Conference 29–30 March 2017 📍 Warsaw, Poland

PDF Days Europe 2017 — Warschau: PDF Association Founding, PDF/A-3, and Interactive PDF

Q: What is a Qualified Electronic Signature (QES) in PDF?

Under the eIDAS regulation , a Qualified Electronic Signature (QES) is the highest level of electronic signature, created using a qualified electronic signature creation device (typically a hardware token) and a qualified certificate from a trust service provider on the EU Trusted Lists. QES has the equivalent legal effect of a handwritten signature in all EU member states. In PDF, QES is implemented using the PAdES (PDF Advanced Electronic Signatures) profile defined by ETSI, which builds on the PDF digital signature infrastructure with additional long-term validation requirements.

PDF Days Europe 2017 took place in Warsaw, Poland on 29–30 March 2017. The event focused on the just-published PDF 2.0 specification nearing finalisation, expanded PDF/A-3 e-invoicing adoption, and interactive PDF forms — with strong representation from Eastern European government digitisation programmes.

Official event page →

Key takeaways

PDF 2.0 (ISO 32000-2:2017) was weeks from publication — 2017 was the last conference to preview the final specification before release.
AES-256-GCM (authenticated encryption) replaced AES-CBC in PDF 2.0 encryption — a security upgrade addressing padding oracle attack risks.
XFA deprecated in PDF 2.0 — new form development should target AcroForms; XFA migration planning needed for organisations with LiveCycle deployments.
EU Web Accessibility Directive adopted October 2016 — PDF/UA became a legal compliance requirement for EU public sector PDF documents.
eIDAS fully in effect from July 2016 — qualified electronic signatures in PDF now had harmonised legal weight equal to handwritten signatures across all EU member states.
PDF/A-4 planning underway — the first PDF/A variant based on PDF 2.0 (published 2020) was in early development.

PDF Days Europe 2017 was held in Berlin in May 2017, organised by the PDF Association. The conference took place in the final months before the publication of ISO 32000-2:2017 (PDF 2.0) — making it the last opportunity for the PDF community to preview the complete specification before its formal release. Attendees arrived knowing that PDF 2.0 was weeks away, and sessions focused on what implementors and organisations needed to know before the standard arrived. Two external events shaped the 2017 programme alongside the PDF 2.0 countdown: the EU Web Accessibility Directive (Directive 2016/2102) had been adopted in October 2016, giving PDF/UA new legal footing in the European public sector, and the eIDAS regulation (EU 910/2014) had been in effect since July 2016, harmonising electronic signature law across EU member states and creating a new compliance context for PDF digital signatures. The combination of imminent PDF 2.0 publication, new accessibility legislation, and active signature law reform made 2017 one of the most substantively consequential PDF Days Europe conferences.

PDF 2.0 — the final preview before publication

By May 2017, ISO 32000-2 was approaching final ballot. Sessions at PDF Days Europe 2017 gave implementors and document engineers their most complete picture yet of the new standard's scope: Encryption updates — PDF 2.0 replaced the AES-CBC encryption of PDF 1.7 with AES-256-GCM (authenticated encryption), addressing a class of padding oracle attacks possible against CBC mode. For the first time, PDF encryption would provide both confidentiality and integrity protection. See PDF Encryption for background. XFA deprecation confirmed — PDF 2.0 formally deprecated XFA (XML Forms Architecture), Adobe's proprietary dynamic forms format. New form development should target AcroForms. This was significant for organisations that had deployed LiveCycle-based XFA forms at scale and would need migration plans. New structure elements — PDF 2.0 added structure elements to support modern document types: /Aside for sidebar content, /H as a generic heading, /FENote for footnotes and endnotes, and /DocumentFragment for document sections. These additions were directly relevant to Tagged PDF and accessibility workflows. Associated files — The new associated file (/AF) mechanism, already in use in PDF/A-3 for embedded data attachments, was formalised in PDF 2.0 as a general-purpose mechanism for attaching machine-readable data to any PDF object. ZUGFeRD invoices had demonstrated its value; PDF 2.0 elevated it to a core feature. PDF/A-4 planning underway — With PDF 2.0 nearly published, planning was underway for PDF/A-4 — the first PDF/A variant based on PDF 2.0 rather than earlier PDF versions. PDF/A-4 would be published as ISO 19005-4 in 2020.

EU Web Accessibility Directive: implications for PDF

The Web Accessibility Directive (WAD) was adopted in October 2016 and required EU public sector bodies to make their websites and mobile applications accessible, with reference to EN 301 549 as the harmonised standard. EN 301 549 incorporated PDF/UA (ISO 14289-1) as the accessibility requirement for PDF documents published by public sector bodies. This meant that for the first time in the EU, PDF/UA was not just a best practice but a compliance requirement for government PDF documents — and non-compliant PDFs on government websites were potentially subject to enforcement action. Sessions at PDF Days Europe 2017 examined the practical implications: how many government PDFs across EU member states would actually pass PDF/UA validation, what the remediation effort would be for legacy documents, which authoring tools could produce PDF/UA-compliant output, and what monitoring and enforcement mechanisms EU member states were putting in place. The consensus was that the WAD would drive substantial demand for PDF/UA compliance tooling, automated testing, and remediation workflows — but that most governments were not yet close to compliance and implementation timelines would be long.

eIDAS and PDF digital signatures

The eIDAS regulation (EU 910/2014) had been fully in effect since July 2016. For PDF practitioners, eIDAS established the legal framework for electronic signatures in the EU and defined three levels of electronic signature with different legal weights: Simple Electronic Signatures — any electronic data attached to or associated with other electronic data for signing purposes (low evidential weight). Advanced Electronic Signatures — uniquely linked to and capable of identifying the signatory, created using signature creation data under the signatory's sole control. PDF signatures using standard PKI qualify. Qualified Electronic Signatures (QES) — created using a qualified electronic signature creation device (hardware) and based on a qualified certificate issued by a trust service provider on the EU Trusted Lists. QES has the equivalent legal effect of a handwritten signature across all EU member states. Sessions explored the practical implementation of qualified electronic signatures in PDF workflows, the ETSI PAdES (PDF Advanced Electronic Signatures) profile that defines how to create eIDAS-compliant PDF signatures, and the cross-border recognition of qualified signatures across EU member states. PDF/A-3 with embedded XML data was also examined as a format for legally archivable signed invoices — combining the PDF/UA accessibility dimension with eIDAS signature compliance.

Frequently asked questions

What changed in PDF encryption between PDF 1.7 and PDF 2.0?

PDF 1.7 used AES-128 or AES-256 encryption in CBC (Cipher Block Chaining) mode. AES-CBC provides confidentiality but not integrity — an attacker who modifies cipher text bytes may cause decryption to produce modified plaintext without detection (padding oracle attacks). PDF 2.0 added AES-256-GCM (Galois/Counter Mode), an authenticated encryption mode that produces an authentication tag alongside the cipher text. When decrypting, the receiver verifies the tag before trusting the plaintext — any tampering with the cipher text is detected. See PDF Encryption for full details.

What is the EU Web Accessibility Directive and does it apply to PDFs?

The EU Web Accessibility Directive (Directive 2016/2102) requires public sector bodies in EU member states to make their websites and mobile applications accessible. The harmonised standard EN 301 549 (referenced in the Directive) incorporates PDF/UA (ISO 14289-1) as the accessibility requirement for PDF documents. So yes — PDFs published by EU government websites are in scope, and non-compliant PDFs may trigger accessibility complaints and enforcement actions. The Directive applied from September 2019 for new content.

What is a Qualified Electronic Signature (QES) in PDF?

Under the eIDAS regulation, a Qualified Electronic Signature (QES) is the highest level of electronic signature, created using a qualified electronic signature creation device (typically a hardware token) and a qualified certificate from a trust service provider on the EU Trusted Lists. QES has the equivalent legal effect of a handwritten signature in all EU member states. In PDF, QES is implemented using the PAdES (PDF Advanced Electronic Signatures) profile defined by ETSI, which builds on the PDF digital signature infrastructure with additional long-term validation requirements.

Try it in your browser

The PDF tools and standards discussed at this event are available free — no account needed.

Edit PDF Protect PDF Sign PDF Open editor