E-Signature Compliance: ESIGN Act and UETA Requirements Explained

PolicyTrak › E-Signature Compliance: ESIGN Act and UETA Requirements Explained
Legal Framework Guide

E-Signature Compliance: ESIGN Act and UETA Requirements Explained

Electronic signatures on policy acknowledgments, contracts and consent forms are given legal effect in the United States by the federal ESIGN Act and, at state level, by the Uniform Electronic Transactions Act. This guide sets out what those statutes say, the record-keeping that supports an electronic signature if it is ever questioned, the document categories the statutes exclude, and how PolicyTrak handles policy versions and acknowledgments. It is a description of the law, not advice on how it applies to your organization.

Sign Up for Free → Read the Guide ↓
⚡ Key Takeaway

The federal ESIGN Act (15 U.S.C. §7001 et seq.) provides that a signature or record may not be denied legal effect solely because it is in electronic form. The Uniform Electronic Transactions Act, a model act published by the Uniform Law Commission, provides the state-level framework and has been adopted by nearly every state — New York is an exception and applies its own Electronic Signatures and Records Act. Both statutes attach conditions: intent to sign, consent to transact electronically, attribution to a signer, association with the record signed, and retention in a reproducible form. How those conditions are satisfied in any particular case is a question for counsel, not for a software vendor. This guide describes what the statutes say and what records a platform can capture.

Sources: 15 U.S.C. §7001 (ESIGN Act) · Uniform Law Commission — Uniform Electronic Transactions Act · New York State Technology Law, Article III (ESRA). Verified September 2026.

What ESIGN and UETA Say

The Electronic Signatures in Global and National Commerce Act (ESIGN Act), enacted in 2000 and codified at 15 U.S.C. §7001, addresses the legal status of electronic signatures and records in interstate and foreign commerce. Its central provision is that a signature, contract or other record relating to such a transaction may not be denied legal effect, validity or enforceability solely because it is in electronic form.

The Uniform Electronic Transactions Act (UETA) is a model act published by the Uniform Law Commission in 1999. It is not federal law. Individual states adopt it, and 49 have done so in some form; New York did not adopt UETA and instead applies its own Electronic Signatures and Records Act. Because adoption is state by state, the text and its exceptions vary, and the applicable version is the one enacted in the relevant state.

The two operate together. ESIGN sets a federal floor and, broadly, gives way to a state’s UETA where that state has adopted the uniform act without material variation. For common business records — employment policy acknowledgments, handbooks, vendor contracts, terms of service, internal SOPs, training completions — both statutes contemplate electronic signature and electronic retention.

Where an electronic signature is disputed, the question is ordinarily evidentiary rather than statutory: the party relying on the signature has to establish that the person said to have signed did in fact sign, and that the record has not changed since. That is what the record-keeping described below is for.

What the Statutes Require

The conditions below are drawn from the text of ESIGN and the uniform text of UETA. How any of them is met in a given implementation, in a given state, on a given document, is a legal question specific to those facts.

  1. 1

    Intent to sign

    ESIGN defines an electronic signature as a sound, symbol or process attached to or logically associated with a record and executed or adopted by a person with the intent to sign the record. Intent is therefore part of the statutory definition rather than a separate test, and what evidences it in a particular signing flow is a question of fact.

  2. 2

    Consent to transact electronically

    ESIGN’s consumer provisions at §7001(c) set out specific consent requirements where a statute otherwise requires information to be provided in writing to a consumer. In an employment context, consent is commonly addressed in onboarding documentation. Whether a particular consent record satisfies the statute is a question for counsel.

  3. 3

    Attribution to a signer

    UETA §9 provides that an electronic signature is attributable to a person if it was the act of that person, and that this may be shown in any manner, including by reference to the security procedures used. Attribution is thus established by evidence rather than by any prescribed method.

  4. 4

    Association with the record

    Both statutes require the signature to be attached to, or logically associated with, the record signed. Where a document exists in successive versions, the practical question in a dispute is which version the signature was associated with.

  5. 5

    Retention and reproducibility

    ESIGN §7001(d) addresses retention: an electronic record satisfies a retention requirement if it accurately reflects the information in the record and remains accessible to those entitled to it, in a form capable of accurate reproduction.

The Records That Support an Electronic Signature

Neither statute prescribes what a platform must capture. The items below are the ones commonly relied on as evidence when a signature is questioned, and are described here as record types rather than as legal requirements.

Timestamp

Date and time of signature. A server-side timestamp is not set by the signer’s own device.

IP address

The address the signature was submitted from, which together with the timestamp gives network and approximate location context.

Device information

The user agent string identifying browser and device type.

Authentication method

How the signer’s identity was verified before signing — for example, an authenticated session or a one-time code.

Document reference

An identifier for the exact record signed, so the text presented at the time can be retrieved afterwards.

Audit trail

A log linking the signature to the steps in the signing flow, so the sequence can be reconstructed.

Documents ESIGN and UETA Exclude

Both statutes carve out categories of document. An electronic signature on an excluded document may not have the effect the statute would otherwise give it, whatever platform produced it.

ESIGN §7003 excludes wills, codicils and testamentary trusts; matters governed by state law relating to adoption, divorce and other family law; court orders, notices and official court documents; notices of cancellation or termination of utility services; notices of default, repossession, foreclosure or eviction in respect of a primary residence; notices of cancellation or termination of health or life insurance benefits; product recall notices affecting health or safety; and documents required to accompany the transportation of hazardous materials. State enactments of UETA carry their own exclusions, which vary.

For the business records most organizations handle day to day, these exclusions rarely arise. They are worth knowing about before an electronic signature is used on anything unusual.

Source: 15 U.S.C. §7003 — Specific exceptions. Verified September 2026.

Document Control in PolicyTrak

PolicyTrak is a policy and SOP management platform, not a legal service, and the section above describes an evidentiary standard rather than a product. Set against that standard, what PolicyTrak does well is document control: keeping the text of every policy, every revision to it, and the record of who has acknowledged it. What any of that establishes in a particular dispute is a matter for counsel.

Every version is retained

Each revision is stored as a numbered version with the name of the person who made it and the date and time it was saved. Nothing is overwritten.

Earlier text stays retrievable

Any previous version can be opened and read in full, so the wording that was in force on a given date does not have to be reconstructed from memory.

Versions can be compared side by side

Two versions display in parallel, which makes it possible to show exactly what changed between them rather than asserting that something did.

Changes are logged by type

The audit log records each change to a policy with its timestamp and the field that changed — the content, the delivery method, the status.

An explicit acknowledgment action

The employee previews the document and then signs, as a distinct act rather than as a by-product of navigating away from it. The acknowledgment is recorded with the date and time.

Outstanding items are visible

Who has acknowledged and who has not is shown per policy and per location, so the gap between distribution and completion is not invisible.

PolicyTrak records the date and time of each acknowledgment and logs IP and device info, but its documentation does not state that an acknowledgment references the specific version displayed at signing, and it does not describe a signed acknowledgment certificate. Organizations whose retention or evidentiary requirements call for those should raise them with us before relying on the record for that purpose.

Keep Your Policy Text Under Control

PolicyTrak retains every version of every policy with its author and date, shows what changed between any two of them, and tracks who has acknowledged each policy across every location.

Sign Up for Free → Book a Demo

Policy acknowledgment tracking

The hub page: how acknowledgment records are captured, tracked and exported.

Tracking acknowledgments across a workforce

Who signed, when, and what is still outstanding across every location.

Testing whether employees understand a policy

Acknowledgment proves receipt, not comprehension. How to check the difference.

When an employee declines to sign

What the record can capture, and which questions belong with counsel.

Frequently Asked Questions

Is a typed name in a form field an electronic signature?
It can be. ESIGN defines an electronic signature as a sound, symbol or process attached to or logically associated with a record and executed or adopted with intent to sign — it does not prescribe a particular method, so a typed name, a drawn signature and a click can all fall within the definition. What differs between them is not the definition but the evidence available afterwards: whether the person who typed the name can be identified, whether the record they saw can be retrieved, and whether the surrounding log is intact. Two implementations using the same signature method can leave very different evidentiary positions. Whether any given implementation is adequate for a particular document is a question for counsel.
Does ESIGN require multi-factor authentication?
No. Neither ESIGN nor UETA prescribes an authentication method. UETA §9 provides that attribution may be shown in any manner, including by reference to the security procedures used — which leaves the choice of procedure to the parties and the assessment of its sufficiency to the tribunal. Stronger authentication produces stronger evidence of attribution, and organizations commonly match authentication strength to the significance of the document, but that is a risk judgment rather than a statutory requirement.
What happens if an employee says they never signed?
The party relying on the signature generally bears the burden of establishing that it was the act of the person said to have signed. Under UETA §9 that may be shown in any manner, including by reference to the security procedures in use at the time. In practice the evidence is the record around the signature: how the signer was authenticated, when the signature was submitted, from where, and which version of the document was presented. A record with those elements intact is easier to stand behind than one without them. How a particular dispute resolves depends on its own facts and should be discussed with counsel.
Do employees outside the United States need different handling?
Possibly. ESIGN and UETA govern transactions in the United States. Other jurisdictions have their own frameworks — the EU’s eIDAS Regulation, the UK’s Electronic Communications Act 2000, Canada’s PIPEDA and equivalents elsewhere — and their requirements differ, particularly around identity verification and the categories of signature they recognize. Organizations signing across borders should establish which framework applies to each signer and take advice on it. We do not assert compliance with frameworks outside the United States.
How long should acknowledgment records be kept?
It depends on the document, the industry and the jurisdiction, and the applicable period is worth confirming with counsel rather than assuming. As illustrations of the range: the HIPAA Privacy Rule requires certain documentation to be retained for six years from creation or from the date it was last in effect (45 CFR §164.530(j)); OSHA requires employee exposure records to be kept for at least thirty years, and employee medical records for the duration of employment plus thirty years (29 CFR §1910.1020(d)(1)). Employment-related acknowledgments are commonly kept for the duration of employment plus the limitation period for employment claims, which varies by state. Because storage is inexpensive relative to the cost of being unable to produce a record, many organizations simply retain them.
Are electronic signatures admissible in court?
Electronic records are not excluded from evidence for being electronic. ESIGN provides that a record may not be denied legal effect solely because it is in electronic form, and electronic records are authenticated under the ordinary rules — in federal proceedings, Federal Rules of Evidence 901 and 902. Admissibility is a separate question from weight: what an electronic signature is worth as evidence depends on what can be shown about how it was made and whether the record has changed since. Questions about a specific matter belong with counsel.
⚠️
Legal & Compliance Disclaimer This page describes what the ESIGN Act and UETA say. It is general information only and is not legal, HR or compliance advice. Electronic transactions law varies by jurisdiction and by document type, and UETA in particular is adopted state by state with local variation. Nothing here determines whether a given signature, implementation or document satisfies any legal requirement — that assessment depends on your own facts and belongs with qualified legal counsel. PolicyTrak is a software platform, not a law firm.