Governments ensure EUDI Wallet security through a layered framework established by eIDAS 2.0, combining mandatory certification, strict technical requirements, independent oversight, and ongoing monitoring. Every wallet solution must meet these standards before it can be issued to citizens or businesses, and compliance does not stop at launch. This article walks through each layer of that security framework, from the foundational rules to the people responsible for enforcing them.
What security framework does eIDAS 2.0 establish for the EUDI Wallet?
eIDAS 2.0, Regulation (EU) 2024/1183, amends Regulation (EU) 910/2014 and establishes a comprehensive, legally binding security framework that every European Digital Identity Wallet must comply with before it can be made available to users. The regulation defines requirements covering cryptographic integrity, data minimisation, user control, and cross-border interoperability, all underpinned by a set of implementing acts adopted by the European Commission. The first five core implementing acts were adopted at the end of 2024, starting the relevant 24-month period that runs to the 24 December 2026 deadline.
At the heart of this framework is the Architecture and Reference Framework (ARF), a technical document that elaborates how wallets must be built, how they communicate with other systems, and what security properties they must demonstrate. The ARF is not legislation, but it provides the authoritative technical elaboration of the requirements set out in the implementing acts. Wallet providers, whether governments or private companies, must follow both.
The framework also reflects a clear principle: users must remain in control of their own data. The EUDI Wallet is designed so that people can choose exactly what information they share, with whom, and when. Nothing beyond what is strictly necessary for a given interaction should be disclosed. This data minimisation principle is a core security requirement built into the architecture itself.
Several implementing acts sit beneath eIDAS 2.0, covering specific areas such as the certification of wallet solutions, protocols and interfaces, cross-border identity matching, and the handling of security breaches. Together, these create a detailed and enforceable rulebook that leaves little room for ambiguity.
How is the EUDI Wallet certified before it can be used?
Before an EUDI Wallet solution can be deployed to the public, it must go through a formal certification process. This process verifies that the wallet meets all technical and security requirements defined in eIDAS 2.0 and the implementing acts. Certification is carried out by accredited conformity assessment bodies, independent organisations authorised to evaluate whether a wallet solution genuinely meets the required standards.
The certification process examines several dimensions of a wallet solution, including:
- Cryptographic security and key management
- Integrity and core functionality as defined in the implementing acts
- Secure storage of identity data and credentials
- Compliance with protocols and interfaces for interoperability
- Resilience against known attack vectors and vulnerabilities
Once a wallet solution passes certification, it is added to an official list of certified European Digital Identity Wallets maintained at the EU level. This list gives relying parties, such as banks, healthcare providers, and public services, confidence that they are interacting with a verified and trustworthy wallet. Certification is not a one-time event. Wallets must maintain compliance as the technical standards evolve, and recertification may be required when significant updates are made.
The four large-scale pilots that ran from April 2023 to 2025 involved more than 350 entities across 26 Member States plus Norway, Iceland, and Ukraine, and played an important role in shaping what certification looks like in practice. The insights gathered from those pilots directly informed the security and interoperability requirements that wallet providers must now meet.
What technical security requirements must EUDI Wallet providers meet?
EUDI Wallet providers must meet a detailed set of technical security requirements that cover everything from how identity data is stored to how credentials are presented and verified. These requirements apply equally to government-issued wallets and privately operated wallets that have been officially recognised under eIDAS 2.0.
Key technical requirements include:
- Cryptographic proof: All identity data and credentials stored in the wallet must be cryptographically signed, making it possible for verifiers to confirm their authenticity. Verification involves three distinct checks: confirming the issuer’s signature against the relevant national trusted list, which feeds into the EU List of Trusted Lists (LOTL); checking the revocation status of the credential via the issuer’s status information; and validating the wallet unit attestation to confirm that the presenting wallet runs on a certified wallet solution. Only the first of these checks can be performed fully offline.
- Secure key storage: Private keys used to sign and authenticate must be stored within the Wallet Secure Cryptographic Device, a hardware-backed secure element that forms part of the wallet unit, to prevent extraction or misuse. Private keys for Person Identification Data and attestations do not leave this secure element. When a user moves to a new device, attestations are re-issued rather than copied.
- Selective disclosure: Wallets must support selective disclosure, meaning users can share only specific attributes from a credential. For example, confirming that a person is over 18 without revealing a date of birth. This can be achieved through selective disclosure mechanisms in the supported credential formats, mdoc and SD-JWT VC, without requiring zero-knowledge proofs.
- Binding to the holder: Credentials must be cryptographically bound to the wallet unit, preventing credentials from being used by someone other than the holder.
- Interoperability standards: Wallets must implement the protocols and interfaces defined in the implementing acts. These include OID4VCI for credential issuance, OID4VP for credential presentation, ISO/IEC 18013-5 for proximity presentation, and ISO/IEC TS 18013-7 for online presentation. The High Assurance Interoperability Profile (HAIP) sets out the specific combination of these standards required for EUDI Wallet interoperability. Cross-border interoperability covers the framework design; whether every specific use case is available in every Member State will depend on national rollout progress and sector-specific requirements.
- Breach response: Providers must have documented procedures for detecting, reporting, and responding to security breaches, in line with the implementing act on security incidents.
These requirements reflect a broader shift in digital identity thinking, moving toward cryptographic proof that travels with the user. For organisations in regulated sectors such as finance, healthcare, and government, understanding these technical foundations is essential for building systems that can accept and verify wallet credentials reliably.
Who oversees and enforces EUDI Wallet security across EU member states?
Oversight of EUDI Wallet security is a shared responsibility involving multiple actors. The European Commission manages the legal framework and adopts implementing acts. EU Member States provide or mandate wallet solutions, certify and notify them, and supervise actors within their own jurisdiction through national competent authorities. The European Digital Identity Cooperation Group supports cross-border cooperation and alignment between Member States. Wallet providers, issuers of Person Identification Data and attestations, qualified trust service providers, and relying parties each carry their own defined responsibilities within this ecosystem. No single central European authority operationally manages all EUDI Wallets.
National competent authorities have the power to investigate wallet providers, require corrective action, and suspend or revoke certification if a wallet solution is found to be non-compliant. The implementing acts define the formats and procedures for annual reports that these supervisory bodies must submit, creating a structured accountability mechanism that operates on a recurring basis.
Peer reviews between Member States add another layer of scrutiny. Under the implementing act on peer reviews of eID schemes, countries assess each other’s approaches, sharing findings and identifying gaps. This cross-border review process helps raise standards consistently, which addresses one of the key weaknesses of the original eIDAS regulation.
For organisations operating across multiple EU countries, this shared oversight model has a practical implication: a wallet certified and notified in one Member State must be recognised in all others. This mutual recognition principle is central to the EUDI Wallet’s value proposition, and the oversight framework is what makes that recognition trustworthy. Relying parties must also register with their national authority under CIR (EU) 2025/848, adopted on 6 May 2025, before they can request wallet data. Registration is per intended use, specifying which attributes and attestations will be requested, and the wallet checks each request against that registered scope. Sector-specific legislation continues to apply alongside these registration requirements. Organisations in the government sector in particular need to understand how these supervisory relationships and national requirements interact when planning their wallet integration strategies.
How does ongoing monitoring keep the EUDI Wallet secure after launch?
Ongoing monitoring of EUDI Wallet security happens through a combination of mandatory reporting, incident response obligations, and continuous technical updates to the ARF. Security does not end at certification. Wallet providers are required to monitor their systems actively and report any significant security breaches to the relevant national competent authority in a timely manner.
The implementing act on security breaches of European Digital Identity Wallets sets out specific obligations for how incidents must be detected, classified, and reported. This creates a clear chain of accountability: if something goes wrong, there is a defined process for escalation and response that protects users and the broader ecosystem.
At the technical level, the ARF is a living document. As new threats emerge and as the large-scale pilots generate real-world insights, the reference framework is updated to reflect current best practices. Wallet providers must track these updates and adapt their implementations accordingly, which is why the certification process includes provisions for ongoing compliance.
The pilots that ran until 2025 were instrumental in stress-testing these monitoring mechanisms. The four consortia covered distinct use cases: EWC focused on Digital Travel Credentials, payments, and organisational digital identity; POTENTIAL covered government services, opening a bank account, SIM registration, mobile driving licence, remote qualified signing, and e-prescriptions; NOBID focused on payments; and DC4EU covered education and social security. Feedback collected across these use cases revealed practical vulnerabilities and usability challenges that have since been addressed in updated specifications. A second wave of pilots started in 2025, with WE BUILD focusing on business wallets and payments, and APTITUDE covering travel, ticketing, vehicle registration, and payments. This iterative approach to security is one of the reasons the EUDI Wallet framework is considered more robust than earlier EU digital identity initiatives.
How the ID Connector supports EUDI Wallet security requirements
Meeting EUDI Wallet security standards requires aligning processes, systems, and compliance frameworks with a regulatory landscape that continues to develop. The legal deadline for Member States to make wallet solutions available is 24 December 2026, but practical interoperability and national rollout are expected to develop in phases. From 24 December 2027, the acceptance obligation under Article 5f of eIDAS 2.0 applies to relevant regulated private sectors where strong user authentication is legally or contractually required, covering areas including financial services, healthcare, telecoms, energy, transport, education, social security, and digital services. Micro and small enterprises, defined as fewer than 50 employees and an annual turnover or balance sheet total of no more than 10 million euros, are exempt. Very Large Online Platforms are subject to a separate provision under Article 5f, where the obligation applies when the platform requires user authentication, at the voluntary request of the user and limited to the minimum necessary data.
The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
In the context of EUDI Wallet security, the ID Connector handles the verification steps that the framework requires: validating issuer signatures against national trusted lists that feed into the EU List of Trusted Lists, checking credential revocation status, and validating wallet unit attestations to confirm that a presenting wallet runs on a certified wallet solution. It also enforces the registered attribute scope defined under CIR (EU) 2025/848, so that each data request stays within the bounds of what the relying party has registered for a given intended use.
For organisations in financial services, healthcare, pharma, or government preparing for wallet-based verification, get in touch with the TrustTech team to discuss what EUDI Wallet readiness looks like for your organisation.