A small business owner’s digital administration in Estonia 2026: when to use e-services, digital signatures and authorizations, and how to avoid mistakes

In this guide, we explain when a digital signature is needed, how to check a signature’s validity, how to grant e-MTA access rights, and what can be learned from the DigiDoc4j failures of 2026. Examples are suitable both for a board member of OÜ and for a business owner with a small team.

In brief: an e-service, a digital signature, and an authorisation are not the same thing

Important: logging into an e-service verifies the user's identity, but does not in itself give them the right to perform all actions on behalf of the company. Likewise, one click in an e-service does not always replace a separate signature.

Is every electronic signature equivalent to a handwritten signature?

No. Under Article 25 of the European Union’s eIDAS Regulation, a qualified electronic signature (qualified electronic signature, QES) has the same legal effect as a handwritten signature. A simple or advanced electronic signature may not be rejected as evidence in legal proceedings solely because it is in electronic form, but this does not mean that all e-signatures automatically have the same legal status.

Näiteks võib PDF-ile joonistatud allkirjapilt väljendada kokkulepet, kuid see ei ole sama mis kvalifitseeritud digiallkiri. Kui dokument nõuab kindlat vormi, tuleb kontrollida, milline allkirja liik on nõutav. Eesti tavapäraste kvalifitseeritud digiallkirjade loomiseks saab kasutada ID-kaarti, Mobiil-IDd ja sobivat kvalifitseeritud Smart-ID kontot.

The cross-border recognition of qualified electronic signatures is provided for under the eIDAS Regulation in the EU. However, a foreign partner’s software or workflow may require a technical check: does the signed file open, and can it be validated correctly?

How to digitally sign a document in Estonia?

1. Prepare the final document. Check the amounts, dates, parties, attachments and version number.
2. Open the official DigiDoc4 app on your computer or the RIA DigiDoc mobile app on your phone, and add the file to be signed.
3. Choose a signing method: ID-card, Mobile-ID or Smart-ID, depending on the service's support and your access rights.
4. Check the confirmation code. Make sure the verification code displayed on the device matches the action you initiated. Do not confirm an unexpected signing request.
5. Enter PIN2 only to confirm an action you have deliberately initiated. PIN1 is usually used for identification or logging in.
6. Save the signed document container with the signatures; do not rely solely on a screenshot of the document or a separate PDF file.

If you receive a .asice file or another digitally signed container from another company, open it in a trusted application and check both the signature validity indicator and the contents of the signed files. A signature does not automatically confirm that the signer had the right to represent the company.

ID.ee official guide: signing digitally in the DigiDoc4 app →

Who may sign or act on behalf of a company?

Here, it is important to distinguish between identity verification, e-service access rights, and representation rights. OÜ A board member’s right to represent the company derives from the law and the commercial register data; its scope and any joint representation rights must be checked separately. An accountant or assistant may have access to the company’s e-service, but this does not automatically give them the right to enter into arbitrary contracts on the company’s behalf.

Practical example: an accountant and e-MTA

A business owner needs an accountant to submit tax returns, but does not necessarily need to give them full access to every system. According to the Estonian Tax and Customs Board, e-MTA access rights are assigned to the legal representative on the basis of the commercial register and to other representatives on the basis of authorisation. Certain rights are granted automatically to a board member with sole representation rights; the procedure differs when representation rights are joint.

1. Log in to e-MTA and open Settings → Access rights → Representatives’ access rights.
2. Select the company and add an authorised person if you have the right to manage access rights.
3. Assign the accountant only the necessary sets of permissions or individual permissions, and, where possible, set an expiration date.
4. When the cooperation ends, check and revoke the permissions immediately. An E-MTA authorization may also include reading notices and communicating with a government authority.

Example: an accountant may have the right to submit TSD, but signing a larger supplier contract still requires a decision by a person authorized to do so or a valid power of representation.

Estonian Tax and Customs Board: granting and revoking access rights →

Which e-services does a small business owner need most often?

• e-MTA: tax returns, tax liabilities, the employment register, and access rights management.
• e-Business Register: company data, registry procedures and actions related to the annual report.
• Eesti.ee: state e-services, notifications and finding official information.
• ID.ee and DigiDoc: signing instructions, software and verification of digital signatures.

Each service decides within its own workflow whether logging in and confirming is sufficient or whether a separate document must be signed. The method of representation may also vary from one service to another.

What happened to DigiDoc4 in 2026 and whom does it affect?

1 January 2026 A failure in creating digital signatures occurred in some e-services. According to RIA, this affected, among other things, systems that used outdated DigiDoc4j library versions and had problems processing OCSP validity confirmations. The incident was resolved the same day.

An upcoming service failure in February was initially warned about as well. Later, SK ID Solutions decided to use longer RSA keys for OCSP certificates, so the warning about the February outage no longer applied. This did not remove the need to update the systems.

29 April 2026 implemented the technical change to the European trusted lists (TLv6), which required the administrators of signing and validation systems to ensure appropriate software support. 14 August 2026 DigiDoc4j version 6.2.0 was released. Therefore, it is not correct to call the version of 6.1.0 recommended in January the latest version for all of 2026.

Five common mistakes in digital administration

1. An outdated version of the document is signed

The file names “final_v2” and “final_latest” do not show which one is actually correct. Create one approved signing folder, check the attachments, and remove old working versions from use.

2. Excessive access permissions are granted

An accountant or partner may need access to just one task. Where possible, use restricted rights, time-limited authorizations, and regular access reviews.

3. Trusting an unexpected PIN2 request

If you did not initiate the action yourself, do not approve the request. Check the service name and verification code, because a digital signature may confirm a legally significant document or action.

4. Only a copy of the signed document is retained

To verify a digital signature, it is important to retain the original signature container and, if necessary, the evidence accompanying it—not just a screenshot or a printed file.

5. It is assumed that a digital document is automatically authentic

The electronic format of a document does not guarantee that the sender is genuine or that the bank details are correct. Be especially cautious about an unexpected invoice, a change of account details, or an urgent request to sign.

Checklist for small business owners

• Check which employees and partners have access rights to e-MTA and other services.
• Check who has the actual authority to represent the company and whether representation is joint.
• Keep one approved document version for signing.
• Check the validity of the digital signature and retain the original signature container.
• Use up-to-date applications and, if necessary, ask your IT partner for the library versions.
• Avoid sharing personal PIN codes and approving unfinished signature requests.
• Verify changed payment details on an invoice or contract through an independent channel.

FAQ: digital signatures and digital administration in Estonia

Is a digital signature the same as a handwritten signature?

Under the eIDAS Regulation, a qualified electronic signature is legally equivalent to a handwritten signature. Not all electronic signatures are automatically qualified.

Kas Smart-IDga saab dokumente allkirjastada?

Yes, with a suitable Smart-ID account and a compatible signing service. The level of the specific account and the signing solution used must be checked.

Does e-MTA access permission also grant the right to sign company contracts?

Not automatically. E-MTA access rights concern the use of the relevant e-services. To conclude contracts, you must have the necessary right of representation or authorization.

Can you give a digital signature on a phone?

Yes. In Estonia, you can use the RIA DigiDoc mobile application and a suitable ID-card or Mobiil-ID solution. The available options depend on the device and application.

What should I do if digital signing suddenly stops working?

Check official service announcements, that the application is up to date, and the instructions for the service being used. For the company’s own signing interface, contact the system administrator: the libraries used and signature validation must also be checked.

Is a qualified digital signature issued in Estonia recognized in other EU countries?

Yes, eIDAS provides for the mutual recognition of qualified signatures issued in the EU. However, technical acceptance of the document in a specific partner’s system may require a suitable file format and verification.

Summary

For a small business owner, digital administration works best when it is clear for every action what is being approved, who is authorized to do it, and how the validity of the result is verified. Use official e-services, grant only the necessary access permissions, retain properly signed documents, and ensure that technical integrations are kept up to date.

Sources and official guides

• European Union eIDAS Regulation, Article 25 – legal effect of electronic signatures
• European Commission: eSignature – Frequently Asked Questions
• ID.ee: guide to applying a digital signature
• Estonian Tax and Customs Board: access rights and authorizations
• RIA: Resolving the 1 January 2026 digital signing issue
• ID.ee: Clarification concerning the DigiDoc4j incident
• RIA: 2026. April trust list update
• ID.ee: DigiDoc4j versions and releases

The article is for informational purposes and does not replace legal advice. Artificial intelligence was used to prepare the article; the facts were checked against official sources as of 22.10.2026. For a specific action, always check the requirements of the relevant e-service.

These articles may also be of interest