eIDAS 2.0, Regulation (EU) 2024/1183, amends Regulation (EU) 910/2014 and significantly strengthens the legal validity of digital documents across the EU by expanding and clarifying the rules around electronic signatures, verifiable credentials, and trust services. Under the updated regulation, documents signed using qualified electronic signatures carry the same legal weight as handwritten signatures in all EU member states. This applies to both individuals and organisations, and the framework now extends to a broader range of document types than the original regulation. The sections below walk through the key questions organisations are asking as they prepare for the new rules.
What changes does eIDAS 2.0 make to electronic signature rules?
eIDAS 2.0 builds on the original eIDAS regulation by strengthening the legal framework for electronic signatures and extending it to new contexts. One significant change is that qualified electronic signatures (QES) are now more explicitly tied to the European Digital Identity Wallet, making them more accessible to individuals and businesses across all member states. The regulation also introduces clearer rules for remote signing and for signatures issued on behalf of organisations. It is worth noting that remote signing already existed under the original eIDAS regulation; eIDAS 2.0 refines and extends the framework around it.
Under the original regulation, qualified electronic signatures already had full legal equivalence to handwritten signatures. eIDAS 2.0 does not change that principle, but it does make it easier to achieve that level of assurance. Signing a contract, authorising a transaction, or issuing a formal document can now be done remotely using wallet-based credentials, without sacrificing legal standing. A QES requires a qualified certificate and a Qualified Signature Creation Device (QSCD). National formal requirements for specific document types remain applicable alongside eIDAS rules.
Another important update is the introduction of qualified electronic ledgers and qualified electronic archiving services as recognised trust services. These additions mean that organisations can rely on regulated, legally recognised infrastructure to store and preserve signed documents over time, which matters for compliance in regulated sectors.
Are documents signed with the EUDI Wallet legally valid?
Yes. Documents signed using the European Digital Identity Wallet are legally valid across the EU, provided the signature meets the requirements for a qualified electronic signature under eIDAS 2.0. The EUDI Wallet is designed to support qualified signatures, meaning that any document signed through the wallet carries the same legal force as a handwritten signature in every member state.
The legal validity stems from the way the wallet handles identity verification and cryptographic signing. When a user signs a document through the wallet, their identity has already been verified to a high level of assurance by a trusted issuer. The signature is then cryptographically bound to that verified identity, creating a tamper-evident record that can be validated by any relying party.
Validating a signed document involves more than a single cryptographic check. A relying party should verify the issuer’s signature against the relevant national trusted lists, check the revocation status using the issuer’s status information, and verify the wallet unit attestation to confirm that the presenting wallet runs on a certified wallet solution. Only the first of these checks can be performed fully offline.
This is a meaningful shift from older digital signing methods, where legal validity often depended on which country the signature was issued in and whether that country’s trust infrastructure was recognised elsewhere. With the EUDI Wallet, legal recognition is built into the framework from the start. Organisations accepting signed documents no longer need to assess each signature’s origin on a case-by-case basis, provided the wallet has been certified and notified in accordance with the applicable requirements.
It is worth noting that governance of the EUDI Wallet is a shared responsibility. The European Commission manages the legal framework and adopts implementing acts that contain legally binding requirements. Member States are responsible for providing or mandating wallet solutions, certifying and notifying them, and supervising actors within their jurisdiction. The European Digital Identity Cooperation Group supports cross-border alignment, while wallet providers, issuers of Person Identification Data and attestations, qualified trust service providers, and relying parties each carry distinct responsibilities within the ecosystem. No single central European authority operationally manages all EUDI Wallets.
What types of digital documents does eIDAS 2.0 cover?
eIDAS 2.0 covers a wide range of digital documents, going well beyond simple contracts or identity proofs. The regulation recognises any document that is issued, signed, or exchanged using a qualified trust service as having legal standing. This includes electronically signed contracts, certified digital credentials, qualified electronic seals for organisations, and time-stamped records. A qualified electronic seal has a distinct legal effect from a qualified electronic signature and should not be treated as equivalent to a handwritten signature.
The EUDI Wallet specifically supports the following types of digital documents in daily and professional life:
- Mobile driving licences, usable in both online and physical interactions
- Travel documents such as passports and visas for use at border controls
- Educational credentials including diplomas, degrees, and certificates
- Prescription data shared with pharmacies for medical dispensation
- Proof of organisational representation for business transactions
- Social security documents including the European Health Insurance Card
- Identity verification for opening bank accounts or initiating payments
What makes this significant for organisations is that these documents are verifiable credentials, meaning their authenticity can be confirmed by any party that accepts them, subject to the verification steps described above. This reduces the need for manual verification, physical copies, or repeated identity checks across different services. The availability of specific credential types will depend on national rollout progress and the readiness of issuers in each member state.
How does cross-border recognition of digital documents work under eIDAS 2.0?
Under eIDAS 2.0, digital documents and electronic signatures issued in one EU member state are automatically recognised in all other member states, provided they meet the relevant trust level requirements. This mutual recognition is mandatory, which is a key improvement over the original regulation where cross-border recognition was inconsistent in practice.
The mechanism behind this is the European Trusted List system. Each member state maintains a trusted list of qualified trust service providers. These national trusted lists are brought together in the EU List of Trusted Lists (LOTL). When a document is signed or a credential is issued by a provider on a national trusted list, other member states are legally required to accept it. The EUDI Wallet strengthens this further by using a common technical framework, the Architecture and Reference Framework (ARF), which provides the technical elaboration of the requirements set out in the implementing acts and helps ensure that wallets from different countries can interoperate with each other and with private sector relying parties.
For organisations operating across borders, this is a practical step forward. A contract signed by a customer in Germany using their national EUDI Wallet can be valid for a service provider in France or Spain, provided the relevant wallet has been certified and notified and the relying party is registered under the applicable national framework in accordance with CIR (EU) 2025/848. It is important to understand that cross-border interoperability operates at the level of the European framework. National registration requirements, sector-specific legislation, and the specific legal consequences of a given credential may still vary between member states. Cross-border recognition may develop in phases as national implementations mature.
Organisations working in financial services and other cross-border sectors will feel this benefit most directly, as it removes one of the main friction points in international digital transactions, even as they remain attentive to national and sector-specific requirements.
Which sectors are most affected by eIDAS 2.0 document validity rules?
The sectors most affected by eIDAS 2.0 are those where document authenticity, identity verification, and legal accountability are central to daily operations. Finance, government, healthcare, and education are at the top of this list, but the impact extends to any organisation that issues, accepts, or relies on legally binding documents.
Here is how the rules apply across key sectors:
- Financial services: Banks, insurers, and payment providers must accept EUDI Wallet-based identity verification for onboarding and transactions. eIDAS 2.0 aligns with KYC, AML, and PSD2 requirements, making wallet-verified identities a valid basis for compliance checks. The obligation for relevant private sector relying parties, including financial services, applies from 24 December 2027 under Article 5f of the regulation. Micro and small enterprises with fewer than 50 employees and an annual turnover or balance sheet total not exceeding 10 million euros are exempt.
- Government: Public authorities are required to accept the EUDI Wallet for access to digital public services from 24 December 2026. This includes services such as tax filings and social security applications. Public sector organisations must also issue wallet-compatible credentials to citizens, in accordance with the obligations set out in the regulation and the relevant implementing acts.
- Healthcare: Prescription data, patient identity, and consent documents can be exchanged using wallet credentials. This supports both cross-border care and domestic digital health services. Processing health data requires a legal basis under Article 9(2) GDPR in addition to a standard GDPR basis.
- Education: Institutions can issue digitally verifiable diplomas and certificates through the wallet, reducing fraud and simplifying verification for employers and admissions offices.
- Pharmaceuticals: Prescription validation and supply chain documentation benefit from the trusted, verifiable credential model that eIDAS 2.0 enables.
Organisations in healthcare and life sciences face a particularly complex set of requirements, as they must balance patient privacy, cross-border data exchange, and strict regulatory obligations simultaneously.
What should organisations do to ensure their documents meet eIDAS 2.0 requirements?
To ensure digital documents meet eIDAS 2.0 requirements, organisations need to assess their current signing and identity infrastructure, identify gaps against the new trust service requirements, and build or integrate systems that support qualified electronic signatures and wallet-compatible credentials. The legal deadline by which member states must make EUDI Wallets available to citizens and businesses is 24 December 2026. That deadline reflects a legal obligation on member states. It does not guarantee that every national wallet will have reached the same level of maturity or that every cross-border use case will be fully operational across all member states on that date. Practical interoperability and national rollout are likely to develop in phases, and organisations should plan accordingly.
The practical steps organisations should take include:
- Reviewing existing digital signing processes to determine whether they currently meet qualified, advanced, or basic electronic signature standards
- Assessing whether current identity verification methods will be accepted under eIDAS 2.0 trust level requirements
- Engaging with qualified trust service providers to update or replace legacy signing infrastructure
- Preparing internal systems to accept EUDI Wallet credentials from customers, partners, and employees
- Registering as a relying party with the relevant national authority under CIR (EU) 2025/848 before requesting wallet data, and defining the intended use and attribute scope for each use case
- Updating compliance documentation to reflect the new legal framework, particularly for sectors subject to AML, KYC, or GDPR obligations
Organisations should also pay attention to the qualified electronic archiving requirements under eIDAS 2.0. Storing signed documents in a legally recognised archive is increasingly important for audit trails and long-term enforceability, particularly in regulated industries. You can explore relevant resources and guidance to support your preparation process.
How TrustTech supports eIDAS 2.0 document validity
Preparing for eIDAS 2.0 involves connecting identity verification, qualified signing, and compliance into a single, trusted workflow. The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
For organisations working with signed documents and verified credentials, the ID Connector handles:
- Verification of issuer signatures against national trusted lists, brought together in the EU List of Trusted Lists
- Revocation status checks using issuer-provided status information
- Validation of wallet unit attestations to confirm the presenting wallet runs on a certified wallet solution
- Enforcement of the registered attribute scope, so only attributes declared in the relying party’s registration under CIR (EU) 2025/848 are requested
- Qualified signing via a connected qualified trust service provider
- Reuse of verified identity data across services, reducing repeated checks for customers and partners
This applies across financial services, government, healthcare, and pharma, where document validity, identity assurance, and regulatory compliance all depend on the same underlying infrastructure. To discuss what eIDAS 2.0 means for your organisation’s document workflows, get in touch with our team.