eIDAS is EU law that sorts electronic signatures into simple, advanced and qualified levels by legal weight. 21 CFR Part 11 subpart C is the FDA rule on what makes an electronic signature acceptable for records the FDA regulates. They answer different questions, and a trial can face both. This page lines them up. It is orientation, not legal advice.
Free sandbox · No credit card · 21 CFR Part 11 aligned
| Question it answers | eIDAS (EU) | 21 CFR Part 11 subpart C (US) | |
|---|---|---|---|
| What is it? | EU regulation on electronic identification and trust services | FDA regulation on electronic records and signatures | |
| Main idea | Signature levels with different legal weight | Controls that make a signature trustworthy | |
| Levels? | Simple, advanced, qualified | No levels, one set of requirements | |
| Handwritten equivalent | Qualified signature, by the regulation | Signature is the legally binding equivalent if requirements are met |
The short answer
EU
eIDAS is Regulation (EU) No 910/2014 on electronic identification and trust services. It was amended by Regulation (EU) 2024/1183, which entered into force in May 2024 and added the European Digital Identity Wallet framework. Its signature provisions sit in a small number of articles, and the part that matters for trials is that it sorts electronic signatures into three tiers by how much evidence stands behind them.
Article 25 is the legal effect rule. An electronic signature cannot be denied legal effect or admissibility as evidence in court solely because it is electronic or because it is not a qualified signature. A qualified electronic signature has the equivalent legal effect of a handwritten signature. For simple and advanced signatures, the weight beyond that basic non-discrimination rule is left to national law, which is one reason two EU countries can treat the same click-to-sign flow differently.
This is the base category: data in electronic form attached to or logically associated with other data, used by the signatory to sign. A typed name, a tick box with a name, a drawn signature on a screen and a signature confirmed by a one-time code all fall here as long as nothing more is claimed. The regulation does not set technical conditions beyond that definition, so the strength of a simple signature depends entirely on the surrounding evidence: who was logged in, how they were verified, what was shown to them, and what record exists.
Article 26 lists four requirements. The signature must be uniquely linked to the signatory, capable of identifying the signatory, created using data the signatory can use under their sole control with a high level of confidence, and linked to the signed data so that any later change to that data is detectable. In practice advanced signatures are usually delivered by a trust service provider using certificates or an equivalent mechanism, rather than by a form on a web page. The 2024 amendment did not change these four conditions.
A qualified signature is an advanced signature that is created by a qualified signature creation device and based on a qualified certificate issued by a qualified trust service provider. It is the only level that eIDAS itself gives handwritten-equivalent effect, across the EU. It is also the heaviest to deploy: the signer needs a qualified certificate and a compatible signing method, which is rarely practical for a participant signing a consent form at home.
Side by side
A simplified comparison for orientation. Read the regulation texts for exact wording.
| Aspect | eIDAS simple | eIDAS advanced | eIDAS qualified | 21 CFR Part 11 subpart C |
|---|---|---|---|---|
| Source | Regulation (EU) 910/2014 | Regulation (EU) 910/2014, Art. 26 | Regulation (EU) 910/2014, with qualified certificate and device | 21 CFR 11.100, 11.200, 11.300 |
| Uniquely linked to the signer | Not required by the definition | Required | Required | Required: unique to one individual, never reused or reassigned (11.100(a)) |
| Identity checked | Not set by the regulation | Signature must identify the signatory | Backed by a qualified certificate | Organization verifies identity before establishing the signature (11.100(b)) |
| Signer control | Not required | Sole control with a high level of confidence | Qualified creation device | Two distinct components for ID-and-password signatures; use only by the owner (11.200(a)) |
| Tamper evidence | Not required | Changes to signed data detectable | Required | Signatures linked to their records so they cannot be excised or copied (11.70, in subpart B) |
| Legal weight | Not denied solely for being electronic | Not denied solely for being electronic; further weight is national law | Equivalent to handwritten, EU-wide | Accepted as equivalent to handwritten when the requirements are met |
| Typical delivery | Typed or drawn name, code, click-to-sign | Trust service provider, certificate based | Qualified trust service provider | Validated system with managed accounts and audit trail |
Check the current text of eIDAS (EUR-Lex consolidated version) and 21 CFR Part 11 (eCFR) before relying on any row.
US
Part 11 covers electronic records and electronic signatures used to meet FDA record requirements. Subpart C is the electronic signature subpart. Its core idea is that a signature has to be tied to one person, verified, hard to misuse and protected by access controls, rather than graded by type.
Section 11.100 sets general requirements: each electronic signature must be unique to one individual and not reused by, or reassigned to, anyone else, and before an organization establishes or assigns a signature it must verify the identity of the person. Section 11.200 covers components and controls. A signature that is not based on biometrics must use at least two distinct identification components, such as an identification code and a password. During one continuous controlled session the first signing uses all components and later signings can use one component that only the owner can execute, while a signing outside such a session needs all components each time. Signatures must be used only by their genuine owners, and anyone else attempting to use one should need the collaboration of two or more people. Section 11.300 adds controls for identification codes and passwords: unique combinations, periodic checking and revision, and deauthorizing lost or compromised credentials and devices.
Two neighbouring parts of the rule belong in the picture even though they are not in subpart C. Subpart B (section 11.50) requires signed records to show the signer’s printed name, the date and time, and the meaning of the signature, such as review, approval or responsibility. Section 11.70 requires signatures to be linked to their records so they cannot be removed or copied to falsify another record. In 2024 the FDA finalised a Questions and Answers guidance on electronic systems, records and signatures in clinical investigations, which replaced its 2007 computerised systems guidance and speaks to these topics for trials. It is guidance, not binding, but it shows how the FDA reads the rule.
Where they meet
A trial with EU and US sites, or a US-sponsored study with EU participants, can easily be inside both frameworks. The useful way to think about it is that each one answers a different question for a different reader. Part 11 answers the FDA’s question: can we trust this signature on a record we regulate? eIDAS answers the question a court or a counterparty asks: does this electronic signature have legal effect, and how much?
For a consent form or an investigator sign-off in a trial, neither framework usually requires the top tier. ICH GCP asks that consent is documented by a signed and dated form, and leaves the technology open; the FDA and OHRP joint Q&A on electronic informed consent speaks of confirming the identity of the signer without prescribing a method. In the EU the Clinical Trials Regulation (see our EU CTR guide) sets consent requirements but not an eIDAS level. In practice the deciding voice is the ethics committee or national authority that approves your consent process, so the working rule is: put the proposed signing method in the submission and get it accepted in writing.
Contract-style documents (a sponsor-site agreement, a data processing agreement, an investigator undertaking) are more likely to attract advanced or qualified signatures than a participant’s consent, because the signers already have business credentials and certificates. For participants the practical question is usually how strongly you can verify who they are, not whether they hold a certificate. Our note on remote identity verification for eConsent covers that side.
Where the FDA is the audience, for an IND study or a study whose records will be inspected by the FDA, the Part 11 controls and the 2024 Q&A are the working reference, and the workflow on electronic signatures for clinical trials shows what those controls look like in a signing flow. Our 21 CFR Part 11 checklist goes through the controls item by item, and Annex 11 vs 21 CFR Part 11 compares the US rule with the EU’s computerised-systems annex.
Decision
Work through the questions in order. The answer is a question to put to your regulators, not a verdict.
Treat Part 11 controls as mandatory: unique accounts, two components, identity verification, signature manifestation and record linking.
Ask the ethics committee and national authority which electronic signature method they accept for consent and put it in the submission.
If yes, you need a trust service provider for that document or step. Do not assume a system signature will substitute.
Focus on identity assurance and tamper evidence: OTP or equivalent, a legal-meaning statement, and a signed record linked to the exact document version.
Use your legal team’s usual signing tool. Higher eIDAS levels are more realistic here than for participants.
Keep the audit trail, the signed PDF and the signing metadata together, and check your retention rules.
What Capture does
Capture’s eConsent signing flow is built around identity assurance and record integrity. A participant draws a signature on screen, confirms with a one-time code sent to their email, and acknowledges a legal-binding statement. An investigator or authorised site staff member countersigns after re-entering their password, with a stated meaning. Each signature is hashed to the exact document content at signing, and the signed PDF carries signature data, timestamps and the audit trail.
Meaning of signature
I have reviewed this adverse event and confirm the assessment of seriousness, severity and causality.
Signer
Dr. A. Ozola, PI
Password
••••••••••
Run a test consent in the free sandbox, countersign it, export the signed PDF and audit trail. Free sandbox with every feature, no credit card, and you pay only when you go live with real participants.
Getting it accepted
List what gets signed: participant consent, assent, investigator sign-off on CRFs, delegation logs, contracts. Each can need a different method.
Which regulator inspects (FDA, EU national authorities) and which ethics committees approve. Note any country or committee that has stated a preference.
State how the signer is identified, how the signature is bound to the document and what record is kept. Quote the controls, not just the word "compliant".
Run a mock consent with a colleague as participant and another as countersigner. Export the result and read it as an inspector would.
Write down user management, role assignment and who may sign what. The software supplies controls; your procedures supply the rest.
eIDAS was amended in 2024 and FDA guidance changed in 2024. Re-read the current texts before each new study.
Honest fit
Capture is a good fit: OTP-verified participant signature, password-authenticated countersignature, hashing to the signed document, exportable PDF with audit trail.
Capture is a good fit as a source of the controls: role-based access, field-level audit trail, signed records. Your validation and procedures complete the picture.
Capture is not the right tool on its own. Use a qualified trust service provider for that step.
Not what Capture is for. Use your normal contract signing tool.
Capture cannot give one. Ask your regulatory counsel and your ethics committee.
eIDAS is EU law that defines simple, advanced and qualified electronic signatures and gives them different legal effect. 21 CFR Part 11 subpart C is FDA rule that sets controls an electronic signature must meet to be treated as equivalent to handwriting for FDA-regulated records. One grades signatures by level; the other sets a single set of requirements.
Usually the regulations do not name a level for consent. ICH GCP and the EU Clinical Trials Regulation leave the technology open, so ethics committees and national authorities decide. Some may expect more than a click-to-sign flow, so put your proposed method in the submission and get it accepted.
Not automatically. Part 11 requires unique, verified, controlled signatures, but it does not require a trust service provider or certificate. An eIDAS advanced signature has its own four conditions, including sole control and tamper detection. A signature may meet one set without meeting the other.
At least two distinct identification components for non-biometric signatures, such as an ID code and a password, with all components used when signing outside a continuous controlled session. Signatures must be used only by their genuine owners and designed so that misuse needs two or more people to collude. Check the current text on eCFR.
eIDAS applies to electronic signatures and trust services within the EU, so it can matter for EU-based participants, sites and contracts regardless of sponsor location. Whether it constrains your consent process in practice depends on the national authority and ethics committee that approve it.
No. Capture does not claim to issue advanced or qualified electronic signatures under eIDAS. Its signing flow uses an on-screen signature, email OTP confirmation, password-authenticated countersignature and hashing to the signed document. If your committee requires a higher level, confirm that before relying on Capture signatures alone.
Capture provides Part 11-aligned controls: field-level audit trail, role-based access, electronic signatures with re-authentication and signature-to-document hashing. Compliance depends on how a sponsor validates and uses the system, so treat the software as supplying controls, not a certificate.
No. It is a plain-language orientation. Regulations and guidance change, so check the current text of eIDAS, 21 CFR Part 11 and the FDA Q&A guidance, and ask your regulatory counsel and ethics committee about your specific trial.
Keep exploring
Electronic signatures for clinical trials
How the signing workflow in Capture actually works.
21 CFR Part 11 compliance checklist
The Part 11 controls, item by item.
Annex 11 vs 21 CFR Part 11
The EU computerised-systems annex next to the US rule.
Remote identity verification for eConsent
How strongly you can verify a participant who signs remotely.
eConsent software for clinical trials
The product that carries the signing flow.
Capture eConsent
Templates, signing and countersignature in one place.
Free sandbox with every feature. No credit card, and you pay only when you go live with real participants.