AES or QES?

Under EU law (eIDAS) there are three levels of electronic signature:

• SES (simple)

  any electronic mark, even a pasted picture. Easy, but weak proof of who signed. This is what "image" mode produces — no legal value.

• AES (advanced)

  uniquely tied to one signer and to the exact document; any later change is detectable. This is "azure" mode.

• QES (qualified)

  an AES made with a certified device and a face-to-face-verified identity. By law it is equal to a handwritten signature. This is "beid" (eID card) mode.

QES — eID card (beid)

• Pros — the strongest level; legally equal to a handwritten signature; accepted by any third party with no prior agreement.
• Cons — needs a card reader and your card; you type your PIN ONCE PER DOCUMENT (slow for big batches); your national register number (RRN) is embedded in every file.

AES — Azure Key Vault (azure)

• Pros — ONE login per batch, so fast for many files; no card or reader; no RRN exposure.
• Cons — not "qualified"; trust relies on your organisation's internal CA, so outside parties may not recognise it automatically.

Which one should I choose?

• Internal documents, or large batches — use azure (AES). One login signs the whole batch.
• Documents leaving the organisation, or where a handwritten-equivalent signature is required: use beid (QES), accepting one PIN per document.
• No card or reader available — azure is your only cryptographic option.