The EUDI Wallet relies on a set of open, internationally recognized technical standards to ensure secure, interoperable, and privacy-respecting identity exchanges across Europe. The core standards include SD-JWT VC, ISO/IEC 18013-5 (mdoc), OpenID for Verifiable Credentials (OpenID4VC), and the Architecture and Reference Framework (ARF) published by the European Commission. These standards work together to define how identity data is formatted, requested, and exchanged between wallets, issuers, and relying parties. This article unpacks each standard, explains how they relate to one another, and outlines what organizations should do to prepare.

Which technical standards does the EUDI Wallet actually use?

The EUDI Wallet is built on a combination of credential format standards, protocol standards, and a governance framework. The main technical building blocks are SD-JWT VC (Selective Disclosure JWT Verifiable Credentials), ISO/IEC 18013-5 (the mdoc format), and the OpenID4VC protocol suite. These are brought together under the Architecture and Reference Framework (ARF), which acts as the technical blueprint for all EUDI Wallet implementations.

Each standard plays a distinct role. Credential format standards define how identity data is structured and encoded. Protocol standards define how that data is requested and transferred. The ARF ties everything together by specifying which standards are required, how they interact, and what conformance means in the context of eIDAS 2.0.

The ARF is maintained by the eIDAS Expert Group and updated as the regulation and its implementing acts evolve. It references a wide range of adopted Commission Implementing Regulations covering everything from credential formats and wallet certification to cross-border identity matching and trust service requirements. For organizations preparing for eIDAS 2.0 technical compliance, the ARF is the primary reference document.

What is the difference between SD-JWT and mdoc credential formats?

SD-JWT VC and mdoc are two different formats for encoding verifiable credentials, and the EUDI Wallet supports both. The key difference is their origin and primary use case: SD-JWT VC is a web-native format built on JSON and JWT standards, while mdoc (mobile document) is an ISO standard originally designed for mobile driving licenses and physical document use cases.

SD-JWT VC

SD-JWT VC stands for Selective Disclosure JSON Web Token Verifiable Credential. It builds on the widely used JWT format and adds selective disclosure, meaning the holder can choose to reveal only specific attributes from a credential without exposing the rest. This is particularly important for privacy, since a user can prove their age without sharing their full date of birth, or confirm their nationality without revealing their home address. SD-JWT VC is well suited to online and app-based interactions where JSON and web protocols are the norm.

mdoc (ISO/IEC 18013-5)

The mdoc format is defined by ISO/IEC 18013-5 and was originally developed for mobile driving licenses. It uses CBOR (Concise Binary Object Representation) encoding rather than JSON, making it more compact and efficient for certain environments. mdoc also supports selective disclosure and is designed with strong security properties for both proximity (in-person) and remote interactions. Because of its physical document heritage, it is well suited to use cases like border crossing, age verification at a point of sale, or presenting a digital driving license to a police officer.

In practice, the EUDI Wallet supports both formats because different use cases call for different approaches. The ARF specifies when each format applies and how relying parties should handle both.

How does OpenID4VC enable credential exchange in the wallet?

OpenID4VC is a suite of protocols that defines how verifiable credentials are issued to and presented from a digital identity wallet. It consists of two main components: OpenID for Verifiable Credential Issuance (OpenID4VCI), which governs how a wallet receives credentials from an issuer, and OpenID for Verifiable Presentations (OpenID4VP), which governs how a wallet presents credentials to a relying party.

OpenID4VCI allows an issuer, such as a government authority or a bank, to securely deliver a credential into the user’s wallet. The protocol handles authentication, authorization, and the actual transfer of the credential in a standardized way. This means any wallet that supports OpenID4VCI can receive credentials from any issuer that also supports it, regardless of who built either system.

OpenID4VP handles the presentation side. When a relying party, such as an online service or a physical kiosk, needs to verify an attribute, it sends a presentation request to the wallet. The wallet, with the user’s consent, responds with the relevant credential data. OpenID4VP works with both SD-JWT VC and mdoc formats, making it a flexible layer that connects the credential formats to the real-world exchange scenarios the wallet is designed for.

Together, OpenID4VCI and OpenID4VP form the backbone of how digital identity standards flow through the EUDI ecosystem. They are built on well-established OAuth 2.0 and OpenID Connect foundations, which means many organizations already have some familiarity with the underlying patterns.

What role does ISO/IEC 18013-5 play in the eIDAS 2.0 ecosystem?

ISO/IEC 18013-5 defines the mdoc credential format and the associated data model and protocols for mobile documents. In the eIDAS 2.0 ecosystem, it plays a central role in use cases that require high-assurance, in-person or proximity-based identity verification, as well as regulated document types like the mobile driving license (mDL).

The standard is particularly relevant for government-issued credentials. Because ISO/IEC 18013-5 was developed through the ISO standards process with strong input from governments and document issuance authorities, it carries significant weight in regulated contexts. The EUDI Wallet’s support for mdoc ensures that high-assurance credentials like national identity documents and driving licenses can be represented in a format that meets both EU regulatory requirements and international standards.

For organizations in sectors like financial services or government services, ISO/IEC 18013-5 matters because it defines the trust model and security requirements for the credentials they will receive and verify. Understanding this standard is essential for building relying party integrations that can handle government-issued mdoc credentials correctly.

Are these standards finalized, or are they still evolving?

The standards supporting the EUDI Wallet are at different stages of maturity, and some are still being refined. ISO/IEC 18013-5 is a published, stable ISO standard. The OpenID4VC specifications (OpenID4VCI and OpenID4VP) are mature drafts that have reached a high level of stability, but they continue to be updated through the OpenID Foundation’s working groups. SD-JWT VC is similarly stable but still progressing through the IETF standardization process.

The ARF itself is updated regularly by the European Commission as new implementing regulations are adopted and as feedback from the large-scale pilot projects is incorporated. As of 2026, the pilots have concluded and their insights are feeding into the final technical specifications. This means the overall direction is clear and stable enough for organizations to begin implementation, but specific details can still change.

The practical implication for organizations is this: building on the current ARF version is the right approach, but staying connected to updates from the European Commission and the relevant standards bodies is equally important. The core patterns, such as using OpenID4VC for credential exchange and supporting both SD-JWT and mdoc formats, are unlikely to change fundamentally. The fine-grained details of profiles, conformance requirements, and interoperability specifications are where updates are most likely to occur.

How should organizations prepare for eIDAS 2.0 technical compliance?

Preparing for eIDAS 2.0 technical compliance means understanding which standards apply to your role in the ecosystem, whether you are a wallet issuer, a credential issuer, or a relying party, and then building or adapting your systems accordingly. The earlier you start, the more time you have to test integrations, address gaps, and align with evolving specifications.

Here is a practical sequence to follow:

1. Identify your role in the EUDI ecosystem. Are you issuing credentials, accepting them, or both? Your role determines which standards and compliance requirements apply directly to you.
2. Review the current ARF version. The Architecture and Reference Framework is the authoritative source for technical requirements. Make sure your team is working from the latest version.
3. Assess your credential format readiness. Determine whether your systems need to support SD-JWT VC, mdoc, or both, and what changes are needed to your data models and issuance pipelines.
4. Evaluate your protocol support. Check whether your existing infrastructure can support OpenID4VCI and OpenID4VP, or whether new components are needed.
5. Follow the large-scale pilot outputs. The pilot projects have generated valuable real-world feedback on what works and what does not. This information is publicly available and can save significant time during your own implementation.
6. Plan for ongoing updates. Build a process for monitoring changes to the ARF and the implementing regulations so your compliance posture stays current.

Organizations in healthcare, finance, and other regulated sectors should also consider how verifiable credentials connect to their existing identity verification and compliance workflows. The goal is not to rebuild everything from scratch, but to extend what you already have in a way that is wallet-ready and eIDAS 2.0 compliant. Exploring how to approach this transition early will help you avoid last-minute scrambles.

How TrustTech helps with eIDAS 2.0 technical standards

Navigating the technical landscape of eIDAS 2.0 is complex, especially when standards are still evolving and your organization needs to stay compliant while continuing to serve customers. TrustTech is built specifically to support this transition.

Here is what TrustTech brings to the table:

• eIDAS 2.0-ready infrastructure that supports SD-JWT VC, mdoc, OpenID4VCI, and OpenID4VP out of the box
• Reusable identity and compliance workflows that connect wallet-based credentials to your onboarding, signing, and verification processes
• Sector-specific expertise in finance, government, healthcare, and science, so the implementation fits your regulatory context
• Ongoing alignment with the ARF and the Commission’s implementing regulations, so you stay current without having to monitor every update yourself
• Fast time to production, with a track record of getting organizations live in under five months

Whether you are just starting to map your technical requirements or already deep in implementation, TrustTech can help you move forward with confidence. Get in touch with TrustTech to discuss your eIDAS 2.0 technical readiness and find out how we can support your next steps.