Digital signatures in Italy: types, use and verification

The last two rows describe a category and one of its types, not two successive levels. Drawing or pasting a signature into a PDF does not by itself create a qualified digital signature.

A QES has the legal effect of a handwritten signature in the EU. Other signatures are not without legal value simply because they are electronic; the applicable requirements and context matter.

Before buying, ask the office whether the procedure already provides a signing method. A technically correct signature does not by itself show that an application is complete or that the signatory has the necessary authority.

A qualified remote signature is a way of creating a digital signature/QES; “remote” does not indicate a lower legal level.

Check accepted identification documents, activation, duration, renewal, signature allowances, total cost and support. Some providers accept SPID for identification. Conditions and processing times differ.

For example, a PDF document can be signed as document.pdf or document.pdf.p7m. The extension alone does not establish the signature’s legal level.

A visible signature graphic in a PDF is optional in relation to the actual electronic signature: inspect the signature data using a verifier.

Verifiers may provide online or desktop functions and a downloadable report; check the chosen service’s terms and privacy information.

For several signatories, use the additional-signature function while preserving the agreed content. Check every signature in the final file. Some PDFs retain later revisions: establish which version each signature covers.

CIE: CieSign creates an advanced electronic signature. You need the card, PIN and a compatible device: an NFC smartphone, or a computer with a contactless reader and the required software. CieSign should not be described as a QES.

SPID: ordinary sign-in identifies the user. Signing a document with SPID requires a dedicated procedure meeting AgID’s rules. Signing into a portal does not automatically sign every attachment.

CNS: authentication certificates and signing certificates have different functions, even when they are held on the same device.

PEC: transmits messages with the associated receipts; an attachment must be signed separately when the procedure requires it.

Assessing earlier signatures involves establishing that they were created while the certificate was valid, using time evidence enforceable against third parties.

For important documents, ask the provider how to manage time evidence and future verification.

A backup helps recover files; document preservation involves additional rules and procedures. Retention periods and obligations depend on the document and activity, rather than one universal deadline.

For confidential documents, consider a trustworthy local verifier and check what it transmits. A desktop application may still contact services that report certificate status. Read the documentation before using a service requiring you to upload the document.

Before activation, check remote identification, accepted documents, second-factor authentication and service availability in your country. If a technical problem prevents submission, contact the authority before the application deadline.

Continue with Percorso Cittadino’s guides to PEC, CIE, SPID and scam prevention.