SPID Digital Signature: Italy's Advanced Electronic Signature, Explained

A signature the law has recognized since 2020

On 23 March 2020, AgID issued Determination no. 157/2020, establishing the signature with SPID under Article 20 of Italy’s Digital Administration Code (CAD) — a legal norm that governs the electronic execution of deeds and contracts through the SPID digital identity system. A document signed this way carries the same legal weight as a handwritten signature: it satisfies the requirement of written form and produces the effects of Article 2702 of the Italian Civil Code, the rule that governs the evidentiary force of a privately signed agreement. AgID’s stated goal was to support the completion of document digitization, giving citizens another tool alongside the already existing qualified digital signature.

Adoption, however, remains voluntary: digital identity providers are not required to activate the signing service. That detail explains a lot of what follows.

How the technical process works

The technical flow is specific. A “service provider” — in the guidelines’ terminology, the website or app of a public body or a company, the same kind of actor that handles a request when someone browses online, as described in How the internet works — shows a “Sign with SPID” button. The user picks, among the Identity Providers (the SPID providers), the one offering the signing service. The document to be signed must meet precise requirements: PDF/A-2a format, no password protection, unencrypted, and modifiable only to apply the signature in PAdES format.

The guarantee of authenticity does not rely on a distributed public ledger, as with blockchain: here, trust rests on two verified parties, who must both hold qualified electronic seals that comply with AgID’s recommendations and the eIDAS regulation. The signed document must guarantee “security, integrity and unmodifiability” and clearly and unambiguously link back to its author.

Advanced or qualified electronic signature: not the same thing

The EU’s eIDAS regulation, from 2014, distinguishes three levels of electronic signature. The simple electronic signature is the weakest: electronic data used by the signer to sign, with no further requirements. An Advanced Electronic Signature (AES) must meet four conditions under Article 26: it must be uniquely linked to the signer, capable of identifying the signer, created using data the signer can use under their sole control, and linked to the document in a way that any later change can be detected. The SPID-based signature, under AgID’s guidelines, falls into this category.

A Qualified Electronic Signature (QES) — what most people simply call “digital signature” — is a step above: an AES created with a qualified signature creation device and based on a qualified certificate. Two extra technical requirements, which also bring a different activation process.

Who actually offers the SPID-based signature

Among the SPID providers listed on the official spid.gov.it website — including TIM id, Poste ID, InfoCert ID, Aruba, Sielte id, and Lepida — Lepida documents the Article 20 CAD signing service most clearly. Its official page, though, is explicit on one point: “the service cannot be contracted by individual private users.” The intended customers are Lepida’s member organizations and partner entities that sign a specific contract, with rates built for organizations — 2 euros plus VAT a year per enabled employee for member organizations, 8 euros plus VAT for partner entities with a minimum of 50 users — not for a citizen who wants to sign a personal document on their own.

A practical example: picture a municipality that wants residents to sign an enrollment form for a local service online. If the municipality has partnered with Lepida, it can show citizens the “Sign with SPID” button described in the guidelines: anyone who already has SPID signs the form at no extra cost and without activating anything else. But if a private citizen wants to sign a personal contract alone — say, a freelance work agreement — that exact mechanism is not available to them as of 2026: they would need to turn to a service like InfoCert’s, which is a different thing.

What InfoCert, Poste, and other providers actually sell

Searching online for “digital signature with SPID” mostly turns up pages like InfoCert’s, titled “Digital Signature with SPID Online.” The product described, though, is not the SPID-based signature from AgID’s guidelines: SPID is used as an authentication method to apply a qualified digital signature — or, as an alternative within the same flow, an advanced signature — to a document. No separate activation is required beyond holding a valid SPID identity, but the service is paid: a pack of three signatures, valid for one year, cost 19.90 euros plus VAT, with a timestamp that keeps the signature valid for twenty years.

PosteID’s official page describes a different, almost opposite path: it explains how to use a digital signature that has been active for more than 180 days to obtain SPID credentials, not how to use SPID to sign a document. It is a useful reminder that many services turning up when searching “SPID” and “digital signature” together link the two tools in a way that is not what Article 20 of the CAD describes.

So, what does it actually cost

The answer depends on who is asking. For an organization integrating the Article 20 CAD service through Lepida, the SPID-based signature has a modest, predictable cost, built for the organization rather than the individual signer. For a private citizen looking in 2026 for a way to sign their own document, the more common route runs through a product like InfoCert’s: SPID as the access key, and a qualified or advanced digital signature purchased separately. Knowing which of the two is being searched for — and which one is actually being bought — keeps someone from paying for a service believing it is free, or expecting a product for free that, in 2026 practice, providers reserve for organizations.