eIDAS 2.0, Regulation (EU) 2024/1183, amends Regulation (EU) 910/2014 and fundamentally changes how cross-border digital services work across the EU. It introduces a universal framework that requires every Member State to offer citizens, residents, and businesses a European Digital Identity Wallet. Where the original regulation left significant gaps in cross-border recognition, the amended regulation closes those gaps and extends obligations to the private sector. The sections below break down exactly what this means for organizations operating across European borders.
What changes does eIDAS 2.0 introduce for cross-border services?
eIDAS 2.0 introduces a mandatory, EU-wide digital identity infrastructure that replaces the voluntary and fragmented approach of the original regulation. Every Member State must provide a European Digital Identity Wallet to all citizens, residents, and businesses. Public sector organizations must accept these wallets for online services that require electronic identification from 24 December 2026. Private sector organizations in regulated sectors face a mandatory acceptance obligation under Article 5f from 24 December 2027, with micro and small enterprises below 50 employees and with an annual turnover or balance sheet total not exceeding 10 million euros exempted.
The most significant shift is the move from a system where countries could choose whether to participate in cross-border recognition to one where participation is compulsory. Under the original regulation, Member States that had notified their national eID schemes were required to recognize each other’s systems, but not every country was obligated to create a scheme in the first place. This created an uneven landscape where some countries had mature digital identity infrastructure and others had almost none.
eIDAS 2.0 addresses this by standardizing the underlying architecture through a Common Toolbox and Architecture and Reference Framework (ARF). The implementing acts adopted by the European Commission are legally binding. The ARF provides the technical elaboration of those requirements. This ensures that wallets issued in different countries are designed to be technically interoperable, meaning a certified wallet issued in Finland is intended to work when accessing an appropriate service in Spain or the Netherlands. For organizations offering cross-border digital services, this is a major structural change: they can no longer design their identity verification flows around a single national standard.
Which sectors are most affected by eIDAS 2.0 cross-border requirements?
Financial services, government, healthcare, and education are among the sectors most directly affected by eIDAS 2.0 cross-border requirements. These industries rely heavily on verified identity for access to services, regulatory compliance, and secure data exchange, making the new wallet-based identity framework immediately relevant to their operations.
Here is a closer look at how the impact breaks down across key sectors:
- Financial services: Banks and payment providers in scope of the Article 5f obligation must accept wallet-based identity for account opening, KYC checks, and payment authorization from 24 December 2027. Cross-border onboarding, which has traditionally been slow and paper-heavy, becomes significantly more streamlined. Note that KYC reuse is governed by AML legislation, not by eIDAS 2.0 itself.
- Government: Public administrations must offer wallet-compatible access to services such as tax filing, passport applications, and social security from 24 December 2026. Cross-border access to government services becomes a baseline requirement.
- Healthcare: The EUDI Wallet supports the storage and presentation of medical credentials, prescriptions, and the European Health Insurance Card, enabling patients to access care across borders without carrying physical documents.
- Education: Diplomas, degrees, and professional qualifications can be stored and verified through the wallet, reducing friction for students and workers moving between Member States. Recognition of professional qualifications continues to be governed by Directive 2005/36/EC.
- Telecommunications: SIM registration and identity verification for mobile contracts were included in the large-scale pilot programs, signaling that telecoms are an early adoption priority. Telecoms are also among the regulated sectors listed under Article 5f.
Organizations in financial services and healthcare in particular face both significant compliance obligations and the opportunity to reduce operational friction through wallet-based identity reuse.
How does the EUDI Wallet enable cross-border identity verification?
The EUDI Wallet enables cross-border identity verification by giving users a single, standardized digital identity application that is designed to be recognized across all EU Member States. Users store verified attestations in the wallet, including national identity data, professional qualifications, and official documents, and can share only the specific attributes a service requires through selective disclosure, without exposing unnecessary personal data.
The technical foundation of this cross-border capability is the ARF, which defines how wallets must be built and how they interact with relying parties, the organizations that request identity data. Because all certified wallets conform to the same technical standard, a service provider in one country can verify an attestation issued by an authorized issuer in another country without needing a bilateral agreement or a custom integration.
Verification is not a single cryptographic check. Three separate controls are relevant. First, the issuer’s signature on the attestation is verified against the relevant national trusted list, which is part of the EU List of Trusted Lists (LOTL). Second, the revocation status of the attestation is checked using the status information provided by the issuer. Third, the wallet unit attestation is checked to confirm that the presenting wallet is running on a certified wallet solution. Only the first of these controls can be performed fully offline. It is therefore not accurate to say that an attestation can be verified entirely without contact with the issuer or the issuer’s infrastructure.
Cross-border interoperability operates at the framework level. National registration requirements and sector-specific legislation remain in place, and not every attestation automatically carries the same legal consequence in every Member State.
From a practical standpoint, the wallet replaces the current reality of users having to re-verify their identity from scratch every time they interact with a new organization. A person who has already had their identity verified by their bank, employer, or government authority can reuse that verified attestation when accessing a cross-border service. This verify-once, reuse-everywhere model is one of the most consequential features of the amended regulation for both users and organizations. Each time a user presents credentials from the wallet, they approve that specific presentation. The wallet does not authenticate users once and then act autonomously on their behalf.
The four large-scale pilot programs ran from April 2023 to 2025 across 26 Member States, Norway, and Iceland. They tested cross-border scenarios covering use cases from opening bank accounts to claiming medical prescriptions. The pilots were organized across four consortia: EWC covered Digital Travel Credentials, payments, and organisational digital identity; POTENTIAL covered government services, bank account opening, SIM registration, mobile driving licences, remote qualified signing, and e-prescriptions; NOBID focused on payments; and DC4EU covered education and social security. A second wave of pilots started in 2025, with WE BUILD focusing on business wallets and payments, and APTITUDE covering travel, ticketing, vehicle registration, and payments. The pilots made clear that practical availability of use cases will develop in phases across different countries.
What does eIDAS 2.0 compliance mean for organizations offering digital services in the EU?
eIDAS 2.0 compliance means that organizations offering digital services in the EU must be technically capable of accepting EUDI Wallet attestations for identity verification and authentication within the applicable deadlines. For many organizations, this requires updating onboarding flows, integrating wallet-compatible verification systems, and aligning data handling practices with the regulation’s data minimization principles.
Compliance covers both technical and organizational dimensions. Organizations must review their current identity and onboarding processes to understand where wallet-based attestations will replace or supplement existing checks. This includes:
- Assessing current identity flows: Identify every point in your customer or user journey where identity is verified, authenticated, or re-confirmed.
- Mapping regulatory obligations: Determine which services fall under the mandatory acceptance requirement, whether the relevant deadline is 24 December 2026 for public sector services or 24 December 2027 for regulated private sector services under Article 5f, and which sector-specific rules such as AML or PSD2 apply.
- Registering as a relying party: Under CIR (EU) 2025/848 of 6 May 2025, organizations must register with the national authority of their Member State of establishment before requesting wallet data. Registration covers the intended use and specifies which attributes and attestations will be requested. The wallet checks requests against this registered scope.
- Updating technical infrastructure: Integrate wallet-compatible interfaces and ensure your systems can process verifiable attestations that conform to the ARF. Your organization must be able to accept every relevant certified wallet, regardless of which wallet provider issued it.
- Aligning data practices: The wallet enforces selective disclosure, meaning users share only what is necessary. Your systems must be able to accept partial attribute sets. A relying party needs its own legal basis under the GDPR for processing the data received. For KYC purposes, that basis is typically a legal obligation. For health data, an additional ground under Article 9(2) GDPR is required.
- Training internal teams: Compliance, legal, IT, and customer-facing teams all need to understand what the wallet means for their specific responsibilities.
Organizations in the public sector face obligations from 24 December 2026. Private sector organizations in regulated industries face the Article 5f obligation from 24 December 2027. A vendor that processes wallet data on behalf of a client does not thereby become the relying party. The registration obligation lies with the organization that delivers the service to the end user. Organizations should engage with the relevant national competent authorities in each jurisdiction where they operate.
How does eIDAS 2.0 compare to the original eIDAS regulation?
The original eIDAS regulation, in force since 2016, created a framework for mutual recognition of national eID schemes across the EU, but participation was largely voluntary. eIDAS 2.0 amends this by making key obligations mandatory: every Member State must provide a wallet, and both public and private sector organizations in scope must accept it. The scope, obligations, and technical standardization are all significantly expanded.
The original regulation focused almost entirely on the public sector. Cross-border recognition applied to notified national eID schemes, and private companies were not required to participate. This left the private sector free to build its own identity verification processes, resulting in a highly fragmented landscape where users faced different requirements depending on which organization they were dealing with.
eIDAS 2.0 changes this in three fundamental ways. First, it introduces the EUDI Wallet as a universal instrument that works across both public and private sector services. Second, it extends mandatory acceptance obligations to private organizations in regulated sectors from 24 December 2027. Third, it introduces a common technical architecture, elaborated through the ARF and given legal force through implementing acts adopted by the European Commission, that is designed to ensure genuine interoperability.
Another important difference is the emphasis on user control. The original regulation was primarily about enabling organizations to recognize each other’s identity systems. eIDAS 2.0 places the user at the center, giving individuals the ability to manage and share their identity data through the wallet, with selective disclosure built into the technical design. Users approve each individual presentation request. Governance under eIDAS 2.0 is a shared responsibility: the European Commission sets the legal framework and adopts implementing acts, Member States provide or mandate wallet solutions and supervise actors within their jurisdiction, the European Digital Identity Cooperation Group supports cross-border alignment, and wallet providers, issuers of Person Identification Data and attestations, qualified trust service providers, and relying parties each carry their own defined responsibilities.
When do organizations need to be ready for eIDAS 2.0?
The legal deadline for Member States to make EUDI Wallets available to all citizens, residents, and businesses is 24 December 2026. Public sector organizations must be capable of accepting notified wallets for online services requiring electronic identification by that date. Private sector organizations in regulated sectors covered by Article 5f must be ready to accept wallets by 24 December 2027. These are legal obligations, not predicted launch dates. It is important to understand that these deadlines do not guarantee that every national wallet will have reached the same level of maturity, that every possible cross-border use case will be fully operational in every country on those dates, or that practical interoperability will be uniform across Europe from day one. National rollout, certification and notification of individual wallets, and acceptance by relying parties will each develop at their own pace.
The large-scale pilot programs that ran through 2025 generated the technical specifications and feedback that now inform the final implementation requirements. Organizations that waited for the pilots to conclude before beginning their preparation are already working under time pressure.
In practice, readiness means different things depending on where an organization currently stands. Those with modern, API-based identity infrastructure will find integration more straightforward. Organizations with legacy systems or heavily manual onboarding processes face a more significant transformation. The compliance timelines are fixed, and non-compliance in regulated sectors carries real legal and operational consequences. Organizations should plan for a phased approach that tracks national rollout and certification progress in the jurisdictions most relevant to their operations.
A practical starting point is a gap analysis: map your current identity processes against the requirements of eIDAS 2.0, identify where the biggest changes are needed, and prioritize those areas for investment. Organizations that have already engaged with digital identity resources and frameworks during the pilot phase are better positioned to move quickly.
How TrustTech supports eIDAS 2.0 cross-border compliance
Preparing for eIDAS 2.0 is an opportunity to build a faster, more trusted, and more scalable digital identity infrastructure. The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login, and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs, and identity documents, inside and outside the EU.
For organizations in financial services, healthcare, pharma, and government, the ID Connector handles the technical complexity of wallet acceptance so that internal teams can focus on the compliance and operational dimensions. Specifically, the ID Connector:
- Accepts every relevant certified EUDI Wallet, regardless of the issuing Member State or wallet provider
- Verifies attestations against national trusted lists consolidated in the EU List of Trusted Lists
- Checks revocation status using issuer-provided status information
- Validates wallet unit attestations to confirm the presenting wallet runs on a certified wallet solution
- Enforces the registered attribute scope so that only the attributes declared in the relying party’s registration under CIR (EU) 2025/848 are requested
- Supports reuse of verified identity data across onboarding flows and services
- Connects to a qualified trust service provider for qualified signing where required
Explore our identity solutions or get in touch to discuss your specific situation.