How does eIDAS 2.0 affect cloud service providers in Europe?

eIDAS 2.0, Regulation (EU) 2024/1183, amends Regulation (EU) 910/2014 and directly affects cloud service providers in Europe, particularly those offering services that touch identity verification, electronic signatures, or trusted data exchange. If your cloud platform enables any of these functions for European users or businesses, you are likely within scope. The sections below walk through which services are affected, what compliance looks like in practice, and how to prepare.

Which cloud services fall under eIDAS 2.0 obligations?

Cloud services fall under eIDAS 2.0 obligations when they provide or support qualified trust services, such as electronic signatures, electronic seals, time stamps, website authentication certificates, or registered delivery services. Cloud providers that host or operate these functions on behalf of European businesses are directly within scope. Providers that store data or run infrastructure without touching identity or signing workflows face fewer direct obligations, but are still affected indirectly.

The clearest category is Qualified Trust Service Providers (QTSPs). If a cloud platform issues qualified certificates, manages signing keys, or delivers qualified electronic signatures as a service, it must meet the requirements set out under eIDAS 2.0. This includes audit obligations, security standards, and registration with a national supervisory body, after which the provider is listed on the relevant national trusted list. These national trusted lists are brought together in the EU List of Trusted Lists (LOTL).

Beyond QTSPs, cloud providers that support enterprise customers in regulated sectors such as finance, healthcare, or government also feel the impact. When those customers rely on cloud infrastructure to verify identities, process onboarding, or handle digital documents, the cloud provider becomes part of the compliance chain. Understanding where your platform sits in that chain is the starting point for any compliance assessment.

What new compliance requirements does eIDAS 2.0 introduce for cloud providers?

eIDAS 2.0 introduces a significantly expanded set of compliance requirements compared to the original regulation. Cloud providers offering qualified trust services must meet updated technical standards, undergo conformity assessments by accredited bodies, and demonstrate ongoing compliance through regular audits. The implementing acts contain the legally binding requirements and cover everything from security breach notifications to the management of remote qualified signature creation devices.

Some of the most relevant new requirements include:

• Remote QSCD management: Cloud-based remote signing services that manage qualified signature creation devices must now qualify as a distinct category of trust service, with specific security and operational requirements.
• Wallet relying party registration: Cloud platforms that accept or process data from the European Digital Identity Wallet must register as relying parties under CIR (EU) 2025/848, adopted on 6 May 2025, with the national authority of the Member State where they are established. Registration must specify, per intended use, which attributes and attestations will be requested. The wallet checks requests against this registered scope before any data is disclosed.
• Ecosystem notification obligations: Providers involved in the broader EUDI Wallet ecosystem must comply with notification rules, including how they report security incidents and changes to their services.
• Stricter interoperability standards: Cloud services that exchange identity data across borders must align with updated protocols and interface specifications. The Architecture and Reference Framework (ARF) provides the technical elaboration of the requirements set out in the implementing acts.
• Annual reporting: Supervisory bodies now require structured annual reports from qualified trust service providers, meaning cloud-based QTSPs must build reporting processes into their operations.

For cloud providers that are not QTSPs themselves but support enterprise customers in meeting these obligations, the practical implication is that their platforms need to be capable of integrating with compliant identity and signing infrastructure. That often means updating APIs, supporting new credential formats, and ensuring data handling aligns with both eIDAS 2.0 and GDPR requirements. Note that a vendor processing wallet data on behalf of a customer does not itself become the relying party: the registration obligation rests with the organisation that delivers the service to the end user.

How does eIDAS 2.0 change the relationship between cloud providers and their enterprise customers?

eIDAS 2.0 makes compliance a shared responsibility between cloud providers and their enterprise customers. Enterprise customers in regulated sectors can no longer treat identity verification and digital signing as purely internal processes. When those functions run on cloud infrastructure, the cloud provider becomes a critical part of the compliance picture, and customers will increasingly demand documented assurance of that compliance.

This creates both a challenge and an opportunity for cloud providers. Enterprise customers will ask harder questions: Is your platform EUDI Wallet compatible? Can you support qualified electronic signatures? Are you listed on the relevant national trusted lists? Providers that cannot answer these questions clearly may lose business to competitors who can.

Cloud providers that invest in eIDAS 2.0 readiness can offer genuine value to enterprise customers navigating complex regulatory requirements. The ability to provide reusable identity verification, wallet-compatible onboarding flows, and qualified signing capabilities as part of a managed cloud service is increasingly attractive to organisations that lack the internal expertise to build these capabilities themselves.

For enterprise customers in sectors like financial services or healthcare, where identity assurance is both a regulatory requirement and a business-critical function, cloud providers that can demonstrate eIDAS 2.0 alignment become strategic partners. This is a meaningful shift in how procurement and vendor relationships are managed.

What is the role of cloud-based remote signing under eIDAS 2.0?

Cloud-based remote signing plays a central role under eIDAS 2.0 and is now formally recognised as a qualified trust service in its own right. Remote signing existed under the original eIDAS regulation; eIDAS 2.0 formalises and extends the framework around it. Remote signing allows users to apply a qualified electronic signature without holding a physical signing device, because the cryptographic key is managed securely in the cloud on their behalf. This makes qualified signatures accessible at scale, which is essential for the digital transformation goals behind the regulation.

Under eIDAS 2.0, providers that manage remote qualified signature creation devices (remote QSCDs) must meet a defined set of security and operational requirements. A qualified electronic signature requires a QSCD and a qualified certificate. The regulation requires that the signing key remains under the exclusive control of the signer, even though it is stored remotely, and sets out technical standards for how this control is demonstrated and audited. The four legal requirements for an advanced electronic signature are that it is uniquely linked to the signatory, capable of identifying the signatory, created using data under the signatory’s sole control, and linked to the signed data in a way that makes any subsequent changes detectable.

For cloud providers, this is one of the most commercially significant aspects of the updated regulation. Organisations across Europe need qualified electronic signatures for contracts, onboarding, regulatory submissions, and a growing range of digital interactions. Cloud-based remote signing services that meet eIDAS 2.0 requirements can serve this demand at scale, without requiring users to manage physical tokens or smart cards.

The integration of remote signing with the EUDI Wallet adds another layer of opportunity. As the wallet becomes an important mechanism for identity verification across the EU, cloud-based signing services that connect with wallet credentials can support the full digital interaction lifecycle, from identity verification through to a legally binding signature.

How should cloud providers prepare for eIDAS 2.0 compliance?

Cloud providers should prepare for eIDAS 2.0 compliance by first mapping which of their services fall within scope, then assessing gaps against the updated technical and legal requirements, and finally building a structured roadmap to close those gaps. The core obligations are already defined in the implementing acts, and enterprise customers are beginning to ask compliance questions now.

A practical preparation approach follows these steps:

1. Scope assessment: Identify which services involve identity verification, electronic signatures, credential issuance, or trusted data exchange. These are the areas most directly affected by eIDAS 2.0.
2. Gap analysis: Compare your current technical capabilities and governance processes against the implementing acts under eIDAS 2.0, including requirements for remote QSCD management, relying party registration, and interoperability standards.
3. EUDI Wallet readiness: Evaluate whether your platform can interact with EUDI Wallets. By 24 December 2026, Member States are legally required to make wallets available to all citizens and businesses. That is the legal deadline for Member States’ wallet obligations. Public bodies must accept notified wallets for online services requiring electronic identification from that date. For relevant regulated private sectors, the acceptance obligation under Article 5f applies from 24 December 2027. Enterprises will expect their cloud providers to support wallet-based identity flows as national solutions come online.
4. Conformity assessment planning: If you are or intend to become a QTSP, engage early with an accredited conformity assessment body. The audit process takes time, and early engagement reduces the risk of delays.
5. Customer communication: Develop clear documentation of your eIDAS 2.0 compliance status and roadmap. Enterprise customers in regulated sectors will ask, and having clear answers builds trust.

Providers serving government or other highly regulated customers should also review the outcomes of the Large Scale Pilots that tested EUDI Wallet functionality. The first four pilots, EWC, POTENTIAL, NOBID, and DC4EU, ran from April 2023 to 2025 and are now complete. Their findings informed the technical specifications elaborated in the ARF. A second wave of pilots started in 2025, covering business wallets, payments, travel, ticketing, and vehicle registration. Understanding what worked in practice is valuable context for implementation planning. Note that relying party registration requirements may vary by Member State and sector. Explore the available resources on digital identity to stay informed as the regulatory landscape continues to evolve.

How TrustTech helps cloud service providers navigate eIDAS 2.0

Preparing for eIDAS 2.0 as a cloud service provider involves navigating a complex mix of technical standards, legal requirements, and ecosystem integrations. The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.

Here is what the ID Connector brings to cloud providers and the organisations they serve:

• eIDAS 2.0 ready by design: The platform is built to align with the updated regulation, including support for qualified electronic signatures, reusable identity verification, and EUDI Wallet-compatible flows.
• Remote signing infrastructure: The ID Connector connects to accredited QTSPs to enable cloud-based qualified signing, so organisations can offer legally binding digital signatures at scale without managing physical devices.
• Reusable verification: Once a user is verified, that verification can be reused across services and organisations, reducing friction and eliminating redundant checks.
• Trust management and verification: The ID Connector handles verification against national trusted lists, checks revocation status, and validates wallet unit attestations to confirm that a presenting wallet runs on a certified wallet solution.
• Registered attribute scope: The ID Connector monitors the registered attribute scope per relying party, so data requests stay within what has been registered under CIR (EU) 2025/848.
• Cross-sector applicability: Whether your customers operate in financial services, healthcare, government, or another regulated sector, the identity solutions are designed to meet sector-specific requirements within a single platform.
• Fast time to production: With an average of under five months to production, organisations can move from compliance planning to live implementation quickly.

If you are a cloud provider assessing your eIDAS 2.0 position, or an enterprise looking for a platform to support your digital identity infrastructure in financial services, healthcare, or government, the ID Connector is built for that purpose. Get in touch with TrustTech to discuss your specific situation and find out how the platform can support your compliance journey.