eSignatures in focus: Navigating electronic identification and trust services in Ukraine

October 21, 2024

The evolution and legal landscape of eSignatures in the context of electronic identification means and trust services in Ukraine

In recent years, Ukraine has experienced a significant shift towards digitalization, with the advent of electronic identification (eID) means and trust services being a pivotal element of this revolutionary transformation. As Ukraine endeavours to embrace technology-driven solutions, eID means and trust services - enabling, inter alia, electronic signatures (eSignatures) - have emerged as readily accessible and efficient alternatives to traditional handwriting methods, thereby streamlining processes, minimizing reliance on paper-based documentation, and eliminating the need for the physical presence of signatories in one place.

Given the ongoing war with Russia, eID means and trust services, particularly the Diia digital platform and its eID system, have become the safest option for enabling secure interactions, running business and effectuating transactions without the need for physical presence in Ukraine during wartime.

This guide provides a concise overview of eID means and trust services in Ukraine, with a focus on eSignatures as instruments enabled by eID means and their practical application. It also examines the mutual recognition of eIDs between Ukraine and the EU, as the EU remains Ukraine's largest trading partner, and Ukraine continues down the path to joining the EU.

Contact our team, Volodymyr Monastyrskyy and Roman Mehedynyuk, to learn more about how eID and trust services can benefit your business and explore potential opportunities in Ukraine.

1. eID means and trust services in Ukraine: Present dynamics and path forward

Ukraine has recently updated its legal framework governing eID means and trust services to align more closely, and comply to the maximum extent possible, with the European Union's Regulation (EU) No 910/2014 on electronic identification and trust services for electronic transactions (eIDAS Regulation).

Among all the digital instrumentalities currently available in Ukraine, eSignatures - facilitated by eID means - have become the most widely adopted mechanism for secure digital transactions, identity verification and data integrity protection in B2B and B2G communications.

Starting January 1, 2024, Ukrainian law aligned official definitions of electronic signatures with the eIDAS Regulation, thus facilitating the use of eSignatures across both jurisdictions. In a nutshell, eSignatures can be classified as follows:

Simple Electronic Signature ("SES") is defined as electronic data which is attached or logically associated with other electronic data, and which is used by the signatory as a signature. SES is the least secure type of eSignature used mostly in low-risk transactions due to its limited legal effect and enforceability.

Advanced Electronic Signature ("AES") based on a qualified certificate for electronic signature is an advanced electronic signature, which is created using a qualified certificate for electronic signature and is issued by a qualified trust services provider. It does not contain information about storing the private key in the device used for creating the advanced electronic signature.

AES has a somewhat higher legal effect than SES; but it is used less frequently in practice due to providing less security and being less legally reliable than QES (as define below). In our view, being always based on a qualified certificate, AES holds a higher legal significance in Ukraine than in the EU.

Qualified Electronic Signature ("QES") is defined as an advanced electronic signature that is created using a qualified electronic signature device and is based on a qualified certificate for electronic signature.

This type of signature has the legal standing as a handwritten signature and is presumed to be equivalent to a handwritten signature.

Due to their highest security and legal standing, QESs are widely adopted for high-risk transactions and secure communication by government entities and businesses.

Please note that certain documents, such as certificates of inheritance and passports, still require a handwritten signature and cannot be signed electronically.

2. Scope and application of eID means in Ukraine

eID means, particularly eSignatures, have become integral components of both public and business interactions in Ukraine, utilized by various stakeholders across numerous domains, including:

Government to Business (G2B)

• Business Registration and Updates: Entrepreneurs can use QES to remotely register and update information for (i) a Ukrainian equivalent of a sole proprietorship and (ii) an LLC established based on a model charter.
• Corporate Governance eParticipation: Generally, Ukrainian law permits shareholders and members of Ukrainian businesses (such as JSCs and LLCs) to participate in corporate governance by attending shareholder meetings and casting votes using AES and QES. This being said, the company registry has been slow in updating its infrastructure to fully support such digital participation.
• Tax eFiling: Online tax return filing via the taxpayer cabinet, using QES, is the predominant method for Ukrainian businesses.
• IP eProcessing with UANIPIO: The Ukrainian National Office for Intellectual Property and Innovations (UANIPIO) accepts trademark and patent applications signed with QES. Trademarks and patents are issued in electronic form, which are similarly signed with QES.
• Customs and Trade: eID means are used for filing customs declarations and accessing trade facilitation services via online government platforms.
• Public Procurement: Businesses use eID means to participate in electronic public tenders through the ProZorro system.
• Business Licensing: Businesses use eID means to apply for licenses in regulated industries, such as energy, communications, or alcohol sales, via digital channels.
• Environment and Safety Reporting: eID means are used to submit environmental impact assessments, health, and safety compliance documents.
• Subsidy and Grant Applications: eID means are used by businesses to apply for government subsidies, grants, or support programs.
• Labor Law Compliance: Businesses report employee hires and terminations as well as handle payroll tax contributions using eID means.

Business-to-Business (B2B)

• Contracts and Agreements: eSignatures and other eID means are used for signing commercial contracts and agreements.
• eCommerce: Companies and customers are authenticated and verified via QES in B2B and B2C eCommerce platforms.
• Invoices and Payments: electronic invoices, payment orders, and other primary accounting documents can be issued using QES.

Business-to-Employee (B2E)

• Signature of the employment agreement (contract): When a simplified form is used, the hiring order can be signed with an AES or QES. If an employer and employee mutually agree to a written employment agreement (contract), that agreement (contract) can also be signed using AES or QES.
• Where the simplified form is used, the employee may sign the hiring order using his/her AES or QES and where the employer and the employee agree to a written form of an employment agreement (contract), such employment agreement (contract) could be signed using AES or QES.
• Acknowledgment of receipt and understanding of company policies: Employees may acknowledgment company policies using their [personal] AESs or QESs, if so provided for their employment agreements with the company.

Government to Citizen (G2C)

• Digital Identity Documents: Citizens can store and present digital versions of passports, driver's licenses, and other identification documents through the Diia mobile app, access numerous government services entirely online - i.e., on the Diia platform.
• Personal Income Tax: Individuals can file personal income tax declarations and check their tax status online - i.e., on the Diia platform.
• Social and Healthcare Services: Individuals can access social services via the Diia platform and access medical records, e-prescriptions, and vaccination certificates via the eHealth system.

3. Mutual recognition of ESignatures in the EU and Ukraine

Mutual recognition of eID means and trust services between the EU and Ukraine is a prerequisite for using these means in both jurisdictions.

Ukraine has become the first non-EU country to be included in the TC AdES LOTL (Trusted List of Trust Service Providers), which allows for the verification of electronic signatures and seals from non-EU countries within the EU.

The verification process for Ukrainian electronic signatures and seals is streamlined in the EU through the TC AdES LOTL, which ensures that these digital signatures meet applicable EU standards - currently for the EU's advanced electronic signatures.

Reciprocally, Ukraine recognizes EU qualified trust services on a temporary basis, enabling EU citizens to use their national qualified certificates for electronic signatures or seals in Ukraine. This bilateral recognition, supported by the EU4DigitalUA project, marks a significant advancement in digital cooperation and trust service integration between the EU and Ukraine.

Temporary measures have been put in place to recognize qualified electronic signatures based on certificates issued by European qualified trust service providers (those included in the common list of Trusted Lists of EU member states as well as separate Trusted Lists of EU member state or a member state of the European Free Trade Association (EFTA).

This interim solution ensures that Ukrainian businesses and citizens can continue to operate seamlessly within the EU's digital market while the long-term agreements are being finalized. The ongoing efforts to harmonize electronic signature standards and practices between Ukraine and the EU highlight the commitment to fostering a secure and interoperable digital environment that benefits both parties.

Conclusion

The integration of eSignatures into Ukraine's digital legal infrastructure marks a significant advancement in the country's digital transformation journey.

eSignatures, based on eID and the trust services, play a crucial role in Ukraine's digital legal infrastructure, offering the high level of security and legal enforceability. eID means not only enhance the security and legal standing of digital transactions but also pave the way for greater international cooperation and interoperability, particularly with the European Union.

While the legal framework allows for various types of eID means, the QES is necessary for the most formal or regulated transactions, particularly with government bodies. For transactions requiring high legal certainty, it is recommended to use QES issued by Ukrainian providers or recognized EU providers starting from 2024.

The alignment of Ukrainian laws with the eIDAS Regulation marks a significant step towards improving the interoperability and legal recognition of eID means. This alignment facilitates seamless digital interactions and transactions between Ukraine and the EU, fostering a securer and more collaborative interoperable digital environment.

In Ukraine, while QESs are legally permissible for notarization and state registration, their actual implementation lags behind due to factors such as technical infrastructure and the availability of relevant technical and regulatory frameworks. So, it is advisable to consult with relevant authorities and legal professionals to ensure compliance with specific requirements and to navigate the complexities of the current system effectively.