eIDAS 2.0 affects businesses across Europe by amending the original eIDAS regulation, Regulation (EU) 910/2014, to extend obligations to the private sector and by introducing the European Digital Identity Wallet as infrastructure that qualifying businesses must accept. Where the original regulation focused mainly on public services and cross-border recognition of national eID schemes, eIDAS 2.0 creates direct obligations for a much broader range of organisations. This article walks through the key questions businesses are asking right now about what changes, who is affected, and how to prepare.
What does eIDAS 2.0 actually change compared to the original eIDAS?
The original eIDAS regulation, in force since 2016, created a framework for EU Member States to recognise each other’s national electronic ID systems. It worked reasonably well for cross-border public services, but participation was voluntary and adoption was uneven. Regulation (EU) 2024/1183, which amended Regulation (EU) 910/2014 and entered into force on 20 May 2024, fundamentally changes the scope, reach, and ambition of that framework by making the European Digital Identity Wallet a requirement.
Under the original rules, Member States could notify their national eID schemes for cross-border recognition, but there was no obligation to do so. This led to significant differences between countries in how digital identity worked in practice. eIDAS 2.0 closes those gaps by requiring every Member State to make a European Digital Identity Wallet available to all citizens, residents, and businesses by the legal deadline of 24 December 2026.
The other major shift is the extension to the private sector. The original regulation largely served government and public administration use cases. eIDAS 2.0 brings private organisations into the picture, requiring certain categories of businesses to accept the EUDI Wallet as a valid means of identity verification. This is a structural change in how digital identity works across Europe.
Governance under eIDAS 2.0 is a shared responsibility distributed across multiple actors. The European Commission manages the legal framework and adopts implementing acts, which contain the legally binding requirements. EU Member States provide or mandate wallet solutions, certify and notify them, and supervise actors within their jurisdiction. The European Digital Identity Cooperation Group supports cooperation and cross-border alignment. National competent authorities, wallet providers, issuers of Person Identification Data and attestations, qualified trust service providers, and relying parties each carry distinct responsibilities within this ecosystem. No single central European authority operationally manages all EUDI Wallets.
Which types of businesses are affected by eIDAS 2.0?
eIDAS 2.0 directly affects businesses that provide online services requiring strong identity verification, particularly those in regulated sectors. The regulation identifies specific categories of service providers that will be required to accept the EUDI Wallet.
It is important to distinguish between two separate acceptance obligations. From 24 December 2026, public sector bodies must accept notified wallets for online services that require electronic identification. From 24 December 2027, Article 5f of the amended regulation applies to relevant regulated private sectors where strong user authentication is legally or contractually required. Micro and small enterprises are exempt from the private sector obligation: organisations with fewer than 50 employees and an annual turnover or balance sheet total of no more than 10 million euros fall outside its scope.
Very Large Online Platforms fall under a separate provision of Article 5f. For VLOPs, the obligation applies where the platform requires user authentication, on voluntary request by the user and for the minimum necessary data. The condition relating to legally or contractually required strong authentication does not apply to VLOPs.
The sectors most directly affected by the private sector obligation include:
- Financial services and banking, including institutions that perform KYC checks, account opening, and payment authentication
- Healthcare and pharmaceuticals, for patient identification, prescription handling, and access to health records
- Telecommunications, for SIM registration and customer identity verification
- Energy
- Transport
- Education, for issuing and verifying academic credentials
- Social security
- Drinking water
- Postal services
- Digital infrastructure and digital services
Beyond these sectors, any organisation that currently relies on username and password authentication for high-value or sensitive services should pay close attention. eIDAS 2.0 sets a new baseline for what trusted digital identity looks like, and businesses outside the immediately regulated categories may find that customer expectations and competitive pressure push them toward wallet-compatible identity flows. Organisations in financial services and healthcare face the most direct compliance requirements under Article 5f.
What are the main compliance obligations for businesses under eIDAS 2.0?
The core compliance obligation for in-scope businesses under eIDAS 2.0 is the requirement to accept the EUDI Wallet as a valid method for user identification and authentication. This means updating digital onboarding flows, authentication systems, and data handling processes to support wallet-based interactions.
More specifically, businesses need to consider the following obligations:
- Accepting EUDI Wallet credentials for identity verification where required by the regulation
- Ensuring that only the minimum necessary data is requested from users during wallet interactions, in line with data minimisation principles
- Registering as a relying party under CIR (EU) 2025/848 of 6 May 2025 with the national authority of the Member State of establishment before requesting any wallet data. Registration is per intended use and specifies which attributes and attestations will be requested. The wallet checks requests against this registered scope.
- Aligning identity verification processes with the assurance levels defined under eIDAS 2.0, particularly for high-risk services
- Reviewing how existing identity and authentication infrastructure interacts with wallet-based flows
A supplier that processes wallet data on behalf of a client does not thereby become the relying party. The registration obligation rests with the organisation that delivers the service to the end user. A relying party does not automatically require a qualified trust service provider for wallet acceptance. A QTSP becomes relevant in specific circumstances, such as qualified signing or the use of qualified attestations of attributes.
For businesses already operating under GDPR, AML, KYC, or PSD2 frameworks, eIDAS 2.0 adds another layer of requirements that must be integrated into existing compliance programmes. Wallet-based identity verification can simplify compliance by providing cryptographically signed, standardised data. Note that reuse of KYC data across organisations is governed by AML regulation, not by eIDAS itself.
How does the EUDI Wallet affect customer identity verification?
The EUDI Wallet changes customer identity verification by replacing fragmented, repetitive document checks with a reusable digital identity that users control. A customer who has already been verified through their national identity system can share only the specific information a business needs, such as proof of age or nationality, without exposing their full identity document. This selective disclosure of attributes is built into the wallet’s design.
The data shared is cryptographically signed by the issuer, which makes it tamper-evident. Verifying a presentation involves three distinct checks: verifying the issuer’s signature against the relevant national trusted list, which is part of the EU List of Trusted Lists; checking the revocation status of the attestation using the issuer’s status information; and checking the wallet unit attestation to confirm that the presenting wallet runs on a certified wallet solution. Only the first of these checks can be performed fully offline.
For businesses, wallet-based flows can reduce onboarding friction significantly. Lengthy identity checks are one of the leading causes of drop-off during digital onboarding. A wallet-based flow can replace multiple manual steps with a single, user-initiated sharing action. Each time a user presents data from the wallet, they approve that specific presentation. Businesses must adapt their systems to request and process wallet credentials correctly, which requires both technical integration and a clear understanding of which data attributes are needed for each use case.
The wallet also supports reusable compliance. A customer who completed KYC at their bank does not need to repeat the full process when opening an account elsewhere if both organisations operate within the same trust framework. Whether that reuse is permissible depends on applicable AML rules, not on eIDAS alone. This is one of the most significant potential efficiency gains that eIDAS 2.0 enables for regulated industries.
A relying party must accept every relevant notified wallet, regardless of which wallet provider issued it or in which Member State. Relying parties do not choose a wallet provider.
When do businesses need to be ready for eIDAS 2.0?
The legal deadline for Member States to make the EUDI Wallet available to citizens and businesses is 24 December 2026. This is a legal deadline, not a predicted launch date. Practical interoperability and national rollout may develop in phases, and not every cross-border use case will be fully operational throughout Europe from that date. Businesses should plan around the legal deadline while recognising that real-world implementation will evolve over time.
For private sector relying parties in the regulated categories covered by Article 5f, the acceptance obligation applies from 24 December 2027. Planning for that deadline should begin now, given the lead time required for registration, technical integration, and internal change management.
The first four large-scale pilot programmes, which tested the wallet across sectors including banking, healthcare, travel, and education, ran from April 2023 to 2025 and have concluded. The insights from those pilots fed directly into the technical specifications and architecture that businesses will need to integrate with. A second wave of pilots started in 2025. The legally binding requirements are set out in the implementing acts adopted by the European Commission, with the first five core implementing acts adopted at the end of 2024. The Architecture and Reference Framework provides the technical elaboration of those requirements.
In practice, becoming a compliant relying party in the EUDI Wallet ecosystem takes time. Technical integration, legal review, registration under CIR (EU) 2025/848, and internal change management all require lead time. Businesses operating across multiple Member States should factor in country-by-country requirements. Organisations that leave preparation until late 2026 or late 2027 will be building under pressure.
What steps should businesses take to prepare for eIDAS 2.0?
Preparing for eIDAS 2.0 involves a combination of regulatory assessment, technical readiness, and process redesign. The most effective approach starts with understanding exactly where your organisation sits within the regulation’s scope and then working outward from there.
- Assess your regulatory scope. Determine whether your organisation falls within the categories of service providers required to accept the EUDI Wallet, and which deadline applies to you: 24 December 2026 for public sector bodies, or 24 December 2027 for regulated private sector organisations under Article 5f. Check whether the micro and small enterprise exemption applies.
- Map your current identity flows. Audit how you currently verify, onboard, and authenticate users. Identify which steps could be replaced or improved by wallet-based interactions, and where gaps exist in your current infrastructure.
- Understand the technical requirements. Familiarise your technical teams with the Architecture and Reference Framework for the EUDI Wallet, which provides the technical elaboration of the legally binding requirements set out in the implementing acts. Becoming a relying party requires integration with standardised protocols and data formats, including OID4VP for presentation and OID4VCI for issuance, and credential formats including mdoc and SD-JWT VC.
- Align with existing compliance frameworks. Connect your eIDAS 2.0 preparation with your existing GDPR, AML, KYC, and sector-specific compliance programmes. These frameworks overlap significantly, and a joined-up approach avoids duplication. Remember that your organisation needs its own GDPR legal basis for processing wallet data. For KYC, that basis is typically a legal obligation. For health data, an additional ground under Article 9(2) GDPR is required.
- Engage with your technology partners. Work with identity infrastructure providers who already have experience with eIDAS-compliant systems. The implementation timeline is tight, and specialist knowledge can reduce risk significantly.
- Plan for change management. Digital identity changes affect customer experience, internal processes, and staff workflows. Build a clear internal communication and training plan alongside your technical implementation.
Organisations that treat eIDAS 2.0 as a compliance checkbox will miss the broader opportunity. The regulation creates the conditions for faster, more secure, and more user-friendly digital interactions. Businesses that design their identity flows around the wallet from the ground up will be better positioned than those that integrate it as an afterthought.
How TrustTech helps businesses prepare for eIDAS 2.0
Getting eIDAS 2.0 compliance right requires translating complex requirements into working systems and integrated processes. That is where the ID Connector from TrustTech comes in.
The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
For organisations in financial services, healthcare, pharma, and government preparing for the 24 December 2026 and 24 December 2027 deadlines, the ID Connector handles:
- Wallet acceptance and relying party integration, covering every notified wallet regardless of provider
- Verification against national trusted lists, consolidated in the EU List of Trusted Lists
- Revocation status checking using issuer status information
- Validation of wallet unit attestations to confirm the presenting wallet runs on a certified wallet solution
- Enforcement of the registered attribute scope per intended use, in line with CIR (EU) 2025/848
- Reusable identity data flows that reduce repeated verification steps across services
- Qualified signing via a connected QTSP
Get in touch with TrustTech to discuss where your organisation stands and what a practical path forward looks like.