Electronic signature in Colombia: what makes it valid

A signature does not have to be ink to count. Colombia has recognised electronic signatures since 1999. What matters is how reliable the method is, and what you can prove afterwards.

Many teams still print, sign and scan out of habit or doubt. The rules are clearer than most people think, and the decisions that matter are about evidence and authority, not about paper.

What the law says

Ley 527 de 1999 gives legal effect to data messages and to digital signatures, and sets up the system of certification entities. Decreto 2364 de 2012 later regulated the electronic signature itself. Both follow the same idea: a signature can be made by technical means, as long as the method identifies the signer, shows their approval, and is reliable and appropriate for what the document is for.

The decree is deliberately neutral about technology. It names methods such as codes, passwords, biometric data and private cryptographic keys, and it lets the parties agree between themselves which method they accept.

Electronic, digital, certified: three terms people mix up

• Electronic signature. Any method that identifies the signer and shows intent: a one-time code, a password, a click after identity checks, biometric data or a cryptographic key.

• Digital signature. A signature built with cryptography and a certificate, which links the document to the signer and shows if the text was changed afterwards. Ley 527 lists the attributes it must have to carry the same force as a handwritten one.

• Certified signature. A digital signature whose certificate was issued by a certification entity accredited by ONAC, the national accreditation body. This is the strongest option, and it is what some counterparties ask for.

In practice most business contracts are signed with an electronic signature, and the strength of the method is chosen by the risk. A short NDA and a large financing agreement do not need the same one.

What evidence to keep

If a signature is ever challenged, the question will be whether you can show who signed, how they were identified, and that the text did not change. Keep:

• who signed, and how they were identified;

• the date and time of each step: sent, opened, signed;

• the exact document that was signed, and proof that it was not altered;

• the sequence of events around it, such as reminders and refusals.

This record matters more than a picture of a signature. A neat scrawl on a screen proves little; a complete trail proves a lot.

When a signature is not enough

Some acts need formalities that go beyond a signature. A transfer of real estate, for example, requires a public deed. If you are not sure whether a contract falls into that group, ask counsel before choosing the signing method.

Authority matters more than ink

A valid signature from someone who cannot bind the company is still a problem. Who may sign for a company comes from its certificate of existence and legal representation, its bylaws and any board approval for larger amounts. We cover that in Approvals with verified signing authority.

A checklist before you rely on a signing platform

• How does it identify each signer, and can you choose a stronger method for riskier contracts?

• Are certificates involved, and who issues them?

• What evidence does it keep, and for how long?

• Can you set the order of signers and send reminders?

• Can you export the signed file and the full trail, in a form you can keep without the platform?

• Where is the data stored, and who can see it?

How Colibit handles it

In Colibit, signing is always a person’s act. An agent never signs, and nothing is signed from a chat. The signature package is built only from the approved version of each document and goes to the signers in the right order: the other party’s signer first, then your company’s signatories. A signature platform carries out the signing, and what it reports is recorded in the contract’s history, with the signed file.

This article is general information, not legal advice.