Electronic Signatures and the Law: What Taiwan Got Right
- Dr. Charles Wu
- Apr 29
- 7 min read
Updated: Jun 4
Quick Overview
Taiwan's 2024 Electronic Signature Act reforms are worth studying because they solved a problem most markets haven't yet addressed: the gap between permissive legislation and institutional readiness. By issuing a specific ministerial interpretation of legal validity and establishing a vendor credentialing system built around four concrete dimensions, Taiwan gave organizations the regulatory confidence to act. Its healthcare sector, already one of the most digitally advanced in the world, demonstrated what that confidence enables at scale.
Most countries have laws that permit electronic signatures. But few have built the institutional infrastructure to make those laws meaningful in practice.
Taiwan's 2024 reforms offer an instructive model for how to achieve this.
What we'll cover
The legal gap that permissive electronic signature laws don't fill
Legislation permitting electronic signatures has existed in the United States since 2000, in the European Union since 2000, and in many Asian jurisdictions through the 2000s and 2010s.
Yet adoption has remained uneven, particularly in high-stakes contexts like healthcare consent, financial contracts, and legal agreements.
The reason isn't technical reluctance. It's legal uncertainty. Organizations operating in regulated industries face a specific question that permissive legislation doesn't always answer clearly: if a signed document is disputed in court, what standard of evidence applies, and does our current signing process meet it?
Without a clear answer, legal and compliance teams default to paper. The cost of that default, in labor, storage, and process inefficiency, is substantial but harder to quantify than the perceived risk of a disputed digital signature.
Case study: Taiwan's 2024 legislative approach
What distinguished Taiwan's 2024 reforms wasn't the passage of an electronic signature law. Taiwan had one of those already. What changed was the institutional infrastructure built around it.
And rather than building a hierarchy of signature types with different legal weights like the EU’s eIDAS (Simple, Advanced, and Qualified signatures), Taiwan focused on establishing a binary but well-defined standard with a vendor credentialing system and an official clarification.
The credentialing mechanism.
The Ministry of Digital Affairs established a formal capability registration system for electronic signature service providers. Vendors seeking registration were evaluated across four dimensions:
Service execution and management capability
This examined whether a provider's operational processes and underlying technology met reasonable standards at the time of evaluation. Critically, this included assessing whether their solutions satisfied the legal definition of an electronic signature under Taiwanese law, specifically whether signatures ensured non-repudiation, could identify and verify the signer, and protected document authenticity.
Many electronic signature solutions rely on handwriting recognition as their primary means of confirming who signed. This is widely considered the weakest link in the evidentiary chain. Handwriting captured on a touchscreen or tablet is inconsistent across devices, affected by stylus type and surface friction, and difficult to authenticate independently. It carries even less forensic weight than pen-on-paper signatures, which at least have ink chemistry and pressure indentation to analyze. A credible electronic signature solution needed to demonstrate a more robust method of identity confirmation than pattern-matching against a stored handwriting sample.
For format compliance, providers were required to conform to internationally recognized standards established by the European Telecommunications Standards Institute (ETSI), including CAdES, XAdES, PAdES, ASiC, and JAdES. These standards exist because format determines whether a signed document can be independently verified across jurisdictions and over time. A signature in a non-standard format creates verification dependencies that may not survive the lifespan of the document.
SelfieSign by ThinkCloud, one of the providers that passed registration, illustrates what satisfying this dimension looks like in practice. Its video-based approach addresses the evidentiary gap in traditional e-signatures by recording the signing session as video and audio, capturing the signer's selfie, environment, timestamp, geolocation, and IP address, and encrypting the resulting file using AES and RSA algorithms. The handwriting is also simultaneously recorded, allowing for thorough identification of the signatory and confirmation of their intent.
SelfieSign’s proprietary SVS format complies with both PAdES and XAdES standards. It has obtained EU eIDAS Advanced Electronic Signature (AES) certification, making it one of the few solutions whose non-repudiation credentials are independently verified at an international level rather than self-declared.
Personnel qualifications set minimum human capital requirements
Providers were required to maintain at least two full-time staff with demonstrated experience in electronic signature services, and at least one dedicated personal data protection officer. All personnel and organizations were required to hold ISO 27001:2022 certification, the international standard for information security management. Ongoing security governance, client implementation support, and data protection obligations need qualified people making active decisions.
Demonstrated service track record
This required providers to show real-world deployment experience. Electronic signature systems fail in ways that only become apparent at scale: edge cases in document formats, signing failures on specific devices, and evidentiary gaps that surface during disputes. So, by requiring evidence of prior deployment, the registration mechanism introduced market validation into the credentialing process.
Financial soundness
Financial soundness required providers to maintain positive net worth and demonstrate no outstanding tax liabilities. Providers reporting losses for more than two consecutive years were required to submit an explanation and improvement plans. The rationale here is straightforward: an electronic signature solution creates long-term legal dependencies. Documents signed today may need to be verified years or decades from now.
A provider that exits the market or fails to maintain its certificate chains creates serious evidentiary problems for its clients.
The legal clarification.
Alongside the registration mechanism, the Ministry issued an official interpretation clarifying which electronic signature technologies carry legal effect under Taiwanese law. This addressed the evidentiary question directly, giving organizations the answer that permissive legislation alone had left open.
The amendments achieved rare bipartisan support in the Legislative Yuan before being promulgated in May 2024. This indicates that electronic signature reform was not a partisan or ideologically contested issue, which reduced the likelihood of future reversal and gave long-term adopters greater confidence.
Three policy lessons for other markets
Permissive legislation is necessary but not sufficient. Most markets have already passed laws acknowledging electronic signatures. The next legislative task is specifying what evidentiary standard a signature must meet to be defensible and which technical implementations satisfy that standard.
Vendor credentialing reduces institutional friction. One of the main barriers to adoption is the procurement problem: how does a hospital, bank, or government agency evaluate competing e-signature vendors without deep technical expertise?
A government-approved provider solves this without mandating specific technologies. It is a structural intervention that costs relatively little but significantly accelerates decision-making.
Align domestic standards with international frameworks. Taiwan's approach explicitly referenced eIDAS-compatible standards, which means organizations operating across borders could adopt locally credentialed solutions without creating compliance conflicts.
For any market with significant cross-border commercial activity, harmonization with eIDAS or equivalent international frameworks should hence be prioritized.
Where this leaves other markets
The countries best positioned to replicate Taiwan's results are those willing to treat electronic signature policy as a distinct institutional design problem, separate from the broader question of digital transformation.
The technology is available and internationally certified. The legal frameworks exist in broad outline. What remains in most markets is the specific, unglamorous work of clarifying evidentiary standards, establishing vendor accountability mechanisms, and giving organizations the regulatory confidence to act.
People Also Ask
Are electronic signatures legally binding?
In most jurisdictions, yes, but with important caveats. Most countries have legislation permitting electronic signatures, but the legal weight of any given signature depends on how well it satisfies the underlying evidentiary requirements: can you prove who signed, that they intended to sign, and that the document hasn't changed since? A click-to-sign solution and a biometrically verified, cryptographically sealed signature are both "electronic signatures" under most laws, but they carry very different evidentiary weight in a dispute.
What is non-repudiation and why does it matter?
Non-repudiation is the legal and technical guarantee that a signer cannot later deny having signed. Without it, a signed document is difficult to defend in court. Taiwan's Document Forensics and Information Security divisions confirmed that trajectory-based electronic signatures, which record pressure, vector, and velocity data, cannot be reliably authenticated as evidence. Non-repudiation requires a more robust evidentiary chain than most conventional electronic signature solutions provide.
What should organizations look for when evaluating electronic signature vendors?
Beyond feature lists, three things matter most. First, whether the solution generates a defensible evidentiary record, not just a stored signature. Second, whether the file formats comply with internationally recognized standards such as PAdES, XAdES, or CAdES, which determine whether documents can be independently verified across jurisdictions and over time. Third, whether the vendor is financially stable enough to maintain its cryptographic infrastructure long term, since documents signed today may need to be verified years from now.
Is there a global standard for electronic signatures, and how does Taiwan's approach fit into it?
There is no single unified global standard, but the EU's eIDAS regulation is the most comprehensive framework and increasingly serves as an international reference point. Taiwan's 2024 reforms drew on the same underlying legal logic as eIDAS — that a defensible signature must establish identity, demonstrate intent, and protect document integrity — without adopting its full tiered architecture. By requiring vendors to comply with ETSI-recognized format standards such as PAdES and XAdES, Taiwan ensured that domestically credentialed solutions remain compatible with the broadest range of international jurisdictions, which matters particularly for organizations operating across borders.
Which industries are most exposed to electronic signature risk?
Any industry where signed documents carry long-term legal consequences: healthcare, where consent forms determine liability; financial services, where contracts govern significant transactions; real estate, where agreements transfer assets; and insurance, where policy documents define coverage. In all of these, a signature that cannot be defended in a dispute isn't just a compliance problem — it's a financial and reputational one.
About SelfieSign
SelfieSign is a dynamic biometric signature platform built for high-stakes agreements. Our patented selfie video signing technology (.SVS) captures face, voice, handwriting, geolocation, IP address, and timestamp at the moment of signing and cryptographically binds it to the document.
Trusted by over 80% of hospitals in Taiwan, processing 3 million documents every month, SelfieSign is fully compliant with eIDAS 2.0 AES, GDPR, and ISO 27001.
Comments