Italy's e-signature framework combines the EU-wide eIDAS Regulation (No. 910/2014) with its own long-standing domestic code, the CAD (Codice dell'Amministrazione Digitale, Legislative Decree 82/2005). Unlike EU member states that layered eIDAS onto a thin domestic statute, Italy had a mature electronic-signature regime years before eIDAS existed, and the CAD still governs how electronic documents are formed, evidenced, and preserved for both public administration and private parties.

eIDAS establishes three tiers recognized across the EU: Simple Electronic Signatures (SES), Advanced Electronic Signatures (AES), and Qualified Electronic Signatures (QES, called firma digitale under Italian law). Article 20 of the CAD gives AES and QES the same evidentiary weight as a handwritten signature under Civil Code Article 2702, while SES is freely assessed by the judge under Article 21, based on the security and integrity of the signing process. That freely-assessed standard is not a weak one in practice: the Corte di Cassazione ruled in May 2024 that an email signed with SES still counts as full evidence when its origin and content go uncontested.

AES on a Third-Party Platform

One detail is worth flagging for a multi-tenant platform like Firma.dev. Italy's technical rules for AES (DPCM 22 February 2013, still in force for signature generation) were written around a closed relationship between one company and its own customers, such as a bank running its own signing flow for its own account holders. Article 60 of that decree limits a domestically-compliant AES to the legal relationship between the signer and the party that provides the AES solution, which is why most Italian AES deployments belong to a single company rather than a neutral third-party signing platform. A Firma.dev AES signature remains a valid, enforceable eIDAS signature that cannot be denied legal effect merely for being electronic, and it holds up under the same freely-assessed standard SES relies on. It may not automatically carry the enhanced Article 2702 presumption reserved for a compliant closed-loop AES or QES. For ordinary commercial contracts, a well-built audit trail covering identity capture, timestamps, and tamper-evidence carries real evidentiary weight regardless.

Some document types sit outside SES/AES entirely. Civil Code Article 1350 requires a notarial deed or authenticated private deed for real estate transfers, long leases over nine years, and related property rights, and Italian courts draw a hard line here: a 2025 Cassazione ruling confirmed that even a litigation power of attorney needs a handwritten or qualified signature, with AES explicitly rejected. Public procurement bids on platforms like SINTEL and SATER also require QES. None of this touches the contracts SaaS companies actually send: commercial agreements, NDAs, employment contracts, and subscription terms all work with SES or AES today.

Insurance is the one industry with an active regulator opinion on signature tiers. IVASS Regulation No. 8/2015 directs insurers toward AES, QES, or digital signature for policy documentation, closer to a recommendation than a ban, but it explains why AES, not SES, is the practical floor for insurance paperwork.

Looking ahead, eIDAS 2.0 (Regulation 2024/1183) is rolling out the EU Digital Identity Wallet, with Italy required to offer one by the end of 2026 and mandatory relying-party acceptance following in 2027. Existing SES and AES methods stay valid throughout that transition.