Penneo receives green light for acceptance on EU Trust List

Penneo has been accepted for inclusion on the EU Trust List marking a major milestone reached for the company since it paves the way for further growth in the audit and accounting vertical and other industries across Europe.

Penneo announced today that the Agency for Digital Government in Denmark (Digitaliseringsstyrelsen) has completed its review and approved Penneo’s application to be included on the European Commission Trust list (EUTL). This means that Penneo is now officially listed on a public list of selected Quality Trust Service Providers (QTSPs) that are specifically accredited and authorized to deliver the highest levels of compliance with the EU eIDAS electronic signature regulation.  

During 2022, Penneo has invested significant resources to enhance its tech infrastructure and upgrade the company’s Sign platform according to EU legislation. The recent approval means that Penneo is now authorized to offer the highest level of electronic signature in the eIDAS regulation: Qualified Electronic Signatures (QES) in addition to Advanced Electronic Signatures (AES) that Penneo already offers. The signature type that is issued in different EU member states depends on the assurance level and maturity of the eID infrastructure in a given country. Becoming a QTSP, however, positions Penneo as a key player in this field and will allow the company to increase the security and compliance level for signatures as soon as the market allows it. 

In eIDAS, only QES signatures are perceived legally and automatically equivalent to handwritten signatures. Also, they are the only types of signatures that are automatically recognized in transactions across EU member states. All EU member states oversee providers in their own country, but once a QTSP is approved in one country, their services can be marketed in other EU countries with the same level of compliance. In other words, the approval will improve Penneo’s overall value proposition and ability to serve larger companies across borders in the EU.      

“In Denmark, the only entities listed on the EUTL are currently the Danish Government and Nets. In many countries outside the Nordics, QES is required for certain document types to be considered legally valid. For example, this is the case for employee contracts in Belgium and annual reports in Germany. In this way, QES is an important market enabler and we expect it will speed up new market entries. It also taps directly into our overall mission of making it as easy and beneficial as possible for our customers to be compliant,” says CEO, Christian Stendevad.

The eIDAS regulation was introduced in 2016 and became mandatory in all EU member states taking precedence over any conflicting national laws. At the time, it replaced the eSignature Directive that was introduced in the late 90’s by establishing an EU-wide legal framework for electronic signatures and a range of newly defined digital “trust services”. The overall objective of the regulation is to enable convenient and secure electronic transactions across EU borders for citizens, businesses, and public sector institutions.

The eIDAS regulation defines three types of electronic signatures ranging from simple electronic signatures (SES) over advanced electronic signatures (AES) to the most secure, qualified electronic signatures (QES):

• Simple / Standard electronic signatures (SES) can be as simple as a text, an image, or a symbol placed on a document digitally with the intent to sign. They are the least secure type of e-signatures, and are not admissible in court in many cases.
   
• Advanced electronic signatures (AES) are a more secure type of e-signatures. They must be uniquely linked to the signer, capable of identifying the signer, created using electronic signature creation data that is under the sole control of the signer and connected to the signed documents so that any subsequent changes can be detected. To meet these requirements, advanced e-signatures are based on the combined usage of digital certificates (eIDs) and public-key encryption.
   
• Qualified electronic signatures are the most secure type of e-signatures and have the equivalent legal effect of handwritten signatures in all EU countries. What’s more, Member States are prohibited from requesting e-signatures of a higher security level than a qualified e-signature. Because Penneo is now a QTSP, Penneo can offer QES although it should be noted that the company’s ability to deliver QES depends on the assurance level of eID providers in a given country.

The member states of the EU publish trusted lists of qualified trust service providers according to the eIDAS regulation. Penneo’s official listing can be found here.