The ESIGN Act compliance checklist, and the eIDAS one beside it

Drop your document here and sign it now. PDF, Word and Excel all work: a .docx or .xlsx is laid out in your browser exactly as it was written, so there is nothing to convert first. Add a signature, a date, a company stamp or a watermark, then download it sealed. Free to start, no account, and the file is never uploaded to do it.

Most articles about electronic signature law tell you they are legally binding and stop there, which is true and useless. The question somebody actually has is narrower: what does our process have to do for a signature to survive being challenged. Here is that list, for the ESIGN Act and UETA in the United States, with the eIDAS equivalents beside each item, because most companies eventually need both.

What the ESIGN Act actually requires

The federal ESIGN Act of 2000 and UETA, adopted in nearly every state, say the same thing in different words: a signature, contract or record cannot be denied legal effect solely because it is electronic. That is a rule about non-discrimination, not a certification you can pass. There is no such thing as an ESIGN certified product, and any vendor implying otherwise is selling you a feeling.

What the statutes do impose is a short list of conditions, and those are checkable. An eSign Act compliance checklist worth using is a list of the things your process has to produce, not a list of features a platform advertises.

The checklist

One. Intent to sign. The signer has to take a deliberate act that means agreement: clicking a button labelled Sign, drawing a signature, typing a name into a field described as a signature. A name in an email footer is not intent. Under eIDAS this is the same idea, stated as data used by the signatory to sign.

Two. Consent to do business electronically. For consumer transactions the ESIGN Act is specific: the consumer must affirmatively consent, must be told they can request a paper copy and what it costs, must be told how to withdraw consent, and must be given the hardware and software requirements for accessing the records. This is the item most often skipped, and it is the one that voids a consumer signature. Business to business signing does not carry the same disclosure burden.

Three. Attribution. You have to be able to show the signature was the act of the person it is attributed to. UETA puts it in terms of the security procedure used. In practice this is where email link, access code, SMS one time password and identity verification with a document check sit on a rising scale, and where you sit on it should match what the document is worth.

Four. Association of the signature with the record. The signature has to be attached to or logically associated with the document, and it has to stay attached. A signature image emailed separately, or one that can be dragged off the page in a PDF reader, fails this in the way most likely to be noticed only in a dispute.

Five. Record retention and accurate reproduction. The record must be capable of being retained and accurately reproduced by everyone entitled to it. This is why a signed file the counterparty cannot open, or one that renders differently in different readers, is a retention problem rather than an aesthetic one.

Six. Integrity, which the statutes imply and evidence law demands. If you cannot show the document is the same document that was signed, the rest of the list is decorative.

What eIDAS adds, and the three levels

eIDAS is the European regulation, and unlike ESIGN it defines levels rather than a single standard. A simple electronic signature is the baseline and is admissible. An advanced electronic signature, AES, must be uniquely linked to the signatory, capable of identifying them, created using data the signatory can use under their sole control, and linked to the data such that any later change is detectable. A qualified electronic signature, QES, is an advanced signature made with a qualified signature creation device and backed by a qualified certificate from a trust service provider on the EU trusted list.

The practical difference is evidential weight. A QES carries the same legal effect as a handwritten signature across the EU and reverses the burden of proof, which is why it is required for a small set of transactions and useful for high value ones. It is also the only level you cannot self-certify: it involves a supervised trust service provider, and any tool claiming eIDAS compliant digital signatures without naming one is describing the simple level.

For most commercial contracts a simple or advanced signature is what is used, and the argument in practice is about evidence rather than about admissibility.

What a tamper evident audit trail has to contain

An audit trail is only worth what it can prove afterwards. The minimum useful set: each signer's identity as established and by what method, the time of each event to the second, the network address the action came from, the sequence of events including views and declines rather than only completions, and a cryptographic fingerprint of the finished document.

That last item is what makes it tamper evident rather than merely detailed. A SHA-256 hash of the sealed file changes completely if a single character in the document changes, so tamper proof digital signature validation is really a comparison: recompute the hash of the file you hold, compare it with the hash recorded at signing, and a mismatch is proof of change rather than a matter of opinion.

What an audit trail cannot do is prove a document was not altered before it was signed. That is a different control, and it is why sending the document yourself matters more than people expect.

Where a certificate based digital signature fits

The words electronic signature and digital signature are used interchangeably in marketing and mean different things technically. An electronic signature is the legal concept: an act showing intent. A certificate based digital signature uses PKI: a private key signs a hash of the document, and a certificate issued by a certificate authority binds that key to an identity. Certificate based digital signature tools are a distinct product category from signing platforms, and some regulated organisations run both.

A PKI certificate based digital signature gives you two things a drawn signature does not: the identity is asserted by a third party rather than by the signer, and the mathematics tie the signature to the exact bytes of the document. It costs you certificate procurement, key management, revocation checking, and a support problem when a certificate expires halfway through a signing round.

Both approaches produce legally binding signatures under ESIGN and eIDAS. The choice is about what your counterparties and regulators expect, not about which is real. For most commercial documents an audit trail plus a public verification page answers the question a certificate would have answered, without the key management.

Sector rules that sit on top: HIPAA, FDA, and the rest

General signature law is the floor, not the ceiling. HIPAA compliant electronic signature software is not a category any regulator defines, and neither is a HIPAA compliant eSignature platform: what HIPAA requires is that a covered entity or business associate applies the Security Rule safeguards to protected health information, and that anybody handling PHI on their behalf signs a business associate agreement.

So the question to ask a vendor is not whether they are HIPAA compliant, it is whether they will sign a BAA and what their encryption, access control and audit controls actually are. We will say plainly that we do not currently offer a BAA, so if you are a covered entity signing documents containing PHI, that is the gating question and you should treat it as a no until it changes. Our technical safeguards, encryption in transit and at rest, per signer audit logging and a tamper evident seal, are in place; the contractual half is not.

The same shape applies elsewhere. FDA 21 CFR Part 11 governs electronic records in regulated life sciences and has its own requirements around system validation and record controls. Financial services rules vary by regulator and instrument. Check the sector rule before assuming the general one is enough.

Are electronic signatures legally binding in court

Yes, and they have been for two decades. Courts in the United States, the EU, the UK and most of the world have upheld electronically signed agreements routinely, and the reported disputes are almost never about whether an electronic signature can bind. They are about whether this particular person signed this particular document.

Which is the point of the checklist above. The cases that go badly are the ones where the process cannot show consent was obtained, or cannot show what the document said at the time, or attributed a signature to somebody on the strength of an email address alone. The law is settled. The evidence is the part you control.

The short version

Get affirmative consent for consumer transactions and keep the record of it. Make the signing act unambiguous. Match your identity check to the value of the document. Keep the signature attached to the record. Keep a retrievable copy the other side can open. And seal the finished document so any later change is detectable rather than arguable.

Every document signed here carries the last three by default: the signature is printed into the page rather than laid over it, a SHA-256 fingerprint is taken at sealing, and the audit certificate records each signer with the time, the address and the checks they passed. The first three are process decisions, and no platform can make them for you.

Questions people ask about this

Is there such a thing as an ESIGN Act certification?

No. The ESIGN Act is a rule of non-discrimination rather than a standard with an accreditation body, so no product can be certified against it. A vendor claiming ESIGN certification is describing something that does not exist. What can be assessed is whether your process meets the statutory conditions, which is what the checklist above is for.

What is the difference between an electronic signature and a digital signature?

An electronic signature is the legal concept: any electronic act made with intent to sign. A digital signature is a cryptographic technique using PKI, a private key and a certificate from a certificate authority. Every digital signature is an electronic signature; most electronic signatures are not digital signatures in that technical sense, and both are legally binding.

What is a qualified electronic signature and do I need one?

A QES is the highest eIDAS level, made with a qualified device and a certificate from a trust service provider on the EU trusted list, and it carries the legal equivalence of a handwritten signature across the EU. Most commercial contracts do not require one. It is worth the extra process where a specific law demands it, or where the amount at stake justifies reversing the burden of proof.

Does an advanced electronic signature need a certificate?

Not necessarily. An AES is defined by four properties rather than by a technology: unique linkage to the signatory, capability of identifying them, sole control of the creation data, and detectability of later changes. A certificate is one way to meet them and not the only way.

How long do we have to keep signed records?

The ESIGN Act requires the record to be capable of accurate reproduction for as long as the law otherwise requires that record to be retained, which pushes the answer back to the underlying rule: tax, employment, healthcare and financial retention periods all differ. The practical implication is a format you will still be able to open, which is an argument for a flat sealed PDF over a proprietary container.

Sign a PDF online free →

What PDF Verified is, and what it is not

Electronic signature law is settled in broad terms and specific in the details. The ESIGN Act, UETA, eIDAS and their equivalents recognise electronic signatures across more than 190 countries, and what decides a particular case is intent to sign plus evidence connecting the signature to the signer, which is what the audit certificate records. Certain document types carry their own formalities wherever you are: deeds, wills, some property instruments, and anything requiring a witness or a notary. Sign only what you are authorised to sign, since applying another person signature without their authority is forgery whatever tool is used.

PDF Verified is a tool for preparing, signing, stamping and checking documents. It is not a law firm, a compliance service or a forensic examiner, and nothing here is legal, financial or compliance advice. Requirements differ by country, by document type and by the party asking, so check what applies to your document before you rely on it, and take advice where the document matters. You are responsible for the documents you create, sign and send, and for having the authority to do so: signing or stamping in somebody else name, or as an organisation you do not represent, is forgery whatever tool is used. To the extent the law allows, we accept no liability for how a document made with this tool is used or relied on. The full position is in our terms of service.

More on legality & compliance

Tools