Document management and digital signature: a complete guide to electronic documents, FES/FEA/FEQ and compliant preservation

1. What digital document management is and what it is for

Digital document management is the set of rules, processes and tools with which a company governs its documents in digital format. A document management system (DMS) holds together the files, the data that describe them (metadata), access permissions, versions, approval or signature flows and the log of operations. Its purpose is not just to store: it is to know which document is valid, who can see it, who must approve or sign it, when it expires and how it is preserved.

DMS and file sharing: the difference

A cloud storage service saves and shares files. A DMS adds governance: every document has a type, an owner, an access level and a history. In HR the difference emerges when you need to prove to whom a payslip was delivered, which version of a policy was in force or who signed a letter.

Benefits and risks to avoid

• A single place for each document, with a named owner.
• Permissions by role and document type, limited to what is necessary.
• Preservation and deletion rules decided beforehand, not afterwards.
• Risk: digitising the mess, that is, moving the same folders online without rules.
• Risk: believing that a DMS replaces compliant preservation, which is something else (see the differences).

In EcosAgile: EcosAgile Document & Signature provides an electronic document folder with document types and visibility rules, linked to electronic signature.

For the big picture of the digital transformation of HR functions, see the guide to the digitalisation of HR processes. The stages of a document are covered in the section on the life cycle.

2. Electronic document, dematerialisation, archiving and preservation: the differences

Dematerialising, archiving and preserving are different activities. Dematerialising means creating a document in digital format instead of on paper, or acquiring it in digital form; digitalising, in a broader sense, means using digital tools to carry out a process (see the guide to the digitalisation of HR processes). Archiving means ordering a document so that it can be found. Preserving in compliance with the rules means managing it with rules, metadata and a process designed to maintain its authenticity, integrity and readability over time. Backup, which serves to restore data after a failure, is none of the three.

Electronic document and digitised document

For the CAD (Article 1, Legislative Decree 82/2005, D.Lgs. 82/2005), an electronic document is the electronic document containing the computer representation of legally relevant acts, facts or data. It is born digital, for example a PDF generated from a template. A scanned sheet, by contrast, is an image copy of an analogue document: under Article 22 CAD it has the same evidentiary effect as the original if its conformity is not disowned. The conditions for the copy should be checked against the text currently in force.

Why preservation is not the same as backup

A PDF saved in the cloud is archived, not thereby preserved in compliance with the rules. Where the law requires a document to be preserved, Article 44(1-ter) CAD calls for a preservation system that ensures authenticity, integrity, reliability, readability and retrievability in accordance with the AgID Guidelines. These provide for submission, archiving and distribution packages. In the past the term used was "substitute preservation" (conservazione sostitutiva). Which documents must be preserved, and for how long, depends on the rule that applies to them.

Please note: the AgID Guidelines are Determination 407/2020 as amended by Determination 371/2021, mandatory since 1 January 2022. As of 3 November 2026 AgID has a working group to update them (DD no. 11/2026) and no new version appears to have been issued.

The case of expense receipts is covered in the guide to expense reports and business travel. The preservation process is described in the section on compliant digital preservation.

3. The life cycle of a digital document

A digital document needs to be governed throughout a life cycle: it is created or acquired, classified, made accessible to those entitled to it, approved and signed when necessary, archived, preserved for the required period and finally produced on request or disposed of according to the applicable rules. Each stage should leave a verifiable trace of who did what and when. Not all documents go through all the stages: it depends on the type of document and the rules that apply to it.

The eight stages and who is responsible for them

1. Creation or acquisition: HR or general administration generate the document from a template, or receive it.
2. Classification and metadata: type, person, date and owner are recorded.
3. Access and permissions: HR and IT decide who sees what.
4. Workflow and approval: managers validate the content.
5. Signature: the designated person signs, at the level chosen together with legal counsel (see signatures).
6. Archiving: the document enters the relevant file.
7. Preservation: for documents that require it, the preservation manager together with the provider.
8. Production or disposal: time limits depend on the rule governing the document; for personal data the "no longer than necessary" rule applies (Article 5(1)(e) GDPR).

Indicative roles. EcosAgile working model, not a standard.

Example, the hiring letter: HR generates it from a template (1) and classifies it (2); the manager approves it (4); the person signs it (5); the signed copy enters the file (6) and, if the company so decides, goes on to preservation (7).

In EcosAgile: the signed document can be saved in the person's folder, if the procedure template provides for it. Compliant preservation is an integrated service to be activated.

In-depth with the expert: in the eIDAS 2 and digital signature webinar (in Italian) (June 2026, 49 minutes) Alberto Sturniolo, Regulatory Specialist at Tinexta InfoCert, describes submission, preservation and production in the integrated service (from minute 37:39).

File and metadata are explored in more depth in the sections on the employee file and on search and metadata.

4. Digital employee file and HR documents

The digital employee file is the set of HR documents linked to a person and held in a single environment, with rules on who can see what. It replaces the paper binder and the shared folders: each document has a category, an owner and a defined visibility. To govern it, three things are decided: which documents go in, who can access them and how long they stay. The last one has no single answer.

Which documents it contains

EcosAgile working model, not a standard: the actual matrix is defined with HR, privacy and legal counsel.

Health records follow their own rules: they are handled by the company doctor (see privacy and health data). The offer and entry documents are covered in the onboarding process.

Visibility rules and self-service

The GDPR requires data to be relevant and limited to what is necessary (Article 5(1)(c)): visibility therefore follows the role, and a manager does not normally need their team's payslips. With self-service, employees consult their own documents from a reserved area (see People-Centric HR). For the documents that set up the employment relationship, Ministry of Labour ruling no. 2/2026, a non-binding opinion, requires identified and secure access and a tracked date of availability: see employment contracts and digital onboarding.

Retention: no single period

There is no single retention period for HR documents. The GDPR requires that identifiable data not be kept longer than necessary (Article 5(1)(e)) and that this can be demonstrated (Article 5(2)). A retention schedule is needed (the holding periods for each category of document, not to be confused with compliant digital preservation) by document type, approved by HR, privacy and legal counsel, with the review date recorded among the metadata. Archiving does not mean preserving in compliance with the rules.

In EcosAgile: the EcosAgile Document & Signature page describes an electronic document folder with document types and visibility rules. The signed document can be viewed by the employee in Employee Self Service, under My documents; the copy in the folder depends on the signature template.

5. Electronic signature, digital signature and identification: what changes

"Electronic signature" is the broader term: it covers the simple, advanced and qualified signature, defined by Article 3 of the eIDAS Regulation (EU 910/2014, points 10, 11 and 12). The Italian "digital signature" is a particular case: a qualified signature based on cryptographic keys (Article 1(s) CAD). The two expressions are therefore not synonyms. Identifying a person, for example with SPID or CIE, is a different operation from signing. Regulatory framework as of 3 November 2026.

Electronic signature and digital signature compared

Identification, certified email (PEC) and signing

Identifying means establishing who the person is; signing means affixing a signature to the document. Ministry of Labour ruling no. 2/2026 (30 September 2026, non-binding opinion) states that identification is not, in itself, equivalent to an electronic signature. Among the routes the ruling admits is identification, including with SPID or CIE, followed by an FEA, for example with a one-time code on a device under the signatory's exclusive control; the FEQ and the digital signature are also admitted. Certified email (PEC) attests sending and delivery (Article 48 CAD), not signing. The case of the contract is covered in employment contracts, SPID and CIE.

Evidentiary value and written form

With a digital signature, another FEQ or an FEA, the electronic document satisfies the written-form requirement and has the effect of Article 2702 of the Civil Code (Article 20(1-bis) CAD). In other cases, such as the FES, suitability and value can be freely assessed in court, according to security, integrity and unalterability. The effect cannot, however, be denied merely because the signature is electronic (Article 25(1) eIDAS). For some deeds the law indicates the minimum level: see which signature to choose. Texts: consolidated eIDAS and ruling no. 2/2026.

6. FES, FEA and FEQ: which signature to choose

FES, FEA and FEQ are not interchangeable: the choice depends on the document, the proof needed and the risk of the process. There is no rule valid for all HR contracts. According to the speaker at the Tinexta InfoCert webinar, no rule imposes a signature level on the types of HR document; legal constraints concern the deeds for which a minimum level is indicated (Article 21(2-bis) CAD). The table below is a starting point to discuss with legal counsel, not a rule. References updated to 3 November 2026.

Three questions before choosing

1. Does the law prescribe a form? For the private agreements (scritture private) of Article 1350 of the Civil Code, first paragraph, nos. 1 to 12, made as an electronic document, an FEQ or digital signature is required on pain of nullity, unless the signature is authenticated; for the deeds of no. 13 an FEA is also sufficient (Article 21(2-bis) CAD).
2. How much proof is needed? With the FEQ, use of the device is presumed to be attributable to the holder, who must prove otherwise in order to disown the signature (Article 20(1-ter) CAD). According to the speaker, with the FEA there is no such presumption: the evidence is provided by the signature service provider.
3. How much weight does the document carry with third parties, in a dispute or an inspection?

In-depth with the expert: in the eIDAS 2 and digital signature (in Italian) webinar (June 2026, 49 minutes) Alberto Sturniolo, Regulatory Specialist at Tinexta InfoCert, states at minute 08:04 that the choice rests with the customer according to the level of trust wanted; for contracts and hiring letters he suggests FEA or FEQ (minute 43:19). This is the speaker's position, not a rule.

When you need legal counsel

• The deed is among those of Article 1350 of the Civil Code.
• An internal company rule imposes a level.
• The document might be produced in court or at an inspection.

In EcosAgile: in EcosAgile Document & Signature the signature level (simple, advanced or qualified) is set in the procedure template and signing is done from a smartphone using the link received by email. For the FEQ, the qualified signature must be activated on the customer's account.

7. eIDAS 2 and European digital identity

eIDAS 2 is Regulation (EU) 2024/1183, which amends Regulation (EU) No 910/2014 (eIDAS) on digital identity and trust services. For companies it does not create a "new signature": it updates the common rules on identification, certificates and signatures and adds new trust services, such as qualified electronic archiving. It has been in force since 20 May 2024, but many operational rules depend on implementing acts with their own dates. Framework updated to 3 November 2026.

The European Digital Identity Wallet

Article 5a ("Article 5 bis" in the Italian text) provides that each Member State must make at least one European Digital Identity Wallet available within 24 months of the entry into force of the relevant implementing acts. The implementing acts, including Implementing Regulation (EU) 2024/2977, have been in force since 24 December 2024: the deadline for Member States is therefore 24 December 2026. For HR it is a topic to monitor; the effect of national implementing rules should be checked with legal counsel.

Qualified signatures and definitions

A qualified electronic signature based on a qualified certificate issued in one Member State is recognised as qualified in the others (Article 24a(1)). The qualified signature has an effect equivalent to a handwritten signature (Article 25(2)). The definitions of electronic, advanced and qualified signature are in Article 3 eIDAS, no longer in the CAD.

Regulation 2025/1566 and qualified archiving

Implementing Regulation (EU) 2025/1566 lays down the rules for verifying the identity of whoever receives a qualified certificate and applies from 19 August 2027. It concerns identification for the issuing of certificates, not signatures in general or preservation. Qualified electronic archiving (Article 45j), by contrast, is the service of receiving, storing, retrieving and deleting electronic data: nothing indicates that it equates to Italian compliant preservation, which remains governed by the CAD and the AgID Guidelines. AgID has set up a working group to update them (Determination of the Director General no. 11/2026), ongoing as of 3 November 2026.

In-depth with the expert: in the eIDAS 2 and digital signature (in Italian) webinar (June 2026, 49 minutes), at minute 01:07, Alberto Sturniolo, Regulatory Specialist at Tinexta InfoCert, explains that eIDAS 2 updates trust services and makes compliant preservation (e-archiving) a trust service. This is the speaker's position, not the text of the law. Official texts: Reg. 2024/1183, Reg. 2025/1566.

8. Employment contracts, SPID/CIE and digital onboarding

In digital hiring, two moments need to be distinguished: making a document available to the employee and having the employee sign it. SPID and CIE identify whoever logs in; Ministry of Labour ruling (Interpello) no. 2/2026 (30 September 2026) specifies that identification is not, in itself, equivalent to affixing an electronic signature. For the employee's declarations, a digital signature, a qualified or advanced signature, or a document formed in accordance with Article 20(1-bis) CAD is required. The ruling is an opinion, not a binding rule.

Identification and signing compared

Delivering is not having the document signed

A document that involves no completion or declaratory activity by the employee can be placed in a reserved area accessible only to them. This requires identification and secure access, integrity, and tracking of the date it was made available and, if requested, of acknowledgement.

Example: a policy requiring only acknowledgement is placed in the reserved area, tracking the date and the acknowledgement. The individual contract expresses an intent and goes through a signature.

Which signature for the contract

The choice depends on the document and should be assessed with legal counsel: Article 1 of Legislative Decree 152/1997 (D.Lgs. 152/1997) requires information in writing and proof of transmission to, or receipt by, the employee.

In-depth with the expert: in the eIDAS 2 and digital signature (in Italian) webinar, at minute 43:19, Alberto Sturniolo (Tinexta InfoCert) observes that there is no regulatory prescription for contracts and hiring letters. He suggests the advanced or qualified signature, because they presuppose identification: a suggestion by the speaker, not an obligation.

Evidence to keep in onboarding

According to ruling no. 2/2026 (non-binding opinion), in an inspection the employer will have to be able to demonstrate compliance, and temporary unavailability of the platform does not exempt it from meeting the deadlines.

• Date made available and, if requested, acknowledgement.
• Identification of whoever accesses and whoever signs.
• Signed document with the signature evidence.
• An alternative method of delivery.

Selection, offer and hiring are covered in the guide Recruiting, offer and onboarding; the signature flow in the section Signature workflow.

In EcosAgile: the advanced electronic signature, from a smartphone, involves uploading the identity document, facial recognition and a one-time code by SMS. In a sequential procedure the candidate can sign first, then the recruiting manager.

9. Electronic signature workflow

A signature workflow establishes who signs, in what order, at what signature level, by what deadline and with what evidence. It can be single, sequential, parallel, group, multiple or bulk, and can involve internal and external signatories, with deadlines, reminders and audit. The choice depends on the document, the signature level and the process, not on a single rule.

The modes and the terms

External signatories

Candidates, contractors and consultants are not in the staff records. The flow must clarify how their contact details are collected, how they are identified, depending on the signature level, and where the signed document ends up.

Deadlines, reminders and audit

A deadline stops the procedure from stalling, and an automatic reminder prompts those who have not signed to do so. The audit records who signed, when, with what outcome and any anomalies: it can serve as evidence in a dispute or inspection, to be kept together with the signed document. See also security, privacy and audit trail.

In-depth with the expert: in the eIDAS 2 and digital signature (in Italian) webinar (June 2026) the EcosAgile speaker shows the signature procedures (in Italian) (26:41), the group signature (in Italian) (31:12) and the bulk signature (in Italian) (35:00). He also notes that, if the document has a deadline, the system sends automatic reminders.

In EcosAgile: in EcosAgile Document & Signature the signature level (simple, advanced or qualified), sequential or simultaneous sending and the copy of the signed document in the person's folder (if provided for) are set in the procedure template. Signatories can be internal or external, the procedure has a deadline and a "Procedure audit" tab with the event log. Group signature creates a procedure for each member of the group. To see it in action you can request a demo.

10. Templates, letters and automatic document generation

Automatic generation starts from a template: an approved text in which the variable fields, called placeholders, are replaced with data already in the system. The document produced is checked in preview, can be sent for signature and ends up in the person's file. This reduces copy and paste, transcription errors and uncontrolled versions of the same letter.

An example of a letter from a template

A pay-change letter has a fixed text and a few fields: name, job title, effective date, new amount. The system reads the fields from the employee records, HR checks the result and sends the letter for signature, without rewriting the text for each person.

What to check before sending

• A single approved template for each type of letter, with an owner and the date of the last review, to avoid local copies.
• The preview of the completed document, to catch missing or wrong data.
• The position of the signature in the document, with a placeholder for each signatory.
• The destination of the signed document: the person's folder, not a shared folder.

The single-template rule is an EcosAgile working model, not a standard.

In EcosAgile: letters are produced from preconfigured templates, in Word or PDF, with the data present in the platform. Each letter produced remains in a letter archive, searchable by name or by person. For signing, a placeholder for each signatory is inserted in the PDF. The signed document can be copied into the person's folder, if the signature procedure provides for it. The demo of letters from templates (in Italian) is in a webinar recorded in 2024: for current features, ask EcosAgile.

For offer and hiring letters see offer, electronic signature and onboarding; for letters on the handover of assets, Assets & Benefits. The signature level is chosen as explained in the section FES, FEA and FEQ.

11. Compliant digital preservation and e-archiving

Compliant digital preservation is a process distinct from operational archiving. It serves to maintain the authenticity, integrity, readability and retrievability of electronic documents over time, in accordance with Article 44 of the CAD and the AgID Guidelines. The archive is for working every day. Preservation is for demonstrating, even years later, that the document is the original and can still be read. Backup restores data after a failure and is not preservation.

Packages, metadata and manager

The AgID Guidelines (Determination 407/2020, as amended by Determination 371/2021, mandatory since 1 January 2022) provide for three information packages: submission, archiving and distribution. Every unalterable electronic document receives metadata at the time of its formation, defined in Annex 5: the mandatory fields include the unique and persistent identifier (a code calculated from the content of the file, called a hash), the document type, the author and the subject.

The preservation system has a preservation manager, who may entrust the service to a provider (Article 44(1-quater) CAD). If the service is entrusted to a provider, it is advisable to set out in writing which tasks remain in the company.

Please note: eIDAS 2 introduces the electronic archiving trust service, with requirements for the qualified service in Article 45j of Reg. (EU) 910/2014: receipt, storage, retrieval and deletion of data. It should not be read as equivalent to Italian compliant preservation: the question should be assessed with legal counsel. As of 3 November 2026 no new version of the Guidelines appears to have been issued; an AgID working group (Determination of the Director General no. 11/2026) is working on updating them.

In-depth with the expert: in the eIDAS 2 and digital signature webinar (in Italian) (June 2026, 49 minutes, from minute 37:39) Alberto Sturniolo, Regulatory Specialist at Tinexta InfoCert, maintains that with eIDAS 2 compliant preservation becomes a trust service with common European rules, and that the framework changes compared with the AgID Guidelines alone. This is the speaker's position, not a rule. The relationship between this trust service and Italian preservation is not clarified by the official sources consulted; as of 3 November 2026 the AgID Guidelines remain the Italian reference.

In EcosAgile: the integrated compliant preservation service (details in the product section) must be activated as a separate service: it is not automatically included in the signature. According to the webinar, if it is activated together with the signature, signed documents flow into an environment dedicated to the customer, from which they can be produced.

Expense receipts have their own tax rules: they are covered in dematerialisation and preservation of the expense report. For choosing a provider see how to choose software.

12. Security, privacy and audit trail

HR document management rests on least privilege: each role sees only the documents needed for its task, every access and every change is tracked, and the retention period is defined by category. Technical measures, such as encryption, serve these rules and do not replace them. The GDPR requires data to be limited to what is necessary (Article 5(1)(c)) and the ability to demonstrate compliance with the principles (Article 5(2)).

Roles and documents matrix

Example to adapt to the company's roles. EcosAgile working model, not a standard.

IT configures the profiles but does not need to read the contents. Occupational medicine documents follow their own rules, described in health privacy.

Retention and audit trail

There is no single retention period for HR documents. A retention schedule (holding periods) is built by category, with four items (the principle is Article 5(1)(e) GDPR):

• the document category;
• the rule that sets the period, checked with the labour consultant;
• the person responsible for the document;
• the action at the end of the period: deletion or justified extension.

The audit trail is the chronological log of who did what: access, download, change, signature. It answers the question "who downloaded this document?". If the log can also result in remote monitoring of workers, Article 4 of the Workers' Statute (Statuto dei lavoratori, Law 300/1970) must be considered: a union agreement or authorisation for certain tools, and adequate information on how the tools are used and on the checks carried out. Whether the log falls within the exclusions in paragraph 2 must be decided case by case, with legal counsel.

In EcosAgile: every signature procedure has an audit tab with the log of the signature service's events. Document types have visibility rules. For auditing of access and downloads and for security measures, ask EcosAgile for the current scope. The general framework is in security, privacy and governance.

13. Search, metadata, versions and deadlines

An HR document is found quickly when it has consistent metadata: which employee it refers to, what category it is, from when it applies, who is responsible for it and when it expires. Search by keyword or within the text of the document helps, but it only works on top of a shared classification. Versions indicate the valid copy, the deadline register flags what needs renewing. Search must respect the document's permissions: whoever cannot open a document should not even see it among the results (security and privacy).

HR metadata: an example

Metadata are the data that describe the document. For electronic documents the AgID Guidelines require them to be generated and associated with the document at the time of its formation; the mandatory fields are in Annex 5. The company adds the fields useful for HR management.

Example with invented data: the deadlines do not indicate periods set by rules.

Valid version and history

For each document there is only one valid version. The earlier ones remain as history, with date, author and reason for the change. A document that has already been signed is not normally modified: the company decides, with legal counsel, whether to issue a new version or an addendum and have them signed again (signature workflow).

Document deadlines: a good practice

The deadline register is a list of dates, each with an owner and an advance notice, for example at 60 and 30 days (a company choice). It is used for certificates, fixed-term contracts, smart working agreements and policies to be reviewed. There is no single period: it depends on the document, the rule or the internal policy and should be defined with legal counsel.

14. Integration with HRMS, Payroll, Recruiting, Talent and Expense

A document system is worth more when it is not an isolated archive. Documents should originate from the processes that generate them and return to the employee file once the process is complete. In this way the employee records remain a single set, the signature starts with data that is already correct and the result is archived without downloading and renaming files by hand. The reference point is the HRMS, the system that holds employee records and organisation: the other processes use its data.

What passes from one process to another

General EcosAgile diagram, not a customer's configuration.

Before connecting

For each item of data you decide which system it originates from, who corrects it, in which direction it travels and how often it is updated. The channel (API, structured files, single access) is chosen afterwards. This is a question to put to the provider, together with which system acts as the source of the employee records: the general framework is in the guide on cloud HR, integrations and architecture.

Boundaries with the other guides

• Recruiting: offer, signature and transfer to the file are covered in the guide offer, electronic signature and onboarding.
• Talent: appraisals are covered in the guide performance appraisal.
• Expense: the tax case is covered in the guide digital expense report and preservation.

In EcosAgile: the signature is found in the People module, alongside the employee records; according to the June 2026 webinar (in Italian) employee records, templates and the file feed the procedure. The same webinar lists, among the processes with an impact on documents (in Italian), the candidate's consent with remote signature, onboarding (contracts and assignment letters) and 360-degree appraisal, which requires signatures in sequence. For payslips, the 2024 webinar (in Italian) describes bulk upload with notification to the person, not a link with payroll calculation. These are examples of use of EcosAgile Document & Signature, not integrations described one by one.

15. AI, OCR and document automation

OCR and document AI read, classify and suggest, but they do not make a file compliant or preserve it in compliance with the rules. OCR turns the image of a scan into text. AI can propose a category, extract dates and amounts, and help with search. Compliant digital preservation is a different process. With HR data, every proposal by the machine should be checked by a person.

Three functions not to be confused

Use cases and controls

• Use cases: acquiring scanned documents, suggesting metadata, searching by meaning, flagging duplicates.
• Risks: reading errors that propagate, personal data sent to external services, permissions wrongly applied to results.
• Controls: fields to confirm, spot checks, log of operations. For OCR on expense receipts see the guide on expense reports; for AI in HR processes the guide on digitalisation.

Privacy and the AI Act

The GDPR requires data to be limited to what is necessary (Article 5(1)(c)) and security measures appropriate to the risk (Article 32). Annex III, point 4, of Regulation (EU) 2024/1689 includes systems for selecting people or deciding on working conditions. OCR or classification of HR documents does not fall within it in itself, but may do so if used for those purposes. Article 6(3) provides for exemptions for procedural or preparatory tasks, not for profiling. As of 3 November 2026, following Reg. (EU) 2026/1744, the obligations for the high-risk systems of Annex III apply from 2 December 2027. The assessment depends on the case: it should be made with legal counsel.

16. KPIs and governance of document management

Document management KPIs measure two things: how efficient the process is (times, rework, share of digital) and how well it is under control (deadlines, versions, access). Each indicator has a written formula, an owner who answers for the data and a reading frequency. Without these three elements the number guides no decision and only serves to show that the software is being used.

Nine document KPIs: formula, owner, frequency

EcosAgile working model, not a standard. Targets are set after measuring the starting situation.

Governance: who reads the numbers

A document process manager collects the indicators, discusses them with HR, legal, IT and privacy and proposes corrections. The data come from the system logs: sending and signing dates, procedure statuses, audit trail. Before analysing access, Article 4 of the Workers' Statute (Law 300/1970) should be assessed with legal counsel case by case.

17. How to migrate from paper, email and shared folders

An HR archive is migrated to digital starting from an inventory: which documents exist, where they are, who uses them, which version is valid and for how long they must remain available. Only then are classification, metadata, permissions and preservation rules defined, and the material moved, one category at a time. Digitising the mess without redesigning the rules simply moves the problem somewhere else.

The six phases

1. Inventory. Paper documents, email attachments and shared folders are listed, with owner, location and use.
2. Classification and retention. Each type receives a category, metadata and a retention period. No source indicates a single period for HR documents: it is defined with legal counsel, type by type. What no longer needs to be kept is not migrated (Article 5(1)(e) GDPR).
3. Permissions. They are assigned by role, starting from the minimum necessary (security and privacy).
4. Acquisition. Email attachments are saved in the right file and do not stay in the mailbox. Paper becomes an image copy (Article 22 CAD). Before destroying an original, check with legal counsel whether the copy is sufficient for that document.
5. Pilot. A single category, for example smart working agreements, with real users and a success criterion measured with the KPIs.
6. Extension and change. Training, communication and a switch-off date for the old channels, as in the HR digitalisation roadmap.

Checklist before closing the old repositories

• Each type has an owner and a single place of reference.
• The valid version is identified and duplicates in email and folders have been recorded.
• Documents with a deadline have the date recorded.
• Permissions are by role and tested with a test user.
• A spot check confirms that nothing has been left out.
• The old repository goes read-only, then is closed and deleted according to the agreed timing.

18. How to choose document management and signature software

The choice starts from the document life cycle and the company's risks, not from the list of features. If only a few documents need to be signed, a standalone signature tool may be enough. If HR documents also need to be classified, protected, retrieved, tracked against deadlines and preserved, you need a document management system with integrated signature. The fifteen criteria follow the life cycle in this guide; for each there is a test to see in a demo on one of the company's own cases.

EcosAgile working model, not a standard. No scores.

In EcosAgile: in EcosAgile Document & Signature the signature level is set in the procedure template, which can also go to external signatories. The signed document can return to the employee's folder, every procedure has its own audit and compliant preservation is an integrated service to be activated. The tests can be seen in a demo.

20. Frequently asked questions