Advanced Electronic Signature: What Holds Up on Tablets and Apps

An advanced electronic signature (AES, in Italian FEA) is an electronic signature that identifies the signer, is created with means under the signer's sole control and makes any change to the document after signing detectable. Under Italian law, a document carrying an advanced electronic signature has the same weight as a private deed signed by hand. Business owners usually care about something else, though: how much the signature a customer draws with a finger on the technician's tablet is worth. It does count, and its weight depends more on the process built around the signature than on the technology behind it.

On service reports, delivery notes (DDT, the Italian transport document) and proof of delivery, choosing between a simple, advanced or qualified signature has practical consequences, and handwritten biometric signatures bring privacy obligations with them. If you decide to offer AES to your own customers, the law also asks a lot of you on the organisational side. What follows is what we explain to clients when we design apps for field technicians and sales reps, with references to the official rules. For any specific contract, check with your lawyer or DPO.

Advanced electronic signature: what the law says

The rules come from three levels. The first is European: the eIDAS Regulation (EU) No 910/2014 defines the types of signature. Article 26 sets out the four requirements of an advanced electronic signature: it is uniquely linked to the signatory, it is capable of identifying the signatory, it is created using signature creation data that the signatory can, with a high level of confidence, use under their sole control, and it is linked to the signed data so that any subsequent change is detectable. Article 25 adds a point many people forget: an electronic signature cannot be denied legal effect or admissibility as evidence solely because it is electronic or because it is not qualified.

The second level is Italian: the Digital Administration Code (CAD, Legislative Decree 82/2005). Article 20, paragraph 1-bis, states that an electronic document meets the written form requirement and has the effect set by Article 2702 of the Italian Civil Code, meaning the evidential value of a private deed signed by hand, when it carries a digital, qualified or advanced signature, or when it is created, after the author has been identified electronically, through a process that meets the requirements set by AgID, the Italian digital agency (its 2020 Guidelines on electronic signing, which underpin signing through SPID, Italy's public digital identity, for example). In every other case the value of the document is "freely assessed by the court", based on its security, integrity and unalterability.

The third level is the technical rules of the Italian Prime Ministerial Decree (DPCM) of 22 February 2013. Articles 55 to 61 explain how an advanced electronic signature solution is built and what the business offering it has to do. We come back to this in the section on obligations.

Simple, advanced, qualified: the differences in practice

"Simple electronic signature" is not a legal term: it is used for every electronic signature that is neither advanced nor qualified. A signature drawn on a screen with nothing else around it, a click on "I accept", a name typed at the bottom of a form.

There is also a form requirement worth knowing. In Italy, Article 21, paragraph 2-bis, of the CAD requires a qualified or digital signature, on pain of nullity, for the private deeds listed in Article 1350 of the Civil Code, items 1 to 12 (such as contracts transferring real estate). For the other deeds the law requires in writing (item 13 of the same article) an advanced electronic signature is enough. With a service report or a delivery note this almost never comes up, but if your app is also used to sign contracts, it is better to know beforehand.

Signatures on digital service reports: what you actually need

Most service reports and proofs of delivery do not need an advanced electronic signature. They need a well-built simple signature, with enough evidence around it to withstand a dispute.

The typical case: a maintenance technician finishes a job in an apartment building, the building contact signs on the tablet, and the report turns into an invoice. If three months later the property manager disputes the hours, you have to show that the document was not touched after signing, who was there, where and when. The court looks at the document's "security, integrity and unalterability". A PDF generated when the job is closed, with the signature embedded, a fingerprint of the file (hash) stored separately, the date and time of signing and of synchronisation, the device's GPS position, the technician's name and photos of the job is already far stronger evidence than the crumpled carbon copy that used to ride around in the van.

An advanced electronic signature makes sense when the signed document is a real financial commitment and the customer is a repeat one: accepting a quote on a building site, renewing a maintenance contract, an order taken by a sales rep at a shop that buys from you every month. In these cases, moving from a signature that is "freely assessed" to one with the effect of a private deed puts you in a much stronger position if the customer denies having signed.

Before deciding, count how many disputes you have had over the last two years and on which documents. If the answer is "two, both about hours", you need a clearer report and a traceable simple signature, not an AES service. If instead you lose money because customers deny having approved extra work, AES deserves serious consideration, at least for that type of document. Our article on digital service reports for field technicians covers the other features an app like this needs.

Handwritten biometric signatures: how they work and what they mean for privacy

A handwritten biometric signature (in Italian, firma grafometrica) is the more advanced version of the finger signature. The customer signs with a pen on a tablet or a dedicated pad, and besides the stroke the system records dynamic data such as pressure, speed and timing. That data, encrypted inside the document, lets a handwriting expert compare the signature with other signatures by the same person if there is a dispute. It is one of the techniques used to create an advanced electronic signature when the customer signs in person: the Italian data protection authority (Garante privacy) treats it precisely as a basis for AES.

The sensitive point is that biometric signature data is biometric data (Article 4 of the GDPR) and, when it is used to link the signature uniquely to a person, it falls among the special categories of Article 9, which strictly limits its processing. In 2014 the Garante devoted a section of its general decision on biometrics to handwritten biometric signatures, with precise requirements. The decision predates the GDPR: the prior checking procedure no longer exists and the Regulation is now the framework, but the technical requirements are still the most concrete reference. In short, it asks that:

• the signer is identified first and gives free consent;
• there is always an alternative way to sign without biometrics, on paper or digitally;
• biometric data does not stay on the tablet, not even briefly, and is stored only inside the document, encrypted with a public key whose private key is held by a trusted third party;
• that data can be decrypted only in the event of a dispute and at the request of the judicial authority;
• mobile devices are covered by a management system (MDM or MAM) with remote wipe in case of theft;
• there is a technical report, including an assessment of necessity and proportionality, reviewed at least once a year.

In practice a handwritten biometric signature is not a library you add to the app in an afternoon. It involves your DPO or privacy consultant, a provider to hold the keys and, almost always, an impact assessment. For a maintenance company with ten technicians another route is often better, such as AES with an OTP code sent to the mobile phone of a customer who has already been identified.

Offering AES to your customers comes with obligations

Under Article 55 of the 2013 DPCM, building an advanced electronic signature solution is unrestricted and needs no authorisation. However, a business that uses it with its own customers becomes the party that "provides" the solution, even if it bought the software or had it developed by someone else. Article 57 then gives that business a set of obligations:

1. identify the customer with certainty using a valid identity document;
2. inform the customer about the terms of use of the service and have them sign a declaration of acceptance before activating it;
3. keep a copy of the identity document, the declaration and any information proving compliance with the technical requirements for at least twenty years;
4. give the customer a free copy of these documents on request, and explain on its website how to request them;
5. publish on its website the features of the system and the technologies used;
6. offer, where possible, a service to withdraw consent and a support service;
7. hold civil liability insurance of no less than €500,000 and make this known.

Then there is Article 60: an advanced electronic signature created this way is valid only in the relationship between the signer and the business that provides it. If your customer signs a document they then have to present to a third party, a bank for instance, that signature does not cover them as AES. For documents that also need to be valid with other parties, a qualified or digital signature is the better choice.

That is why, when a client asks us for "AES in the app", our first question is about the organisation: who identifies the customer the first time, where the documents are archived for twenty years, who manages the insurance policy. If there are no answers to these, the signature stays simple, whatever software you choose.

What the software has to do

Whether you choose a well-made simple signature or AES, there are requirements the app and the business software must meet. This is the list we use when we design a custom mobile app for technicians and sales reps:

• The document is finalised before signing. The customer signs a PDF already generated with all the data (hours, materials, prices if any) and sees exactly what they are signing.
• As soon as the signed document reaches the server it is sealed: hash fingerprint, company signature or seal, timestamp where needed. Any later change must be obvious.
• An event log (audit trail) records who created the document, when it was signed, from which device, at what position and with which app version.
• The signer's identity is tied to something verifiable: name and role for a simple signature, identity document and verified mobile number for AES with OTP.
• The customer gets a copy straight away, by email or in the customer area. For AES, Article 56 of the DPCM requires that the signer can obtain evidence of what they signed, and in any case an immediate copy cuts down calls to the office, as we explain in our article on a customer portal that ends repetitive requests.
• The app works offline. Plant rooms and basements often have no signal, so the signature is captured on the device, which immediately calculates the document's fingerprint and records the local date and time. On synchronisation the server checks the fingerprint, applies the seal and, where needed, the timestamp, and the event log keeps both times.
• Storage is separate and protected, with backups and role-based permissions. If you use biometrics, biometric data must never end up in a central database. For data protection in general, our guide to cybersecurity for SMEs has practical advice.

For AES, do not build the signing part from scratch: there are trust service providers with APIs for OTP, remote signing and long-term archiving. The custom work lies in the flow around it, that is when the signature is requested, from whom, on which document, and how the signed document gets back into the business software without anyone re-uploading it by hand.

An example from the field: Dabe Connect

For Dabe Service, an industrial and residential building services contractor, we developed Dabe Connect: a web-based management platform, an app for technicians and a customer area. In the app, technicians receive work orders, fill in the job report, attach photos and collect the customer's signature on the screen. Data syncs with the central platform and the customer finds the reports in their private area.

The case study reports that paper was eliminated for maintenance and installation work. What matters for this article is that the signature on the tablet sits inside a tracked flow, with the report generated by the system, the photos, the assigned technician and a copy available to the customer. If you work in the same sector, our article on management software for building services contractors shows how jobs, projects and invoicing connect.

Which signature to choose: a simple rule

If the document is there to prove that a job was done or that goods arrived, start with a well-tracked simple signature. If the document is a financial commitment with a customer who will sign often, consider an advanced electronic signature and treat it as an organisational project as well as a technical one. If the document has to be valid with third parties or is one of the deeds for which the law requires a qualified signature, use a digital signature. And if you are thinking about handwritten biometric signatures, bring in whoever handles privacy before you choose the tablet.

Once you have decided, ask your provider to show you a signed document and its event log. If they cannot, that log probably does not exist.

Let's talk

If you are digitising service reports, deliveries or quotes and are not sure which level of signature you need, we can look at your process together: which documents you have signed, by whom, and what happens if someone disputes them. In one call we can work out whether fixing your current app is enough or whether it makes sense to redesign the flow from scratch, with signing built into your business software. Book a call with Selli and bring a sample service report or delivery note.