Advanced Electronic Signature: Meaning and Requirements

An EU electronic signature with specific requirements for signer identification, control and detection of document changes.

Sarah Mitchell

Published on

2026-11-06

Last updated on

AES must meet all four eIDAS Article 26 requirements.
Identity, signer control and detectable changes are separate requirements.
A digital signature or verification code alone does not establish AES status.

What is an advanced electronic signature?

An advanced electronic signature (AES) is an electronic signature that meets the four additional requirements in Article 26 of the EU eIDAS Regulation. It is a defined legal level, rather than a signature that merely looks secure.

What are the four requirements?

The signature must be uniquely linked to the signer, capable of identifying that person, created using signature-creation data the signer can use under their sole control with a high level of confidence, and linked to the signed data so that subsequent changes are detectable.

The European Commission's eSignature FAQ explains the level and its common implementation through certificates and cryptographic keys. Adding an email address or a verification code alone does not demonstrate that all four requirements are met.

How does AES differ from other signatures?

A cryptographic digital signature can support these requirements, but its presence does not automatically establish AES status. A simple electronic signature need not meet the additional Article 26 criteria.

A qualified electronic signature adds a qualified certificate and qualified creation device. AES does not automatically receive the EU-wide handwritten-signature equivalence specifically given to QES; its legal effect still depends on the transaction and applicable rules.

A Common Case: Working with an EU business partner

A New York consulting firm may receive an AES requirement from an EU business partner. Before signing the services agreement, the firm checks how the proposed process meets all four eIDAS Article 26 criteria; a verification code alone does not answer that question.