Under eIDAS 2.0, high assurance is the highest identity assurance level defined in the regulation. It means that an identity has been verified with the greatest possible certainty, using robust proofing methods and strong multi-factor authentication. High assurance applies when the risk of identity fraud or misuse is significant enough to demand the strongest available safeguards.
eIDAS 2.0 amends Regulation (EU) 910/2014 and defines three levels of assurance, with high at the top. Understanding what it requires, how it differs from the level below it, and where it applies helps organizations decide whether their current identity infrastructure is fit for purpose. The sections below walk through each of these questions in a practical, accessible way.
What are the three assurance levels defined in eIDAS 2.0?
eIDAS 2.0 defines three identity assurance levels: low, substantial, and high. Each level reflects a different degree of confidence in a person’s claimed identity, based on how that identity was verified and how it is authenticated during use. The higher the level, the more rigorous the requirements for both enrollment and ongoing authentication.
The three levels form a tiered framework that organizations and Member States can apply depending on the sensitivity of a service or transaction:
- Low assurance offers a limited degree of confidence. It is suitable for services where the consequences of identity fraud are minimal and basic self-assertion is sufficient.
- Substantial assurance provides a moderate level of confidence. It requires verified identity proofing and multi-factor authentication, making it appropriate for a wide range of online services.
- High assurance provides the greatest degree of confidence. It demands the most stringent identity proofing and the strongest authentication methods, and is reserved for high-risk services and sensitive transactions.
This tiered approach allows organizations to match the level of identity assurance to the actual risk involved in a given interaction. For many regulated sectors such as finance, healthcare, and government, high assurance is not optional but a regulatory expectation.
What specific requirements must an identity scheme meet for high assurance?
To qualify as high assurance under eIDAS 2.0, an identity scheme must meet strict requirements across two dimensions: identity proofing (how the identity is established) and authentication (how the identity is verified at the point of use). Both dimensions must independently satisfy the high assurance criteria.
For identity proofing, the scheme must verify that the claimed identity exists and belongs to the person presenting it. This typically involves checking against authoritative sources such as government-issued documents, and confirming that the person presenting the identity is physically the same individual. Remote proofing methods, such as NFC chip reading from a biometric passport combined with liveness detection, are accepted when they meet the required technical standards.
For authentication, high assurance requires the use of multi-factor authentication where at least two independent factors are used. These factors must come from at least two different categories: something you know, something you have, and something you are. The authenticator itself must be hardware-based or cryptographically secured, making it resistant to cloning, phishing, and replay attacks.
The scheme must also demonstrate that the binding between the verified identity and the authenticator is robust. This means the credential issued after proofing must be securely linked to the individual and protected against unauthorized use or transfer.
How does high assurance differ from substantial assurance under eIDAS 2.0?
The key distinction between high and substantial assurance lies in the strength of the authentication mechanism and the rigor of identity proofing. Substantial assurance requires verified identity and multi-factor authentication, but it permits software-based authenticators and allows slightly more flexibility in proofing methods. High assurance requires hardware-backed authentication and leaves no room for weaker alternatives.
In practical terms, a substantial assurance scheme might use a mobile app with a PIN and biometric unlock as the second factor. A high assurance scheme requires that the cryptographic key used for authentication is stored in a hardware security element, such as a secure enclave on a device or a dedicated hardware token, and cannot be extracted or replicated.
The difference also extends to identity proofing. Substantial assurance allows for remote verification methods that are robust but may rely on document scans and video-based checks. High assurance demands a higher level of certainty, often requiring verification against chip-based documents or in-person checks, combined with biometric comparison.
For organizations deciding which level to target: if your service involves access to sensitive personal data, financial accounts, healthcare records, or legal transactions, substantial assurance may not be sufficient. High assurance is the appropriate baseline for services where the consequences of identity fraud are severe.
Which authentication methods qualify under the high assurance level?
Under eIDAS 2.0, authentication methods that qualify for high assurance must be hardware-backed, cryptographically secured, and resistant to the most common attack vectors, including phishing, man-in-the-middle attacks, and credential theft. The key requirement is that the private cryptographic key used for authentication is stored in a tamper-resistant hardware element and never leaves it.
Methods that meet this standard include:
- Smart cards and hardware tokens that generate cryptographic signatures using keys stored in a secure chip, such as those used in qualified electronic signature creation devices (QSCDs).
- FIDO2 hardware security keys (such as those conforming to the WebAuthn standard) where the authenticator is a physical device with a dedicated secure element.
- Mobile devices with hardware-backed key storage, where authentication relies on a secure enclave or Trusted Execution Environment (TEE) and is combined with biometric verification tied to that hardware.
- National eID cards with chip-based authentication, where the chip stores cryptographic keys and the card is used in combination with a PIN or biometric factor.
Software-only authenticators, even those using biometrics, do not qualify for high assurance on their own because the keys they protect can potentially be extracted or compromised. The hardware requirement is what sets high assurance authentication apart from the methods permitted at the substantial level.
What does high assurance mean for EUDI Wallet compliance?
The European Digital Identity Wallet, introduced under eIDAS 2.0, is designed to operate at the high assurance level by default. This means that the wallet must meet all the identity proofing and authentication requirements described above, and that any identity data stored or presented through the wallet carries the same level of trustworthiness.
For organizations that accept or rely on the EUDI Wallet for identity verification, this has a direct implication: when a user presents credentials from their wallet, those credentials can be trusted at the high assurance level, provided the wallet has been issued and certified in accordance with the regulation. Responsibility for this is shared across several actors. The European Commission manages the legal framework and adopts the implementing acts that set binding requirements. Each Member State is responsible for providing or mandating a wallet solution, certifying it, notifying it, and supervising the relevant actors within its jurisdiction. Wallet providers, issuers of Person Identification Data and attestations, and qualified trust service providers each carry specific obligations under the framework. Relying parties are responsible for verifying that the credentials they receive meet the required assurance level, and must register with the national authority of their Member State of establishment under CIR (EU) 2025/848 before they can request wallet data. This distributed governance model means there is no single central European authority that operationally manages all EUDI Wallets. The Architecture and Reference Framework (ARF) provides the technical elaboration of the requirements set out in the implementing acts, but it is the implementing acts themselves that are legally binding.
Each Member State is required to make at least one certified EUDI Wallet available to citizens, residents, and businesses by 24 December 2026. This is the legal deadline for Member States’ wallet obligations. It does not guarantee that every national wallet will have reached the same level of maturity by that date, or that every possible cross-border use case will be fully operational throughout Europe from that point. Practical interoperability and national rollout are likely to develop in phases, and organizations should plan accordingly. Public sector services across the EU must accept notified wallets from 24 December 2026. For regulated private sector organizations in certain sectors, including banking and financial services, healthcare, telecoms, energy, transport, education, social security, drinking water, postal services, digital infrastructure and digital services, a separate acceptance obligation applies from 24 December 2027 under Article 5f of the regulation, in contexts where strong user authentication is legally or contractually required. Very large online platforms serving more than 45 million users in the EU fall under a separate provision of Article 5f: for those platforms, the obligation applies where the platform requires user authentication, on the voluntary request of the user and for the minimum necessary data. Micro and small enterprises, defined as organizations with fewer than 50 employees and an annual turnover or balance sheet total of no more than 10 million euros, are exempt from the Article 5f obligation. For organizations preparing their systems today, 24 December 2026 marks the point at which wallets become legally required to be available, and acceptance can be tested ahead of the 24 December 2027 obligation that applies to relevant private sector parties.
Which sectors and use cases require high assurance level identity?
High assurance level identity is required wherever the risk of identity fraud is high and the consequences of getting it wrong are serious. Under eIDAS 2.0, certain services are explicitly required to accept high assurance identities, and in regulated sectors the expectation of high assurance is built into existing legal frameworks that run alongside eIDAS.
Sectors and use cases where high assurance is typically required or strongly recommended include:
- Financial services: Opening bank accounts, accessing investment platforms, executing high-value transactions, and meeting KYC and AML obligations under applicable anti-money laundering directives. Note that whether verified identity data from a wallet can be reused for KYC purposes is determined by AML regulation, not by eIDAS 2.0 itself.
- Government services: Accessing tax records, applying for permits or benefits, signing legal documents, and any interaction with public authorities that involves sensitive personal data.
- Healthcare: Accessing patient records, issuing or claiming prescriptions, providing consent for medical procedures, and sharing health data across borders.
- Pharmaceuticals and life sciences: Regulatory submissions, clinical trial access, and supply chain verification where the identity of authorized individuals must be confirmed with certainty.
- Legal and notarial services: Signing contracts, authenticating legal instruments, and verifying the identity of parties to a transaction. eIDAS 2.0 determines the legal effect of electronic signatures, but national formal requirements continue to apply.
It is worth noting that cross-border use of high assurance credentials does not automatically remove national registration requirements or sector-specific legal obligations. Which elements of the EUDI Wallet framework are interoperable at European level and which remain governed by national or sector-specific rules will vary by use case. Organizations in financial services and healthcare in particular are likely to find that high assurance is a compliance requirement, both under eIDAS 2.0 and the sector-specific regulations that apply to them.
How the ID Connector supports high assurance identity under eIDAS 2.0
The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
In the context of high assurance identity, the ID Connector handles several of the technical and compliance tasks that organizations must address before they can reliably accept wallet-based credentials. These include:
- Verification against national trusted lists, which are brought together in the EU List of Trusted Lists (LOTL), to confirm that the issuer of a credential is recognized under the framework.
- Revocation status checks against issuer-provided status information, so that credentials that have been revoked are not accepted.
- Wallet unit attestation validation, confirming that the presenting wallet instance is running on a certified wallet solution.
- Attribute scope management, ensuring that data requests stay within the scope registered by the relying party under CIR (EU) 2025/848.
- Reuse of verified identity data across services, so that a person verified at high assurance level does not need to repeat the full proofing process for every interaction.
- Qualified signing via a connected qualified trust service provider, linking a verified identity to every signature in a way that is legally recognized across the EU.
Organizations in financial services, healthcare, pharma, and government that are preparing for the 24 December 2026 and 24 December 2027 deadlines can use the ID Connector to build high assurance acceptance into their onboarding and authentication flows. Get in touch with TrustTech to discuss what high assurance identity means for your organization and how the ID Connector fits into your setup.