EU member states face significant challenges in implementing the EUDI Wallet, ranging from technical fragmentation and outdated legal frameworks to low citizen trust and coordination gaps between national authorities. These challenges are not unique to one or two countries — they are systemic across the EU, reflecting the scale and ambition of building a unified digital identity infrastructure across 27 different national systems. The sections below break down the most pressing obstacles and what they mean in practice.
Why is EUDI Wallet implementation so complex for member states?
EUDI Wallet implementation is complex because it requires every EU member state to simultaneously modernize technical infrastructure, align national legislation with eIDAS 2.0, and build citizen-facing services, all within a shared European framework that itself is still being finalized. No two member states start from the same position, which makes a uniform rollout extremely difficult.
Some countries already have mature national digital identity systems, such as the Nordic eID schemes, while others are building foundational infrastructure largely from scratch. It is important to distinguish these existing national identity systems from EUDI Wallets: an established national eID scheme is not automatically an EUDI Wallet, and the two should not be treated as interchangeable. This uneven starting point means the gap between the most and least prepared member states is substantial. The European Digital Identity Wallet is an entire ecosystem involving wallet providers, relying parties, trust service providers, and authentic sources such as government registries and healthcare systems. Coordinating all of these actors, across borders, under a shared regulatory framework, is an enormous undertaking. Responsibility for this is distributed: the European Commission manages the legal framework and adopts implementing acts; member states provide or mandate wallet solutions, certify and notify them, and supervise actors within their jurisdiction; and the European Digital Identity Cooperation Group supports cooperation and cross-border alignment between member states and the Commission.
The large-scale pilots launched in April 2023, involving over 350 entities from 26 member states plus Norway, Iceland, and Ukraine, helped surface exactly how complex this coordination is in practice. Even with structured consortia and European Commission co-funding, the pilots revealed that aligning technical standards, legal requirements, and user experience across borders takes far more effort than anticipated.
What technical barriers slow down EUDI Wallet rollout?
The main technical barriers to EUDI Wallet rollout include fragmented national identity infrastructure, a lack of interoperability between existing systems, and the complexity of implementing cryptographic standards at scale across diverse device environments. These are not simple integration problems — they require deep architectural changes in how identity data is stored, shared, and verified.
Many member states rely on legacy identity systems that were not designed for the kind of selective disclosure and verifiable credential exchange that the EUDI Wallet requires. Retrofitting these systems to support the technical specifications set out in the Architecture and Reference Framework (ARF), which provides the technical elaboration of the requirements contained in the implementing acts, demands significant investment in both time and technical expertise.
Interoperability is a particular sticking point. The wallet must work seamlessly across borders for use cases such as opening a bank account, claiming prescriptions, presenting a mobile driving license, or accessing government services. Each of these scenarios involves different data formats, verification protocols, and relying party integrations. The EUDI Wallet framework is designed so that a certified wallet from one member state can be used with an appropriate relying party in another member state, but this does not mean that every use case will immediately be available everywhere, that national registration requirements disappear, or that sector-specific legislation ceases to apply. Achieving consistent, reliable cross-border functionality requires all parties to implement the same technical specifications in compatible ways.
The ARF specifies mdoc and SD-JWT VC as the credential formats for the EUDI Wallet. For proximity presentation, ISO/IEC 18013-5 applies; for online presentation, ISO/IEC TS 18013-7 applies. Credential issuance uses OID4VCI and presentation uses OID4VP. The High Assurance Interoperability Profile (HAIP) provides additional constraints to ensure interoperability across implementations.
Verification involves three distinct checks, not a single cryptographic operation. First, the relying party verifies the issuer’s signature against the relevant national trusted list, which forms part of the EU List of Trusted Lists (LOTL). This check can be performed fully offline. Second, the relying party checks the revocation status of the attestation using status information provided by the issuer, which requires a connection to the issuer’s infrastructure. Third, the relying party validates the wallet unit attestation to confirm that the presenting wallet runs on a certified wallet solution. Describing verification as a process that can take place entirely without contact with the issuer is therefore not accurate in all cases.
Security certification adds another layer of complexity. Wallet solutions must be certified against defined security standards before they can be listed as approved European Digital Identity Wallets. This certification process takes time and requires dedicated conformity assessment bodies, which are not yet uniformly available across all member states.
How do national legal frameworks conflict with eIDAS 2.0 requirements?
National legal frameworks often conflict with eIDAS 2.0 requirements because existing identity, data protection, and sector-specific laws were written before the concept of a universal digital identity wallet existed. Adapting these frameworks requires legislative changes that take time and political will to push through.
eIDAS 2.0, Regulation (EU) 2024/1183, amends Regulation (EU) 910/2014. As an EU regulation, it applies directly in all member states without requiring transposition into national law. However, member states must still take national action to implement and enforce its requirements, including designating competent authorities, certifying wallet solutions, and updating national processes that interact with the wallet framework.
For example, some member states have national laws that require physical presence for identity verification in certain contexts, such as opening a financial account or signing a legal document. These requirements can conflict with the EUDI Wallet’s purpose of enabling fully remote, wallet-based verification. Reconciling these rules means either amending national legislation or creating explicit legal provisions that recognize wallet-based verification as equivalent, where the regulation permits this.
Data protection law adds further complexity. While the GDPR provides a common baseline, national implementations vary, and some member states have stricter rules around what data can be shared, stored, or processed through third-party wallet infrastructure. The eIDAS 2.0 framework introduces concepts such as Person Identification Data (PID) and Electronic Attestations of Attributes (EAA), which need to be clearly defined and recognized in national law before they can be used in legally binding transactions. The legally binding requirements for these concepts are set out in the implementing acts; the ARF provides the technical elaboration that supports their implementation. It is also worth noting that attestations fall into distinct categories: Qualified Electronic Attestations of Attributes (QEAA), issued by Qualified Trust Service Providers; Public Body Electronic Attestations of Attributes (PuB-EAA), issued by or on behalf of public bodies; and non-qualified EAA, issued by other providers. These categories carry different legal weight and are subject to different requirements.
Healthcare and financial services legislation present particularly stubborn conflicts, as these sectors carry their own regulatory requirements that were not written with interoperable digital identity wallets in mind.
Which sectors face the biggest compliance pressure from the EUDI Wallet?
Financial services, healthcare, and government are the sectors facing the greatest compliance pressure from the EUDI Wallet, because they handle the most sensitive identity data and are subject to the strictest existing regulatory requirements. These sectors also represent the highest-volume use cases that the wallet is specifically designed to serve.
In financial services, the wallet intersects with AML, KYC, and PSD2 requirements. Banks and payment providers must determine how wallet-based identity verification fits into their existing compliance workflows, and whether wallet-issued credentials meet the evidentiary standards required for regulatory reporting. Sector-specific legislation does not disappear because a credential is issued through an EUDI Wallet. Organizations must assess how wallet-based verification satisfies their existing regulatory obligations in each jurisdiction, including obligations under AML law, which governs whether and how KYC data can be reused. The NOBID consortium’s large-scale pilot, which focused on domestic and cross-border payment use cases across Nordic, Baltic, Italian, and German participants, demonstrated both the potential and the complexity of integrating wallet-based identity into payment flows.
Healthcare faces similar pressure. The wallet was piloted for prescription claims and access to the European Health Insurance Card, both of which involve sensitive personal health data. Ensuring that wallet-based data exchange meets medical confidentiality requirements, while remaining interoperable across borders, is a significant compliance challenge. Processing health data through a wallet also requires a legal basis under both Article 6 and Article 9(2) GDPR, in addition to any sector-specific requirements.
Government services face a different kind of pressure: from 24 December 2026, public sector bodies are required to accept notified EUDI Wallets for online services where electronic identification is required. This means public sector organizations must invest in relying party infrastructure, update authentication systems, and train staff, all while managing existing digital service obligations.
For relevant regulated private sector organizations, such as banks, healthcare providers, telecoms, energy suppliers, transport operators, postal services, and providers of digital infrastructure and digital services, the obligation to accept the EUDI Wallet under Article 5f of eIDAS 2.0 applies from 24 December 2027. This obligation covers situations where strong user authentication is required by law or contract. Micro and small enterprises, defined as organizations with fewer than 50 employees and an annual turnover or balance sheet total of no more than 10 million euros, are exempt. Very Large Online Platforms (VLOPs) are subject to a separate provision under Article 5f: for VLOPs, the obligation applies where the platform requires user authentication, on the voluntary request of the user and for the minimum necessary data only.
Before a relying party can request wallet data, it must register with the national authority of the member state where it is established, as required under CIR (EU) 2025/848 of 6 May 2025. During registration, the relying party specifies the intended uses and the attributes and attestations it will request. The wallet checks each presentation request against this registered scope. A relying party must be capable of accepting every relevant notified wallet, regardless of which wallet provider issued it.
How can member states overcome citizen trust and adoption barriers?
Member states can overcome citizen trust and adoption barriers by prioritizing transparency about how wallet data is used, offering compelling everyday use cases from launch, and ensuring the wallet experience is genuinely simpler than current alternatives. Trust is built through citizens experiencing the wallet as useful and safe in practice, and regulation alone cannot achieve this.
One of the most consistent findings from the large-scale pilots is that citizen uptake depends heavily on whether the wallet solves a real, recognizable problem. Use cases such as presenting a mobile driving license, accessing social security benefits, or signing contracts digitally resonate with everyday life. When citizens can see a direct personal benefit, adoption follows more naturally.
Privacy by design is central to building trust. The EUDI Wallet is built around the principle of selective disclosure, meaning users share only the specific attributes needed for a given interaction. For example, a user can prove they are over 18 by disclosing only that attribute, without revealing their full date of birth. Communicating this clearly to citizens, in plain language, is essential. Many people remain skeptical about digital identity systems because past experiences have involved opaque data sharing and a loss of control.
It is important to distinguish between a user approving a data request in the wallet and giving consent as a legal basis under the GDPR. Each time a relying party requests data, the user reviews and approves that specific request in the wallet. The relying party still needs its own GDPR legal basis for processing the data it receives. For KYC purposes, that basis is typically a legal obligation rather than consent. The wallet dashboard gives users visibility over their interactions, but it is a tool for the user, not a logging facility for the wallet provider.
Wallet use is voluntary. Member states that invest in public education campaigns, pilot programs with high-visibility services, and clear feedback mechanisms will be better positioned to achieve meaningful adoption. The large-scale pilots collected user feedback specifically to improve the wallet’s design and usability, and this kind of iterative, citizen-centered development is the right approach.
What governance and coordination gaps remain across the EU?
Significant governance and coordination gaps remain across the EU, particularly around the pace of implementing act adoption, the consistency of supervisory oversight between member states, and the lack of a unified approach to onboarding relying parties. These gaps risk creating a fragmented European digital identity landscape rather than the seamless ecosystem the regulation envisions.
The eIDAS 2.0 regulation requires a substantial number of implementing acts covering everything from PID and EAA formats to certification of wallet solutions, cross-border identity matching, security breach reporting, and trust service provider requirements. These implementing acts contain the legally binding requirements that member states and other actors must follow. The first five core implementing acts were adopted at the end of 2024, starting the relevant 24-month period. While further acts have been adopted since, their consistent application across 27 member states depends on national supervisory bodies, including national competent authorities and registrars, that vary in capacity, expertise, and resources. The European Commission is responsible for adopting these acts; member states are responsible for implementing and supervising compliance within their jurisdictions; and the European Digital Identity Cooperation Group plays an advisory and coordination role, supporting peer reviews and cross-border alignment.
Relying party registration is another coordination challenge. Under CIR (EU) 2025/848, organizations that want to accept the EUDI Wallet must register with the national authority of the member state where they are established before they can request wallet data. The registration covers the intended uses and the specific attributes and attestations the relying party will request. There is currently no single harmonized European registration path that applies uniformly across all member states, and the processes for doing so are still being established in many jurisdictions. Without clarity on national registration requirements, private sector organizations face uncertainty about when and how to invest in wallet integration.
The legal deadline for member states to make EUDI Wallets available is 24 December 2026. This deadline should not be interpreted as a guarantee that every national wallet will reach the same level of maturity on that date, or that every possible cross-border use case will be fully operational throughout Europe from that point. Practical interoperability and national rollout are likely to develop in phases, and organizations should plan accordingly. The European Digital Identity Cooperation Group (EDICG) plays a central role in bridging coordination gaps, advising on implementing acts, organizing peer reviews of national eID schemes, and facilitating cooperation between member states and the Commission. The pace of coordination through this group must match the urgency of the 2026 deployment timeline.
How the ID Connector addresses EUDI Wallet implementation challenges
The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
For organizations in financial services, healthcare, pharma, and government preparing for the obligations that apply from 24 December 2026 and 24 December 2027, the ID Connector addresses the core technical and compliance challenges described in this article in concrete ways:
- Accepting every relevant notified EUDI Wallet, regardless of the issuing member state or wallet provider, so relying parties meet their obligation to accept all certified wallets
- Managing trust by verifying issuer signatures against national trusted lists, which are part of the EU List of Trusted Lists (LOTL), and where applicable against Lists of Trusted Entities (LoTE)
- Checking revocation status using issuer-provided status information, as part of the full three-step verification process
- Validating wallet unit attestations to confirm that the presenting wallet runs on a certified wallet solution
- Enforcing the registered attribute scope, so that only the attributes and attestations declared during relying party registration under CIR (EU) 2025/848 are requested in each transaction
- Supporting reuse of verified identity data across services, within the bounds of the applicable GDPR legal basis
- Enabling qualified signing via a connected Qualified Trust Service Provider (QTSP), for use cases that require a Qualified Electronic Signature (QES)
The ID Connector sits between the parties that need to interact, enabling secure identification, qualification, and signing without any single party controlling the relationship. Whether you are a financial institution preparing for wallet-based KYC, a government body building public service integrations, a healthcare organization navigating cross-border prescription flows, or a pharma company managing regulated identity processes, the ID Connector provides a standards-based path to wallet acceptance that is built for EU compliance from the ground up.
Ready to understand what EUDI Wallet implementation means for your organization? Get in touch with TrustTech to start the conversation.