Understand what changes in the new ITI Normative Instruction in 2025

A ITI normative instruction is the legal instrument used by the National Institute of Information Technology to regulate practices and procedures within the ICP-Brasil ecosystem. In 2025, two important updates – Normative Instructions No. 33 and No. 34 – redefined technical and legal parameters for electronic signatures qualified, with a direct impact on companies, public bodies and specialized platforms. 

These changes strengthen security, increase alignment with international standards, and establish stricter requirements to ensure the legal validity of documents over time.

In this article, we will explain in a technical and accessible way the role of the ITI, the changes brought about by the new regulations, the relevance of the AD-RT policy, the mandatory long-term validation (LTV), and how ZapSign adapted quickly, reinforcing its commitment to compliance and user experience.

The role of ITI and its importance for ICP-Brazil

O National Institute of Information Technology (ITI) is the authority responsible for maintaining and coordinating the Brazilian Public Key Infrastructure (ICP-Brasil), which guarantees the authenticity, integrity and legal validity of digital documents in the country.

The ICP-Brasil functions as a hierarchical chain of trust, in which each digital certificate is issued and validated based on strict security rules. This structure allows contracts, authorizations, and official documents to be digitally signed with legal force, as provided for in the Digital Signature Law.

The ITI, through regulatory instructions, constantly updates technical and compliance requirements to keep ICP-Brasil aligned with global best practices. This continuous updating is essential for the country to keep up with technological developments and growing demands. qualified signature. 

Furthermore, the agency acts as a link between certifying bodies, public agencies and private companies, ensuring that all certificate issuance and verification processes follow unified standards. 

This contributes to national and international interoperability, enabling Brazilian documents to be recognized in other countries and digital transactions to occur securely and with legal support in different sectors of the economy.

Main changes brought about by IN nº 33 and 34/2025

The two new regulatory instructions published in 2025 mark a significant advance in digital signature policies. They update standards, require new practices, and introduce more modern algorithms to increase security levels.

AD-RT Policy

A Digital Signature with Time Reference (AD-RT) is a policy aimed at the long-term preservation of documents. It ensures that each signed file includes a timestamp official, issued by an approved certification authority, allowing verification of the integrity and exact date of the signature even years later.

This requirement reinforces the reliability of documents that need to maintain legal validity for long periods, such as digital contracts, corporate minutes and real estate records.

With Normative Instruction No. 33/2025, the AD-RT policy became mandatory for qualified archival signatures, ensuring that each signature is linked to consistent and auditable verification data. This prevents future questions about a document's authenticity or issuance date, even if the original technology or certificates are replaced over time. 

The adoption of this standard by ITI also harmonizes Brazil with international digital certification practices, strengthening document security and ensuring that companies and public agencies can meet long-term legal and regulatory requirements without gaps.

Long-Term Validation (LTV)

A long-term validity (LTV) complements the AD-RT policy. It ensures that all elements necessary to validate the signature—such as the certificate chain—are in place. ICP-Brazil, revocation lists (CRLs) and OCSP responses – are incorporated into the document at the time of signing.

In practice, this means that even if a digital certificate expires or is revoked years later, the signature will remain verifiable through a digital signature verifier compatible.

With the requirement established by Normative Instruction No. 33/2025, LTV has become a fundamental part of the lifecycle of digital documents that need to maintain legal validity for decades. This feature eliminates the need for future external verification, ensuring that all essential data is already integrated into the file itself. 

This way, companies, public agencies and independent professionals can maintain the integrity and authenticity of contracts, reports, records and other critical documents, even in the face of technological changes, changes in providers or updates to cryptographic standards over time.

Scaling cryptographic algorithms

With IN No. 34/2025, the ITI updated technical document DOC-ICP-15.03 to version 9.0, authorizing the use of more modern cryptographic algorithms, such as those from the EdDSA family (Ed25519 and Ed448). These algorithms offer greater performance and security, aligning with international practices.

This update strengthens the ecosystem of signature with digital certificate and ensures resilience against increasingly sophisticated cyber threats.

Furthermore, the use of algorithms such as Ed25519 and Ed448 represents a technical advancement that expands verification capacity and reduces known vulnerabilities in older methods. By adopting globally recognized standards, ICP-Brasil increases its compatibility with foreign systems, facilitating international transactions and ensuring that Brazilian documents can be validated in other countries. 

This evolution also signals to the market that Brazil is committed to keeping its digital certification system up-to-date, resilient, and prepared to respond quickly to new security and technical compliance requirements.

Relevance of changes for security and legal validity

The new normative instructions have a direct impact on legal validity of electronic signature (Learn more) and document security.

For companies and regulated sectors, such as finance, healthcare, and real estate, compliance with these requirements is not only a legal obligation but also a factor in competitiveness. Documents protected by AD-RT and LTV reduce fraud risks, strengthen governance, and meet internal and external audit requirements.

Furthermore, by incorporating standards such as EdDSA, ICP-Brasil remains compatible with international solutions, facilitating global transactions. This allows digital contracts and records issued in Brazil to be recognized and verified abroad with the same technical robustness. 

The consistent application of these measures contributes to the market confidence, ensuring that companies can operate securely and transparently, even in the face of increasingly stringent regulatory requirements and constantly evolving cyber threats.

How ZapSign Adapted Quickly and Seamlessly

ZapSign conducted detailed technical work to adapt to the new rules without altering the user experience. This adaptation included adjustments to the signature algorithm, enhanced approval of timestamp providers, and automatic implementation of LTV on all issued documents.

Technical adjustments

Shortly after the publication of IN No. 33/2025, the ZapSign engineering team conducted a thorough analysis of the AD-RT policy and initiated system adjustments to ensure full compliance. All documents with digital signature now automatically include timestamps and validation data.

Testing and compliance

The platform has been tested with official ITI tools and market validators, confirming full compliance with the new guidelines. This means that, for the end user, signing a contract with digital signature remains as simple as before, but with enhanced security.

Direct benefits for regulated sectors

With the adaptation, companies in sectors that require high technical adherence, such as health, legal and financial, can operate with peace of mind, knowing that their digital documents are protected and in compliance with current legislation.

ZapSign's contract generator as a strategic differentiator

A key highlight in ZapSign's portfolio is the AI contract generatorThis feature allows you to quickly create customized documents, integrating clauses tailored to each business, with legal certainty and adherence to ICP-Brasil standards.

By combining the contract generator with the new requirements of IN nº 33/2025, ZapSign offers a fully automated flow: from document creation to digital signature qualified, with AD-RT and LTV incorporated.

This reduces manual steps, speeds up negotiations, and improves the experience for clients and legal teams.

Conclusion

The updates brought by ITI normative instruction in 2025 represent a decisive step in the evolution of digital signature security and compliance in Brazil. By adopting policies such as AD-RT, implementing long-term validation, and expanding the use of modern cryptographic algorithms, the ITI reinforces the robustness of the ICP-Brasil and ensures the legal validity of documents for decades.

ZapSign demonstrated agility and commitment by fully adapting to the new requirements while maintaining its intuitive and secure platform. For companies that need to ensure compliance, optimize processes, and reduce costs, this combination of technology and regulatory adherence is a strategic differentiator.

If your organization is looking for an electronic signature solution that combines security, practicality and compliance with the latest standards, discover now ZapSign platform.