Yes, the EUDI Wallet is designed to be safe for identity verification. It is built on strict European security standards under eIDAS 2.0, which amends Regulation (EU) 910/2014 and requires strong encryption, user-controlled data sharing, and independent certification before any wallet solution can be deployed. The questions below walk through exactly how that safety works in practice, and what it means for organisations that plan to accept the wallet.
How does the EUDI Wallet protect your identity data?
The EUDI Wallet protects your identity data through a combination of cryptographic security, selective disclosure, and user approval. No data leaves the wallet without the user explicitly approving the request, and every piece of shared information is cryptographically signed so that the receiving party can verify its authenticity.
At a practical level, this means the wallet does not act as a simple database of personal details. Instead, it stores verified attestations that are tied to a specific person and issued by a trusted authority, such as a government agency or a qualified trust service provider. When a user presents an attestation, only the information strictly necessary for that interaction is shared. For example, proving you are over 18 does not require sharing your date of birth, your name, or any other detail. This works through selective disclosure of a specific attribute, such as “age over 18”, without requiring zero-knowledge proofs.
This approach, often called selective disclosure, is one of the most important privacy protections built into the EUDI Wallet security model. It limits data exposure by design.
It is worth noting that verifying an attestation involves more than one cryptographic check. A relying party carries out three distinct steps: verifying the issuer’s signature against the relevant national trusted list, checking the revocation status of the attestation using the issuer’s status information, and verifying the wallet unit attestation to confirm that the presenting wallet runs on a certified wallet solution. Only the first of these checks can be performed fully offline. The other two require some form of connectivity.
What security standards does the EUDI Wallet have to meet?
The EUDI Wallet must meet the high assurance level defined under eIDAS 2.0, which is the most demanding tier in the European identity security framework. Wallet solutions are independently audited and certified before they are allowed to operate, and they must comply with technical standards developed through the eIDAS expert process, including the requirements set out in the relevant implementing acts and elaborated in the Architecture and Reference Framework (ARF). The implementing acts are legally binding; the ARF provides the technical elaboration.
These requirements cover several layers of security:
- Cryptographic integrity: Attestations stored in the wallet are digitally signed and tamper-evident. Any modification would immediately invalidate the attestation.
- Device and platform binding: The wallet unit is bound to the user’s device in a way that prevents attestations from being copied or transferred without authorisation. Private keys for PID and attestations do not leave the secure cryptographic device. If a user switches to a new device, attestations are reissued rather than copied.
- Authentication requirements: Users must authenticate themselves, typically using biometrics or a PIN, before the wallet can share any data.
- Interoperability standards: Wallet solutions must follow common technical specifications, including mdoc and SD-JWT VC credential formats, ISO/IEC 18013-5 for proximity presentation, ISO/IEC TS 18013-7 for online presentation, OID4VCI for issuance, and OID4VP for presentation, so they work consistently across all EU Member States.
The eIDAS 2.0 security requirements also apply to the organisations that issue attestations into the wallet. Issuers must themselves be recognised within the European trust framework. National trusted lists, brought together in the EU List of Trusted Lists (LOTL), record which issuers and trust services are recognised. The chain of trust runs from the issuing authority through to the moment an attestation is presented and verified.
The first four Large Scale Pilots ran from April 2023 to 2025 and have concluded. They involved more than 350 entities across 26 Member States, Norway, Iceland, and Ukraine, and tested these standards across real-world scenarios. The POTENTIAL pilot covered government services, opening bank accounts, SIM registration, mobile driving licences, remote qualified signing, and e-prescriptions. EWC focused on Digital Travel Credentials, payments, and organisational digital identity. NOBID concentrated on payments. DC4EU addressed education and social security. A second wave of pilots started in 2025, with WE BUILD covering business wallets and payments, and APTITUDE covering travel, ticketing, vehicle registration, and payments. The insights gathered from these pilots are feeding directly into the final design and security specifications of the wallet.
Who controls the data stored in the EUDI Wallet?
The user controls the data stored in the EUDI Wallet. This is one of the foundational principles of the entire framework. No third party, including the wallet provider, the attestation issuer, or any public authority, can access or share a user’s data without their explicit action and approval.
Governance of the EUDI Wallet is a shared responsibility across several distinct actors. The European Commission manages the legal framework and adopts implementing acts. EU Member States are responsible for providing or mandating wallet solutions, certifying and notifying them, and supervising actors within their jurisdiction. The European Digital Identity Cooperation Group supports cooperation and cross-border alignment. National competent authorities and registrars, wallet providers, issuers of Person Identification Data and attestations, qualified trust service providers, and relying parties each carry specific responsibilities within this structure. No single central European authority operationally manages all EUDI Wallets.
User-centric control works in two important ways. First, users decide which attestations to store in their wallet and which to present in any given interaction. Second, the wallet provides a dashboard that gives users visibility into what has been shared and with whom. This dashboard is a tool for the user, not a logging facility for the wallet provider.
Importantly, the regulation also prohibits wallet providers from tracking users across different services. A government body that issues your digital ID cannot see where you use it. A relying party that verifies your identity through the wallet cannot correlate that interaction with other services you have used. This structural separation is a deliberate design choice to limit large-scale data profiling.
It is also important to distinguish between a user approving a data request in the wallet and giving consent as a legal basis under the GDPR. Each approval covers that specific presentation. The relying party needs its own GDPR legal basis for processing the received data. For KYC purposes, that basis is typically a legal obligation. For health data, an additional condition under Article 9(2) GDPR is required.
For organisations in regulated sectors such as financial services or healthcare, this also has compliance implications. Accepting EUDI Wallet attestations means receiving only the verified data the user has chosen to share, which aligns naturally with data minimisation principles under GDPR.
Can the EUDI Wallet be hacked or misused?
No digital system is entirely immune to risk, but the EUDI Wallet is designed with multiple layers of protection that make it significantly more resistant to hacking and misuse than most existing identity methods. The combination of device binding, cryptographic signing, and high assurance authentication makes it very difficult to impersonate a legitimate user or tamper with attestations.
Several specific protections reduce the risk of misuse:
- Attestations cannot be copied: Because attestations are cryptographically bound to the user’s wallet unit and the private keys do not leave the secure cryptographic device, they cannot simply be extracted and used elsewhere.
- Presentation requires active user approval: Even if a device were compromised, an attestation cannot be presented without the user completing an authentication step and approving the specific request.
- Issuers are verified: Only recognised and audited issuers can place attestations into a wallet. Distinctions apply between Qualified Electronic Attestations of Attributes (QEAA), Public Body Electronic Attestations of Attributes (PuB-EAA), and non-qualified EAA. Each category carries different trust and legal consequences.
- Relying parties are registered: Organisations that want to request attestations from a wallet must register with the national authority of their Member State of establishment under CIR (EU) 2025/848, adopted on 6 May 2025. During registration, a relying party specifies per intended use which attributes and attestations it will request. The wallet checks incoming requests against that registered scope. Anonymous or unregistered parties cannot request data.
The Large Scale Pilots described above specifically stress-tested these protections in realistic scenarios. The feedback gathered has been used to strengthen any weak points before full-scale deployment.
How does the EUDI Wallet compare to existing digital identity methods?
The EUDI Wallet offers stronger privacy, higher assurance, and broader interoperability than most existing digital identity methods. Where traditional approaches rely on username and password combinations, one-time codes, or fragmented national eID systems, the EUDI Wallet provides a single, high-assurance identity that works across borders and across both public and private services.
The current eIDAS framework, in place since 2018, already allows EU Member States to recognise each other’s national eID schemes. However, participation has been uneven, coverage of private sector services is limited, and the user experience varies significantly from one country to another. The EUDI Wallet is designed to close these gaps by creating a consistent, interoperable standard that every Member State must provide. Existing national digital identity systems, such as Austria’s ID Austria infrastructure or the Netherlands’ DigiD and eHerkenning, are separate from the EUDI Wallet, even where the wallet may build on or operate alongside them.
Cross-border interoperability is a core design goal of the framework: a certified wallet solution from one Member State is intended to be usable with an appropriate relying party in another Member State. This does not mean that every use case will immediately be available in every Member State, that sector-specific legislation disappears, or that every attestation automatically carries the same legal consequence everywhere. Some elements of interoperability operate at European level, while others remain national or sector-specific.
Compared to commercial identity solutions such as social login or third-party verification services, the EUDI Wallet gives users far greater control over their data and does not create a dependency on a private platform. Users can access services without sharing unnecessary personal information with intermediaries.
For organisations, the practical difference is also significant. Accepting a EUDI Wallet attestation means receiving cryptographically signed data from a trusted issuer, checked against national trusted lists and verified for revocation status, rather than relying on self-reported information or manual document checks. This reduces fraud risk, speeds up onboarding, and supports compliance with KYC and AML requirements in a more robust way than many current methods allow.
Should organisations accept the EUDI Wallet for identity verification?
Yes, organisations should plan to accept the EUDI Wallet for identity verification. Under eIDAS 2.0, Regulation (EU) 2024/1183, which amends Regulation (EU) 910/2014, specific categories of organisations will be legally required to accept the wallet at different points in time.
From 24 December 2026, public sector bodies must accept notified wallets for online services that require electronic identification. From 24 December 2027, Article 5f extends acceptance obligations to relevant regulated private sectors where strong user authentication is legally or contractually required. These sectors include banking and financial services, healthcare, telecoms, energy, transport, education, social security, drinking water, postal services, digital infrastructure, and digital services. Very large online platforms (VLOPs) are covered by a separate provision of Article 5f: where a platform requires user authentication, it must accept the wallet on the voluntary request of the user and for the minimum necessary data. Micro and small enterprises, defined as organisations with fewer than 50 employees and an annual turnover or balance sheet total of no more than 10 million euros, are exempt.
A relying party does not choose a wallet provider. It must be able to accept every relevant notified wallet, regardless of which Member State issued it. Before requesting wallet data, a relying party must register with the national authority of its Member State of establishment under CIR (EU) 2025/848. A supplier that processes wallet data on behalf of a client does not thereby become the relying party. The registration obligation rests with the organisation that delivers the service to the end user.
From a practical standpoint, accepting EUDI Wallet attestations simplifies identity verification considerably. Organisations can rely on attestations that have already been issued and validated by a trusted authority, reducing the burden of identity proofing, lowering the risk of fraud, and removing the need for users to repeatedly prove themselves from scratch.
Organisations in regulated sectors have additional reasons to act early. The wallet aligns directly with data minimisation requirements under GDPR, supports KYC and AML compliance, and provides a clear audit trail for every verified interaction. For government services, the wallet is already central to the regulatory roadmap leading up to the legal deadline of 24 December 2026, which is the date by which Member States must meet their wallet obligations under eIDAS 2.0.
It is worth understanding what that deadline means in practice. 24 December 2026 is the legal deadline for Member States’ wallet obligations. It is not a guarantee that every national wallet will have the same level of maturity on that date, or that every possible cross-border use case will be fully operational throughout Europe from that moment. Practical interoperability and national rollout are likely to develop in phases. Organisations should build wallet-ready infrastructure progressively so they are well positioned as adoption accelerates across different markets and sectors.
How TrustTech supports EUDI Wallet identity verification
The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
For organisations preparing for the EUDI Wallet, the ID Connector handles the technical and trust-layer work that wallet acceptance requires:
- Wallet acceptance across Member States: the ID Connector connects to every notified wallet solution, so organisations do not need to build separate integrations per country or per wallet provider.
- Trust management and verification: the Connector verifies issuer signatures against national trusted lists brought together in the EU List of Trusted Lists, checks attestation revocation status, and validates wallet unit attestations to confirm the presenting wallet runs on a certified wallet solution.
- Registered attribute scope enforcement: the Connector checks that each data request stays within the scope registered by the relying party under CIR (EU) 2025/848.
- Reusable verified identity: verified data can be used across multiple services without requiring users to start the process again each time.
- Qualified signing: where a transaction requires a qualified electronic signature, the Connector connects to an accredited QTSP, so the signing flow runs through the same interface as identification and login.
The ID Connector is relevant across financial services, healthcare, pharma, and government, where attestation quality, revocation checking, and registered scope all carry direct compliance consequences. If your organisation is preparing for wallet acceptance and wants to understand what the technical and registration requirements mean for your systems and processes, get in touch with TrustTech to see how the ID Connector fits your situation.