Qualified vs non-qualified electronic time stamps: legal value and how to get one

A qualified electronic time stamp is issued by a provider listed on the EU trusted list and enjoys a legal presumption that its date and time are accurate (Article 41(2) of the eIDAS Regulation). A non-qualified time stamp, such as a hash anchored on a blockchain, is admissible as evidence (Article 41(1)) but carries no presumption: if the date is challenged, the party relying on it must prove it. Courts weigh both freely.

What an electronic time stamp is

Regulation (EU) No 910/2014, better known as eIDAS, defines an electronic time stamp in Article 3(33) as "data in electronic form which binds other data in electronic form to a particular time establishing evidence that the latter data existed at that time". It answers exactly one question: did these data exist at that moment? It says nothing about who created them or whether their content is true. Article 3(16) places the creation and validation of time stamps among the "trust services", which may be qualified or non-qualified.

In practice you do not stamp the whole document but its fingerprint: the SHA-256 hash, 64 hexadecimal characters that change completely if a single bit of the file changes. The full mechanism is explained in the guide on how to prove that a document existed on a date.

What makes a time stamp qualified

A time stamp is qualified when it meets Article 42 of eIDAS and is issued by a qualified trust service provider. In summary, Article 42(1) requires that it binds date and time to the data in a way that reasonably precludes undetectable change, that it is based on an accurate time source linked to UTC, and that it is signed or sealed with an advanced electronic signature or seal of the provider.

The provider has passed a conformity audit and appears on the trusted list published by each Member State and aggregated by the European Commission in its trusted list browser. Technically, most operate a time-stamping authority (TSA) that issues tokens under the RFC 3161 protocol: a small signed file containing the hash, the time and the provider's identity.

Anything that does not meet these conditions is a non-qualified time stamp, for instance the inscription of a hash in a public blockchain, which is what Proovik does on the Kaspa network.

What effect each one has

Both are admissible as evidence (Article 41(1))

"An electronic time stamp shall not be denied legal effect and admissibility as evidence in legal proceedings solely on the grounds that it is in an electronic form or that it does not meet the requirements of the qualified electronic time stamp."

Only the qualified one carries a presumption (Article 41(2))

"A qualified electronic time stamp shall enjoy the presumption of the accuracy of the date and the time it indicates and the integrity of the data to which the date and time are bound."

The presumption reverses the burden of proof. With a qualified time stamp, whoever disputes the date has to prove it is false. With a non-qualified one, whoever relies on it has to prove it is correct. That is why how accuracy can be demonstrated matters so much: whether it rests on the provider's word or on a check anyone can repeat.

What the law says in Spain

Law 6/2020 of 11 November, which regulates certain aspects of electronic trust services, completed eIDAS in Spanish law and rewrote Article 326 of the Civil Procedure Act (LEC), the provision on the evidential weight of private documents. In summary:

• Art. 326.3 LEC. When the authenticity, integrity or accuracy of date and time of an electronic document that a non-qualified trust service can establish is challenged, evidence is taken under paragraph 2 and under Regulation (EU) 910/2014.
• Art. 326.4 LEC. If a qualified trust service that was on the trusted list at the relevant time was used, the document is presumed to have the disputed characteristic and the service is presumed to have been provided correctly.

One point is often overlooked: a non-qualified time stamp does not by itself confer the Spanish Civil Code status of "fecha cierta" under Article 1227, which recognises the date of a private document against third parties only from its entry in a public register, the death of a signatory or its delivery to a public official by reason of their office. What it provides is proof of existence and prior date, which the court weighs together with the rest of the evidence.

When you need a qualified time stamp and when a non-qualified one is enough

Choose a qualified time stamp when you need the presumption of Article 41(2), or of Art. 326.4 LEC in Spain, when a procedure or a contract expressly requires one, or when you preserve electronic signatures for the long term, because archival formats require re-stamping with qualified time stamps.

A non-qualified time stamp is enough when you want to fix many versions (drafts, code, designs) at low or no cost, when the document must not leave your machine, and when you want anyone to be able to check the proof twenty years from now without depending on the issuer still existing, accepting that, if the date is challenged, you will have to show how it is checked.

The two routes combine: a law firm can stamp the drafts of a non-disclosure agreement with Proovik and add a qualified time stamp only to the signed version, as shown in the guide on how to protect your NDA or supplier contract.

An honest comparison: qualified TSA, OpenTimestamps, Proovik and a notary

No figures, because costs change; the timing row describes normal behaviour, not a service commitment.

More detail, OriginStamp included, in the comparison of OpenTimestamps, OriginStamp, qualified time stamps and Proovik.

How to get a time stamp

A qualified time stamp

Find a provider of qualified time stamps on your country's trusted list or in the European Commission's trusted list browser, contract the service and send the document's hash with an RFC 3161 client; store the token next to the document and plan re-stamping before the provider's certificate expires.

A non-qualified blockchain time stamp with Proovik

1. Compute the hash in your browser. Drop the file on the certification page; the SHA-256 is computed on your machine and the document is not uploaded.
2. The hash is written into a Kaspa transaction. The network, which produces about ten blocks per second, includes the transaction in a block whose header carries the timestamp covered by proof of work. The seal is normally confirmed within seconds.
3. Download the PDF certificate. It contains the hash, the transaction id, the block timestamp in UTC and the attached PVK-PROOF/1 proof package.
4. Anyone can verify it without Proovik. The verification page or the reference verifier recompute the four links of the proof.

How to do it with Proovik

Proovik issues non-qualified electronic time stamps: it anchors the SHA-256 of your document in a Kaspa transaction and gives you a PDF certificate with the PVK-PROOF/1 package that anyone can check without our involvement. It establishes existence, prior date and integrity of the file; it does not establish who created it or that its content is true, and it does not carry the presumption of Article 41(2). You can start without an account from the certification page; the technical mechanism is in what a blockchain timestamp is, the privacy architecture in the article on digital sovereignty and proof of existence on Kaspa, and the checking procedure in how to verify a proof of existence without relying on the provider.

Sources

• Regulation (EU) No 910/2014 (eIDAS), EUR-Lex
• Law 6/2020 of 11 November on certain aspects of electronic trust services, BOE (Spain)
• Law 1/2000, Civil Procedure Act, Art. 326, BOE (Spain)
• Spanish Civil Code, Art. 1227, BOE
• EU Trusted List Browser (eIDAS Dashboard)
• RFC 3161, Internet X.509 Public Key Infrastructure Time-Stamp Protocol
• OpenTimestamps