Deep integration of the corporate IT landscape with government digital services—from the Electronic Court to tax platforms—has become a critical condition for business continuity. However, in practice, the procurement of systems for document management is still accompanied by conceptual confusion. Procurement department heads and Chief Digital Transformation Officers (CDTOs) sometimes equate basic cloud file storage, a Document Management System (DMS), and a full-fledged Enterprise Content Management (ECM) platform.
This leads to hidden legal and operational risks: at some point, it turns out that contracts saved years ago have lost their legal validity due to the inability to verify the signers' certificate keys. For a large enterprise, understanding the difference between these classes of systems is not just a matter of terminology, but a matter of survival in the legal field.
File storage, DMS, or ECM: clarifying the terminology for procurement
To ensure investments in digitalization do not turn into the purchase of a "digital dump," it is necessary to clearly distinguish approaches to document management.
The first level is basic Document Management Systems (DMS). Their task is to organize files, ensure versioning, provide basic metadata search, and offer an interface for collaboration. A basic DMS handles operational text approval within a department well, but it does not manage the complex lifecycle of a record and its cryptographic attributes in the long term.
The highest level is Enterprise Content Management (ECM). ECM manages the lifecycle of any unstructured information: from scans of primary documents to links between court cases, contracts, and financial transactions. ECM tightly integrates content into business processes (BPM), ensures long-term archival storage with a guarantee of immutability, and provides end-to-end audit tools.
Legal validity of electronic documents: why "just saving a PDF" is not enough
Many companies operate under a dangerous illusion: if a file is saved in PDF format and signed with a Qualified Electronic Signature (QES), legal security is guaranteed. However, Ukrainian legislation imposes more complex requirements. According to the Law of Ukraine No. 851-IV "On Electronic Documents and Electronic Document Management," the legal force of an electronic document cannot be denied solely due to its electronic form if it contains mandatory details. An electronic copy with mandatory details, including the author's electronic signature, is equivalent to the original.
In turn, the Law of Ukraine No. 2155-VIII "On Electronic Identification and Electronic Trust Services" defines the legal framework for using qualified electronic signatures (QES). Only an electronic document signed with a key valid at the time of signing has legal force. To ensure the resilience of electronic document management (EDM), an enterprise must verify not only the signature itself but also the trust status of the service provider's certificate (via the lists of the Central Certification Authority). A simple file system does not do this, shifting the risks onto the company.
Technological challenge: how to ensure QES verification in the long term
The validity period of a qualified QES certificate is usually limited. What happens when an enterprise needs to provide a contract or HR document for long-term storage after ten years? If such a document is checked using standard tools, the system may return a validation error due to the expiration of the certificate or changes in cryptographic algorithms.
To solve this problem, ECM architecture employs long-term signature storage standards (such as the CAdES-X Long family of formats). The archival storage process involves the system automatically contacting a Time Stamping Authority (TSP) and obtaining proof of certificate validity (OCSP or CRL) at the moment of signing. These proofs are cryptographically "embedded" into the file. Basic DMS systems often lack such built-in archival certification mechanisms.
Integration with government services: requirements of the Electronic Court and cross-border EDM
A modern enterprise actively exchanges data with the external environment. In particular, integrating a corporate EDM system with the "Electronic Court" subsystem requires strict validation of file formats, automatic control of sending/receiving statuses, and the ability to apply QES according to procedural requirements.
Another challenge is cross-border document management. It requires compatibility with European trust services according to eIDAS standards. This means the system must be able to validate EU qualified electronic signatures (QES). If the IT architecture lacks flexibility in working with different trust services, the enterprise will face barriers when scaling the business.
Architectural approach: how to build a resilient document management system
To avoid technological limitations, large enterprises are advised to implement a three-tier architecture:
- Client layer (DMS/BPM): operational work with documents, routing of approval processes.
- Integration layer: ensuring native connection with external government services and certification authority registries.
- ECM storage (Archive): repository for long-term storage of records with a guarantee of the legal validity of documents.
To structure cybersecurity risks and the operational resilience of document management IT systems, it is also advisable to apply the NIST CSF 2.0 methodology. Although this is a voluntary framework for Ukrainian civil business, it offers a convenient division of risk management processes into functions (Govern, Identify, Protect, Detect, Respond, Recover).
Such an architecture should be based on powerful platform solutions. For example, the low-code platform UnityBase, which is a joint development of companies in the Intecracy Group alliance (where InBase acts as a key, but not the only, developer). UnityBase offers a full-stack JavaScript toolkit, a built-in domain metadata model, and access control (RBAC/RLS) for developing enterprise applications.
Ready-made products are built on the mechanisms of this platform:
- Megapolis.DocNet: a comprehensive ECM solution for large-scale corporate document management and reliable integration with government bodies.
- Scriptum DMS: a system for flexible process automation (BPM) and operational content management.
Using such solutions provides the enterprise with a technological basis for complying with the requirements of Laws No. 851-IV and No. 2155-VIII. However, it is important to understand that no software solves the issue of legal compliance automatically—technologies must be accompanied by appropriate configuration of internal company regulations and policies.
Selection matrix: DMS vs. ECM for the corporate sector
| Comparison criterion | Basic DMS | Full-fledged ECM system |
|---|---|---|
| Management object | Files and their versions (contracts, acts) | Corporate content, metadata, links, and record lifecycles |
| QES/QES handling | Only application and basic verification at the time of signing | Full certificate validation via OCSP/CRL, support for long-term storage formats (CAdES-X Long) |
| Integration with government registries | Absent or implemented at a basic level | Deep integration with the Electronic Court, Certification Authorities, and eIDAS providers |
| Process automation | Simple sequential approval routes (workflow) | Complex dynamic processes (BPM), automatic task distribution |
| Archival storage | Temporary file storage in folders | Long-term archive with mechanisms for regular timestamp renewal |
The correct choice of document management system class at the tender stage is a strategic decision that protects the company from the need to re-implement its IT architecture in a few years and guarantees the preservation of the legal significance of its business assets.
FAQ
How does DMS differ from ECM in simple terms for a tender committee?
A basic DMS focuses on operational work with files and their approval. A full-fledged ECM system manages the entire lifecycle of corporate content, metadata, long-term archives, and ensures the legal validity of documents.
How to check if an EDM system maintains the legal validity of documents after the QES certificate expires?
The system must support long-term signature storage formats (e.g., CAdES-X Long). This means that proof of the certificate's validity at the time of signing and time stamps are cryptographically embedded into the document file.
What technical requirements does the Electronic Court impose for integration with corporate document management?
Integration requires strict validation of document formats, control of sending/receiving statuses for procedural files, and an automated mechanism for applying QES in accordance with the regulatory requirements of government services.
Data sources
- Verkhovna Rada of Ukraine: Law of Ukraine On Electronic Documents and Electronic Document Management
- Verkhovna Rada of Ukraine: Law of Ukraine On Electronic Identification and Electronic Trust Services
- The NIST Cybersecurity Framework (CSF) 2.0
- Central Certification Authority of Ukraine: Qualified providers of electronic trust services