What is BS 10008? Proving electronic records hold up

A customer disputes a loan agreement they signed online three years ago. They say it wasn't them. Your team finds the PDF, the signature and the onboarding file.

Then legal asks the harder question: can you prove who signed it, that the identity check was sound, and that nothing has changed since? BS 10008 exists to answer exactly that.

The pressure behind it is growing. According to Cifas (2026), more than 444,000 cases were recorded to the UK National Fraud Database in 2025, a record year, and 72% of them were linked to identity fraud and facility takeover.

Every one of those cases produces a signed record, an identity check or a disputed transaction someone has to defend.

This guide explains what BS 10008 is, how it treats electronic identity verification and electronically stored information (ESI), and what your information management system needs to do so your records carry real evidential weight.

Key takeaways

• BS 10008 is the British Standard for the evidential weight and legal admissibility of electronically stored information (ESI)
• Electronic signatures are legal in the UK and admissible as evidence, but the court decides how much weight they carry
• BS 10008 covers electronic identity verification, including e-signatures and linking an identity to a specific document
• Certification applies to your organisation's information management system, so software alone can't make you compliant
• The strongest evidence comes from records that are captured, signed, stored and audited on one governed platform

What is BS 10008?

BS 10008 is a British Standard, published by BSI, that specifies how an organisation should manage electronically stored information (ESI) so it is trustworthy and carries strong evidential weight. It sets the controls that let you prove a record's authenticity, integrity and signer identity whenever it is challenged.

Are electronic signatures legal? Yes, and that's the easy part

Are electronic signatures legal in the UK? Yes. Your e-signed contracts will get into court, but BS 10008 makes them credible and verifiable.

Section 7 of the Electronic Communications Act 2000 makes an electronic signature, and its certification, admissible as evidence on the authenticity or integrity of the data it relates to. UK eIDAS adds that a signature can't be denied legal effect simply because it is electronic.

The explanatory notes to the Act are clear on the catch: the court decides whether a signature was used correctly and how much weight to give it against other evidence. So the fight moves to your records.

Opposing counsel won't argue the signature is inadmissible. They'll argue your system can't show it wasn't altered, that the signer's identity was never properly verified, or that your audit trail has gaps.

That's where most enterprises are weakest. Signed documents sit in one system, identity checks in another, and the audit log in a third, if logging was switched on at all.

How BS 10008 works

BS 10008 treats evidential weight as the result of a managed system, run consistently over the whole life of a record. The standard comes in two parts.

BS 10008-1: the specification

BS 10008-1 sets out the requirements for managing ESI in an information management system so that it is demonstrably authentic and intact throughout its lifecycle, whether it is used for business, compliance or dispute resolution. This is the part your organisation is assessed and certified against.

BSI's stated benefit is practical. When your system conforms, disputes spend less time arguing over whether disclosed records are genuine, which cuts the effort and cost of resolving them.

BS 10008-2: the code of practice

BS 10008-2 is the implementation guide. It describes the attributes, procedures and processes a compliant system needs, plus how such systems should be audited. It deliberately stays technology-neutral and recommends no specific products.

One limit worth knowing: Part 2 doesn't cover how you judge the authenticity of information before it enters your system. Your onboarding and capture controls have to handle that themselves.

From BIP 0008 to the 2020 edition

The standard grew out of BIP 0008, a code of practice that BCS notes was extended in 2005 to cover electronic communication and the linking of electronic identity to documents. BS 10008 followed in 2008, was revised in 2014, and was split into Parts 1 and 2 in 2020.

The 2020 edition put "electronically stored information (ESI)" into the title, which is why ESI and BS 10008 now travel together in search results and in e-disclosure conversations.

Electronic identity verification under BS 10008

Electronic identity verification is where BS 10008 matters most to compliance and legal teams. Pinsent Masons' Out-Law summarises its scope as covering electronic signatures and the linking of an electronic identity to particular electronic documents, alongside document scanning and a full life history of each electronic object.

Linking an identity to a specific document

A signature proves very little on its own. What carries weight is the chain: this verified person, with this identity evidence, signed this exact version of this document, at this time, and the document hasn't changed since. BS 10008 expects your system to preserve every link in that chain, and to show it on demand.

Simple, advanced and qualified signatures under UK eIDAS

UK eIDAS recognises three levels of electronic signature. A simple electronic signature can be a typed name or a click. An advanced electronic signature is uniquely linked to the signer and detects later changes. A qualified electronic signature adds a qualified certificate and device, and carries the same legal effect as a handwritten signature.

English law rarely demands advanced or qualified signatures. Our view: for high-value or high-risk records such as loan agreements, policy documents and supplier contracts, match the signature level to the risk of the transaction. Choosing the cheapest option and hoping the evidence holds is the mistake to avoid.

Where the proof breaks down

Most identity evidence is strong at the moment of signing and weak three years later.

The identity check sits in a separate onboarding system, the certificate has expired, the signed PDF was exported and re-saved, and nobody can show the file in the archive matches the one that was signed. BS 10008 treats preservation as part of verification, and it's the step enterprises skip most.

What BS 10008 expects from your information management system

BS 10008 stays technology-neutral, so it describes outcomes and controls. The table below turns those areas into the evidence an assessor, regulator or opposing counsel will ask you to produce.

The common thread is consistency. A control that runs for some document types and not others gives opposing counsel an opening.

BS 10008 in practice: use cases in regulated UK enterprises

BS 10008 earns its keep where records get disputed and losing a dispute costs real money. Three scenarios show where it bites.

Customer onboarding and KYC records in banking and insurance

A policyholder challenges a claim decision, or a borrower denies opening an account. You need the identity documents, the verification result, the signed terms and the audit trail, all tied together.

The pressure is rising: Fraudscape reports that identity fraud in insurance rose by 26% in 2025. For banks and financial services firms, a well-kept customer file also answers the FCA's record-keeping questions without a scramble.

Signed contracts and supplier agreements in energy and utilities

Utilities and energy providers sign grid connection agreements, supplier contracts and customer terms that run for years. When a disagreement surfaces a decade in, the question is which version was signed, by whom, and what changed afterwards. A governed contract management process with a full version history gives you that answer in minutes.

Proof of delivery and customs records in transport and logistics

In logistics, electronic proof of delivery and customs declarations settle billing disputes and HMRC queries. Those records only carry weight if you can show they weren't edited after capture, and AI-based document fraud detection can flag altered delivery notes and invoices before they reach billing.

Challenges and limitations of BS 10008

BS 10008 is demanding, and a few realities trip up even well-prepared teams.

It certifies your system, not a product.

BS 10008-1 applies to your organisation's electronic information management system: the people, policies and processes as well as the software. No vendor can hand you compliance in a box, and any claim that suggests otherwise deserves scrutiny.

Signature validity ages.

Cryptographic algorithms weaken and certificates expire, while your retention periods can run for decades. Plan how you'll preserve the evidential value of signatures over the full retention period, and ask your signature and archive providers exactly how they handle it.

Logs only prove what they recorded.

Many systems let you switch audit logging on or off by category. If logging for an action type was never enabled, a clean log proves nothing. Audit your audit configuration before you rely on it.

Scanning and destroying paper needs discipline.

BS 10008 addresses document scanning, and destroying originals is only defensible when your capture process is documented, quality-checked and followed every time.

What happens to your signed documents after the signature

Signing is one moment in a record's life. The evidential weight you need years later depends on everything that happens next.

Once a contract, policy or onboarding file is signed, it needs to be stored in an audit-proof archive, classified, attached to the right customer or supplier file, and kept under the right retention rule.

It needs to be findable by the people entitled to see it, and hidden from those who aren't. If litigation starts, deletion has to stop.

When those steps run in separate systems, each hand-off is a gap in your chain of custody. The strongest position is one governed platform that covers:

• Capture: scanning and ingesting inbound documents, with identity and data checks at the point of entry
• Storage and archiving: tamper-evident retention of the signed original and its metadata
• Records management: retention schedules, disposal rules and legal holds applied consistently
• Workflow: approvals and signing steps recorded as part of the document's history
• Integration: signed records available in context inside SAP, Microsoft 365 and your line-of-business systems

This is the practical side of information governance, and it's what turns a BS 10008 policy into evidence you can actually produce.

How Doxis supports BS 10008-aligned evidence management

BS 10008 asks you to prove, years later, that a record is exactly what it claims to be and that the right person signed it. That proof is only as strong as the platform that captured, stored and logged it.

Doxis is an intelligent content automation platform that brings document management, document archiving, records management, workflow and AI-powered document processing together in one system.

To be clear on certification: BS 10008 certifies your organisation's information management system, and Doxis doesn't hold BS 10008 certification itself. Doxis is certified to ISO 16175:2020 for records management and gives you the controls a BS 10008 programme relies on:

• Tamper-evident archiving: software-enforced WORM storage keeps checksums alongside content and detects attempts to manipulate the system clock
• Configurable audit trails: every logged action records the date, action,  user and role, and can be searched, exported and archived for an auditor or court
• Signing inside your process: connectors to established trust service providers such as DocuSign, Adobe Acrobat Sign and XiTrust MOXIS, with signed documents filed straight back into the record
• Identity checks at capture: Doxis AI.dp reads identity documents, including MRZ and NFC chip data, and supports liveness and face matching during onboarding
• Retention and legal hold: retention rules plus a deletion lock that keeps records in place when a dispute or investigation starts
• One platform for the lifecycle: capture, signing, storage and retrieval run in one system with SAP and Microsoft 365 integration, so your chain of custody has fewer hand-offs to defend

The operational payoff is measurable. In a Forrester Total Economic Impact study (2023), Doxis customer SEW-EURODRIVE achieved a 336% ROI over three years, with payback in under six months. If your records still live in an ageing ECM system, a structured migration is a good moment to build BS 10008-aligned controls in from the start.

FAQs on BS 10008