What is an electronic signature, and when does the law accept it?

Ask a lawyer what is an electronic signature and the answer is broader than most people expect. Under the US ESIGN Act it's "an electronic sound, symbol, or process" attached to or logically associated with a record and adopted "with the intent to sign the record" (15 U.S.C. §7006(5)). A typed name counts. So does a click on "I agree", a finger-drawn mark, a code from a text message, or a certificate-based digital signature.

The EU says the same in drier words. Article 3(10) of eIDAS calls it data in electronic form, attached to or logically associated with other electronic data, which the signatory uses to sign.

Neither definition names a technology or a vendor. That's deliberate: the rule shouldn't age with the software. Two ideas sit inside both:

• Intent. Your name in an email's "To" field isn't a signature. The same name typed under "Agreed and accepted" probably is.
• Association with one record. A picture of your handwriting, emailed on its own, is attached to nothing.

Here's the part vendor pages skip. The definition tells you what counts. It doesn't tell you whether a particular signature will survive a dispute, and that's a question of evidence, which is what most of this guide is about. If someone has asked you for ink instead, the guide to wet signatures covers when paper is still required.

Almost anything you do on a screen to say "I agree to this document" qualifies as an e-signature. Every method in the table below counts under ESIGN and eIDAS. What separates them is how much proof each one leaves behind.

Is typing your name an electronic signature? Yes, if you typed it to sign. The Law Commission's 2019 report notes that English courts have accepted a name typed at the bottom of an email. The weak spot is attribution, since anyone with access to your inbox could have typed it.

The scanned signature is the case people get wrong most often. Pasting an image of your handwriting into a PDF does create a signature in the legal sense. It's just a poor one: the image says nothing about who pasted it or whether page four changed afterwards.

Making one takes a minute: open the document in a signing service, type or draw your name where the field asks, and confirm. The mark is the easy bit. When you sign and send documents with Chaindoc, it's the record of who opened and signed, and when, that does the work later.

Statutes decide whether a signature is allowed. Evidence decides whether yours wins. When someone says "I never signed that", four questions come up, roughly in this order.

Intent: did they mean to sign?

The signer has to take a step that reads as agreement. A box labelled "I agree to the terms above", a button marked "Sign", a name typed under "Agreed and accepted". Silence doesn't count. Neither does a box someone else ticked in advance.

Consent: did they agree to deal electronically?

Under ESIGN, nobody has to use or accept electronic records (§7001(b)(2)). With consumers the bar is higher. Where a law says information must reach a consumer in writing, an electronic version only works after the consumer has consented, received the required disclosures and shown they can open the format (§7001(c)). Between businesses, consent usually shows through conduct. A clause in the contract is still cheaper than an argument later.

Attribution and integrity: who signed, and is it the same document?

Attribution links the signature to a person: a verified email address, a one-time code, an ID check, the IP address and device. Integrity proves the file hasn't changed since. A cryptographic hash does that job well. Change one byte and the hash comes out completely different. That's arithmetic, not a vendor promise, and anyone can rerun it.

Retention: can you still produce it?

This is the one people forget. ESIGN §7001(e) lets a court deny legal effect to an electronic record that isn't "capable of being retained and accurately reproduced" by everyone entitled to keep it. Put plainly, a signed contract that lives only inside a vendor account you've since closed is a weak contract.

In practice, intent and consent are settled by how the signing flow was built. Attribution and retention are where real disputes get lost.

The ESIGN Act has been federal law since 2000. Its core is one sentence in 15 U.S.C. §7001(a): a signature, contract or record relating to a transaction in interstate or foreign commerce "may not be denied legal effect, validity, or enforceability solely because it is in electronic form."

The ESIGN Act requirements that trip people up fit in a short list:

1. 1.
   Consumer consent, after specific disclosures, before electronic records replace paper ones a law says must be in writing (§7001(c)).
2. 2.
   A record every party can keep and reproduce accurately (§7001(e)).
3. 3.
   No forced adoption. Nobody has to accept electronic signatures without agreeing to (§7001(b)(2)), so a bank that insists on its own process is within its rights.

Below the federal layer, the states use the Uniform Electronic Transactions Act, a model law from 1999. UETA's definition in §2(8) is nearly word for word the federal one, and its §7 says that where a law requires a signature, an electronic one satisfies it.

New York is the holdout, the only state without a version of UETA. Its Electronic Signatures and Records Act does the same job: State Technology Law §304 gives an electronic signature "the same validity and effect as the use of a signature affixed by hand."

eIDAS, Regulation (EU) No 910/2014, sorts electronic signatures into three levels, and all three are valid. Article 25(1) bars a court from refusing one legal effect or admissibility as evidence just because it's electronic or isn't qualified. The levels decide how much you'll have to prove, not whether you may sign.

An advanced electronic signature meets the four conditions of Article 26: it's uniquely linked to the signatory, capable of identifying them, created with data they can use under their sole control, and linked to the signed data so any later change is detectable.

A qualified signature adds a qualified signature creation device and a qualified certificate. It's the only level the regulation puts on a par with ink (Article 25(2)), and every member state recognises one issued in another (Article 24a, which replaced the old Article 25(3) in 2024). How you get one, and whether it's worth the cost, is in our guide to qualified signatures.

The UK kept its own copy of eIDAS after Brexit, but its basic rule is older. Section 7 of the Electronic Communications Act 2000 makes an electronic signature admissible in evidence on questions of authenticity and integrity. In 2019 the Law Commission went further and concluded that one "is capable in law of being used to execute a document (including a deed)", as long as the signer means to authenticate it. One catch survives. A deed still needs a witness physically present when it's signed, even if everyone signs on a screen.

People use "electronic signature" and "digital signature" as if they meant the same thing. They don't.

An electronic signature is the legal idea: someone's intent to be bound, expressed electronically. A digital signature is one technique for producing it. The signer's software uses a private key, backed by a certificate from a certificate authority, to sign a hash of the document. Anyone holding the public key can then check which certificate signed and whether the file has changed since.

That pairing is what security people call non-repudiation: the signer can't credibly deny the signature, because the proof travels inside the file rather than in somebody's database. Strictly, it proves the key was used. Whether the right person held the key is still a question of fact.

Every digital signature is an electronic signature. Most electronic signatures aren't digital, and for ordinary contracts the law doesn't ask them to be. The full comparison of digital and electronic signatures covers the technical side.

E-signing covers nearly every commercial document. The exceptions are short, specific and local, which is exactly why they catch people out.

In the US, 15 U.S.C. §7003 takes these out of ESIGN's general rule:

• Wills, codicils and testamentary trusts
• Adoption, divorce and other family-law matters
• Most of the Uniform Commercial Code (Articles 2 and 2A, on sales and leases, stay in)
• Court orders, notices and official court papers such as briefs and pleadings
• Notices cutting off water, heat, power or other utility service
• Default, foreclosure or eviction notices on someone's primary residence
• Notices cancelling health insurance or life insurance benefits
• Product recalls where health or safety is at risk
• Papers that must travel with hazardous materials, pesticides or other toxic goods

Excluded from ESIGN doesn't automatically mean paper. It means federal law stops guaranteeing the electronic version and state law or the court's own rules take over.

Europe has its own sharp edges, and Germany shows them well. Under §126a of the German Civil Code (BGB), an electronic document replaces a statutory written form only with the issuer's name and a qualified electronic signature. And §623 BGB, on ending employment by notice or agreement, says flatly that the electronic form is excluded. No signature level helps there. Paper, or nothing.

A rejected signature is rarely a forged one. Usually it's a mismatch between what you sent and what the other side, or the law, needed.

Wrong level. The recipient needed a qualified signature, typically because national law requires written form, and you sent a simple one. Resending won't fix that; you need a certificate from a qualified trust service provider.

No agreement on the method. Nobody has to accept your signing process unless they've agreed to it, and banks, insurers and public bodies often specify their own.

The file changed after signing. Flattening a PDF, adding a comment or re-saving it in another editor can all break the hash.

The record can't be produced. If you can't hand over a copy every party can keep and reproduce, §7001(e) gives the other side an argument.

An expired or revoked certificate. A signature made while the certificate was valid can still stand, but proving that later takes evidence of when it was made.

A worked example

A supplier sends a signed framework agreement. Legal opens it, adds a comment, saves, and forwards it to finance. Finance runs it through a validator and gets a failure. Panic follows.

Nothing was forged. The comment rewrote the file, so its hash no longer matched the one captured at signing, and the validator did exactly what it should. The original was fine; the copy wasn't. If you're not sure which copy you're holding, a PDF signature check tells you whether the signature still matches the file.

Not much, honestly. So what is an electronic signature, once the legal language is stripped away? A label for intent that the law accepts readily and a court weighs on the evidence behind it.

That's the standard to hold a signing tool to. Judge it by the record it leaves, not by how the signature looks:

• A timestamped signing audit trail: who opened, signed or declined, with email and IP for each step
• A hash of the file, so a later change shows
• An export you can keep, in a format that opens without the vendor's app
• Storage that lasts as long as the retention period for that document, not as long as your subscription

Here's what Chaindoc does, since you're reading this on our blog. It hashes each file when you upload it. When you publish a document, that version's hash goes onto a public blockchain, and each signer's proof is recorded when signing completes. The audit trail and a verification report both export as PDF, and files travel over TLS. A normal request invites everyone at once; a fixed signing order comes through approval routes on the Business plan.

None of that changes the law. It changes what you can show when someone asks.