Qualified timestamp

What it means

A timestamp is electronic evidence that specific data existed at an exact moment and has not changed since. What gets stamped is the hash of the file rather than its content, so the document itself is never sent to the provider.

A qualified timestamp under the eIDAS Regulation carries a Union-wide legal presumption that the time is accurate and the data intact. A non-qualified one carries no such presumption and has to be proven by ordinary evidence.

A timestamp is not a signature: it says nothing about who created a document or agrees with it, only when it existed. Anyone can set the date in a PDF or an e-mail on their own computer, whereas a timestamp comes from an independent provider, which is why it carries weight where an electronic signature alone proves no time.

How it works in practice

The stamp is attached to a qualified electronic signature so that it stays verifiable after the certificate of the signer expires or is revoked. Without it, years later nobody can tell whether the signing happened before expiry or after it.

In practice it underpins electronic document archiving, electronic invoicing and delivery into official mailboxes. Qualified trust service providers appear on the trusted list, which for Slovakia is maintained by the National Security Authority.

When paper documents are converted to digital form, the stamp shows when the scan was made and, together with a documented conversion procedure, helps prove the electronic copy has not changed since. For clients with an electronic archive we therefore set up stamping automatically when a document is stored, not after the fact.

What to watch out for

Accounting documents are filed as signed PDFs, and years later an audit finds that nobody can validate the signatures because the certificates expired long ago. Without a timestamp, and without renewing it in time, a legally provable record is just a file.

Even a qualified timestamp has a limited life, because it relies on the provider’s certificate and on cryptographic algorithms that age. An archive with a long retention period needs regular re-stamping, and when it moves to new cloud storage this task is easily forgotten.