Digital Signatures for Invoices: When They

In an increasingly digital business world, an important question arises: Do electronic invoices need to be digitally signed? The short answer for Germany: Not mandatory since 2011 - but there are good reasons to consider it anyway. In this comprehensive article, you'll learn everything about digital signatures for invoices: the different signature types, legal requirements, practical implementation, and when a signature is truly worthwhile.

What is a Digital Signature? Basics and Technology

A digital signature is the electronic equivalent of a handwritten signature - but significantly more secure and versatile. It's based on cryptographic procedures (asymmetric encryption with public key infrastructure) and fulfills several important functions.

The Three Core Functions of a Digital Signature

1. Authenticity (Genuineness of Origin): The signature confirms that the document actually comes from the stated sender. The recipient can be sure that the invoice comes from you and not from a third party.

2. Integrity (Intactness of Content): Any subsequent change to the document invalidates the signature. Manipulations - even changing a single letter - become immediately apparent. This protects against forgery and fraud.

3. Non-repudiation (Binding Nature): The sender cannot deny having signed the document. The signature is uniquely linked to their identity and can serve as evidence in court.

How Does a Digital Signature Work Technically?

The basic principle:

1. Create hash value: A unique "fingerprint" (hash value) is calculated from the document
2. Sign: The hash value is encrypted with the sender's private key
3. Verify: The recipient decrypts the signature with the public key and compares the hash value

If the hash values match, the document is unchanged and the signature is valid.

Digital Signature vs. Electronic Signature

The terms are often confused, but there are important differences:

The Three Signature Types According to eIDAS Regulation

The EU Regulation eIDAS (electronic IDentification, Authentication and trust Services, No. 910/2014) creates a Europe-wide uniform legal framework for electronic signatures. It distinguishes three levels:

1. Simple Electronic Signature (SES)

The lowest level - it has hardly any technical requirements.

What counts as SES:

• A scanned signature on a PDF
• A typed name at the end of an email
• A checkmark in an online form
• A digitized paraph

Characteristics:

• No special technical requirements
• No identity verification required
• Low evidential value in court
• Suitable for informal documents

Risks:

• Easily forgeable
• No manipulation detection
• Difficult to prove in disputes

2. Advanced Electronic Signature (AES)

This signature already offers significantly more security.

Requirements according to eIDAS Art. 26:

• Uniquely assigned to the signatory
• Enables identification of the signatory
• Created with means under the sole control of the signatory
• Linked to the document so that changes are detected

Characteristics:

• Technically more sophisticated
• Higher evidential value than SES
• No obligation for identity verification by third parties
• Suitable for most business documents

Typical Application:

• Internal approval processes
• Contracts with medium risk
• Quotes and orders

3. Qualified Electronic Signature (QES)

The highest level - legally equivalent to a handwritten signature.

Requirements according to eIDAS Art. 28-30:

• Meets all requirements of AES
• Based on a qualified certificate
• Created with a qualified signature creation device (QSCD)
• Certificate issued by qualified trust service provider (QTSP)
• Identity verification of signatory required

Characteristics:

• Full evidential value in court
• EU-wide recognized
• Highest forgery resistance
• Usually fee-based

Typical Application:

• Notarial documents
• Official communication
• High-value contracts
• Invoices to public clients

Overview Table: The Three Signature Types

Is Digital Signature Required for Invoices?

The Legal Situation in Germany

Requirements for electronic invoices are regulated in the Value Added Tax Act (UStG). Since the Tax Simplification Act 2011:

Electronic invoices in Germany no longer require a qualified electronic signature.

Instead, two conditions must be met (§ 14 Para. 1 UStG):

1. Authenticity of origin: The invoice issuer must be unambiguously identifiable
2. Integrity of content: The content must not have been altered

These requirements can be met in three ways:

1. Internal Control Procedure (ICP): The recipient verifies the invoice based on their internal processes:

• Comparison with order or contract
• Supplier verification
• Plausibility check of amounts

2. EDI Procedure: Electronic Data Interchange with framework agreement between parties.

3. Qualified Electronic Signature: Still a valid option, but no longer mandatory.

Conclusion for Germany: A digital signature is not mandatory, but one of several ways to meet legal requirements.

The Situation in Other EU Countries

The eIDAS regulation applies EU-wide, but implementation for invoices varies:

Italy:

• Electronic invoices must be transmitted via the SDI system (Sistema di Interscambio)
• For B2G invoices (to authorities) a qualified signature is required
• Strictest requirements in the EU

France:

• E-invoicing becomes mandatory from 2026 in stages
• Factur-X (corresponds to ZUGFeRD) becomes standard
• Increased requirements for authenticity

Spain:

• TicketBAI system in some regions
• Qualified signature for B2G invoices

Austria:

• Similar to Germany, no signature requirement
• Internal control procedures recognized
• QES optional but recommended for B2G

Switzerland (not EU):

• No legal signature requirement
• QR invoice as standard for payments
• Signature optional but recognized

When Does a Signature Become Mandatory?

In certain situations, a (qualified) signature may be required:

• Public contracts: Some authorities require QES in their tender conditions
• Industry-specific requirements: E.g., in healthcare or for financial services
• Contractual agreements: If a signature requirement was agreed with the customer
• International business: If the destination country requires a signature

When Is a Digital Signature Worthwhile?

Even though it's not mandatory, there are good reasons for a digital signature:

1. Business with Public Clients (B2G)

For invoices to authorities and public institutions:

• Some clients explicitly require a QES
• XRechnung platforms accept signed documents
• Signature can accelerate acceptance

2. International Business

If you have customers in countries that require signatures:

• Italian B2G customers require QES
• International large customers often have their own compliance requirements
• A signature demonstrates professionalism

3. Maximum Legal Security

A qualified signature offers the highest evidential value:

• In disputes over invoice contents
• When customers claim not to have received invoices
• In defending against manipulation allegations

4. Industries with Increased Security Needs

In sensitive industries, a signature can make sense:

• Financial services
• Healthcare
• Pharma and medical technology
• Critical infrastructure

5. Competitive Advantage and Trust

A signed invoice signals:

• Professionalism and seriousness
• Investment in security
• Modernity of your company

How to Sign Invoices Digitally: Step-by-Step Guide

Step 1: Choose the Right Signature Type

For most use cases, we recommend:

• For normal business invoices: AES or ICP is sufficient
• For B2G invoices: QES recommended or required
• For international customers: QES for maximum recognition

Step 2: Obtain Signature Certificate

For a qualified signature, you need a certificate from an accredited trust service provider (Qualified Trust Service Provider, QTSP).

German Providers:

• D-Trust (Bundesdruckerei) - www.d-trust.net
• Telesec (Deutsche Telekom) - www.telesec.de
• sign-me - www.sign-me.de
• Swisscom Trust Services - www.swisscom.ch/signing

Costs:

• Certificates: €50-200 per year
• Remote signature: Often pay-per-use (€0.20-1.00 per signature)
• Hardware token: One-time €30-100

Identity Verification: For a qualified certificate, you must identify yourself:

• In person on-site
• Via video ident
• With the new ID card (online ID function)

Step 3: Choose Signature Creation Device

You have two options:

Hardware Token (QSCD):

• USB stick with chip (e.g., D-Trust Card Standard)
• Smart card with card reader
• PIN-protected
• Highest security level
• Not location-dependent

Remote Signature (Cloud-based):

• Signature occurs on secure server of provider
• Release via app, SMS-TAN or push notification
• No physical device needed
• Practical for mobile working
• Slightly less control

Step 4: Software and Integration

Manual Signature:

• Signature software (Adobe Acrobat, SignDoc, etc.)
• Sign each invoice individually
• Suitable for low volumes

Automated Signature:

• Integration into invoicing software
• Automatic signature during PDF creation
• Batch signature for many documents
• API integration possible

With Clever Invoice: With Clever Invoice all PDF invoices are automatically provided with the required metadata for authenticity verification. For a qualified signature, an external signature solution can be connected.

Digital Signature and E-Invoice (ZUGFeRD, XRechnung)

Special rules apply for structured e-invoices:

ZUGFeRD

ZUGFeRD invoices are PDF/A-3 documents with embedded XML data:

• A digital signature can secure the entire PDF including the XML data
• The signature protects both the visual representation and the machine-readable data
• Format: PAdES (PDF Advanced Electronic Signature)

Recommendation: With ZUGFeRD, a signature is optional as authenticity can also be proven via ICP. For B2G invoices, however, it may be required.

XRechnung

XRechnung is a pure XML format without PDF:

• Here an XML signature (XAdES) would be used
• In practice, signatures are mostly omitted for XRechnungen
• Transmission occurs via secure channels (Peppol, ZRE)
• The transport route itself already provides authenticity

Recommendation: With XRechnung, a separate signature is usually not necessary as the transmission routes are already secured.

E-Invoice from 2025

With the e-invoicing obligation from 2025 in Germany, the question of signature becomes relevant again:

• For B2B invoices between German companies
• Structured formats (ZUGFeRD, XRechnung) become standard
• Signature requirement is (as of today) not planned
• Internal control procedures remain recognized methods

Tip: With Clever Invoice you create e-invoices according to ZUGFeRD standard that meet all legal requirements - also for the e-invoicing obligation from 2025.

Avoid Typical Mistakes with Digital Signatures

Mistake 1: Confusing Signature with Image Signature

The Problem: Some invoicing programs offer "signatures" that are technically only images or simple electronic signatures.

The Solution: Check if it's a cryptographic signature. A scanned signature is not a digital signature in the legal sense.

Mistake 2: Changing Document After Signing

The Problem: You sign an invoice, then notice an error and correct it. The signature is now invalid!

The Solution: Always finalize all content first, then sign. For corrections: Create new invoice and re-sign.

Mistake 3: Expired Certificates

The Problem: Certificates have limited validity (usually 1-3 years). Signatures created with expired certificates are problematic.

The Solution: Set up reminder for certificate renewal. Regularly check validity.

Mistake 4: Missing Archiving

The Problem: You sign invoices but don't archive them properly.

The Solution: Signature and GoBD-compliant archiving go together. Use an audit-proof archive system that also correctly stores signed documents.

Mistake 5: Choosing Wrong Signature Type

The Problem: You use a QES where an SES is sufficient, or an SES where a QES would be necessary.

The Solution: Check the requirements of your customers and industries. For normal business invoices, an internal control procedure is usually sufficient.

Mistake 6: Mixing Private and Business Certificates

The Problem: You use your personal certificate for business invoices or vice versa.

The Solution: Separate private and business signatures. For company invoices, a company certificate or an appropriately issued personal certificate should be used.

Checklist: Digital Signature for Invoices

✅ Check requirements (legal, contractual, industry-specific)

✅ Choose appropriate signature type (SES, AES or QES)

✅ Select trust service provider (for QES)

✅ Obtain certificate and verify identity

✅ Set up hardware token or remote signature

✅ Test software/integration

✅ Document signature process

✅ Ensure archiving of signed documents

✅ Note certificate renewal in calendar

Conclusion: Signature - Not a Must, But Often Sensible

Digital signature for invoices has not been mandatory in Germany since 2011. Legal requirements for authenticity and integrity can also be met through internal control procedures.

For most freelancers and SMEs:

• Focus on mandatory invoice information
• Use professional invoicing tool
• Ensure your processes are traceable
• This is usually completely sufficient

A qualified signature makes sense for:

• Invoices to public clients
• International business (especially Italy)
• Industries with increased security needs
• When maximum legal security is desired

With the e-invoicing obligation from 2025, the topic becomes relevant again - however, no signature requirement is planned here either. Structured formats (ZUGFeRD, XRechnung) and internal controls remain recognized methods.

Start now: With Clever Invoice you create legally secure invoices in seconds - via chat, voice or classic. All mandatory information is automatically included, and you're also prepared for the e-invoicing obligation 2025!