Will your e-signed contract still verify in 10 years? Timestamps and long-term validation

It can, if the signature carries two things: a trusted timestamp that proves when it was made, and the data needed to validate it (the certificate chain and revocation information) stored inside the PDF itself. In the European PAdES standard these are the B-T and B-LT levels; for very long storage, B-LTA adds archive timestamps (ETSI EN 319 142-1, clause 6.1). Under EU and UK law, a qualified electronic time stamp enjoys a presumption that its date and time are accurate and that the data has not changed (eIDAS Art. 41(2); UK eIDAS Art. 41(2)). Without a timestamp, a signature whose certificate has since expired or been revoked may end up with an "indeterminate" result that nobody can resolve.

Why this matters: you have to keep records

Businesses keep contracts for years, for tax, accounting and limitation periods. The length depends on the country and the document; ask your accountant or lawyer. The legal test for keeping electronic records is similar across systems. In the US, a retention requirement is met by an electronic record that accurately reflects the information and "remains accessible" for the required period "in a form that is capable of being accurately reproduced for later reference" (ESIGN, 15 U.S.C. §7001(d)(1)); UETA has an equivalent rule (§12(a)). Where a law requires written form, an electronic record that cannot be retained and accurately reproduced can be denied legal effect (§7001(e)).

A readable PDF is not enough for a signed contract. If the signature is ever challenged, you want it to still validate, and that depends on decisions made on the day you signed.

The problem: certificates do not last

Every signing certificate has an end date, and it can be revoked before that. Under eIDAS, a qualified certificate that has been revoked loses its validity from the moment of revocation, and its status cannot be reverted (Art. 28(4)). Validation of a qualified signature asks whether the certificate was valid at the time of signing (Art. 32(1)(b)).

So a validator looking at an old signature needs to know two things: when the signature was made, and whether the certificate was valid then. If the certificate has expired and the validator cannot tell whether it was revoked, the European validation standard returns the result INDETERMINATE with the sub-indication OUT_OF_BOUNDS_NO_POE, where "POE" means proof of existence (ETSI EN 319 102-1, clause 5.2.6.4). A timestamp is exactly that proof.

What an electronic time stamp is

eIDAS defines an electronic time stamp as data in electronic form "which binds other data in electronic form to a particular time establishing evidence that the latter data existed at that time" (Art. 3(33)). A qualified electronic time stamp must (Art. 42(1)):

• bind the date and time to the data so as to reasonably preclude undetectable changes,
• be based on an accurate time source linked to Coordinated Universal Time (UTC),
• be signed with an advanced electronic signature or sealed with an advanced electronic seal of the qualified trust service provider, or by an equivalent method.

A non-qualified time stamp still cannot be denied legal effect or admissibility merely because it is electronic or not qualified (Art. 41(1)), but only a qualified one carries the statutory presumption of accurate date, time and integrity (Art. 41(2)). A qualified time stamp from one Member State is recognised as qualified in all others (Art. 24a(6)), and qualified timestamping providers appear on the national trusted lists alongside other qualified services (Art. 22(1)). The UK kept the same two articles (UK eIDAS Art. 41 and 42).

The difference from the date you normally see on a signature is who vouches for it. Without a timestamp, the signing time is only a claimed time, stated by the signing software rather than by an independent provider; the ETSI validation standard treats a claimed signing time and a proof of existence as different things (EN 319 102-1, clause 5.1.1, note 2).

A timestamp alone is not enough: long-term validation

A timestamp shows the signature existed at a given moment. Someone checking it years later also needs the certificates and the revocation status as they were at that moment. The PAdES standard keeps this material (CA certificates, CRLs and OCSP responses) in the PDF, in a structure called the Document Security Store (ETSI EN 319 142-1, clauses 5.4.1 and 5.4.2), and defines four baseline levels (clause 6.1):

The standard says levels B-LT and B-LTA are appropriate where the validity of a signature must be preserved after certificate expiry, revocation or algorithm obsolescence (clause 6.1, note 2). "LTV", the term many PDF readers use, broadly corresponds to the B-LT idea: the file carries what it needs to be checked.

Why embed the data if providers keep it? eIDAS does require qualified providers to make revocation status available "beyond the validity period of the certificate" (Art. 24(4)). But a file that contains its own proof does not depend on any server still answering years from now.

For very long archives: B-LTA and preservation services

Over decades the cryptographic algorithms that protect a signature can weaken. B-LTA addresses this with document time stamps that can be added again later (ETSI EN 319 142-1, clause 6.3, requirement w); before each new one, all validation material not yet in the file must be added (requirement x). The standard notes that B-LTA can help validate a signature beyond events such as weak algorithms or expired validation data (clause 6.1, note 3).

If you would rather not manage this yourself, eIDAS provides for qualified preservation services for qualified electronic signatures, which use procedures and technologies "capable of extending the trustworthiness of the qualified electronic signature beyond the technological validity period" (Art. 34(1)). For most business contracts, B-LT is a sensible starting point; plan for B-LTA or a preservation service if you keep signed records for a very long time.

How to tell whether your PDF has a timestamp and validation data

Open the signature properties in a PDF reader that validates signatures. Check whether the signing time comes from a timestamp rather than the signer's clock, and whether the signature is marked as enabled for long-term validation. The European Commission's DSS demonstration web app can also validate a file at the level of basic signatures, signatures with long-term validation data or signatures with archival data; do not upload confidential documents there, as the Commission says it is for testing only. For the full procedure, see how to verify a signed PDF.

1. Is there a timestamp, and who issued it? For an EU qualified timestamp, is the provider on a trusted list?
2. Does the file contain the certificate chain and revocation data (LTV / B-LT)?
3. Has the document stayed unchanged since signing?
4. Are you keeping the signed PDF file itself, not a printout?

How it works in Collobr

The Collobr E-Signature app for Windows signs quote and contract PDFs in the PAdES format with a smart card or USB token. Collobr does not sell or provide timestamps: if your company registers its own timestamping subscription in Collobr, a timestamp is added to the signature, and the certificate chain and OCSP/CRL revocation data can be embedded in the PDF. Embedding this long-term validation data requires a timestamp. The app has been tested with Turkish qualified certificates and has not yet been tested with EU qualified certificates, so talk to us before you plan an EU qualified signing workflow around it.

If you are unsure which documents can be signed electronically in the first place, see where e-signatures are valid; for the signature levels, see which e-signature you need; and for the full picture, our e-signature guide.