ema esignature capabilities: frequently asked questions...

26
January 2014 EMA/264709/2013 Version 3.0 (revisions dated) EMA eSignature capabilities: frequently asked questions relating to practical and technical aspects of the implementation This question and answer document aims to address the frequently-asked questions and provide guidance regarding technical and practical aspects of the European Medicines Agency’s electronic signature capabilities. 7 Westferry Circus Canary Wharf London E14 4HB United Kingdom An agency of the European Union Telephone +44 (0)20 7418 8400 Facsimile +44 (0)20 7418 8416 E-mail [email protected] Website www.ema.europa.eu © European Medicines Agency, 2014. Reproduction is authorised provided the source is acknowledged.

Upload: vungoc

Post on 22-May-2018

254 views

Category:

Documents


1 download

TRANSCRIPT

Page 1: EMA eSignature capabilities: frequently asked questions ...esubmission.ema.europa.eu/doc/esignature/FAQs for EMA eSignature... · EMA eSignature capabilities: frequently asked

January 2014 EMA/264709/2013 Version 3.0 (revisions dated)

EMA eSignature capabilities: frequently asked questions relating to practical and technical aspects of the implementation

This question and answer document aims to address the frequently-asked questions and provide guidance regarding technical and practical aspects of the European Medicines Agency’s electronic signature capabilities.

7 Westferry Circus ● Canary Wharf ● London E14 4HB ● United Kingdom

An agency of the European Union

Telephone +44 (0)20 7418 8400 Facsimile +44 (0)20 7418 8416 E-mail [email protected] Website www.ema.europa.eu

© European Medicines Agency, 2014. Reproduction is authorised provided the source is acknowledged.

Page 2: EMA eSignature capabilities: frequently asked questions ...esubmission.ema.europa.eu/doc/esignature/FAQs for EMA eSignature... · EMA eSignature capabilities: frequently asked

Contents

Objectives of the EMA eSignature Capabilities ............................................. 3

Registration Process .................................................................................... 3

Business Process ......................................................................................... 3

Technical Questions..................................................................................... 4

Verification and Certificates ........................................................................ 6

How to digitally sign an EMA PDF Form ..................................................... 23

General Questions ..................................................................................... 25

Contact us ................................................................................................. 26

EMA eSignature capabilities: frequently asked questions relating to practical and technical aspects of the implementation

EMA/264709/2013 Page 2/26

Page 3: EMA eSignature capabilities: frequently asked questions ...esubmission.ema.europa.eu/doc/esignature/FAQs for EMA eSignature... · EMA eSignature capabilities: frequently asked

Objectives of the EMA eSignature Capabilities

1) What are the European Medicines Agency’s eSignature capabilities?

The EMA’s eSignature capabilities enable the EMA to send digitally signed electronic documents (PDF) to industry. The EMA also have the capacity to verify digital signatures embedded in digitally signed electronic documents (PDF).

The EMA’s capabilities are in line with the EMA’s strategy for a future electronic only workflow.

These capabilities enable the secure archiving of legally binding digitally signed documents in a more efficient manner and they reduce the requirement to sign and archive paper documents.

2) Which types of documents can be sent with a digital signature?

The EMA accept digital signatures in portable document format (PDF) electronic documents.

3) Who is the eSignature solution for?

Currently, the EMA’s eSignature capabilities are restricted to electronic documents for Scientific Advice, Orphan Medicines and Paediatric submissions between EMA and the pharmaceutical industry.

4) How do I send a digitally signed document to the EMA?

You should send digitally signed documents via your usual submission channel e.g. email or Eudralink.

Registration Process

5) Do companies need to register to access EMA’s eSignature capabilities?

There is no registration requirement to send or receive digitally signed documents.

Business Process

6) Who should digitally sign a document on behalf of a company?

The signatory of a digitally signed document should be the person authorised to fulfil this role within the company.

7) What do I do if I cannot provide a digital signature on an EMA PDF electronic document?

You can complete the necessary document, sign it using wet-ink and scan and send it to the EMA via email or EudraLink. Alternatively you may send the signed document via courier.

8) Does the EMA accept only digitally signed documents?

No, the use of digital signatures is not yet mandatory.

9) How do I know my digitally signed document has been successfully received?

Digitally signed documents will be dealt with in accordance to existing business processes and therefore no additional notification of receipt will be provided.

EMA eSignature capabilities: frequently asked questions relating to practical and technical aspects of the implementation

EMA/264709/2013 Page 3/26

Page 4: EMA eSignature capabilities: frequently asked questions ...esubmission.ema.europa.eu/doc/esignature/FAQs for EMA eSignature... · EMA eSignature capabilities: frequently asked

10) Will digitally signed documents submitted to the EMA go through a different process?

All digitally signed documents received by the EMA will be handled in line with current processes.

11) Do we need to digitally sign applications for all procedure types? Updated September 2013

No, the Agency provides specific PDF certified electronic application forms in the areas of Scientific Advice, Orphan Medicines and Paediatric Medicines for industry to digitally sign and submit using a PDF Reader Application. Details of the available forms can be found here.

Technical Questions

12) When should I involve my organisation’s IT colleagues in the configuration of the eSignature solution?

Please engage with your technical colleagues from the outset. It is advisable to obtain technical support with the configuration.

13) Are all types of PDF software supported?

We have successfully tested the solution using Adobe Reader, however the EMA’s eSignature solution is designed to be compatible with other PDF compliant applications.

14) When I try to open one of the EMA PDF forms with my web browser, I see a message on screen indicating that my web browser cannot open the PDF. Why does this occur? Updated September 2013

Please save the PDF in a suitable location and open it with your chosen PDF reader. Depending on the browser you use and the way in which your computer has been configured, the message you see on screen may differ. If you are using Firefox you might see the message below:

If you are using internet explorer you might see the following:

EMA eSignature capabilities: frequently asked questions relating to practical and technical aspects of the implementation

EMA/264709/2013 Page 4/26

Page 5: EMA eSignature capabilities: frequently asked questions ...esubmission.ema.europa.eu/doc/esignature/FAQs for EMA eSignature... · EMA eSignature capabilities: frequently asked

15) Do we need an external software provider in order to send or receive documents containing an electronic signature?

The use of a software provider is not necessary to digitally sign and receive documents. If your organisation does not currently have the facility to embed a digital signature, you may choose to seek technical guidance to acquire the appropriate technology.

16) How do I digitally sign a PDF?

The EMA will provide PDF certified electronic documents that are reader extended. You may use a PDF compliant reader application, e.g. Adobe Reader Version 9.1 plus.

17) How do I know a PDF is digitally signed?

There is normally a visual representation in the electronic document; however, the actual digital signature is embedded within the PDF file. When you open the PDF file your PDF reader application should notify you that the file contains digital signatures. Please look at the image below to see an example of a digital signature.

Figure 1.

18) Which PDF standards do the EMA conform to?

All electronic documents to be digitally signed will conform to the portable document format file (PDF) version 1.7 ISO 32000-1:2008 standard. It should be noted that ISO/IEC 32000-2 may further clarify the use of digital signatures. This standard is currently under development.

EMA eSignature capabilities: frequently asked questions relating to practical and technical aspects of the implementation

EMA/264709/2013 Page 5/26

Page 6: EMA eSignature capabilities: frequently asked questions ...esubmission.ema.europa.eu/doc/esignature/FAQs for EMA eSignature... · EMA eSignature capabilities: frequently asked

Verification and Certificates

19) Where do I obtain a Qualified Certificate? Updated September 2013

Supervised or accredited trust service providers (TSPs) in EU Member States supply Qualified Certificates to corporate entities and also to citizens. TSP supervisory bodies or TSP scheme operators maintain a list of TSPs that are authorised or accredited to supply Qualified Certificates.

TSPs are supervised by their indigenous TSP supervisory body, which is normally a government department. Some EU Member States also delegate the TSP supervision to a national TSP scheme operator that undertakes trust services accreditation. Table 1 shows the trust service providers (TSPs) supervisory body or scheme operator for each EU Member State.

EU Member State

Supervisory Body and/or Trust Scheme Operator Lists Country Code

Belgium FPS Economy, SMEs, Self-employed and Energy - Quality and Security - Information Management

BE

Bulgaria Communications Regulation Commission BG Czech Ministry of the Interior of the Czech Republic CZ Denmark Danish Agency for Digitisation DK Germany Federal Network Agency DE Estonia Estonian Technical Surveillance Authority EE Ireland Department of Communications, Energy and Natural Resources IE Greece Hellenic Telecommunications and Post Commission (EETT) EL Spain Ministerio de Industria, Energía y Turismo ES France Direction Générale de la Modernisation de l'Etat (DGME) FR Croatia To be determined HR Italy Agenzia per l’Italia Digitale IT Cyprus Department of Electronic Communications, Ministry of

Communications and Works CY

Latvia Data State Inspectorate LV Lithuania Communications Regulatory Authority of the Republic of Lithuania LT Luxembourg Institut Luxembourgeois de la Normalisation, de

l'Accréditation, de la Sécurité et qualité des produits et services (ILNAS)

LU

Hungary National Media and Infocommunications Authority HU Malta Malta Communications Authority MT The Netherlands Authority for Consumers & Markets NL Austria Rundfunk und Telekom Regulierungs-GmbH AT Poland National Bank of Poland PL Portugal National Security Cabinet of Portugal PT Romania Ministerul Comunicatiilor si Societatii Informationale RO Slovenia Republic of Slovenia, Ministry of Education, Science and Sport SI Slovakia National Security Authority SK Finland FICORA - Finnish Communications Regulatory Authority FI Sweden Swedish Post and Telecom Agency (PTS) SE United Kingdom tScheme UK Iceland To be determined IS Lichtenstein The Office for Communications (AK) LI Norway NPT - Norwegian Post and Telecommunications Authority NO Table 1 – List of EU Member States TSP Supervisory Body or TSP Scheme Operator

You will need to clarify in your enquiries that you are specifically seeking TSPs that issue Qualified Certificates. The European Commission Trusted Lists of Certification Service Providers LOTL and each states’ lists are updated as and when there is a need for such a change.

EMA eSignature capabilities: frequently asked questions relating to practical and technical aspects of the implementation

EMA/264709/2013 Page 6/26

Page 7: EMA eSignature capabilities: frequently asked questions ...esubmission.ema.europa.eu/doc/esignature/FAQs for EMA eSignature... · EMA eSignature capabilities: frequently asked

20) Who is the EMA’s Qualified Certificate Provider?

The EMA shall be using the certification services provided by the Spanish Royal Mint (Fábrica Nacional de Moneda y Timbre (FNMT) – Real Casa de la Moneda) under Contract EC Framework Contract No DI/06750-0 PKI Services.

21) How do I ensure our certificates are compliant with the EMA’s requirements?

The Directive of the European Parliament and of the Council on a Community framework for electronic signatures (1999/93/EC) defines requirements on a specific type of certificate named `Qualified Certificates’, which are given a specific relevance for the acceptance of electronic signatures and their legal effects Article 5. The Directive’s ANNEX I describes the Requirements for qualified certificates and ANNEX II describes the Requirements for certification-service-providers issuing qualified certificates“

The ETSI Technical Specification ETSI TS 101 862 V1.3.1 (2004-03) Qualified Certificate Profile may be obtained here.

You may also send a test digitally signed PDF by email to [email protected] if you require EMA to test the verification of the digital signatures on your planned submissions.

22) Who is the EMA’s PDF Certify Certificate Provider?

The EMA is using a certificate from GlobalSign as part of the Adobe Certified Document Services Scheme for Certifying EMA documents.

23) Is it possible to obtain a Qualified Certificate if my organisation is not based in the EU? Updated January 2014

There are a number of Trust Services Providers (TSPs) that supply Qualified Certificates to non-domiciled entities. These TSPs may supply Qualified Certificates to organisations outside the EU and to organisations in EU states where there are no TSPs issuing Qualified Certificates. From our initial investigations we have ascertained that Qualified Certificates may be obtained from the following TSPs; however, this list is not exhaustive.

• Luxtrust S.A. Luxembourg – please see the instructions at the foot of this page on registration processes.

• Post Trust limited Ireland – please contact [email protected].

• Trans Sped SRL Romania – please contact [email protected].

It is important that you state that you require the Qualified Certificate for digitally signing PDF electronic documents.

24) How do I verify an EMA digital signature?

In order to verify an EMA digital signature you must make sure your system is configured to trust the root certification authority certificates used by EMA, see question "Who is the EMA's Qualified Certificate Provider?" Please refer to your organisation's security policies.

EMA eSignature capabilities: frequently asked questions relating to practical and technical aspects of the implementation

EMA/264709/2013 Page 7/26

Page 8: EMA eSignature capabilities: frequently asked questions ...esubmission.ema.europa.eu/doc/esignature/FAQs for EMA eSignature... · EMA eSignature capabilities: frequently asked

25) How do I ensure that Certification Authority Root certificates, associated with EMA digital signatures, are available to my PDF application?

You need to ensure that Certification Authority Root certificates, associated with EMA digital signatures, are available to your PDF application. The points below describe the steps to follow in order to import those certificates to your local Windows environment and Adobe Reader as an example.

A. This capability is achieved by downloading the three certificates from the EMA eSignatures web pages, as shown in Figure 2.

Figure 2.

B. Download each certificate and use the “open” option and the install option, as shown in Figure 3, to import the FNMT Root CA Certificates, using the certificate import wizard.

EMA eSignature capabilities: frequently asked questions relating to practical and technical aspects of the implementation

EMA/264709/2013 Page 8/26

Page 9: EMA eSignature capabilities: frequently asked questions ...esubmission.ema.europa.eu/doc/esignature/FAQs for EMA eSignature... · EMA eSignature capabilities: frequently asked

Figure 3.

C. When you have installed all three FNMT certificates click on the file to open the EMA PDF Form in your PDF application.

D. You now need to accept these installed certificates into your PDF applications trusted certificate store. An example of this task is shown in Figure 3, using PDF reader application. This task is required to be complete once only for all EMA digitally signed EMA PDFs. Click on the signature tab, with the green tick in the side bar. Then click on “signature details” to expand the attributes to show certificate details. Then highlight FNMT-RCM and then click on the trust tab. Then click on the “add to Trusted Identities” button, as shown in Figure 4.

Figure 4.

EMA eSignature capabilities: frequently asked questions relating to practical and technical aspects of the implementation

EMA/264709/2013 Page 9/26

Page 10: EMA eSignature capabilities: frequently asked questions ...esubmission.ema.europa.eu/doc/esignature/FAQs for EMA eSignature... · EMA eSignature capabilities: frequently asked

In the next dialogue box, as shown in Figure 5, click OK to accept these FNMT Root CA certificates.

Figure 5.

In the next pop-up dialogue box, as shown in Figure 6, ensure that the accept root certificate box is checked and then press OK

Figure 6.

EMA eSignature capabilities: frequently asked questions relating to practical and technical aspects of the implementation

EMA/264709/2013 Page 10/26

Page 11: EMA eSignature capabilities: frequently asked questions ...esubmission.ema.europa.eu/doc/esignature/FAQs for EMA eSignature... · EMA eSignature capabilities: frequently asked

E. Now verify all the digital signatures by clicking the “Validate All” button. Figure 7 shows the result of verifying the digital signatures in an EMA PDF.

Figure 7.

26) How do I confirm if I have the required certificates in the trust store?

If you are using Adobe software you can start by Checking the Adobe Certificate Authority Root Certificate Trust Configuration in Adobe Reader / Adobe Acrobat:

1. Open the PDF in Adobe Reader or Acrobat.

2. Open the signature tab.

3. Right click on the Certification signature named “Certified by EMA Certify”.

4. Select “Show signature properties…”

EMA eSignature capabilities: frequently asked questions relating to practical and technical aspects of the implementation

EMA/264709/2013 Page 11/26

Page 12: EMA eSignature capabilities: frequently asked questions ...esubmission.ema.europa.eu/doc/esignature/FAQs for EMA eSignature... · EMA eSignature capabilities: frequently asked

Figure 8.

5. Click “Show Signer’s Certificate…”

Figure 9.

6. From the List on the left select the top most certificate called “Adobe Root CA”.

7. Select the Trust tab.

8. You should now see that this certificate is trusted for “Signing documents or data” and “Certifying documents”. The “Add to Trusted Certificates…” button should be greyed out and disabled.

EMA eSignature capabilities: frequently asked questions relating to practical and technical aspects of the implementation

EMA/264709/2013 Page 12/26

Page 13: EMA eSignature capabilities: frequently asked questions ...esubmission.ema.europa.eu/doc/esignature/FAQs for EMA eSignature... · EMA eSignature capabilities: frequently asked

Figure 10.

9. Without changing the Tab click on the second certificate name from the top in the left panel called “GlobalSign Primary SHA256 CA for Adobe”.

10. You should see in the trust tab that the permissions are inherited from the parent certificate granting “Sign documents or data” and “Certify documents”. This time however the “Add to Trusted Certificates…” button is not disabled. You don’t need to do anything here.

EMA eSignature capabilities: frequently asked questions relating to practical and technical aspects of the implementation

EMA/264709/2013 Page 13/26

Page 14: EMA eSignature capabilities: frequently asked questions ...esubmission.ema.europa.eu/doc/esignature/FAQs for EMA eSignature... · EMA eSignature capabilities: frequently asked

Figure 11.

11. Without changing the Tab click on the third certificate name from the top in the left panel called “EMA Certify <[email protected]>”.

12. You should see in the trust tab that the permissions are inherited from the parent certificate granting “Sign documents or data” and “Certify documents”. Again the “Add to Trusted Certificates…” button is not disabled. You don’t need to do anything here.

EMA eSignature capabilities: frequently asked questions relating to practical and technical aspects of the implementation

EMA/264709/2013 Page 14/26

Page 15: EMA eSignature capabilities: frequently asked questions ...esubmission.ema.europa.eu/doc/esignature/FAQs for EMA eSignature... · EMA eSignature capabilities: frequently asked

Figure 12.

13. Click OK.

14. Click Validate Signature.

15. You should then see the following:

EMA eSignature capabilities: frequently asked questions relating to practical and technical aspects of the implementation

EMA/264709/2013 Page 15/26

Page 16: EMA eSignature capabilities: frequently asked questions ...esubmission.ema.europa.eu/doc/esignature/FAQs for EMA eSignature... · EMA eSignature capabilities: frequently asked

Figure 13.

16. Please Repeat steps 3 – 15 for the second signature field, In Step 8 you should see the following:

EMA eSignature capabilities: frequently asked questions relating to practical and technical aspects of the implementation

EMA/264709/2013 Page 16/26

Page 17: EMA eSignature capabilities: frequently asked questions ...esubmission.ema.europa.eu/doc/esignature/FAQs for EMA eSignature... · EMA eSignature capabilities: frequently asked

Figure 14.

17. In this case the permissions on each certificate should be “Sign documents or data” only.

If the first certificate in the certificate list does not have any permissions set or the “Add to Trusted Certificates…” button is not disabled please email [email protected].

27) How do I change certificate permissions?

1. Open Adobe Reader or Acrobat.

2. Select “Edit” -> “Preferences”

EMA eSignature capabilities: frequently asked questions relating to practical and technical aspects of the implementation

EMA/264709/2013 Page 17/26

Page 18: EMA eSignature capabilities: frequently asked questions ...esubmission.ema.europa.eu/doc/esignature/FAQs for EMA eSignature... · EMA eSignature capabilities: frequently asked

Figure 15.

3. Scroll down the list in the left hand panel and select “Signatures”.

4. Under the section “Identities & Trusted Certificates” click “More”.

EMA eSignature capabilities: frequently asked questions relating to practical and technical aspects of the implementation

EMA/264709/2013 Page 18/26

Page 19: EMA eSignature capabilities: frequently asked questions ...esubmission.ema.europa.eu/doc/esignature/FAQs for EMA eSignature... · EMA eSignature capabilities: frequently asked

Figure 16.

5. Click “Trusted Certificates”.

6. Sort by “Certificate Issuer”.

7. Look down the list for “Adobe Root CA”. Select it.

EMA eSignature capabilities: frequently asked questions relating to practical and technical aspects of the implementation

EMA/264709/2013 Page 19/26

Page 20: EMA eSignature capabilities: frequently asked questions ...esubmission.ema.europa.eu/doc/esignature/FAQs for EMA eSignature... · EMA eSignature capabilities: frequently asked

Figure 17.

8. Confirm that the details in the bottom panel match the following:

Adobe Root CA Adobe Systems Incorporated

Issued by: Adobe Root CA Adobe Systems Incorporated Valid from: 2003.01.08 23:37:23 Z Valid to: 2023.01.09 00:07:23 Z Intended usage: Sign certificate (CA), Sign CRL

9. If the settings match click close. If not continue to Step 10.

10. Click “Edit Trust”.

EMA eSignature capabilities: frequently asked questions relating to practical and technical aspects of the implementation

EMA/264709/2013 Page 20/26

Page 21: EMA eSignature capabilities: frequently asked questions ...esubmission.ema.europa.eu/doc/esignature/FAQs for EMA eSignature... · EMA eSignature capabilities: frequently asked

Figure 18.

11. Make sure the following options are ticked on this screen:

a) Use this certificate as a trusted root

b) Signed document or data

c) Certified documents

12. Click “OK”.

13. You have now completed the steps to update an imported certificate’s trust permissions.

EMA eSignature capabilities: frequently asked questions relating to practical and technical aspects of the implementation

EMA/264709/2013 Page 21/26

Page 22: EMA eSignature capabilities: frequently asked questions ...esubmission.ema.europa.eu/doc/esignature/FAQs for EMA eSignature... · EMA eSignature capabilities: frequently asked

28) Do you have suggestions on how FNMT Root Certification Authority Certificates can be dispersed company-wide rather than each person, in that organisation, downloading these certificates and importing them into their workstations individually? Updated October 2013

EMA recommends that you request either your security operations or IT operations department to download the three FNMT certificates from the EMA website and import them into your organisation’s directories. Your IT operations department will need to configure the PDF reader application on your workstations to validate the certificate chain, associated with the digital signature, using certificates maintained in relevant directories. An alternative configuration would be to disperse the certificates automatically to workstations in your organisation using a Client Management Tool. The certificate dispersal policy and implementation will very much depend upon the security policies of your organisation and the configuration of your organisation’s IT infrastructure.

29) How do I know if there is a problem with the verification of a digital signature?

1. Look out for alerts in the Blue Certification notification bar across the top of the PDF display panel. The alerts that indicate a problem are shown below:

a) User action required to validate a signature field on the form

b) The form Certification is valid but the recipient signature cannot be validated

c) The recipient signature field on the form is valid but the Certification is not valid

d) The document Certification and recipient signature are not valid /cannot be validated.

e) Either the document Certification or Recipient Signature Field is Invalid.

f) All signatures on the form are valid

2. Signature Panel - Certification Field

a) Status unknown

b) Invalid

EMA eSignature capabilities: frequently asked questions relating to practical and technical aspects of the implementation

EMA/264709/2013 Page 22/26

Page 23: EMA eSignature capabilities: frequently asked questions ...esubmission.ema.europa.eu/doc/esignature/FAQs for EMA eSignature... · EMA eSignature capabilities: frequently asked

c) Valid

3. Signature Panel – Recipient Signature Field

a) Status Unknown

b) Signature has Problems

c) Invalid

d) Valid

30) What do I do if I cannot verify a digital signature that is embedded in an EMA document?

Please contact [email protected]

31) Are digital signatures in Adobe products compatible with PDF/A?

PDF/A-1 FULLY supports Digital Signatures. Reader, Acrobat and LiveCycle all fully support signing a PDF/A according the requirements for same.

How to digitally sign an EMA PDF Form

This section is included for those individuals that may not be familiar with digitally signing PDF Forms using a PDF reader application.

A. Click on the file to open the EMA PDF Form in your PDF reader application.

B. The EMA Form is authenticated automatically, as shown by the blue ribbon and blue rosette and the statement “Certified by EMA” in Figure 19.

EMA eSignature capabilities: frequently asked questions relating to practical and technical aspects of the implementation

EMA/264709/2013 Page 23/26

Page 24: EMA eSignature capabilities: frequently asked questions ...esubmission.ema.europa.eu/doc/esignature/FAQs for EMA eSignature... · EMA eSignature capabilities: frequently asked

Figure 19.

C. Enter the pertinent information of the scenario into the form’s fields.

Figure 20.

D. Place your cursor over the "Signature of sponsor’s representative" digital signature box, as shown in Figure 21, and right click.

E. Proceed through the dialogue to digitally sign the electronic document (save the file in a new name)

EMA eSignature capabilities: frequently asked questions relating to practical and technical aspects of the implementation

EMA/264709/2013 Page 24/26

Page 25: EMA eSignature capabilities: frequently asked questions ...esubmission.ema.europa.eu/doc/esignature/FAQs for EMA eSignature... · EMA eSignature capabilities: frequently asked

Figure 21.

F. The representation of your digital signature is displayed in the digital signature box as shown in Figure 22. This representation is configurable in your PDF reader application; however, the digital signature is embedded into the PDF file. Your PDF application should provide you with the option to save the file in a new filename; however, if this facility is not provided then save the form using the “Save Form” button.

Figure 22.

General Questions

32) When will the eSignature solution “go live”?

The eSignature solution was launched in September 2013.

EMA eSignature capabilities: frequently asked questions relating to practical and technical aspects of the implementation

EMA/264709/2013 Page 25/26

Page 26: EMA eSignature capabilities: frequently asked questions ...esubmission.ema.europa.eu/doc/esignature/FAQs for EMA eSignature... · EMA eSignature capabilities: frequently asked

33) Are EMA digital signatures legally binding? Updated September 2013

EMA digital signatures are advanced electronic signatures created by secure signature creation devices and supported by Qualified Certificates. Digital signatures on EMA electronic documents conform to the requirements for Qualified Certificates of Annex I of the Directive 1999/93/EC of the European Parliament and of the Council dated 13th December 1999. Digital signatures on EMA electronic documents are created using a secure signature-creation device as specified in Annex III of the Directive.

Under Article 5 1b of the Directive, Member States shall ensure that advanced electronic signatures, based upon a Qualified Certificate and created by a secure signature creation device, are admissible as evidence in legal proceedings.

34) What is the cost of the eSignature solution? Updated September 2013

The cost of the eSignature solution is free for a user already in possession of a qualified certificate and the means to create a digital signature.

For organisations that do not yet have the capability to digitally sign documents electronically, we advise you to seek a quotation from a supervised or accredited trust service provider (TSP) supplying digital signature services supported by Qualified Certificates.

You should refer to Table 1 above to determine the respective accreditation body or scheme operator that maintain a list of supervised or accredited TSPs supplying Qualified Certificates.

35) How do the EMA ensure that digitally signed PDFs submitted by industry cannot be tampered with?

The PDF electronic forms are certified, using the EMA Entity Keys, to ensure that industry users complete the specific permitted fields and do not add further fields. By certifying the PDF file, the electronic forms are being “locked down” to detect unauthorised manipulation.

36) Is the EMA’s digital signature solution compatible with the FDA’s digital signature requirements? Updated September 2013

The EMA’s digital signature solution is legally binding in the European Union. It is apparent that each country may have its own digital signature legislation. Users are advised to familiarise themselves with the requirements of the country they are submitting documents to.

Contact us

For queries concerning the EMA’s eSignature solution please contact [email protected]

EMA eSignature capabilities: frequently asked questions relating to practical and technical aspects of the implementation

EMA/264709/2013 Page 26/26