E-Signatures and the Law: eIDAS, ESIGN, and the ECA

The short version

Electronic signatures are legally valid in the US, the EU, and the UK. They've been valid for over two decades. Three laws establish this:

• ESIGN Act (US, 2000) — Federal law covering all 50 states
• eIDAS Regulation (EU, 2016) — Regulation covering all EU member states
• Electronic Communications Act (UK, 2000) — Domestic law post-Brexit

All three laws say the same thing: an electronic signature cannot be denied legal effect solely because it's electronic. A click, a typed name, a digital mark — these all count, as long as certain conditions are met.

ESIGN Act (United States)

The Electronic Signatures in Global and National Commerce Act was signed into law on June 30, 2000. It establishes that electronic signatures and electronic records have the same legal standing as handwritten signatures and paper documents.

Key requirements:

• Intent to sign — The signer must demonstrate intent to sign. A clear “Sign” action (clicking a button, typing a name) satisfies this
• Consent to do business electronically — Both parties must agree to use electronic signatures
• Association of signature with record — The system must connect the signature to the specific document
• Record retention — The signed document must be retained and reproducible

Exceptions: Wills, family law matters (adoption, divorce), court orders, utility cancellations, health insurance terminations, and documents requiring notarisation are excluded.

State-level: Most states have also adopted UETA (Uniform Electronic Transactions Act), which provides additional consistency. Only New York has not adopted UETA but still recognises e-signatures under its own ESRA law.

eIDAS Regulation (European Union)

The Electronic Identification, Authentication and Trust Services Regulation (No. 910/2014) came into effect on July 1, 2016. It replaced the older e-Signature Directive and established a standardised framework across all EU member states.

eIDAS defines three tiers of electronic signature:

The critical point: all three tiers are legally valid. A Simple Electronic Signature (SES) “shall not be denied legal effect and admissibility as evidence in legal proceedings solely on the grounds that it is in an electronic form” (Article 25.1). The higher tiers provide stronger evidential weight, not exclusive legal validity.

For most commercial contracts — NDAs, SOWs, freelance agreements, invoices — SES or AES is sufficient. QES is typically required only for specific use cases mandated by individual Member States (e.g., real estate transfers in some jurisdictions).

Electronic Communications Act (United Kingdom)

The UK's Electronic Communications Act 2000 (ECA) provides the domestic legal basis for electronic signatures. Section 7 states that electronic signatures are admissible as evidence in legal proceedings regarding the authenticity or integrity of any communication or data.

Post-Brexit, the UK no longer falls under eIDAS directly. However, the UK retained eIDAS in domestic law through The Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 (UK eIDAS), which mirrors the EU regulation closely.

In practice, the UK framework is functionally identical to the EU's for most commercial purposes. The Law Commission confirmed in its 2019 report that electronic signatures are valid for virtually all contracts under English law, including deeds (with specific witnessing requirements).

What makes a signature “legally binding”

Across all three frameworks, a legally binding electronic signature needs to demonstrate:

1. Intent to sign — The signer took a deliberate action to sign. Active participation in a signing ceremony (reviewing the document, typing their name, clicking “Sign”) demonstrates intent
2. Identity verification — The system records who signed. Email verification, OTP, API key authentication, and IP address logging all contribute to this
3. Document integrity — The document hasn't been modified since signing. A SHA-256 hash provides mathematical proof of this
4. Audit trail — When did each party sign? What was their IP address? How were they verified? A complete audit trail provides the evidential record
5. Consent — Both parties agreed to use electronic signatures for this transaction

How Signbee satisfies each requirement

Under eIDAS classification, Signbee signatures qualify as Advanced Electronic Signatures (AES) — the signature is uniquely linked to a verified signatory, created using data under their sole control (email OTP), and linked to subsequent changes via the SHA-256 hash.

When you need more

There are situations where a standard electronic signature isn't sufficient:

• Real estate transfers — Many jurisdictions require wet signatures or qualified electronic signatures
• Notarised documents — Powers of attorney, sworn statements, and court filings often require notarisation
• Wills and testaments — Excluded from ESIGN Act; most jurisdictions require physical witnesses
• Government contracts — Some government procurement processes mandate specific signature types

For everything else — NDAs, service agreements, freelance contracts, invoices, statements of work, licensing agreements, partnership agreements — electronic signatures are not just valid, they're the standard.

The developer takeaway

If you're integrating e-signatures into your product, the legal requirements are simpler than they appear:

1. Ensure the signer takes a deliberate action (not passive acceptance)
2. Verify identity through at least one factor (email is standard)
3. Hash the document to prove it hasn't changed
4. Record timestamps, IPs, and verification methods
5. Deliver copies to both parties

Signbee handles all five automatically. You call the API; the law is satisfied.