Customer requests a "qualified electronic signature", DocuSign says it is signed, is that correct?
eIDAS has three levels: SES (Simple), AdES (Advanced) and QES (Qualified). DocuSign defaults to SES or AdES, not QES. For some documents (notarial deeds, specific employment contracts), NL or EU law explicitly requires QES.
Try this first
- 1Ask the customer which level they need and on what legal basis. "QES" sometimes means "clear who signed", in which case AdES often suffices.
- 2AdES is tied to a verified identity and to the signer (DocuSign Standard with ID-verify, or equivalent flow).
- 3QES requires a qualified certificate from a Trust Service Provider. The authoritative list of NL/EU QTSPs is the EU Trusted List (check via the Dutch Ministry of Economic Affairs site or the EU eIDAS Dashboard). Do not trust unverified lists; always pick a provider that is on the Trusted List for the specific service you need.
- 4Build the right flow per document type. An employment contract and a quote need not match level; it saves licensing and effort.
When to bring us in
For cross-border signing or documents that must stand in court, the AdES vs QES choice is legal, not IT. Bring in a lawyer for scope.
See also
- Does NIS2 apply to my company?Two questions decide it: are you in a listed sector, and do you meet the threshold from Recommendation 2003/361/EC (more than 50 FTE and more than EUR 10M turnover or balance sheet). Below that you are only indirectly in scope, via your customers. The threshold determines whether you are an important or essential entity depending on sector.
- What changes with the Dutch Cyber Security Act?The Cyberbeveiligingswet is the Dutch implementation of NIS2. Track NCSC for the exact effective date and the lower regulations.
- Am I personally liable as a director under NIS2?Yes. The board is accountable for approving and overseeing the cyber measures. Severe negligence can become personal.
None of the above fits?
Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.
Or skip the DIY entirely
Our Managed IT clients do not look these things up. One point of contact, a fixed monthly price, resolved within working hours.