The Click That Counts: What UK Teams Should Keep When They E-Sign

Most UK small teams now sign supplier terms, NDAs, settlement agreements and even some HR paperwork with a click. That is fine. What is less fine is the assumption that the vendor's green tick settles the legal question. It doesn't. An electronic signature is evidence, and evidence has to be gathered deliberately. The law rarely cares that you used a particular brand. It cares whether you can show who signed, what they signed, and when.

Three tiers, one practical question

UK law recognises three broad flavours of electronic signature: simple, advanced and qualified. A simple signature can be a typed name, a checkbox, a scanned squiggle or a click-to-accept button. For most ordinary commercial contracts, that is enough. An advanced electronic signature is more tightly linked to the signer, is created using data the signer controls, and makes later changes detectable. A qualified electronic signature goes further: it uses a qualified certificate and a qualified signature creation device, and it gets special legal treatment under the UK's eIDAS regime.

The practical question is not 'which one sounds most secure?' It is 'how much might we need to prove if this goes wrong?' A low-value software renewal may be fine with a simple signature and a sensible audit trail. A high-value settlement, a deed, or a document that will be relied on years later deserves a harder look. Qualified signatures are not magic either. They are stronger evidence, but they do not fix a badly drafted contract or a signer who had no authority.

Where the formalities still bite

A deed is not just a contract with a fancy title. In England and Wales, a deed generally needs to be signed, attested by a witness, and delivered. Electronic signatures can be used for deeds if those formalities are met, but 'we used an e-sign tool' does not automatically meet them. Check how your provider handles witnessing: does the witness actually see the signature being applied, and does the audit trail record their attestation properly? A witness who clicks a link after the event may not give you the comfort you think.

Wills in England and Wales are a well-known exception, and certain powers of attorney and regulated filings have their own fussy rules. Company execution under the Companies Act 2006 also has formalities that depend on how the document is signed and by whom. The Law Commission's 2019 report confirmed that electronic signatures can work for many documents, but it did not abolish formalities. If a document is a deed, a will, a power of attorney, or something a regulator will inspect, get advice before you send the envelope. It is cheaper than discovering the problem in a dispute.

The features that feel legal but aren't

Vendors love reassuring language. 'Bank-level encryption' is good for protecting data in transit, but it says little about whether the right person signed. 'Court-admissible' is marketing, not a legal status. 'Tamper-proof' is helpful, but you still need the hash and the audit trail in your own hands. A certificate of completion is useful evidence, not a force field. A biometric squiggle may look impressive, but it does not automatically make a simple signature advanced or qualified.

None of this means the features are useless. It means they are inputs to evidence, not substitutes for it. The strongest position is usually a clear contract, a sensible signing process, and an audit trail you can actually produce when asked. A beautiful signing ceremony with no exportable records is just a nicer way to lose an argument.

What to export at the moment of signing

Do not wait until a dispute, an audit or a renewal to discover that your plan no longer includes the audit certificate. Export the evidence when the envelope completes, and store it with the signed document. The exact fields vary by provider, but the useful set usually includes:

• The final signed PDF, with every page and attachment, not just a link to the vendor's portal.
• The audit certificate or audit log, including the envelope ID and the full signing sequence.
• Each signer's name, email address, organisation and any phone number used for authentication.
• The authentication method used: email link, SMS one-time code, knowledge-based questions, identity document check, or SSO.
• Timestamps in UTC, plus the signer's stated time zone where available.
• IP addresses, device and browser details, and delivery or access events.
• The document hash or fingerprint and the algorithm used, so you can show later that the file has not changed.
• A record of consent to use electronic signatures, if your process captures one.
• For witnessed documents, the witness's name, email, signature, attestation and timestamp.
• Any declined, reminder or reassigned signing events that explain the timeline.

Store that bundle in a read-only folder with a sensible retention period, and make sure someone other than the person who sent the envelope can find it. A shared drive called 'Signed stuff' is not an archive. A naming convention that includes the counterparty, contract type and signing date will save you hours later.

A small-team routine that holds up

Start by classifying the documents you sign. Ordinary supplier terms and low-value renewals can usually use a simple signature with a good audit trail. High-value contracts, deeds, board approvals and anything that may end up in an employment dispute deserve a second look at the execution formalities. Use one e-signature system where you can, because consistency makes training and retrieval easier. Then run a quarterly sample: pick one completed envelope, export the evidence bundle, and check that a colleague can understand it without calling the vendor.

The click is not the contract. The click is one link in a chain of evidence. Treat the export as part of signing, not an admin chore for later, and the seal on the document is still worth something two years down the line.