If you run an activity business anywhere in the European Union, such as a climbing gym, adventure park, dive center or bike tour, you may want customers to sign forms online or on a tablet. This guide covers the EU's e-signature rules under eIDAS, what changed with the 2024 amendments, what a signed form does for your business, and how EU and national law treat liability waivers and the health data forms often contain.
This guide is general information about EU law, with links to the laws it cites, so you and your lawyer can look into anything that applies to your business.
The short answer. Under the eIDAS Regulation, an electronic signature can't be denied legal effect just because it is electronic, so a simple e-signature on an activity form is valid evidence across the EU. A signed form records the risks and rules you explained and collects health declarations. Whether it can also limit your liability is mostly a matter of national law: EU consumer law lists terms excluding liability for death or personal injury among those that may be unfair, and in Germany, for example, they are ineffective in standard terms.
EU Law at a Glance
| E-signature law | eIDAS Regulation (EU) No 910/2014, amended by Regulation (EU) 2024/1183 ("eIDAS 2.0") |
|---|
| Signature levels | Simple, advanced and qualified. Only a qualified signature is guaranteed the same effect as handwriting everywhere |
|---|
| When a qualified signature is needed | Only where national law requires a particular form, such as a statutory written form in Germany |
|---|
| What a signed form does | Records risks, rules and safety briefings, which can bear on the participant's own share of fault under national law; collects health declarations |
|---|
| Health data on forms | Special category data under GDPR Article 9 |
|---|
| Waivers of liability for injury | Listed as potentially unfair in consumer contracts (Directive 93/13/EEC, Annex 1(a)); national law decides, and it varies |
|---|
Are Electronic Signatures Legal in the EU?
Yes. The eIDAS Regulation applies directly in every Member State. Article 25(1) says: "An electronic signature shall not be denied legal effect and admissibility as evidence in legal proceedings solely on the grounds that it is in an electronic form or that it does not meet the requirements for qualified electronic signatures." Article 25(2) gives a qualified electronic signature "the equivalent legal effect of a handwritten signature." Every Member State must also recognize a qualified signature based on a qualified certificate issued in another Member State; eIDAS 2.0 moved that rule from Article 25(3) to a new Article 24a.
eIDAS leaves a lot to national law. Recital 49 says "it is for national law to define the legal effect of electronic signatures," apart from the rule on qualified signatures. In practice, most contracts don't need any particular form, so a simple electronic signature is enough, and the question in a dispute is about evidence: who signed, what they saw and when.
Simple, Advanced and Qualified Signatures
- Electronic signature (simple): "data in electronic form which is attached to or logically associated with other data in electronic form and which is used by the signatory to sign" (Article 3(10)). A drawn signature, typed name or "I agree" click.
- Advanced electronic signature: must be uniquely linked to the signer, capable of identifying them, created with data under their sole control, and linked to the signed data so any later change is detectable (Article 26).
- Qualified electronic signature: an advanced signature created by a qualified signature creation device and based on a qualified certificate (Article 3(12)).
National law sometimes requires the qualified level. In Germany, where a statute prescribes written form and electronic form is used instead, the signer must add their name and a qualified electronic signature (BGB section 126a). So it pays to check national form requirements where you operate.
What eIDAS 2.0 Changed
Regulation (EU) 2024/1183 amended eIDAS and entered into force on 20 May 2024. For signatures, the core rules stayed the same: Article 25(1) and (2) are unchanged, and the requirements for an advanced signature in Article 26 are unchanged. The amendments moved cross-border recognition of qualified signatures into the new Article 24a, and added a paragraph to Article 26 under which the Commission may set reference standards for advanced signatures, with compliance presumed for signatures that meet them.
The main change is the European Digital Identity Wallet. Each Member State must offer citizens at least one wallet within 24 months of the first implementing acts, which entered into force on 24 December 2024, so the deadline falls in late December 2026, and rollout has been uneven. According to the European Commission, creating qualified electronic signatures for non-professional use will be free. For an activity business, that makes qualified signatures easier for customers to make; it doesn't change the validity of simple e-signatures on ordinary forms.
What This Means for Liability Waivers
EU law doesn't have a single waiver rule. Contract and tort law are national, with EU consumer protection as a common layer on top.
What a Signed Form Does
- It records what each participant was told. A form that describes the activity and its risks, with the participant's acknowledgment, is evidence of the warnings and safety briefings they received. How much it matters depends on the facts and the national law that applies.
- It can bear on the participant's own fault. National law may take the injured person's own fault into account. In Germany, for example, BGB section 254(1) makes the duty to compensate, and how much, depend on the circumstances, especially how far each side caused the damage. A signed record of the rules a participant agreed to follow is evidence a court can weigh on that question.
- It sets your rules. Age and ability limits, required equipment and conduct rules, with the participant's agreement to follow them.
- It collects health declarations. Health conditions and emergency contacts, so staff can decide whether someone should take part.
The Unfair Contract Terms Directive
Under Directive 93/13/EEC, a standard term in a consumer contract is unfair if, "contrary to the requirement of good faith, it causes a significant imbalance in the parties' rights and obligations." The Annex gives "an indicative and non-exhaustive list" of terms that may be unfair. The first item, point 1(a), covers terms "excluding or limiting the legal liability of a seller or supplier in the event of the death of a consumer or personal injury to the latter resulting from an act or omission of that seller or supplier." Member States may also adopt stricter rules (Article 8).
National Law Varies: Germany as an Example
Each Member State applies its own contract and tort law on top of the Directive. Germany is one clear example. Under BGB section 309 no. 7, standard business terms can't exclude or limit liability for injury to life, limb or health caused by a negligent breach of duty, or for other damage caused by gross negligence. Section 276(3) adds that no one can be released in advance from liability for intent. A pre-printed activity waiver in Germany therefore can't release injury claims based on negligence. Other countries have their own rules, including on parents signing for children, so it's worth having a local lawyer review your form for each country where you operate.
Storing Signed Forms Under GDPR
Under the GDPR, "data concerning health" is a special category (Article 9). Processing it is prohibited unless an exception applies, such as explicit consent for specified purposes (Article 9(2)(a)) or where processing is necessary to establish, exercise or defend legal claims (Article 9(2)(f)), and you also need a lawful basis under Article 6. The storage limitation principle (Article 5(1)(e)) means keeping forms only as long as you need them, and Article 32 requires appropriate security, with encryption given as an example.
How WaiverFile Helps EU Businesses
WaiverFile doesn't draft waivers, and the wording of your form is a job for you and your lawyer. Once it's written, WaiverFile makes it easy for every participant to sign it and keeps a complete, easy-to-find record of each one:
- Sign anywhere. Customers sign before they arrive from their own phone or computer, using a link sent by email or SMS, a QR code or your website, or on-site at a tablet kiosk. The WaiverFile Venue app works offline.
- Your form, in your languages. Offer forms in multiple languages, and use the editor's formatting options, initial boxes inside the text and required checkboxes for the risks and rules you choose.
- A record of what was signed. Each signed form stores the signature, the answers, the date and time, and for online signing the IP address and device used, the kind of evidence that matters for simple e-signatures. Search any form in seconds, or download them in bulk as a ZIP file for any date range.
- Health questions with extra protection. Required questions collect health declarations and emergency contacts. Records are encrypted in transit and at rest, and you choose which staff can see forms. WaiverFile's HIPAA features, built for the US health privacy law, add extra encryption, a log of who viewed health information and the option to keep health details out of emails. These can support your GDPR security measures under Article 32, but using them doesn't by itself make your processing compliant.
- Families on one form. A parent or guardian can sign for themselves and their children, adding each child by name and date of birth.
Browse our free waiver templates, or set up a free account to try it with your own form.
Sources and Further Reading
- Regulation (EU) No 910/2014 (eIDAS), as adopted: arts. 3, 25, 26 and recital 49
- Regulation (EU) 2024/1183 (eIDAS 2.0), EUR-Lex: new art. 24a, deletion of art. 25(3), new art. 26(2)
- European Commission, European Digital Identity Regulation
- Garrigues, EU Digital Identity Wallet timetable
- Council Directive 93/13/EEC on unfair terms in consumer contracts: arts. 3 and 8, Annex 1(a)
- German Civil Code (BGB), sections 126a, 276 and 309 (official English translation)
- German Civil Code (BGB), section 254 (contributory fault, German text)
- Regulation (EU) 2016/679 (GDPR): arts. 5, 9 and 32
General information, not legal advice. WaiverFile is not a law firm, and this article is not legal advice. Laws change and courts decide each case on its own facts, so have a local attorney review your waiver.
Published February 1, 2021 · Updated November 4, 2026