Security
How to verify a digital signature in the EU: qualified vs advanced (eIDAS), with France, Germany, Italy, Spain and Poland
Checking an EU signature is two questions. Is it intact and made with a valid certificate? Any good checker answers that. Is it qualified? That depends on whether the certificate was issued as a qualified certificate by a qualified trust service provider on the EU Trusted Lists, created with a qualified device, which only a validator that consults those lists can determine. A qualified signature has the legal effect of a handwritten one across the EU.
In the European Union, electronic signatures are governed by the eIDAS Regulation (Regulation (EU) No 910/2014, significantly amended in 2024 by the regulation often called eIDAS 2). It defines three levels of electronic signature and gives each a different legal weight. When you receive a signed PDF in the EU, "is it valid?" really means two different things, and it is worth knowing which one you need answered.
The short answer
- Integrity and certificate: has the document changed since signing, and was the certificate valid? Any competent signature checker (including Verify PDF Signature) answers this.
- Legal level (simple, advanced or qualified): this depends on facts recorded in the EU Trusted Lists: whether the issuer is a qualified trust service provider and whether the certificate is a qualified certificate for electronic signatures, created on a qualified device. Determining that needs a validator that consults those lists; the European Commission provides a free demonstration validator (DSS), and member states and qualified providers offer others.
The three levels under eIDAS
| Level | What it requires | Legal effect |
|---|---|---|
| Simple electronic signature | Any data in electronic form used to sign. A typed name, a scanned image, a click | Cannot be denied legal effect just because it is electronic; weight is up to the court |
| Advanced electronic signature (AdES) | Uniquely linked to and capable of identifying the signer, under the signer's sole control, and detects any later change | Stronger evidence; often required by contracts or sector rules |
| Qualified electronic signature (QES) | An advanced signature made with a qualified signature creation device and based on a qualified certificate | Equivalent to a handwritten signature; recognised in every member state |
Almost every certificate-based PDF signature is at least technically capable of being "advanced". Whether it truly is (and whether it is qualified) depends on the certificate and how the signature was made.
There are also electronic seals, the organisational equivalent of a signature: issued to a legal person (a company or authority) rather than a natural person, with the same simple, advanced and qualified levels. Many official PDFs from EU public bodies carry a seal, not a personal signature.
Step 1: check integrity and the certificate
Upload the PDF, exactly as received, to Verify PDF Signature:
- Signature: Valid and a verdict of Unchanged since [name] signed it: the content has not changed.
- Anything changed after signing is listed page by page, with a side-by-side comparison and the option to download the version that was signed.
- Certificate details show the signer, the issuing provider, validity dates, key usages and the chain. The Timestamp and Long-term validation rows tell you how well the signature will survive over time. Relevant because many EU signatures are made at the PAdES B-T, B-LT or B-LTA levels.
If anything here fails, the legal level does not matter: an altered document is an altered document.
Step 2: determine the legal level
To know whether a signature is qualified, a validator must confirm, from the Trusted Lists, that at the time of signing:
- The issuing provider was a qualified trust service provider with a qualified status for issuing signature certificates;
- The certificate was a qualified certificate for electronic signatures (or seals);
- The private key was held on a qualified signature creation device (a qualified smart card, token, or a qualified remote signing service).
The European Commission's DSS demonstration validator reports this as a qualification such as QESig (qualified electronic signature), AdESig-QC (advanced with a qualified certificate) or AdESig, alongside an overall indication such as TOTAL_PASSED, INDETERMINATE or TOTAL_FAILED. INDETERMINATE usually means information is missing (often revocation data or a timestamp) not that the signature is fake.
Adobe Acrobat and Reader can also use the EU Trusted Lists and indicate qualified signatures and seals when those lists are enabled in the Trust Manager preferences.
Where the legal level matters formally (a court filing, a public procurement bid) a qualified validation service (a trust service defined in eIDAS) produces a signed validation report that carries more weight than a screenshot.
Why "qualified" matters
- A QES is equivalent to a handwritten signature everywhere in the EU, and a QES based on a qualified certificate from one member state is recognised as a QES in all others.
- Some acts in some member states require a QES or cannot be done electronically at all. This varies by country and by the kind of document.
- For everything else, parties can agree on simple or advanced signatures, and courts weigh them as evidence.
Country notes
France
French law recognises electronic signatures in the Civil Code, and a qualified electronic signature benefits from a presumption of reliability: the person challenging it has to prove it is unreliable, rather than the other way round. Many French official documents also carry a 2D-Doc barcode, which signs the key details of the document and can be read with compatible apps. For PDFs signed by French providers, check integrity as above and the qualified status with a Trusted-List-aware validator.
Germany
Germany uses the term qualifizierte elektronische Signatur for QES. The Federal Network Agency (Bundesnetzagentur) supervises qualified trust services and runs Germany's trusted list. Where German law requires written form, a QES can generally replace it unless a specific law excludes that. Many authorities sign or seal PDFs; validate integrity with any PAdES checker and qualification with a Trusted-List-aware validator.
Italy
Italy's firma digitale is a qualified signature, and it is extremely common in business and public administration. It comes in two main forms: PAdES, inside the PDF, which any PDF checker reads; and CAdES, the familiar .p7m file, which needs a CAdES-capable verification application. The national digital agency publishes a list of free verification software. See My signed file is .p7m, .p7s, .imz or .xml, not PDF.
Spain
Spanish administrations sign documents in PAdES, XAdES and CAdES formats, and the administration's online validation platform (VALIDe) validates them. Many documents also carry a CSV (Código Seguro de Verificación): a code that retrieves the original from the issuing body's electronic office. Certificates from the national mint (FNMT) and the electronic identity card are widely used.
Poland
Poland has qualified signatures (podpis kwalifikowany) and also the free podpis zaufany (trusted signature) and the podpis osobisty (personal signature from the electronic ID card). The trusted and personal signatures are recognised nationally for dealings with public bodies, but they are not qualified signatures under eIDAS. Government services verify all three; the trusted signature may be embedded in a PDF or produced as an XML file.
The eIDAS 2 changes
The 2024 amendment introduced the European Digital Identity Wallet, which member states must offer to citizens. Wallets are expected to let people create qualified electronic signatures for free for non-professional use. As wallets roll out, more ordinary people will be sending qualified signatures, and more recipients will need to verify them.
What KovaPDF does and does not tell you
Verify PDF Signature checks integrity, what changed after signing, the certificate and its chain, revocation, timestamps and whether long-term validation data is present, and it gives you a PDF report of all of it. It also reads the EU Trusted Lists and reports the eIDAS level (qualified signature, qualified seal, advanced, or not qualified) with the trust service provider and country, and it can produce an ETSI TS 119 102-2 validation report. For formal proceedings, a qualified validation service is still the reference.
Common questions
What is the difference between an advanced and a qualified electronic signature?
An advanced signature identifies the signer, is under their sole control and detects changes. A qualified signature is an advanced signature made with a qualified signature creation device and based on a qualified certificate from a qualified trust service provider. Only a qualified signature has the legal effect of a handwritten one across the EU.
How can I tell if a signature is qualified?
Use a validator that consults the EU Trusted Lists, such as the European Commission's DSS demonstration validator, Adobe Acrobat with the EU Trusted Lists enabled, or a qualified validation service. It checks the provider's status, the certificate's qualified status and the signature device.
Is a qualified signature from one EU country valid in another?
Yes. Under eIDAS, a qualified electronic signature based on a qualified certificate issued in one member state is recognised as a qualified electronic signature in all other member states.
The EU validator says INDETERMINATE. Is the signature fake?
Not necessarily. INDETERMINATE means there was not enough information to reach a firm result, often missing revocation data or timestamps. Check integrity separately; if the document is unchanged, the question is about proof over time, not tampering.
Does KovaPDF show whether a signature is qualified?
Yes. Verify PDF Signature checks the signing certificate against the EU Trusted Lists and shows the eIDAS level (qualified electronic signature, qualified seal, advanced, or not qualified) alongside integrity, changes after signing, the chain, revocation, timestamps and long-term validation data. When it cannot decide, it says so. For formal proceedings, a qualified validation service remains the reference.
How do I verify an Italian .p7m file?
With a CAdES-capable verification application. Italy's digital agency lists free ones, and the EU's DSS validator accepts CAdES too. A PDF signature checker cannot read .p7m files.