Electronic Signature Related to Identification Documents (e-Signature)
In Bosnia and Herzegovina, the electronic signature service became available to citizens on 1 July 2024, when the Agency for Identification Documents, Registers and Data Exchange of Bosnia and Herzegovina (IDDEEA BiH) opened the first Registration Authority (RA) Office for submitting applications for the issuance of qualified electronic certificates and electronic signatures. This marked the first time that citizens were able to electronically sign documents, 18 years after the adoption of the Law on Electronic Signature.
A Qualified Electronic Signature (QES) represents the highest level of electronic signing and, in accordance with the applicable legislation of Bosnia and Herzegovina, has the same legal effect as a handwritten signature.
Its use enables secure, reliable, and legally valid electronic signing of documents, as well as access to electronic services in communication between citizens, businesses, and public authorities.
IDDEEA BiH has established all the necessary technical, organizational, and legal prerequisites for the lawful and secure implementation of qualified electronic signatures, laying the foundation for the digital transformation and modernization of public administration in Bosnia and Herzegovina.
The electronic signature provided by IDDEEA BiH is fully compliant with applicable legislation, legally valid, and technically secure, representing a key enabler of modern electronic transactions and digital services in Bosnia and Herzegovina.
Legal and Institutional Framework
Pursuant to Article 8, Paragraph 6 of the Law on the Agency, IDDEEA is responsible for digital signing in the field of identification documents. In particular, the Agency is entrusted with issuing electronic certificates and providing electronic signatures related to identification documents, in accordance with the legislation governing electronic signatures.
Within the scope of its statutory responsibilities, IDDEEA has established a Public Key Infrastructure (PKI), providing the technical foundation required for the delivery of trust services in electronic transactions.
The legal framework governing the activities of the IDDEEA Certification Authority (CA) for issuing electronic certificates consists of the following laws and bylaws:
Law on Electronic Signature (Official Gazette of Bosnia and Herzegovina, No. 91/06);
Law on Electronic Document (Official Gazette of Bosnia and Herzegovina, No. 58/14);
Rulebook on the Detailed Conditions for the Issuance of Qualified Certificates (Official Gazette of Bosnia and Herzegovina, No. 14/17).
The general operating rules of the IDDEEA Certification Authority (CA) are set out in the following documents:
Certification Policy (CP) of the Certification Authority of the Agency for Identification Documents, Registers and Data Exchange of Bosnia and Herzegovina
Certification Practice Statement (CPS) of the Certification Authority of the Agency for Identification Documents, Registers and Data Exchange of Bosnia and Herzegovina.
The qualified and non-qualified electronic certificates, as well as the qualified electronic timestamps issued by the IDDEEA Certification Authority, are fully compliant with the applicable laws and secondary legislation of Bosnia and Herzegovina, the European Union eIDAS Regulation (Regulation (EU) No. 910/2014 of the European Parliament and of the Council on electronic identification and trust services for electronic transactions in the internal market), and the relevant international standards, recommendations, and best practices in this field.
Methods of Using the Electronic Signature
IDDEEA BiH enables the use of qualified electronic signatures through:
- The Web Application for Electronic Signing, which allows users to sign documents in a secure online environment; and
- The e-IDDEEA mobile application, which enables convenient electronic signing and secure electronic identification using a mobile device.
Both methods have the same legal effect and are fully compliant with the applicable legislation of Bosnia and Herzegovina.
Under the Law on Electronic Signature, an electronic signature is technology-neutral. The law defines signature creation and verification devices as software or hardware used to create and verify electronic signatures. Accordingly, electronic signature and certification services include the provision of products and procedures related to electronic signatures.
Neither the Law nor the bylaws prescribe the use of a single specific device. Instead, they establish strict requirements that a Secure Signature Creation Device (SSCD) must satisfy. Any solution that complies with these security requirements is legally valid.
Depending on users’ needs and on the issuance model adopted by the relevant Certification Authority (CA), several signature media and deployment models are available, all of which comply with the applicable legal framework:
The electronic signature may be stored on the chip of the national identity card and used with a compatible smart card reader.
Although IDDEEA has technically implemented this solution, qualified certificates are not currently issued on the identity card, as the Council of Ministers of Bosnia and Herzegovina has not yet adopted the decision establishing the fee for qualified certificates stored on the identity card.
- Server-Based Solution (Electronic Signature) currently provided by IDDEEA
In this model, cryptographic keys and signature data are securely stored within a certified Hardware Security Module (HSM) environment. Users authorize the use of their signature through multi-factor authentication, for example via the e-IDDEEA mobile application, eliminating the need for a physical card reader or USB token.
This electronic signature solution enables users to sign documents securely from any location, which reflects the primary purpose of modern electronic signature services.
- Physical Media (Smart Cards and USB Tokens) which remain in the exclusive possession of the certificate holder and used by certain CA bodies in BiH.
Regardless of the medium used, all of the above solutions provide the same legal validity and comply with the Rulebook on Measures and Procedures for the Use and Protection of Electronic Signatures (Official Gazette of Bosnia and Herzegovina, No. 14/17).
Registration (RA) Offices
The Registration Authority (RA) Offices of IDDEEA play a central role in the electronic signature system. They are responsible for the in-person identification of applicants, receiving applications for qualified electronic certificates, and activating qualified electronic signatures.
IDDEEA’s RA Offices are available throughout Bosnia and Herzegovina, ensuring that electronic signature services are accessible to citizens across the entire territory of the country.
Identification Using the Electronic Identity Card
Users may identify themselves by using a valid Bosnia and Herzegovina electronic identity card (eID) with an embedded chip together with a compatible smart card reader. This method enables secure identity verification and reliable authentication of the user’s identity.
Identification Using the e-IDDEEA Mobile Application
In addition to the electronic identity card, users may also identify themselves through the e-IDDEEA mobile application, which provides secure and reliable electronic identification without the need for additional hardware.