What are the three assurance levels defined in eIDAS 2.0?

eIDAS 2.0, Regulation (EU) 2024/1183, amends Regulation (EU) 910/2014 and defines three assurance levels for electronic identification: low, substantial, and high. These levels indicate how reliably a digital identity system can verify that a person is who they claim to be. The higher the level, the stronger the verification process and the greater the trust placed in that identity. These levels carry legal weight under eIDAS 2.0 and determine which services an identity can be used to access across EU member states.

Whether you work in finance, healthcare, government, or another regulated sector, the assurance level you use determines which services you can offer, which risks you accept, and how your systems must be built. This article walks through the most important questions organizations ask about eIDAS assurance levels.

What do the three assurance levels actually mean in practice?

The three eIDAS assurance levels, low, substantial, and high, describe the degree of confidence that a digital identity genuinely belongs to the person using it. Each level sets progressively stricter requirements for how identity is established, managed, and authenticated. In practice, the level you use signals how much trust you are placing in a verified identity when granting access to a service or accepting a digital transaction.

Here is what each level means in everyday terms:

• Low assurance level: The identity has been checked to a basic degree. The risk of error or misuse is limited but not eliminated. This level is suitable for services where the consequences of an incorrect identity are minor.
• Substantial assurance level: The identity has been verified through a more robust process, and authentication requires at least two factors. The risk of impersonation or fraud is significantly reduced. This level is appropriate for services where incorrect identification could cause meaningful harm.
• High assurance level: The identity has been verified to the highest standard, including strong in-person or equivalent remote checks, and authentication is protected against compromise at every step. This level is required where the consequences of a false identity could be severe, such as accessing sensitive personal data or authorizing high-value transactions.

How are the assurance levels determined under eIDAS 2.0?

Under eIDAS 2.0, the assurance level of an electronic identification scheme is determined by evaluating three main areas: how the identity was initially registered and verified (enrollment), how the identity credentials are managed and protected, and how the person authenticates themselves when using the identity. Each area must meet the requirements of the claimed level for the overall scheme to qualify.

During enrollment, the key question is how thoroughly the person’s real-world identity was confirmed. At the low level, a basic self-declaration or simple document check may suffice. At the substantial level, the identity document must be verified and linked to the person, often through a combination of document checks and biometric verification. At the high level, the process must be equivalent to a rigorous in-person check, with strong evidence that the identity document is genuine and that the person presenting it is the legitimate owner.

Authentication requirements also differ significantly. Substantial and high levels both require multi-factor authentication, but the high level adds requirements around the security of the authentication mechanism itself, including resistance to remote attacks and hardware-level protection of credentials.

These criteria are assessed by conformity assessment bodies. Schemes must be formally notified to the European Commission before they can be recognized across member states. The European Digital Identity Cooperation Group plays a central role in supporting cross-border alignment and cooperation on the technical specifications and standards that underpin this assessment process. Legally binding requirements are set out in the implementing acts adopted by the European Commission, while the Architecture and Reference Framework provides the technical elaboration of those requirements.

Which assurance level is required for which use cases?

The required eIDAS assurance level depends on the sensitivity of the service and the risk associated with incorrect identification. eIDAS 2.0 specifies that public sector bodies offering online services must accept electronic identification at the assurance level appropriate to the risk of their service. For many regulated services, the substantial or high level is required by law or by sector-specific regulation.

Some practical examples of how levels map to use cases:

1. Low assurance: Accessing general public information portals, subscribing to newsletters, or using low-risk online services where the impact of a false identity is negligible.
2. Substantial assurance: Opening a bank account remotely, registering a SIM card, accessing government services such as tax filing or social security information, and onboarding for regulated financial services under KYC and AML requirements.
3. High assurance: Accessing highly sensitive personal records such as medical files, authenticating for qualified electronic signatures, cross-border identity verification for critical services, and interactions where identity fraud could have serious legal or financial consequences.

In sectors such as financial services and healthcare, the high assurance level is increasingly the expected standard, particularly as regulations such as PSD2, AML directives, and healthcare data laws require organizations to know with certainty who they are dealing with.

What is the difference between eIDAS 1.0 and eIDAS 2.0 assurance levels?

The three assurance levels, low, substantial, and high, already existed under the original eIDAS regulation from 2014. What eIDAS 2.0 changes is the scope of who must use them, how they are applied, and which identity solutions qualify. The most significant shift is that eIDAS 2.0 extends the framework beyond public sector services and introduces the European Digital Identity Wallet as a new way to reach the high assurance level.

Under eIDAS 1.0, the mutual recognition of notified eID schemes applied only to public sector services, and participation was voluntary for member states. This led to uneven adoption across Europe, with significant differences in which countries had notified schemes and at which assurance levels. Private sector organizations could not rely on the framework in a consistent way.

eIDAS 2.0 addresses this by requiring all member states to make a digital identity wallet available to citizens and businesses, and by opening the framework to private sector relying parties. It also introduces tighter technical requirements and implementing acts that standardize how assurance levels are assessed and certified. The result is a more consistent and interoperable European digital identity landscape, where the same assurance level carries the same meaning regardless of which country issued the identity.

How does the EUDI Wallet relate to assurance levels?

The European Digital Identity Wallet is designed to operate at the high assurance level. This means the identity data stored and shared through the wallet has been verified to the most stringent standard under eIDAS 2.0. When a user presents their wallet credentials to a relying party, that party can trust they are dealing with a verified identity that meets high assurance requirements.

The wallet achieves this through a combination of rigorous identity proofing during setup, cryptographically secured credentials, and strong authentication mechanisms. The wallet also supports selective disclosure, allowing users to share only the specific attributes needed for a transaction, such as confirming they are over 18 without revealing their full date of birth. This can be achieved through selective disclosure of a single attribute, without requiring zero-knowledge proofs. This approach protects privacy while maintaining the integrity of the assurance level.

When a relying party receives a presentation from the wallet, verification involves three distinct checks: confirming the issuer’s signature against the relevant national trusted list (part of the EU List of Trusted Lists), checking the revocation status of the attestation using the issuer’s status information, and validating the wallet unit attestation to confirm that the presenting wallet runs on a certified wallet solution. Only the first of these checks can be performed fully offline.

Governance of the EUDI Wallet is a shared responsibility. The European Commission sets the legal framework and adopts implementing acts. Each member state is responsible for providing or mandating a wallet solution, certifying and notifying it, and supervising the actors within its jurisdiction. Wallet providers, issuers of Person Identification Data and attestations, qualified trust service providers, and relying parties each carry distinct responsibilities within this structure. The European Digital Identity Cooperation Group supports cooperation and cross-border alignment across member states.

The legal deadline for member states to fulfill their wallet obligations is 24 December 2026. This is a legal deadline, not a predicted launch date, and it does not guarantee that every national wallet will have reached the same level of maturity on that date or that every possible cross-border use case will be fully operational throughout Europe at that moment. Practical interoperability and national rollout are expected to develop in phases, and organizations should plan accordingly. For regulated private sector relying parties in areas such as banking, financial services, healthcare, telecoms, energy, transport, and digital services, the obligation under Article 5f of eIDAS 2.0 applies from 24 December 2027. Micro and small enterprises with fewer than 50 employees and an annual turnover or balance sheet total of no more than 10 million euros are exempt from this obligation.

Large-scale pilot programs tested the wallet across sectors. The first four pilots ran from April 2023 to 2025: EWC covered Digital Travel Credentials, payments, and organisational digital identity; POTENTIAL covered government services, opening a bank account, SIM registration, mobile driving licence, remote qualified signatures, and e-prescriptions; NOBID focused on payments; and DC4EU covered education and social security. A second wave of pilots started in 2025, with WE BUILD focusing on business wallets and payments, and APTITUDE covering travel, ticketing, vehicle registration, and payments. For organizations preparing their systems now, understanding how the wallet integrates with their identity verification flows is a key part of their eIDAS 2.0 readiness approach.

What should organizations do to comply with eIDAS 2.0 assurance requirements?

To comply with eIDAS 2.0 assurance requirements, organizations should start by mapping their services to the appropriate assurance level, then assess whether their current identity verification and authentication processes meet the corresponding technical and procedural standards. Compliance is an ongoing process that requires alignment between legal, technical, and operational teams.

Practical steps to get started include:

• Identify which services require which assurance level based on regulatory obligations and risk assessment.
• Review your current identity proofing and authentication processes against eIDAS 2.0 requirements for the relevant level.
• Assess whether your systems are ready to accept EUDI Wallet credentials and verifiable credentials from notified eID schemes.
• Before requesting wallet data, register with the national authority in your member state of establishment under CIR (EU) 2025/848, specifying per intended use which attributes and attestations you will request. The wallet checks each presentation request against this registered scope.
• Engage with qualified trust service providers where your services require qualified electronic signatures, qualified electronic seals, or qualified attestations of attributes.
• Monitor implementing acts as they are published, since eIDAS 2.0 is still being rolled out through a series of detailed technical specifications and legally binding requirements.

Organizations in the government sector face the 24 December 2026 deadline for accepting high assurance identities. Regulated private sector organizations in finance, healthcare, telecoms, energy, transport, and digital services face the 24 December 2027 deadline under Article 5f, subject to the exemption for micro and small enterprises. Cross-border use of EUDI Wallet credentials does not remove national registration requirements or sector-specific legal obligations, and not every credential will automatically carry the same legal consequence in every member state. Early preparation reduces the risk of compliance gaps and positions organizations to benefit from the efficiency gains that reusable, high-assurance digital identity enables. Exploring the available resources on digital identity compliance can help teams build a structured roadmap.

How TrustTech supports eIDAS 2.0 assurance levels

The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.

For organizations working through eIDAS 2.0 assurance requirements, the ID Connector handles the technical steps that assurance compliance depends on:

• Accepting EUDI Wallet presentations at high assurance level across all certified wallet solutions, regardless of the issuing member state.
• Verifying issuer signatures against national trusted lists, checking attestation revocation status, and validating wallet unit attestations to confirm the presenting wallet runs on a certified wallet solution.
• Enforcing the registered attribute scope per intended use, so each presentation request stays within what your organization registered under CIR (EU) 2025/848.
• Supporting selective disclosure flows, including age verification without exposing the full date of birth.
• Connecting to a qualified trust service provider for qualified electronic signatures and qualified electronic seals where your services require them.
• Carrying other identity means, such as national eIDs, bank IDs, and identity documents, through the same interface, so organizations in financial services, healthcare, pharma, and government can consolidate identity flows without rebuilding separate integrations.

Ready to take the next step? Get in touch with TrustTech to discuss how the ID Connector fits your eIDAS 2.0 assurance requirements.