By Safock Procurement Research Team8 min read
A supplier emails a price agreement as a PDF and asks for it signed by Friday. The old routine is to print it, sign it, scan it and email it back, and the scanned copy is barely legible. Signing it electronically takes a couple of minutes.
Two questions decide whether that's good enough. Will an electronic signature hold up if the agreement is ever disputed? And if it is, can you show which version of the document you actually signed?
For most business documents, yes, in both the US and the EU.
United States. The federal ESIGN Act says that, for transactions in interstate or foreign commerce, a signature, contract or other record "may not be denied legal effect, validity, or enforceability solely because it is in electronic form" (15 U.S.C. § 7001, Cornell LII). Nearly every state has also adopted the Uniform Electronic Transactions Act along similar lines, and New York has its own equivalent statute.
European Union. The eIDAS regulation says that "an electronic signature shall not be denied legal effect and admissibility as evidence in legal proceedings" solely because it is electronic or isn't a qualified electronic signature. It also says that "a qualified electronic signature shall have the equivalent legal effect of a handwritten signature" (Regulation (EU) No 910/2014, Article 25, UK-retained text on legislation.gov.uk).
eIDAS describes three levels. A simple electronic signature is any electronic data used to sign, such as a typed name or a drawn signature on a PDF. An advanced signature is uniquely linked to the signer and makes later changes detectable. A qualified signature is an advanced one created with a certified device and certificate. Most purchasing documents are signed with simple signatures. Some contracts, and some countries, call for more.
The ESIGN Act lists exceptions (15 U.S.C. § 7003). It doesn't apply to:
Two of those matter for purchasing. Contracts for the sale of goods remain covered: the Act's exception for the Uniform Commercial Code specifically keeps Article 2 (sales) and Article 2A (leases) in. Shipping papers for hazardous materials don't, so chemical deliveries may still need ink.
Anything that must be witnessed or notarized, and anything your counsel or the other party says needs a stronger signature, should go through a service that provides one. This is a summary, not legal advice.
A signature on a PDF shows that someone intended to sign that document. On its own it doesn't prove who that someone was: anyone can type a name or draw a squiggle.
In a dispute, the evidence around the signature does the work. Keep it:
Drawn and typed signatures are both signatures. What generally matters is the intent to sign. The Bollard Document Signer records which method was used, and when, on the signing summary page.
The harder question in a dispute is often "which version?" A price list attached to an agreement can be edited after signing, and two copies can look the same while differing by one figure.
A cryptographic fingerprint settles it. SHA-256 turns any file into a 64-character code. The same file always gives the same code. Change one byte, such as a single digit in a price, and the code is completely different. There is no practical way to make two different documents share a fingerprint.
The Document Signer's optional signing summary page, added to the end of the signed PDF, records:
| On the summary page | What it is for |
|---|---|
| Document name and page count | Which document this is |
| SHA-256 of the original file | Proof of exactly which version was signed |
| Signed by | The name the signer gave |
| Signature method | Drawn by hand, or typed and rendered in a script face |
| Signed at | Date and time, with time zone |
| Fields added | How many signature, date, name and text fields, on which pages |
To check a copy later, compute the fingerprint of the original you kept and compare it with the one on the summary page. The signed PDF itself will have a different fingerprint, because signatures were added. The summary records the original, so keep the original alongside the signed copy.
Choose any file to see its SHA-256 fingerprint, worked out in your browser. Paste a fingerprint from a signing summary to compare.
Check a file's SHA-256 fingerprint
Fingerprint
—
Choose a file and paste a fingerprint to compare them.
Many online signing services upload the document to their servers to display and sign it. For a supplier price list, a contract with rates in it, or anything with bank details, that is a copy of your commercial terms on someone else's system.
The Bollard Document Signer opens the PDF, places the signature and writes the signed copy entirely in your browser. The file isn't uploaded.
Free tool
PDF Document Signer
Draw or type your signature, place it with the date, your name or other text on any page, and download the signed PDF with an optional signing summary page. The document never leaves your device.
Runs in your browser. No sign-up.
They work well for:
Purchase approvals are different. Signing a PDF to approve a purchase works once, but it leaves the evidence in an inbox. Approvals hold up better when the purchasing system records who approved what, at what amount, against the approval matrix.
For most business documents, yes. In the US, the ESIGN Act says a signature or contract may not be denied legal effect solely because it is electronic. In the EU, the eIDAS regulation says an electronic signature can’t be refused legal effect or as evidence solely because it is electronic. Some documents are excluded, and the evidence of who signed still matters.
It can be. What generally matters is that the person intended to sign the document, not whether the signature was drawn or typed. Keep a record of how the signature was made and who sent the signed copy.
The ESIGN Act excludes, among others, wills, codicils and testamentary trusts, adoption, divorce and other family law matters, court orders and filings, certain notices such as utility shut-offs, foreclosures, evictions and product recalls, and documents that must accompany hazardous materials. State law and other rules may add more.
Record a cryptographic fingerprint, such as a SHA-256 hash, of the original document when it is signed, and keep the original. Anyone can later compute the fingerprint of a copy and compare. If even one byte has changed, the fingerprint is completely different.
With many online signing services, yes: the file is uploaded to their servers. The Bollard Document Signer opens and signs the PDF in your browser, and the signed copy is saved straight to your device without being uploaded.