As a precautionary measure, we would like to inform you that both the EU Commission and BaKOM are planning changes regarding one-shot signatures for signature applications in both legal areas. The changes could come into force in the EU by the end of May and must be audited by May 2026, while the changes in Switzerland and the implementation date are still under discussion.
This affects the requirement that, in the future, one-shot signatures – i.e., signatures that occur in the same session as the identification of the signer and without the use of additional authentication means such as SMS – require a special act of intent to consent to the signature. This act may not take the form of a button or checkbox for signature approval, but must involve greater effort: for example, scrolling through the text to be signed to the end and then pressing a button to sign or entering a phrase like "Please sign" or similar in a text field.
The regulations are based on the latest version of the standard TS 119 431-1, SIG-6.3.1-15. Furthermore, the standard also stipulates that signatures must be completed within 30 minutes after the end of the identification process. This is usually not a problem, as the identification process itself takes longer, but rarely the consent. With the tightening of consent requirements (e.g., by scrolling through a longer text), this guideline must still be observed, as the consenting person may need to read the text again for a longer period.
As design and implementation always take longer, we would like to launch this pre-announcement today, knowing that the law has not yet been enacted. However, with the new version of the ETSI standards and the draft laws we have, implementation is very likely.