Deep integration of the corporate IT landscape with government digital services is critical for business continuity. However, when procuring automation systems, enterprises often confuse basic document management systems (DMS) with enterprise content management (ECM) platforms. This creates legal and operational risks, including the threat of documents losing their legal validity due to the inability to verify expired signature certificates.
What this means for the market
Confusing DMS with ECM leads to severe compliance and operational risks for the corporate sector. Without proper ECM integration, businesses face the threat of their digital archives losing legal validity over time, potentially leading to failed audits, contractual disputes, and major disruptions when expired signature certificates cannot be verified during legal proceedings.
System classification: DMS vs. ECM
For effective digitalization, it is crucial to distinguish between these system classes:
- DMS (Document Management System) provides file organization, version control, basic search, and collaboration. It is suitable for rapid document approval but does not manage their full lifecycle.
- ECM (Enterprise Content Management) manages all unstructured information and its relationships, integrates content into business processes (BPM), and guarantees long-term archival storage.
Legal validity and long-term storage of QES
According to Ukrainian Laws No. 851-IV and No. 2155-VIII, only a document signed with a key that was valid at the time of signing holds legal force. Since the validity period of QES certificates is limited, verifying documents years later becomes a challenge.
To address this, ECM architecture utilizes long-term signature storage formats (such as CAdES-X Long). The system automatically queries a Time Stamp Authority (TSA/TSP) and retrieves proof of certificate validity (OCSP/CRL) at the time of signing, embedding them into the file. Basic DMS systems typically lack these tools.
Building a resilient IT architecture
Large enterprises are recommended to implement a three-tier architecture:
- Client layer (DMS/BPM) for daily operations and routing.
- Integration layer for connecting with government services (e.g., Electronic Court) and central certification authority (CCA) registries.
- ECM repository (Archive) for long-term document preservation with guaranteed legal validity.
Modern low-code platforms like UnityBase, which powers systems like Megapolis.DocNet and Scriptum DMS, can serve as the technological foundation for such solutions. They enable the automation of complex processes and ensure compliance with legal requirements, although technologies must be accompanied by proper internal corporate regulations for full compliance.
Action plan
- Transition from basic DMS to a three-tier IT architecture that includes a dedicated ECM repository for long-term preservation.
- Adopt long-term signature storage formats like CAdES-X Long to automatically embed certificate validity proofs.
- Deploy modern low-code platforms such as UnityBase to automate compliance processes, and pair them with updated internal corporate regulations.
Prepared by a Software Ukraine member. Original publication.