eIDAS levels and EU path
Which eIDAS assurance Seal produces today, and the roadmap to AES/QES
eIDAS levels and EU path
CompAI EIDAS-1 / SEA-47. This page states Seal’s current assurance level and the honest path to Advanced / Qualified Electronic Signatures for EU deals. It is documentation, not a product claim of QES.
What Seal produces today
| Market frame | Seal level | What that means |
|---|---|---|
| eIDAS | SES — Simple Electronic Signature | Identity + intent + integrity of the record (and, at Level 1, of final PDF bytes via platform PAdES-B). Not AES/QES. |
| US ESIGN / UETA | Electronic signature with demonstrable consent | ESIGN consent + privacy notice + sealed audit trail + Certificate of Completion. |
SES under eIDAS Art. 3(10) is still legally valid for many B2B flows. It is not equivalent to an Advanced or Qualified signature for regulated EU use cases that require AES/QES.
What backs SES on Seal
- Identity / attribution — recipient email + optional graded auth (
none/access_code/email_otp, SEA-48); actor recorded on every sealed audit row. - Intent — ESIGN consent gate + optional privacy notice (SEA-45 / SEA-52).
- Integrity of the record — per-org tamper-evident
audit_logshash chain (SEA-44); Certificate of Completion sidecar (SEA-50). - Integrity of final PDF bytes — flatten + platform PAdES-B on completed envelopes (SEA-49 Level 1). Verifiable offline without trusting Seal’s DB. Platform cert is Seal-operated (self-signed or org-managed) — Acrobat will show “identity unknown” until a public-CA / trust-service path is added.
Explicit non-claims
- Seal does not currently issue AES (unique-to-signer cert under sole control).
- Seal does not currently issue QES (qualified certificate + QSCD / certified remote signing).
- Certificate of Completion is an audit summary, not a PAdES seal.
- Platform PAdES-B is a platform seal of the final artifact, not a per-signer qualified identity.
Roadmap to AES / QES
Ship only when a deal requires it. Levels match SEA-49:
| Step | Product | eIDAS mapping | Dependency |
|---|---|---|---|
| Today | SES + platform PAdES-B (L1) | SES | Shipped |
| PAdES-T | RFC 3161 TSA at seal time | Still SES/AES-adjacent evidence | SEA-49 Level 2 — TSA vendor + ops cost |
| PAdES-LT/LTA | Embed OCSP/CRL + archival timestamp | Long-term validation | SEA-49 Level 3 — enterprise/EU sales |
| AES | Per-signer certificates under sole control of the signer | Advanced Electronic Signature | TSP integration; signer key custody (device or remote) |
| QES | Qualified certificates + QSCD / CSC-style remote signing | Qualified Electronic Signature | EU trust-service provider; certified device/CSC; different regulatory company |
Rule: do not market “eIDAS compliant” without naming the level. Default copy: “SES with sealed audit trail and platform-sealed final PDF; AES/QES via TSP roadmap.”
For EU RFPs
Answer with this page + Trust & evidence
- Production checklist. If the RFP requires AES or QES as a go-live gate, escalate — that is a TSP partnership, not a weekend feature.