How do we handle international eSignature compliance like eIDAS for global software?

All answers to this question.

Compliance is a moving target. Always consult with a legal expert in the specific region before finalizing your software architecture.

   Answered 2024-03-21 by Karen Phillips

• Definitely, Karen. A Business Analyst should always map out the legal requirements before the developers write a single line of the signature logic.

     Commented 2024-03-22 by James Wilson

Is it possible to build a single workflow that intelligently switches between ESIGN and eIDAS based on the user's IP address?

   Answered 2024-03-22 by Mark Peterson

• Mark, it's possible but complex. You’re better off defaulting to the highest common denominator (AES) for all global users. This ensures compliance across the board without over-complicating your codebase with geolocation logic that might fail if a user is on a VPN.

     Commented 2024-03-24 by Steven Harris

Under eIDAS, there are three levels. For most B2B contracts, an Advanced Electronic Signature (AES) is sufficient, but it must be uniquely linked to the signer and created using data that the signer can use under their sole control. A "Qualified" signature (QES) is the highest level and requires a face-to-face (or video) ID verification by a Qualified Trust Service Provider. In late 2024, my team had to integrate a European provider to handle these QES requirements because the local laws in Germany and Italy are much stricter for credit agreements than in the US.

   Answered 2024-10-25 by Barbara Taylor