Under eIDAS 2.0, national governments issue credentials by acting as authoritative data sources that push verified identity attributes into the European Digital Identity Wallet ecosystem. Each Member State is legally required to provide citizens, residents, and businesses with an EUDI Wallet by 24 December 2026, and government bodies are the primary issuers of the foundational credentials that make those wallets trustworthy and usable across borders. Governance of this ecosystem is a shared responsibility: the European Commission manages the legal framework and adopts implementing acts; Member States provide or mandate wallet solutions, certify and notify them, and supervise actors within their jurisdiction; the European Digital Identity Cooperation Group supports cooperation and cross-border alignment; and national competent authorities, wallet providers, issuers, qualified trust service providers, and relying parties each carry defined roles. This article walks through the key questions organisations and practitioners are asking about how that issuance process works in practice.
What types of credentials can governments issue under eIDAS 2.0?
Under eIDAS 2.0, governments can issue two main categories of credentials: the Person Identification Data (PID) and Qualified Electronic Attestations of Attributes (QEAAs). The PID is the foundational identity credential, confirming who someone is. QEAAs cover a much wider range of verified attributes, from driving licences to professional qualifications and health insurance cards.
In practice, this means a government authority can issue credentials covering a broad spectrum of everyday needs. The large-scale pilots that ran from April 2023 to 2025 tested credential issuance across multiple sectors, including eleven specific scenarios:
- Accessing government services such as filing taxes or applying for a passport
- Opening a bank account with verified identity data
- Presenting a mobile driving licence in both online and physical situations
- Claiming prescriptions at a pharmacy
- Presenting travel documents at airport security
- Accessing social security benefits and health insurance information
- Proving organisational representation as a legitimate business delegate
These credentials are cryptographically signed attestations that support selective disclosure, meaning a user can prove their age without revealing their full date of birth, or confirm their nationality without sharing their home address.
How does a government authority become a trusted credential issuer?
A government authority becomes a trusted credential issuer under eIDAS 2.0 by being formally recognised within the national trust framework and listed on the relevant national trusted list maintained by the Member State. These national trusted lists are brought together in the EU List of Trusted Lists (LOTL). This recognition process ensures that credentials issued by that authority carry legal weight and can be verified by relying parties across the EU.
The trust model works in layers. At the top sits the Member State itself, which is responsible for certifying, notifying, and maintaining its national trust infrastructure in accordance with the legally binding requirements set out in the implementing acts. Authorities that issue credentials, whether a national ID bureau, a driving licence authority, or a social security body, must meet defined security and reliability standards before they can participate in the ecosystem.
eIDAS 2.0 also opens this up beyond purely governmental bodies. Private organisations can become trusted issuers too, provided they are officially recognised by their Member State. A bank, a university, or a healthcare provider could issue QEAAs with the same level of trust as a government department, as long as they meet the required standards and appear on the relevant trusted list. It is worth noting that issuing attestations of attributes is itself a trust service under eIDAS 2.0, and issuers must also support revocation status information and re-issuance when a user switches devices.
How does the credential issuance process actually work?
The credential issuance process under eIDAS 2.0 follows a structured flow in which a trusted issuer creates a signed, verifiable attestation and delivers it directly to the user’s EUDI Wallet. The user then holds that attestation and can present it to any relying party that accepts EUDI Wallet-based authentication.
The process generally works in the following sequence:
- Identity verification: The issuing authority first confirms the user’s identity, typically using an existing national eID scheme or an in-person verification process.
- Credential creation: The authority generates a digital attestation containing the relevant attributes, cryptographically signed with the issuer’s private key. The private keys associated with PID and attestations remain within the Wallet Secure Cryptographic Device and do not leave it.
- Delivery to the wallet: The signed attestation is transmitted to the user’s EUDI Wallet using standardised protocols defined in the Architecture and Reference Framework (ARF), which provides the technical elaboration of the requirements set out in the implementing acts. Issuance uses the OID4VCI protocol; the credential formats prescribed by the ARF are mdoc and SD-JWT VC.
- Storage and control: The user stores the attestation in their wallet unit and decides when and with whom to share it.
- Presentation to a relying party: When a service requests verification, the user approves the request and selectively presents the relevant attestation attributes. The relying party then performs three distinct checks: verifying the issuer’s signature against the relevant national trusted list; checking the revocation status using the issuer’s status information; and validating the wallet unit attestation to confirm that the presenting wallet runs on a certified wallet solution. Only the first of these checks can be performed fully offline.
The European Commission has provided a reference implementation of the EUDI Wallet as an open-source prototype, which Member States and private developers can build on. This common technical foundation supports cross-border interoperability, though the extent to which any given cross-border use case is available will depend on national rollout progress, certification status, and applicable sector-specific legislation in each Member State.
What is the difference between a PID and a QEAA?
The key distinction is that a PID (Person Identification Data) is the foundational identity credential that establishes who you are, while a QEAA (Qualified Electronic Attestation of Attributes) is a verified statement about a specific attribute or qualification you hold. A PID is issued exclusively by or on behalf of a Member State; a QEAA can be issued by any qualified trust service provider that has been officially recognised.
Think of the PID as the digital equivalent of a national identity card. It contains core identity data such as name, date of birth, and nationality, and it forms the anchor of trust for everything else in the wallet. Without a valid PID, the rest of the credential ecosystem has no reliable identity foundation to build on.
A QEAA is more like a verified certificate attached to that identity. Examples include a driving licence, a university degree, a professional registration, or a health insurance card. These attestations are qualified because they are issued by a recognised authority and carry the same legal weight as their physical or paper equivalents under EU law. The eIDAS 2.0 framework also defines Public Body Electronic Attestations of Attributes (PuB-EAAs), which are issued by or on behalf of public bodies and occupy a distinct category from both QEAAs and non-qualified Electronic Attestations of Attributes (EAAs). Non-qualified EAAs exist for lower-assurance use cases, but QEAAs are the standard for regulated sectors such as finance, healthcare, and government services.
Which countries are already issuing eIDAS 2.0 credentials?
As of 2025, no Member State has completed full-scale deployment of a certified and notified EUDI Wallet, but significant progress was made through the four large-scale pilot programmes that ran from April 2023 to 2025. These pilots involved over 350 entities from 26 Member States, plus Norway, Iceland, and Ukraine, and tested real-world credential issuance across multiple sectors.
The four pilot consortia each focused on different use cases. The EU Digital Identity Wallet Consortium (EWC) explored Digital Travel Credentials, payments, and organisational digital identity. The POTENTIAL consortium piloted government services, bank account opening, SIM registration, mobile driving licences, remote qualified signing, and e-prescriptions. The NOBID Consortium focused on wallet-based payment authorisation. The DC4EU consortium covered education and social security credential use cases across borders.
A second wave of pilots started in 2025. The WE BUILD consortium focuses on business wallets and payments. The APTITUDE consortium covers travel, ticketing, vehicle registration, and payments.
National progress varies considerably, and the status of individual country initiatives changes frequently as technical work and policy decisions advance. Denmark’s MitID-based digital identity infrastructure is well established, and the AltID initiative is being developed as a separate, complementary programme; the two should not be treated as interchangeable. Austria has the existing ID Austria digital identity infrastructure, which is eIDAS-compliant, but its status as a certified and notified EUDI Wallet under eIDAS 2.0 should be verified against current authoritative sources before publication. Where the current status of a national wallet cannot be established reliably from authoritative sources, it is more accurate to acknowledge that uncertainty than to present a snapshot that may already be outdated.
The legal deadline for Member States to make EUDI Wallets available is 24 December 2026. That date defines a legal obligation; it does not guarantee that every national wallet will reach the same level of maturity on that date, or that every possible cross-border use case will be fully operational throughout Europe immediately thereafter. Practical interoperability and national rollout are expected to develop in phases, and organisations should plan accordingly. The insights gathered from the pilots are feeding directly into the final technical specifications and security requirements that will govern live credential issuance across the EU.
What does government credential issuance mean for organisations accepting them?
For organisations that accept government-issued eIDAS 2.0 credentials, the practical implication is that identity verification becomes faster, more reliable, and legally stronger. When a user presents a wallet-based PID or QEAA, the organisation receives tamper-evident, cryptographically signed data from a trusted source, reducing the risk of fraud or document forgery.
This matters most in regulated sectors. A bank accepting a government-issued PID for account opening can use it as part of its KYC process, though whether verified wallet data satisfies KYC requirements in a specific case is determined by applicable AML legislation, not by eIDAS 2.0 itself. A healthcare provider receiving a verified health insurance attestation can process it with confidence. A government portal accepting a wallet-based attestation for service access can do so without building its own identity verification infrastructure.
There are also compliance implications to consider. Under eIDAS 2.0, public bodies providing online services that require electronic identification must accept notified EUDI Wallets from 24 December 2026. For regulated private sectors, Article 5f of eIDAS 2.0 introduces an obligation from 24 December 2027 for organisations where strong user authentication is legally or contractually required. The sectors covered include banking and financial services, healthcare, telecommunications, energy, transport, education, social security, drinking water, postal services, digital infrastructure, and digital services. Very large online platforms (VLOPs) are subject to a separate provision under Article 5f: where a VLOP requires user authentication, it must accept EUDI Wallet credentials on the voluntary request of the user and for the minimum necessary data. Micro and small enterprises, defined as organisations with fewer than 50 employees and an annual turnover or balance sheet total of no more than ten million euros, are exempt from the private-sector obligation.
Before requesting wallet data, a relying party must register with the national authority of its Member State of establishment under CIR (EU) 2025/848 of 6 May 2025. Registration covers the specific attributes and attestations the relying party intends to request, per intended use, and the wallet checks incoming requests against that registered scope. A relying party does not choose a wallet provider; it must be capable of accepting every relevant notified wallet, regardless of provider.
Organisations that integrate wallet acceptance now will be better positioned to meet those obligations and serve customers in financial services and other regulated sectors without friction.
How TrustTech supports eIDAS 2.0 credential acceptance
Building the infrastructure to receive, verify, and act on government-issued eIDAS 2.0 credentials is a concrete technical and compliance challenge. TrustTech addresses that challenge through the ID Connector.
The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
For organisations in regulated sectors, the ID Connector handles the specific steps that credential acceptance requires:
- Accepting EUDI Wallet attestations across your onboarding and verification flows
- Verifying issuer signatures against the relevant national trusted lists
- Checking revocation status using issuer-provided status information
- Validating wallet unit attestations to confirm the presenting wallet runs on a certified wallet solution
- Enforcing the registered attribute scope so that only the data covered by your relying-party registration is requested
- Reusing verified identity data across your organisation to eliminate repeated checks
- Connecting identity verification, qualification checks, and qualified signing via an integrated QTSP where required
- Supporting government and healthcare use cases alongside financial services and pharma
TrustTech’s infrastructure connects the parties that need to interact without acting as a relying party itself. That independence makes it possible to build reusable, cross-organisation identity flows that are ready for the wallet era. Explore TrustTech’s solutions to see how the ID Connector supports the full credential acceptance lifecycle, or contact the team to discuss what eIDAS 2.0 credential acceptance means for your organisation.