The European Union's eIDAS framework, which governs electronic identification and trust services, laid the legal foundation for e-signatures in its first version. The update known as eIDAS 2.0 takes that foundation a step further: at the center now sits not just the signature, but the entire digital identity of citizens and organizations. For companies outside the EU this may look like a distant Brussels affair; in reality it concerns everyone who does business with Europe, serves European customers or treats European standards as a reference point.
The idea at the core: a digital identity wallet
The regulation's most visible novelty is the European Digital Identity Wallet. The goal is a wallet model in which a person keeps their identity, credentials and documents under their own control, carries them on their phone and shares them selectively when needed. In this model, identity verification rests not on each service's private user database but on a common, audited trust framework. One of the wallet's natural components is the electronic signature: a user who carries their identity in the wallet is meant to sign documents through that same wallet.
Shifting expectations on the e-signature side
eIDAS 2.0 expands the context of e-signatures more than the technology itself. While the mutual recognition of qualified electronic signatures across member states grows stronger, the question of creating signatures securely on mobile devices gains even more weight. This is where hardware-based security approaches come to the fore: keeping signing keys not in the phone's general memory but inside isolated secure hardware components is the key factor that brings mobile signing up to the trust level of desktop solutions. The practical consequence for organizations: when choosing an e-signature solution from now on, the criterion is not only compliance with today's rules but alignment with the architectural direction Europe has drawn.
What organizations should do now
The regulation's implementation timeline is advancing gradually across member states — which makes this a period for preparing, not waiting. The to-do list is manageable:
- Take inventory of your signature-dependent processes: which documents, how often, signed by whom?
- Review the mobile usability and security architecture of your current e-signature solution.
- If you do business with Europe, clarify which signature levels your counterparties accept.
- Make eIDAS 2.0 alignment a selection criterion in new investments.
This groundwork removes the need to reinvest when the regulation reaches full force.
The essence of the new era: portable trust
The long-term promise of eIDAS 2.0 is trust that travels across institutions and borders. A user carrying their identity and signature in their pocket will transact without worrying about which country the service sits in. Organizations ready for that vision will have built their digital processes not just for today but for the decade ahead.
What it means for businesses outside the EU
Although eIDAS is an EU regulation, its influence spills far past the Union's borders: the standards of large markets gradually become the standards of everyone who trades with them. Any company signing contracts with European customers or running approval flows with European partners deals, in practice, with the counterparty's signature and identity expectations. Beyond that, the architectural principles the regulation promotes — hardware-backed key protection, user control over data, interoperability between services — are simply good practice, useful to any organization building a durable digital trust infrastructure, whatever market it serves next.
With instant e-signing from mobile devices, a Secure Element chip at its base and an EU eIDAS 2.0 compliant architecture, AfiSigner was built for organizations that want to prepare for this new era today. For questions, reach out to us.