Electronic signatures in Cyprus: eIDAS levels and validation

What are ordinary, advanced and qualified electronic signatures?

Under Regulation (EU) No 910/2014, as amended, an electronic signature can be electronic data attached to or logically associated with other data and used by a person to sign. A typed name, drawn mark or platform acceptance may fall within this broad category, depending on the context. Article 25 says a signature must not be denied legal effect and admissibility as evidence solely because it is electronic or does not meet the requirements for a qualified electronic signature. That does not establish that every such method proves identity or consent equally well.

An advanced electronic signature must meet the requirements in Article 26: it is uniquely linked to and capable of identifying the signatory, is created with signature-creation data the signatory can use under their sole control with a high level of confidence, and is linked to the signed data so later changes are detectable. The precise technical method matters. A decorative image of handwriting pasted into a PDF does not by itself demonstrate that those requirements are met.

A qualified electronic signature adds a qualified certificate for electronic signatures and a qualified signature-creation device to an advanced signature. Article 25 gives this specific level the equivalent legal effect of a handwritten signature and cross-border recognition within the EU. It remains necessary to check the applicable transaction rules: equivalence of signature does not magically supply a missing witness, notarial act, corporate resolution or filing through a prescribed government channel.

Related guide: cross-border document formalities.

Basis and guidance: Regulation (EU) No 910/2014 (eIDAS), consolidated text; European Commission: EU trusted lists of qualified trust services

Start with the document and receiving party

Before choosing a signing vendor, list the document type, parties, governing law, intended recipient and method of filing. A commercial contract between two businesses, a public-register submission, a deed, a power of attorney and a bank mandate can have different requirements. Ask whether the recipient accepts an electronic original, a specific signature standard, a paper original, a witness, notarisation, certification or a particular portal. A valid electronic signature is only one part of that matrix.

For a Cyprus company, check the company’s constitutional documents, signing policy and any board authority as well as the external law. If two directors must act together, a valid signature by one person may not bind the company. If a foreign counterparty insists on a qualified signature, confirm which EU service it can validate before signing. Record the decision in the transaction file, especially if the document will be relied on years later.

Do not describe one platform as “legally binding for every Cyprus document.” An electronic contracting process may be enforceable in many settings, but the evidential result depends on attribution, integrity, authority and the formalities of the specific transaction. If the required method is uncertain, obtain the receiving body’s current instructions in writing. That is particularly important for government submissions and instruments affecting property or regulated rights.

Related guide: power-of-attorney formalities.

Basis and guidance: Regulation (EU) No 910/2014 (eIDAS), consolidated text; European Commission: Trust-services questions and answers

How do you verify a qualified provider and service?

EU Member States publish national trusted lists of qualified trust service providers and their qualified services. The European Commission explains that listing has a constitutive effect: the provider and service receive qualified status only when the relevant service appears as qualified in the trusted list. Cyprus publishes its own national trusted list through the Department of Electronic Communications. Use that list or the Commission’s trusted-list browser, not a vendor badge alone.

Check both the legal provider name and the particular trust service. A provider can offer several products; one may be qualified while another is not. The certificate, signature-creation method, service status and time of signing matter. A foreign EU provider can be suitable because eIDAS provides EU-wide recognition for qualified signatures, but you still need to establish that the actual signature used the qualified service at the relevant time.

Trusted-list pages and validation software may show historical states such as granted, withdrawn or supervised at a particular date. Preserve the validation report that ties the specific certificate and signed file to the applicable status. A screenshot of the provider’s homepage is weaker evidence because it may not identify the service or the signature at all. If the result is indeterminate, seek technical review before relying on the file.

Basis and guidance: European Commission: EU trusted lists of qualified trust services; Cyprus Department of Electronic Communications: National Trusted List

Signature by a person versus seal by a legal entity

An electronic signature is made by a natural person. A company may also use an electronic seal, a distinct eIDAS trust service associated with a legal person. A qualified seal can help prove origin and integrity of data from an organisation, but it is not a substitute for proving that an individual had authority to agree to a particular contract. Check which instrument the transaction requires and what the recipient will accept.

Where a director signs for a company, record their name, office and authority alongside the electronic signing evidence. Where a workflow uses a corporate seal, decide whether it is meant to authenticate a company-issued document or to execute a binding agreement. Do not conflate a verified certificate with a legal opinion on representation. The technical validator can confirm cryptographic status; it usually cannot examine board minutes or restrictions in the articles.

For multi-party documents, assign each person the correct signing role and order. A sequence of signatures can change the file after the first signature; compatible signing software preserves each signature’s validity if it applies later signatures correctly. Keep the final electronically signed version, plus the version sent for signature, and check that all required parties signed the same agreed content.

Related guide: company governance and records.

Basis and guidance: Regulation (EU) No 910/2014 (eIDAS), consolidated text; European Commission: EU trusted lists of qualified trust services

How should a signed PDF be validated?

Cyprus’s Deputy Ministry of Research, Innovation and Digital Policy publishes an action guide for checking the validity of electronically signed documents. Start with the original electronic file, not a printout or a flattened scan. Use suitable validation software to inspect the signature, certificate chain, document integrity, signing time where available and any warning about revocation or missing trust information. Record the tool, date and result.

A green tick inside one PDF viewer is a useful first signal, not a complete legal opinion. Ask whether the software used the EU trusted lists, whether the certificate and service were qualified, whether the document was altered after signing and whether the signature was valid at the relevant time. If the file has multiple signatures, examine each separately. An expired certificate today does not necessarily invalidate a signature made when it was valid, but long-term proof may require additional validation data.

If a document is printed and rescanned, the image of a signature remains visible but the original cryptographic evidence normally does not travel with the scan. Keep the signed source file and any validation report in a secure record system. When submitting to a bank or public body, ask whether it wants the original file, a copy, a validation report or a different authorised channel. Do not flatten the only surviving original.

Related guide: secure handling of employment records.

Basis and guidance: Cyprus Deputy Ministry: Electronic-signature validity check guide; European Commission: EU trusted lists of qualified trust services

Identity, sole control and remote signing

Qualified status depends on more than the interface that displays the “Sign” button. The underlying certificate must be a qualified certificate for the particular person, and the signature must be created with a qualified signature-creation device. Remote signing can meet the rules where the qualified provider controls the certified device and the signatory retains the required control over activation. Ask the provider what product and certificate you are actually buying.

Before issuing a signing credential, verify the person’s identity by the provider’s approved process and decide who within the organisation may request or revoke access. Shared logins, shared devices or one-time codes sent to an assistant undermine attribution. A company administrator should be able to start a workflow without being able to sign as someone else. Record the signatory’s contact details and the date authority was checked.

The EU Digital Identity Wallet framework expands options for qualified signatures, but the existence of a wallet app alone does not prove that a specific document carries a qualified signature. The same certificate, device, trusted-list and validation checks apply. Avoid promising a wallet-enabled method to a counterparty until both sides have confirmed the receiving system and the actual qualified service they will use.

Related guide: identity and access controls.

Basis and guidance: Regulation (EU) No 910/2014 (eIDAS), consolidated text; European Commission: eSignature and the EU Digital Identity Wallet

Can a qualified signature from another EU country be used in Cyprus?

Article 25 of eIDAS requires a qualified electronic signature based on a qualified certificate issued in one Member State to be recognised as a qualified electronic signature in other Member States. This cross-border recognition avoids a blanket requirement to buy a certificate from a Cyprus provider simply because the transaction concerns Cyprus. The service must still be qualified and the receiving process must accept the file format and submission channel.

Check whether the recipient is a private counterparty, a bank or a public authority. Public-sector online services have additional eIDAS recognition rules and may publish technical format requirements. A bank may ask for its own mandate or identification procedure even if a contract has a valid qualified signature. A registry can require its official portal. Separate the validity of the signature from a portal’s procedural rules.

For a document that will be used outside the EU, do not assume eIDAS recognition automatically settles the foreign jurisdiction’s evidential or formality rules. Ask the foreign recipient what it accepts and whether an apostille, notarisation or paper process is required. Keep the EU validation evidence anyway, because it may help explain the origin and integrity of the electronic original.

Related guide: apostille and legalisation.

Basis and guidance: Regulation (EU) No 910/2014 (eIDAS), consolidated text; European Commission: Trust-services questions and answers

What should the signing evidence file contain?

Keep the final agreed document before signing, the original completed electronic file, identity and authority checks, the signing-platform audit trail, certificates or validation reports, and relevant correspondence about the chosen method. For qualified signatures, record the provider and service as shown on the trusted list and the validation result. If a witness, certification or special filing was required, retain that evidence separately because the signature technology does not supply it.

Use a naming convention that links each signed file to its transaction without altering the file contents. Store it in a controlled-access repository with backup and retention arrangements proportionate to the underlying legal matter. Limit access to personal identifiers in certificates and audit logs. Do not send the only copy through a chat application that compresses, converts or strips file metadata.

If the file must be disclosed later, provide a copy of the original signed bytes and, where useful, the validation report. A PDF screenshot or photograph may demonstrate appearance but usually cannot support cryptographic verification. Note any software migration or archival process that converted the file; preserve a bit-for-bit original. Where long-term evidential value is important, seek technical advice on validation data and preservation rather than relying on a viewer’s current display.

Related guide: retention and evidence controls.

Basis and guidance: European Commission: EU trusted lists of qualified trust services; Cyprus Deputy Ministry: Electronic-signature validity check guide

Three examples that change the decision

Example one: two founders approve a routine commercial services agreement by a platform click. The method may produce a usable electronic signature, but a dispute will turn on who clicked, what version they saw, their authority and the audit trail. If the counterparties want higher assurance, they may agree to advanced or qualified signatures before circulation. Upgrading after a dispute cannot repair missing contemporaneous evidence.

Example two: a director receives a PDF with a visible “qualified” stamp. The recipient should open the electronic original and validate the certificate and service against the EU trusted lists. A visual label does not establish qualified status. The recipient should separately check the director’s power to sign for the company and whether the document itself needs an additional formality or designated submission route.

Example three: a signed Cyprus filing is printed, stamped and rescanned before upload. The scan may be accepted for one purpose but cannot be assumed to preserve the qualified signature’s validation features. Ask the receiving authority which format and channel it requires; retain the electronic original and a validation report. If the authority needs paper, meet that specific requirement without discarding the digital evidence.

Related guide: public-document handling.

Basis and guidance: Regulation (EU) No 910/2014 (eIDAS), consolidated text; Cyprus Department of Electronic Communications: National Trusted List; Cyprus Deputy Ministry: Electronic-signature validity check guide

A practical signing and verification checklist

Before signing, identify the exact document and recipient, research any statutory formality, confirm the company signatory’s authority, select ordinary, advanced or qualified signing on a reasoned basis, and check any chosen qualified provider and service in an EU trusted list. Agree on the file format and circulation order with all parties. Do not market a signature level as a shortcut around the document’s underlying legal requirements.

During signing, ensure each person receives the final version, controls their own signing credential and sees what they are approving. Complete any separate witness, board, notarial or portal step that applies. After signing, validate each signature in the original electronic file, inspect integrity and certificate status, and resolve warnings before filing or relying on it. A visible mark alone is not the validation result.

Finally, preserve the original signed file, validation report, authority evidence and submission receipt in the transaction record. Record who checked them and when. If the recipient rejects the file, determine whether the issue is signature level, file format, procedure, identity or corporate authority; each needs a different correction. Re-sign only after identifying the reason, so repeated attempts do not create conflicting versions.

Related guide: remote-signing formalities.

Basis and guidance: Regulation (EU) No 910/2014 (eIDAS), consolidated text; European Commission: EU trusted lists of qualified trust services; Cyprus Deputy Ministry: Electronic-signature validity check guide

Primary sources and scope

Sources checked: October 4, 2026. This guide concerns the Republic of Cyprus. Examples are hypothetical, not client case studies. Check current official requirements before making a filing.

• Regulation (EU) No 910/2014 (eIDAS), consolidated text
• European Commission: EU trusted lists of qualified trust services
• Cyprus Department of Electronic Communications: National Trusted List
• Cyprus Deputy Ministry: Electronic-signature validity check guide
• European Commission: Trust-services questions and answers
• European Commission: eSignature and the EU Digital Identity Wallet