What certifies an electronic signature?
An electronic signature is used to express a signature action linked to data or documents. Its legal validity depends on the mechanism used, the evidence retained, and the legal context. In occupational health and safety (OSH), it can be part of approvals, information receipts, delivery records, or other documentary processes, provided it is appropriate for its purpose.
The act of signing must be distinguished from the content it purports to certify. Signing a receipt does not, in itself, demonstrate understanding, competence, or application of a measure. Digital evidence in occupational health and safety must maintain this distinction so that a documentary record is not interpreted as proof of unverified facts.
European levels and framework
The eIDAS Regulation distinguishes between electronic signatures, advanced signatures, and qualified signatures. Advanced signatures must meet requirements regarding linking the signature to the signatory, identification, control over the creation data, and detection of subsequent changes. Qualified signatures add the specific elements required by the regulation. A signature drawing inserted into a file does not automatically acquire these characteristics.
Article 25 recognizes that a qualified signature has the same legal effect as a handwritten one and prevents denying validity to a signature simply because it is electronic or not qualified. This does not, however, make any signed document conclusive proof of its content. In Spain, Law 6/2020 supplements certain aspects of trust services.
Choose according to the procedure
The organization must identify who signs, their role, and the purpose of the document. Approving an assessment, receiving instructions, and validating a maintenance check are all different actions. It’s advisable to review the document and recipient requirements, including those of a government agency when a formal submission is involved.
The selection of the mechanism must consider identity, integrity, intent, and the possibility of verifying the process. There is no general rule that all preventive documentation requires the same level of signature. Nor should it be concluded that the simplest mechanism is sufficient for any use. The decision must be linked to the evidentiary risk and the applicable requirement.
Document and version that are signed
The person must be able to see the content before signing it and understand the meaning of their action. The system needs to link the signature to the exact version of the document. If the content changes later, the signed original must be kept and the new version processed using the appropriate procedure.
Document control must prevent the silent replacement of a signed file with an updated one. It is also advisable to differentiate between draft, pending signature, signed, and canceled documents, using clear and understandable rules. A visible signature image may remain even if the file is altered; therefore, appearance does not replace integrity verification.
Validation, preservation and access
The process must allow for signature verification and the preservation of necessary evidence for the applicable period. Certificates, validation status, timestamps, and procedure logs may be relevant, depending on the mechanism used. Retention needs should be assessed from the design stage, avoiding reliance solely on a screen or confirmation email.
The organization must plan how it will recover documents if it changes providers and how it will subsequently verify their validity. Interoperability helps maintain usable evidence outside the original application. Access for authorized personnel and protection against alteration, loss, or unauthorized disclosure are also essential.
Training, health and the limits of evidence
In preventive training, the signature can certify a specific action, such as attendance or reception, depending on how the record has been organized. It does not replace appropriate content, practice, learning assessment, or competency verification when these are necessary. The document must accurately describe the event being recorded.
Health documentation requires additional controls regarding confidentiality and purpose. A signature does not legitimize any processing or remove access restrictions. Furthermore, receipt forms should not be used to obtain declarations that unduly transfer protective obligations that belong to the employer to the employee.
Practical example
In a hypothetical example, a company distributes revised instructions for using a piece of equipment. The system requires a signature, but the link always opens the most recent version and doesn’t record which content each person viewed. After another modification, it becomes difficult to reconstruct the information that was provided initially.
The organization is changing its procedure for documenting versions, preserving them with supporting evidence, and recording new submissions as needed. It supplements the record with practical explanations and comprehension checks. This solution improves traceability without confusing the signature with an automated demonstration of safe equipment use.
Process monitoring
It is advisable to review outstanding signatures, identity errors, modified documents, and access difficulties. Users should have a way to correct issues and receive a copy when necessary. A backlog of signatures at the end of the month may indicate that the document processing procedure is disconnected from the activity it is intended to record.
The rules must be updated when regulations, suppliers, or procedures change. The aim is to maintain reliable evidence of actual actions, with a proportionate effort. A good signing process is integrated into prevention and facilitates demonstrating what happened, without attributing to the document a scope beyond its contents and evidence.
