Express signing

1. What is changing

XML signing will no longer be supported using NBID.

A new method, no_bankid_csc, will be available in January. You will need to switch to this method as soon as possible, by 1 March 2026, to avoid the risk of losing the ability to sign documents once the old signing method is decommissioned.

With the new set up

• BankID specific attributes in signers.documentSignature.attributes in the Get Document endpoint or Get signer endpoint will likely no longer be returned
• If you are iframing the signature solution, some CSP adjustments may be required due to new domains being introduced, more information will follow
• If you are downloading the native signer file from
  • /documents/{documentId}/files/signers/{signerId} or
  • /documents/{documentId}/files/attachments/{attachmentId}/signers/{signerId}
  • this will change from a SEID_SDO to a DSS PAdES file with the new signature method
• If you are downloading the packaged file from
  • /documents/{documentId}/files/signers/{signerId} or
  • /documents/{documentId}/files/attachments/{attachmentId}/signers/{attachmentId}
  • this used to contain a SEID_SDO, this will change to a PAdES file with the new signature method

2. Who is affected

This only applies when using the combination of Norwegian BankID and PKI signature.

If you are using authentication only, mechanism = identification, you are not affected and no changes are required.

3. What this means for you

3.1 Required changes for affected customers

• XML signing will no longer be supported using NBID
• You will move to the new method no_bankid_csc which will be available in January
• You must switch to no_bankid_csc as soon as possible, by 1 March 2026, to avoid the risk of losing the ability to sign documents once the old signing method is decommissioned
• If you use signers.documentSignature.attributes in the Get Document endpoint or Get signer endpoint, the BankID specific attributes will likely no longer be returned
• If you are iframing the signature solution, some CSP adjustments may be required due to new domains being introduced, more information will follow
• If you are downloading the native signer file from
  • /documents/{documentId}/files/signers/{signerId} or
  • /documents/{documentId}/files/attachments/{attachmentId}/signers/{signerId}

this will change from a SEID_SDO to a DSS PAdES file with the new signature method

• If you are downloading the packaged file from
  • /documents/{documentId}/files/signers/{signerId} or
  • /documents/{documentId}/files/attachments/{attachmentId}/signers/{attachmentId}

this will change from a SEID_SDO to a PAdES file with the new signature method

3.2 Required changes for customers downloading the native combined file

Deadline, 14 February 2026, depending on document time to live

Applicable to those who download and require the native file from one of the following endpoints

• /documents/{documentId}/files
• /documents/{documentId}/files/attachments/{attachmentId}

If you need a native signature containing all signatures, similar to the BankID SDO, you must explicitly include "native" in dataToSign.packaging.signaturePackageFormats. When this is included, ordered signatures are required, otherwise the API will return a 422 error if the order is not specified. This is because signatures must be applied serially to ensure they all appear in the same PAdES file as individual person signatures. You can read more about setting up ordered signatures here.

If you do not include the native package format, the new native BankID PAdES will still be generated, but it will contain only one end user signature per signer. This means that a combined native package, as previously available, will not be created.

The Signicat PAdES will continue to be included as before, containing the individual signatures as evidence in the attached XML package.

4. Timeline and deadlines

• Deadline for switching to no_bankid_csc and avoiding loss of signing capability, 1 March 2026
• Deadline for customers downloading the native combined file, 14 February 2026, depending on document time to live