What is the eIDAS 2.0 implementation roadmap for 2026?

The eIDAS 2.0 implementation roadmap for 2026 centres on one core obligation: EU Member States must make the European Digital Identity Wallet available to all citizens, residents, and businesses by 24 December 2026. For organisations operating in regulated sectors, this means the window for preparation is a present-day priority. This article walks through the key milestones, affected sectors, technical requirements, and practical steps organisations need to take now.

What are the key eIDAS 2.0 milestones organisations must meet by 2026?

The single most critical eIDAS 2.0 milestone for 2026 is the legal obligation for all EU Member States to issue a European Digital Identity Wallet to any citizen, resident, or business that requests one by 24 December 2026. Beyond wallet issuance, public sector bodies are required to accept the EUDI Wallet as a valid means of identity verification and authentication for their online services from that same date. Private relying parties in designated regulated sectors face a separate acceptance obligation under Article 5f of eIDAS 2.0, which applies from 24 December 2027. It is important to note that this legal deadline does not guarantee that every national wallet will reach the same level of maturity on that date, or that every possible cross-border use case will be fully operational throughout Europe from day one. Practical interoperability and national rollout are expected to develop in phases.

To understand how we arrived here, it helps to know the broader timeline. eIDAS 2.0, formally Regulation (EU) 2024/1183, entered into force on 20 May 2024. It amends Regulation (EU) 910/2014 and does not replace it. The European Commission manages the legal framework and adopts implementing acts that contain the legally binding requirements. By the end of 2024, the first five core implementing acts had been adopted, starting the relevant 24-month period. Prior to that, from April 2023 onward, four large-scale pilot programmes ran involving over 350 entities across 26 Member States, Norway, Iceland, and Ukraine. These pilots tested the wallet across real-world scenarios and concluded in 2025. The insights gathered from those pilots directly shaped the technical standards and the Architecture and Reference Framework (ARF) that organisations must now align with.

Key milestones organisations should have on their radar include:

• Wallet availability from Member States for all eligible citizens, residents, and businesses by the legal deadline of 24 December 2026
• Mandatory acceptance of the EUDI Wallet by public sector bodies for online services requiring electronic identification, from 24 December 2026
• Certification and notification of national wallet solutions by the relevant national competent authorities
• Mandatory acceptance by regulated private sector relying parties in designated sectors under Article 5f, from 24 December 2027
• Registration of relying parties with the relevant national authority under CIR (EU) 2025/848, adopted on 6 May 2025, before wallet data can be requested
• Alignment with the technical specifications published under the ARF, which provides the technical elaboration of the requirements set out in the implementing acts
• Compliance with updated trust service requirements under eIDAS 2.0, including qualified electronic signatures and seals

Which sectors are most affected by the eIDAS 2.0 requirements?

The sectors most affected by eIDAS 2.0 are financial services, government, healthcare, telecommunications, education, energy, transport, social security, and digital services. These are the areas where identity verification is both legally required and operationally critical, and where the EUDI Wallet introduces the most significant changes to existing processes.

In financial services, the wallet directly impacts customer onboarding, Know Your Customer (KYC) processes, and strong customer authentication under PSD2. Banks and insurers that currently rely on manual or fragmented identity checks will need to integrate wallet-based verification into their digital journeys. It is worth noting that the reuse of KYC data is governed by AML regulation, and eIDAS 2.0 does not itself determine when verified identity data can be reused for AML purposes. Relying parties in this sector must also register under CIR (EU) 2025/848 before requesting wallet data, specifying per intended use which attributes and attestations they will request.

For government services, the wallet enables citizens to access public services securely across borders, from filing taxes to applying for permits, without needing separate credentials for each service. Cross-border use depends on the receiving Member State’s relying party infrastructure being in place, so organisations should plan for phased availability rather than assuming uniform access from the outset.

In healthcare and pharmaceuticals, attestations issued through the wallet can streamline patient identification, consent management, and cross-border data sharing. However, the legal consequences of specific attestations may vary by Member State, and sector-specific legislation governing health data continues to apply alongside eIDAS 2.0 obligations. Processing health data also requires a legal basis under both Article 6 and Article 9(2) of the GDPR.

Telecommunications providers are affected through SIM registration requirements, while educational institutions will need to issue and accept digital academic attestations compatible with the wallet ecosystem. The Article 5f obligation for private sector relying parties applies from 24 December 2027, and micro and small enterprises with fewer than 50 employees and an annual turnover or balance sheet total of no more than 10 million euros are exempt.

Very Large Online Platforms (VLOPs) are addressed under a separate provision of Article 5f. For VLOPs, the obligation applies where the platform requires user authentication, on the voluntary request of the user and for the minimum necessary data. The condition of legally or contractually required strong customer authentication does not apply to VLOPs.

How does the EUDI Wallet fit into the eIDAS 2.0 implementation timeline?

The EUDI Wallet is the central delivery mechanism of eIDAS 2.0. It is the primary tool through which the regulation’s goals of interoperable, user-controlled digital identity become operational. Governance of the wallet ecosystem is a shared responsibility: the European Commission adopts the implementing acts that set legally binding requirements; EU Member States provide or mandate wallet solutions, certify and notify them, and supervise actors within their jurisdiction; the European Digital Identity Cooperation Group (EDICG) supports cooperation and cross-border alignment among Member States; and wallet providers, issuers of Person Identification Data and attestations, qualified trust service providers, and relying parties each carry defined roles within the framework. There is no single central European authority that operationally manages all EUDI Wallets.

Member States are legally required to make the wallet available by 24 December 2026, and public sector bodies must be ready to accept it as a valid form of identity by that date. Private sector relying parties in regulated sectors must meet their acceptance obligation by 24 December 2027. Organisations should not wait for a single European go-live moment. National rollout and the maturity of individual wallet solutions will vary, and preparation should begin now regardless of where a specific national wallet stands in its development.

The wallet allows users to store attestations, such as national IDs, driver’s licences, professional qualifications, and health data, and share only the specific information required for a given interaction. This selective disclosure principle is central to the regulation’s privacy-by-design approach. Wallet use is voluntary for the user: no one can be required to use the EUDI Wallet. Approving a data request in the wallet is a separate act from providing consent as a legal basis under the GDPR, and relying parties must establish their own GDPR legal basis for processing the data they receive.

The four large-scale pilot programmes that ran from April 2023 to 2025 were designed to test the wallet’s readiness across sectors. The pilots operated as follows: EWC focused on Digital Travel Credentials, payments, and organisational digital identity; POTENTIAL covered government services, opening bank accounts, SIM registration, mobile driving licences, remote qualified signatures, and e-prescriptions; NOBID focused on payments; and DC4EU addressed education and social security. The feedback from these pilots has been incorporated into the technical specifications that organisations must now implement. A second wave of pilots started in 2025: WE BUILD focuses on business wallets and payments, and APTITUDE covers travel, ticketing, vehicle registration, and payments.

What technical standards must organisations implement to comply with eIDAS 2.0?

Organisations must align with the Architecture and Reference Framework (ARF). The ARF provides the technical elaboration of the requirements set out in the implementing acts adopted by the European Commission. The implementing acts are legally binding; the ARF defines the technical standards for wallet interoperability, credential formats, trust registries, and secure data exchange that organisations must follow. In practical terms, this means supporting specific protocols for issuing, presenting, and verifying digital attestations.

The core technical requirements include:

1. Attestation formats: Support for mdoc and SD-JWT VC, the standardised attestation formats compatible with the EUDI Wallet. W3C Verifiable Credentials are not a prescribed EUDI Wallet format under the ARF.
2. Presentation protocols: ISO/IEC 18013-5 for proximity presentation and ISO/IEC TS 18013-7 for online presentation, with OID4VCI for issuance and OID4VP for presentation. The High Assurance Interoperability Profile (HAIP) is also relevant for interoperability between wallet solutions.
3. Trust service alignment: Integration with qualified trust services, including qualified electronic signatures (QES) and qualified electronic seals (QESeal), as defined under eIDAS 2.0. Note that a QES and a qualified electronic seal have different legal effects: a QES has the equivalent legal effect of a handwritten signature, while a qualified electronic seal does not.
4. Selective disclosure: Technical capability to request and receive only the minimum necessary data from a wallet holder, per the registered attribute scope under CIR (EU) 2025/848.
5. Verification: Verification of an attestation involves three distinct checks: verification of the issuer’s signature against the relevant national trusted list, which forms part of the EU List of Trusted Lists (LOTL); checking the revocation status via the issuer’s status information; and validation of the wallet unit attestation to confirm that the presenting wallet runs on a certified wallet solution. Only the first of these checks can be performed fully offline.
6. Attestation types: Organisations should distinguish between Qualified Electronic Attestations of Attributes (QEAA), Public Body Attestations (PuB-EAA), and non-qualified Electronic Attestations of Attributes (EAA). PuB-EAA are not a subcategory of non-qualified EAA.

Organisations that have not yet reviewed the ARF or assessed their current infrastructure against these requirements should treat this as an immediate priority. The technical documentation and guidance available from the European Commission and national supervisory bodies provides the authoritative source for these specifications.

How should organisations structure their eIDAS 2.0 preparation now?

Organisations should structure their eIDAS 2.0 preparation around three parallel workstreams: regulatory assessment, technical readiness, and organisational change. Starting with a clear picture of which obligations apply to your specific sector and use cases is the most effective first step, followed by a gap analysis of your current identity infrastructure. Because national wallet rollout will develop in phases, organisations should plan for progressive integration rather than a single implementation event tied to the legal deadline.

A practical preparation approach looks like this:

• Map your obligations: Identify which eIDAS 2.0 requirements apply to your organisation based on sector, service type, and the categories of users you serve. Determine whether your acceptance obligation falls under the 24 December 2026 deadline for public sector bodies or the 24 December 2027 deadline for regulated private sector relying parties under Article 5f. Check whether your organisation qualifies for the micro and small enterprise exemption.
• Register as a relying party: Under CIR (EU) 2025/848, your organisation must register with the national authority in your Member State of establishment before requesting wallet data. Registration covers each intended use and specifies which attributes and attestations will be requested. The wallet checks requests against this registered scope.
• Assess your current infrastructure: Review your existing identity verification, authentication, and signing processes against the ARF requirements, including support for mdoc and SD-JWT VC formats and the relevant presentation protocols.
• Engage with the ecosystem: Connect with qualified trust service providers, wallet issuers, and technology partners who are already building eIDAS 2.0-compatible solutions. A relying party must be able to accept every relevant notified wallet, regardless of provider.
• Plan for reusability: Design your identity processes so that verified attestations can be reused across interactions, reducing the burden on both users and your compliance team, within the limits set by applicable AML and GDPR obligations.

Organisations that delay preparation risk regulatory non-compliance and competitive disadvantage. Those that move early will benefit from faster onboarding, reduced identity verification costs, and stronger user trust.

What happens if organisations miss the eIDAS 2.0 compliance deadlines?

Organisations that fail to meet eIDAS 2.0 compliance deadlines face regulatory enforcement from national supervisory bodies, potential fines, and the inability to offer certain regulated digital services. Beyond direct penalties, non-compliant organisations risk being excluded from cross-border digital service markets where wallet-based identity is the standard.

The enforcement landscape varies by Member State, as each country’s national competent authority is responsible for overseeing compliance within its jurisdiction. However, the regulation creates a consistent baseline of obligations across the EU, which means there is no straightforward way to avoid requirements by operating in a particular country.

From a business perspective, the risks extend beyond regulatory penalties. As the EUDI Wallet becomes the standard for digital identity across Europe, organisations that are not wallet-compatible will face friction in onboarding users, completing transactions, and participating in cross-border digital services. Competitors who have integrated wallet acceptance early will have a measurable advantage in conversion rates and user trust.

Compliance is an ongoing obligation. eIDAS 2.0 introduces continuing requirements around trust service management, attestation lifecycle, revocation status, and supervisory reporting. Organisations should build compliance into their operational processes rather than treating it as a project with a fixed end date.

How TrustTech supports eIDAS 2.0 implementation

The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.

For organisations preparing for eIDAS 2.0, the ID Connector handles the technical complexity of wallet acceptance in practice. It verifies issuer signatures against the relevant national trusted lists that form part of the EU List of Trusted Lists (LOTL), checks revocation status via issuer-provided status information, and validates wallet unit attestations to confirm that a presenting wallet runs on a certified wallet solution. It also enforces the registered attribute scope under CIR (EU) 2025/848, so that only the data your organisation is registered to request is exchanged. For use cases involving qualified signing, the ID Connector connects to a qualified trust service provider, enabling a complete flow from identity verification to qualified electronic signature with a full audit trail.

The ID Connector is relevant across the sectors most affected by eIDAS 2.0. Financial institutions can use it to integrate wallet-based verification into KYC and onboarding flows. Government bodies can use it to accept EUDI Wallet credentials for public services from 24 December 2026. Healthcare and pharmaceutical organisations can use it to handle patient identification and cross-border attestations within the applicable GDPR and sector-specific legal framework. Across all these sectors, the same integration supports reuse of verified identity data across interactions, reducing repetitive verification for users.

If your organisation is working through its eIDAS 2.0 preparation and wants to understand what implementation looks like in practice, get in touch with TrustTech to discuss your specific situation and next steps.