Digital Signature and Certified Email (PEC) for Italian SMEs — Legal Obligations and How to Get Started

If you run an Italian SME and still rely on registered mail or simple email for contracts, you are exposing your business to legal and financial risks. Italian law requires the use of digital signature and PEC (certified email) for many official communications, from invoicing to public administration bids. At Meteora Web, we have seen companies lose time and money because they lacked the right tools. This guide explains what you need, what the law says, and how to implement them without breaking the bank.

What are digital signature and PEC and why does your SME need them?

PEC (Posta Elettronica Certificata) is an email system with legal validity: it provides receipts that prove sending and delivery, like a registered letter. Digital signature is a cryptographic system that guarantees authenticity, integrity, and non-repudiation of electronic documents. There are three levels: simple (SES), advanced (AES), and qualified (QES). For most official acts in Italy, a qualified digital signature (based on a certificate from an accredited provider) is mandatory.

Why Italian SMEs must adopt them: Since 2014, electronic invoicing to the public administration is compulsory; since 2019 it extends to B2B transactions. Without a digital signature, you cannot sign e-invoices (if you are a professional). Without PEC, you cannot receive notifications from the Tax Agency or INPS. Moreover, the Italian Digital Administration Code (CAD) requires every company with a VAT number to have an active PEC and register it with the Business Register. Non-compliance can lead to fines and even suspension of your VAT number.

What are the legal obligations for Italian SMEs regarding digital signature and PEC?

The key regulations are the Italian Digital Administration Code (D.Lgs. 82/2005) and the eIDAS Regulation (EU 910/2014). Here is what applies to an SME:

• PEC mandatory: Every company must communicate its PEC address to the Business Register within 30 days of registration. Failure can result in fines up to €2,000 and suspension of VAT number.
• Electronic invoicing: All invoices between VAT-registered entities must be issued in electronic format via the SDI system (Exchange System) and must be digitally signed.
• Digital preservation: Tax records must be stored digitally for 10 years with digital signature and time stamp.
• Public administration communications: Tenders, public contracts, and subsidy applications (e.g., PNRR funds) require digital signature and PEC.

Common mistake: Using a free PEC service (like some basic Aruba or Libero accounts). These often lack enough storage or compliance with conservation rules. Better to invest in a professional PEC (€10-20/year) from accredited providers like Aruba, Poste Italiane, or Register.

How to choose and activate digital signature and PEC?

For PEC: Choose an accredited provider. We recommend Aruba or Poste Italiane. Cost is about €5-10/year for a basic professional box. Ensure it offers at least 1GB storage and keeps messages for at least 30 months.

For digital signature: Two main options:

1. Smart card + reader: Traditional USB token with certificate. Requires a smart card reader. Costs €30-60/year. Risk: losing the token requires a new certificate.
2. Remote (cloud) signature: Certificate stored on secure servers; you sign via app or browser with PIN and OTP. More convenient, costs €20-40/year. We recommend this for multi-device users. Providers: Aruba Sign, PosteID firma, InfoCert, Namirial.

Step-by-step activation:

1. Choose an accredited provider (check AgID list).
2. Apply online, upload ID document, wait for verification (24-48h).
3. For remote signature, install the app (e.g., ArubaSign or Dike).
4. For smart card, install drivers and middleware (e.g., Bit4id).
5. Test signing a PDF using Adobe Acrobat or free tool PDF24. The signed file should show a blue ribbon with certificate data.

Integration note: If you use WordPress/WooCommerce, you don't need a digital signature for sales, but for e-invoicing you do. We have integrated plugins that send invoices to SDI with digital signature via APIs (e.g., Fatture in Cloud).

How much do they cost and how to manage them smoothly?

Costs are modest compared to fines:

• Professional PEC: €10-20/year per mailbox.
• Remote digital signature: €30-50/year per person.
• Smart card kit: €50-70/year.
• Time stamp: €20-30/year (for long-term preservation).

For a 3-person SME, total annual cost is under €200. Compare that to the cost of a single registered letter (€5) or a lost legal notice (fines starting from €1,500).

Daily management tips: Use a dedicated PEC inbox (do not mix with newsletter spam). Set up forwarding of important messages to your regular email (with filters). Keep a calendar for certificate renewal (usually valid 3 years). We once had a client who missed a PEC renewal and received a €1,500 fine for late INPS communication.

What to do now

Use this checklist to get compliant:

1. Check if you already have an active PEC registered with the Business Register. If not, activate a professional PEC and register it on impresa.italia.it.
2. Purchase a remote digital signature for yourself and your partners (we use Aruba Sign).
3. Integrate digital signature into your workflow: if you use accounting software, enable automatic signing of e-invoices.
4. Set up PEC backup and renewal alerts.
5. Train your staff to sign PDFs and verify signatures (using free AgID tools).

We have seen entrepreneurs save hours of paperwork and thousands in penalties just by activating these tools. For a broader view, read our Digital Transformation for Italian SMEs pillar guide. If you need help configuring digital signature in your invoicing or website, contact us — we work remotely across Italy from Sciacca, Sicily.