, and the result says how many lists were loaded and when.

The ladder

European law describes three levels of electronic signature. In everyday language:

Simple electronic signature. Typing your name, ticking a box, drawing a signature. Legal in many situations; proves very little on its own.

Advanced electronic signature. Uniquely linked to the signer, made with something under their sole control, and able to detect later changes. A certificate-based signature normally reaches this.

Qualified electronic signature (QES). An advanced signature made with a qualified certificate from a provider on the trusted lists, and with the private key held on a secure signature creation device: a token, a smart card, or a supervised remote service.

A qualified signature is the one EU law treats as equivalent to a handwritten signature across the Union.

Signatures and seals

You may also see "Qualified electronic seal (EU)". The difference is simple:

• A signature belongs to a person.
• A seal belongs to an organisation: a company, a ministry, a hospital.

A seal is how an institution signs invoices or certificates in its own name rather than an individual's.

The labels you can see

Why "could not determine" appears

Because guessing here would be worse than saying nothing.

The level is worked out from two sources: what the certificate itself declares, and what the country's trusted list says about the provider that issued it. When a fact is missing, when a list could not be loaded, or when the two sources disagree in a way the software cannot settle, the answer is could not determine: not an optimistic guess in either direction.

Note also that if the trusted lists cannot be loaded at all, no eIDAS level is claimed for anything, and the result says so.

What this means for you

If you are receiving a document: a qualified badge is the strongest automated assurance available in Europe. An "advanced" or "not qualified" badge is not an accusation. Most of the world's perfectly valid signatures are not qualified, because they were never meant to be.

If you need a qualified signature: you cannot make one by choosing an option in any tool. You need a qualified certificate from a listed provider, and your key must live on a device they supply. That is a purchase and an identity check, not a setting.

Legal standing

This page describes what the lists and the levels are. Whether a particular document needs a qualified signature depends on the law that applies to it, and that varies by country and by document type. We have separate country guides for that. For example which electronic signatures are legally valid in the EU and how to verify a qualified electronic signature in the EU.