Organizations should prepare for eIDAS 2.0 implementation by auditing their current identity infrastructure, understanding which obligations apply to their sector, and taking concrete steps to become compatible with the European Digital Identity Wallet. The regulation is not a distant prospect: member states are legally required to make EUDI Wallets available to citizens and businesses by 24 December 2026, which means the preparation window is now. This article walks through the most important questions organizations are asking as they get started.
What does eIDAS 2.0 actually require organizations to do?
eIDAS 2.0, Regulation (EU) 2024/1183, amends Regulation (EU) 910/2014 and requires certain categories of organizations to accept the European Digital Identity Wallet as a valid means of authentication and identity verification. Beyond acceptance, organizations must align their digital identity processes, data handling, and trust service integrations with the updated regulatory framework. This affects how they onboard users, verify credentials, and handle digital signatures.
At its core, eIDAS 2.0 builds on the original eIDAS regulation but closes significant gaps. Where the original framework left it up to member states whether to build and promote national eID schemes, the new regulation makes it mandatory. Every EU member state must issue a EUDI Wallet to any citizen, resident, or business that wants one.
For organizations, this translates into several concrete obligations:
- Accepting EUDI Wallets for authentication in services where strong identity verification is required, subject to the applicable acceptance deadline for their sector
- Becoming a registered relying party under CIR (EU) 2025/848 before requesting wallet data, registering with the national authority of the member state of establishment
- Ensuring that identity data exchanges meet the technical standards set out in the Architecture and Reference Framework, which provides the technical elaboration of the legally binding requirements contained in the implementing acts
- Aligning trust service integrations with updated requirements for qualified electronic signatures, seals, and timestamps
- Reviewing data minimization practices, since the wallet is designed so users share only what is strictly necessary for each interaction
The regulation also introduces new categories of qualified trust services, including qualified electronic ledgers and qualified electronic archiving services, which expand the compliance surface for organizations that rely on these services.
Governance of the EUDI Wallet framework is a shared responsibility. The European Commission manages the legal framework and adopts implementing acts. Member states provide or mandate wallet solutions, certify and notify them, and supervise actors within their jurisdiction. The European Digital Identity Cooperation Group supports cooperation and cross-border alignment. National competent authorities and registrars, wallet providers, issuers of Person Identification Data and attestations, qualified trust service providers, and relying parties each carry distinct responsibilities within this structure.
Which organizations are most affected by eIDAS 2.0?
Organizations in regulated sectors with high-trust digital interactions are most directly affected by eIDAS 2.0. The regulation establishes two separate acceptance obligations with different deadlines and scopes.
From 24 December 2026, public sector bodies must accept notified EUDI Wallets for online services that require electronic identification. From 24 December 2027, Article 5f extends the obligation to relevant regulated private sectors where strong user authentication is required by law or contract. Those sectors include banking and financial services, healthcare, telecommunications, energy, transport, education, social security, drinking water, postal services, digital infrastructure, and digital services. Micro and small enterprises are excluded from this private sector obligation: organizations with fewer than 50 employees and an annual turnover or balance sheet total of no more than 10 million euros fall outside the scope.
Very large online platforms are covered by a separate provision of Article 5f. For VLOPs, the obligation applies where the platform requires user authentication, on the voluntary request of the user and for the minimum necessary data. The condition of legally or contractually required strong authentication does not apply to VLOPs.
The impact goes beyond the organizations explicitly named in the regulation. Any business that currently asks users to prove their identity digitally will need to consider how the EUDI Wallet changes user expectations and competitive dynamics. If your competitors accept the wallet and you do not, that friction becomes a business problem as well as a compliance one.
Organizations in financial services face particular urgency. Strong Customer Authentication requirements under PSD2 intersect directly with eIDAS 2.0, and the wallet is expected to become a recognized method for meeting those requirements. Similarly, healthcare organizations handling sensitive patient data will need to assess how wallet-based identity fits into their consent and verification workflows, including the additional requirements under Article 9(2) GDPR for health data.
What is the timeline for eIDAS 2.0 compliance deadlines?
Regulation (EU) 2024/1183 entered into force on 20 May 2024. By the end of 2024, the first five core implementing acts had been adopted, triggering the relevant 24-month period. The legal deadline of 24 December 2026 requires EU member states to make the European Digital Identity Wallet available to all citizens, residents, and businesses. Public sector bodies in mandatory acceptance categories must be ready to accept wallet-based identity from that date.
The private sector acceptance obligation under Article 5f applies from 24 December 2027 to the regulated sectors listed above. Organizations should plan their implementation timelines against these two distinct dates, not a single go-live moment.
It is also important to distinguish between the legal deadline itself, the availability of certified and notified national wallets, the opening of relying party registration by national competent authorities under CIR (EU) 2025/848 of 6 May 2025, and the point at which operational cross-border interoperability is functioning in practice. These milestones will not necessarily coincide across all member states.
The implementing acts contain the legally binding requirements. The Architecture and Reference Framework provides the technical elaboration of those requirements. Both have gone through multiple iterations, and the Commission has issued a range of implementing regulations covering everything from wallet certification to cross-border identity matching. Organizations should verify the current ARF version before finalizing their technical implementation.
Four large-scale pilot projects ran from April 2023 through 2025 and have now concluded. The POTENTIAL consortium tested government services, bank account opening, SIM registration, mobile driving licences, remote qualified signatures, and e-prescriptions. The EWC consortium covered Digital Travel Credentials, payments, and organisational digital identity. NOBID focused on payments. DC4EU addressed education and social security. The insights from those pilots fed directly into the final technical specifications that organizations will need to implement. A second wave of pilots started in 2025: WE BUILD covers business wallets and payments, and APTITUDE covers travel, ticketing, vehicle registration, and payments.
In practical terms, readiness requirements will vary by member state and service category. Technical integration, compliance assessment, and staff readiness all take time. Preparation needs to start now.
How should organizations assess their current identity infrastructure gaps?
Organizations should assess their identity infrastructure gaps by mapping every touchpoint where identity is verified, credentials are exchanged, or signatures are applied, and then testing each against eIDAS 2.0 requirements. The goal is to identify where current systems cannot support wallet-based interactions, verifiable credentials, or updated trust service standards.
A practical gap assessment covers several dimensions:
- Onboarding flows: Can your current onboarding process accept a EUDI Wallet presentation instead of a manual document upload or third-party identity check?
- Authentication methods: Are your login and re-authentication mechanisms compatible with wallet-based identity assertions? Note that users approve each wallet presentation individually.
- Data handling: Does your system support selective disclosure, where users share only the specific attributes needed for a given interaction?
- Trust service integrations: Are your electronic signature and seal solutions aligned with the updated qualified trust service requirements under eIDAS 2.0? Note that a qualified electronic seal has a different legal effect from a qualified electronic signature and must not be treated as equivalent to one.
- Interoperability: Can your systems communicate with wallet providers and other relying parties across borders? Cross-border interoperability operates at the European framework level, but national registration requirements and sector-specific legislation continue to apply. Not every credential automatically carries the same legal consequence in every member state.
- Compliance documentation: Do you have the audit trails, consent records, and data processing documentation that regulators will expect? Your organization needs its own GDPR legal basis for processing wallet-derived data, separate from the user’s approval of a wallet presentation request.
Many organizations discover that their identity infrastructure was built for a pre-wallet world: each onboarding is independent, credentials are not reusable, and compliance checks are repeated from scratch every time. That model is exactly what eIDAS 2.0 is designed to replace. Identifying those gaps early is what makes a realistic implementation plan possible.
What technical changes are needed to accept the EUDI Wallet?
To accept the EUDI Wallet, organizations need to register as a relying party under CIR (EU) 2025/848 with the national authority of their member state of establishment before requesting any wallet data. Registration covers each intended use, specifying which attributes and attestations will be requested. The wallet checks requests against this registered scope. After registration, organizations must implement support for the technical protocols defined in the Architecture and Reference Framework and integrate verifiable credential presentation flows into their applications. This requires backend changes, updated APIs, and in many cases new identity middleware.
The technical foundation of the EUDI Wallet is built on open standards. The ARF specifies mdoc and SD-JWT VC as the supported credential formats, with ISO/IEC 18013-5 for proximity presentation, ISO/IEC TS 18013-7 for online presentation, OID4VCI for issuance, and OID4VP for presentation. The High Assurance Interoperability Profile (HAIP) defines the interoperability requirements that implementations must meet. Organizations will need to support the presentation of Person Identification Data and Electronic Attestations of Attributes. These are tamper-evident and cryptographically signed, meaning your systems need to validate them correctly.
Verification is not a single cryptographic check. Three separate controls are involved: verifying the issuer’s signature against the relevant national trusted list, which is part of the EU List of Trusted Lists; checking revocation status via the issuer’s status information; and validating the wallet unit attestation to confirm that the presenting wallet runs on a certified wallet solution. Only the first of these can be performed fully offline.
The regulation distinguishes between Qualified Electronic Attestations of Attributes (QEAA), Public Body Attestations (PuB-EAA), and non-qualified Electronic Attestations of Attributes. PuB-EAA is a separate category and must not be placed under non-qualified EAA.
Key technical steps include:
- Registering as a relying party under CIR (EU) 2025/848 and specifying the attributes and attestations required per intended use before requesting wallet data
- Implementing the protocols and interfaces specified in the Architecture and Reference Framework for wallet interactions, including HAIP compliance
- Supporting selective disclosure so that your systems only request and process the attributes they genuinely need
- Integrating with certified wallet solutions and ensuring your technical stack can handle cross-border identity matching, while accounting for the fact that national and sector-specific requirements continue to apply alongside the European framework
- Updating your qualified electronic signature workflows if you rely on remote signing or qualified trust services. Note that a relying party does not automatically require a qualified trust service provider for wallet acceptance. A QTSP becomes relevant where qualified signing or qualified attestations are involved.
For organizations that currently handle identity verification in-house, this is a significant undertaking. For those already working with modern identity platforms, the path to wallet compatibility is shorter but still requires deliberate integration work. The digital identity solutions available today are increasingly designed with eIDAS 2.0 readiness built in, which reduces the custom development burden.
Where should organizations start with their eIDAS 2.0 preparation?
Organizations should start their eIDAS 2.0 preparation by identifying which obligations apply to them, conducting a gap assessment of their current identity infrastructure, and assigning ownership of the compliance and implementation workstream. Starting with clarity on scope prevents wasted effort and helps prioritize the changes that matter most.
In practice, the first steps look like this. First, determine whether your organization falls into a mandatory acceptance category under the 24 December 2026 deadline for public sector bodies, the 24 December 2027 deadline for regulated private sector organizations under Article 5f, or the separate VLOP provision, or whether wallet readiness is primarily a competitive and strategic priority. The urgency and sequence differ across these situations. Second, map your current identity touchpoints and test them against the eIDAS 2.0 requirements described above. Third, engage your IT, compliance, legal, and business teams early: eIDAS 2.0 is not a purely technical project, and decisions about data minimization, user consent, and cross-border interoperability have business and legal dimensions that extend beyond the European framework into national and sector-specific rules.
Organizations in government services will often have different starting points than those in financial services or healthcare. Sector-specific guidance and use cases from the large-scale pilots are a useful reference for understanding what wallet-based interactions look like in practice. Because national rollout will develop at different speeds across member states, organizations operating across borders should monitor the certification and notification status of individual national wallets and the opening of relying party registration in each relevant jurisdiction.
One practical principle worth keeping in mind: the organizations that will adapt most smoothly are those that treat eIDAS 2.0 as an opportunity to rebuild identity processes that have long been fragmented, slow, and friction-heavy. Reusable identity, portable credentials, and trusted digital signatures are the building blocks of better digital experiences for both organizations and their users. Exploring the available resources on digital identity implementation can help teams get up to speed quickly.
How TrustTech supports eIDAS 2.0 implementation
The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
For organizations preparing for eIDAS 2.0, the ID Connector handles the technical complexity of wallet acceptance directly. Specifically, it covers:
- Relying party registration and management of the registered attribute scope per intended use, so that wallet requests stay within the boundaries set under CIR (EU) 2025/848
- Verification against national trusted lists, as part of the EU List of Trusted Lists, for issuer signature validation
- Revocation status checking via issuer status information
- Wallet unit attestation validation to confirm that a presenting wallet runs on a certified wallet solution
- Reuse of verified identity data across onboarding, login, and signing flows, reducing repeated verification steps
- Qualified signing via a connected QTSP, for organizations that need qualified electronic signatures as part of their workflows
The ID Connector is relevant across financial services, healthcare, pharma, and government, where the combination of wallet acceptance, trust management, and qualified signing needs to work as a single integrated flow. Organizations can reach production in under five months, with measurably faster onboarding and fewer compliance bottlenecks.
Get in touch with TrustTech to discuss which obligations apply to your organization and what the right next steps look like for your sector.