eIDAS 2.0, Regulation (EU) 2024/1183, amends Regulation (EU) 910/2014 and significantly affects digital identity in the insurance sector by introducing new requirements for identity verification, electronic signatures, and trusted data exchange. Insurers must now align their onboarding, contracting, and compliance processes with a unified European digital identity framework. This article walks through the most important questions insurers are asking right now, from what changes under eIDAS 2.0 to how your organisation should prepare.
What changes does eIDAS 2.0 bring to identity verification?
eIDAS 2.0 raises the bar for digital identity verification across the EU by making high-assurance identity checks more accessible, standardised, and interoperable. The updated regulation introduces the European Digital Identity Wallet, requires Member States to provide wallets to all citizens, residents, and businesses, and extends the framework to include private sector organisations. Insurers are directly affected because they now have access to verified, reusable identity data at a level of assurance that was previously difficult to achieve at scale.
Under the original eIDAS framework, identity schemes varied widely between Member States, and private sector organisations had limited access to cross-border identity verification. eIDAS 2.0 closes these gaps. It creates a consistent standard for how identity is verified, presented, and accepted across Europe. For insurers, this means that a customer who has already verified their identity through a government-issued wallet can share verified attributes such as their name, address, or date of birth directly with an insurer, without repeating the process from scratch.
The regulation also strengthens the legal standing of qualified electronic signatures and introduces verifiable attestations as a recognised format for sharing trusted data. This gives insurers a solid legal and technical foundation for digital contracting, consent management, and customer authentication.
How does the EUDI Wallet affect insurance customer onboarding?
The EUDI Wallet has the potential to make insurance customer onboarding significantly faster and less friction-heavy. Instead of asking customers to upload documents, fill in lengthy forms, or repeat identity checks they have already completed elsewhere, insurers can accept wallet-based attestations that have already been verified at a high level of assurance. This reduces onboarding time and lowers the risk of drop-off during the sign-up process.
In practice, a customer opening a new insurance policy could share their verified identity, address, and relevant attestations directly from their EUDI Wallet in a single interaction. The insurer receives tamper-evident, cryptographically signed data. Verifying that data involves three distinct checks: confirming the issuer’s signature against the relevant national trusted list, checking the revocation status via the issuer’s status information, and verifying the wallet unit attestation to confirm that the presenting wallet runs on a certified wallet solution. This is the principle of verify once, reuse everywhere, and it is one of the most practical benefits eIDAS 2.0 brings to the insurance sector.
For insurers, this also means rethinking how onboarding flows are designed. Systems that were built around document uploads and manual review processes will need to be updated to accept wallet-based data and attestations. Organisations that invest in this infrastructure early will be able to offer a noticeably smoother customer experience compared to those still relying on legacy verification methods.
Which insurance use cases benefit most from eIDAS 2.0?
Several insurance use cases stand to gain the most from eIDAS 2.0, particularly those that involve repeated identity checks, cross-border customers, or high-value transactions requiring strong authentication. The regulation removes friction from processes that currently depend on manual verification or paper-based documentation.
The use cases with the clearest benefits include:
- New customer onboarding: Accepting verified identity attributes from an EUDI Wallet eliminates the need for document uploads and manual review.
- Policy contracting and renewals: Qualified electronic signatures allow contracts to be signed digitally with full legal validity across the EU, subject to applicable national formal requirements.
- Claims processing: Verified identity and attribute data can speed up claims validation, especially where proof of identity or employment status is required.
- Cross-border customers: eIDAS 2.0 is designed so that a certified wallet from one Member State can be used with a relying party in another Member State. Practical cross-border interoperability is expected to develop in phases as national wallets are certified and notified, and national registration requirements and sector-specific legislation remain in force.
- KYC and AML compliance: Reusable, verified identity data can reduce the cost and time associated with Know Your Customer checks. The extent to which verified identity data from an EUDI Wallet can be reused for KYC purposes is governed by AML legislation, not by eIDAS 2.0 itself. The new AML framework applying from July 2027 points towards identity verification via notified schemes, the EUDI Wallet, and qualified trust services as accepted methods.
Each of these use cases benefits from the same underlying principle: trusted identity data that has already been verified does not need to be re-verified from scratch. This saves time for customers, reduces operational costs for insurers, and improves the overall quality of identity data held on file.
What compliance obligations does eIDAS 2.0 create for insurers?
eIDAS 2.0 creates concrete compliance obligations for insurers operating in the EU, particularly around accepting EUDI Wallet credentials, using qualified trust services, and meeting interoperability requirements. Insurers that fall into the category of relying parties, meaning organisations that request identity data from wallets, must register with the national authority of their Member State of establishment under CIR (EU) 2025/848 of 6 May 2025 before they can request wallet data. Registration is per intended use: the relying party specifies which attributes and attestations it will request, and the wallet checks each request against that registered scope. Governance of the wallet framework is a shared responsibility: the European Commission manages the legal framework and adopts implementing acts; Member States provide or mandate wallet solutions, certify and notify them, and supervise actors within their jurisdiction; the European Digital Identity Cooperation Group supports cross-border alignment; and national competent authorities, wallet providers, issuers of Person Identification Data and attestations, qualified trust service providers, and relying parties each carry their own distinct responsibilities.
Key compliance considerations for insurers include:
- Accepting EUDI Wallet credentials: Under Article 5f of the regulation, regulated financial services providers operating online are required to accept EUDI Wallet-based authentication and identity sharing from 24 December 2027, where strong user authentication is legally or contractually required. The period leading up to that date is the appropriate window for insurers to test integration and prepare their systems. By 24 December 2026, Member States must have at least one certified wallet operational and available for citizens, residents, and businesses, and public bodies must accept notified wallets for online services requiring electronic identification. The 24 December 2026 deadline is a legal obligation on Member States. It does not guarantee that every national wallet will have reached the same level of maturity or that every cross-border use case will be fully operational throughout Europe on that date. Practical interoperability and national rollout are expected to develop in phases. Micro and small enterprises, defined as organisations with fewer than 50 employees and an annual turnover or balance sheet total not exceeding 10 million euros, are excluded from the Article 5f acceptance obligation.
- Qualified electronic signatures: Contracts and consent forms signed using qualified electronic signatures (QES) must be accepted as legally equivalent to handwritten signatures. A QES requires a qualified certificate and a qualified signature creation device (QSCD). National formal requirements for specific contract types continue to apply.
- Data minimisation: eIDAS 2.0 reinforces the principle that only the data strictly necessary for a transaction should be requested. Insurers need to review what they collect and why. Selective disclosure of attributes, for example confirming that a customer is over a certain age without revealing their exact date of birth, supports this principle.
- Interoperability standards: Systems must be capable of reading and processing attestations in formats aligned with the implementing acts adopted by the European Commission. The credential formats prescribed in the Architecture and Reference Framework (ARF) are mdoc and SD-JWT VC. The ARF provides the technical elaboration of those requirements and is a practical reference for building integration, though it is not itself legislation. The implementing acts are legally binding.
- Audit and record-keeping: Insurers must maintain complete records of identity-linked transactions, particularly for signed documents and compliance checks.
These obligations intersect with existing regulatory requirements such as GDPR, AML directives, and sector-specific rules. Insurers should treat eIDAS 2.0 compliance as part of a broader digital identity and compliance strategy, not as a standalone project.
How should insurers prepare their systems for eIDAS 2.0?
Insurers should start preparing for eIDAS 2.0 by auditing their current identity verification and onboarding infrastructure, identifying gaps against the new requirements, and building a roadmap for integration. The goal is to move from fragmented, document-heavy processes to a connected system that can accept, process, and store verified digital identity data.
Practical preparation steps include reviewing how identity data is currently collected and stored, assessing whether existing systems can accept attestations in the formats prescribed by the implementing acts, and evaluating the need for qualified trust services such as qualified electronic signatures. Organisations that have already invested in API-based onboarding infrastructure will find integration more straightforward, while those with older legacy systems may face a more significant technical lift.
It is also worth engaging with the technical specifications now. The first wave of implementing acts, covering technical specifications, security standards, and interoperability rules, was adopted in late 2024, starting the relevant 24-month period. A second wave covering qualified electronic archiving, validation, certificates, and qualified trust service providers followed in 2025. The implementing acts set out the legally binding requirements. The Architecture and Reference Framework provides the technical elaboration of those requirements and is a practical reference for building integration. Building familiarity with both early gives your team a meaningful head start. By 24 December 2026, Member States must have at least one certified wallet operational and available, and public bodies must accept notified wallets. The acceptance obligation for regulated private sector parties in the relevant sectors, including financial services, then takes effect on 24 December 2027. This gives insurers a well-defined preparation window. National rollout and practical interoperability will develop in phases, and early engagement with implementation partners will be more effective than a last-minute response.
What risks do insurers face by delaying eIDAS 2.0 adoption?
Insurers that delay eIDAS 2.0 adoption face a combination of compliance risk, competitive disadvantage, and operational inefficiency. As the regulation comes into full effect and EUDI Wallets become more widely used, organisations that have not updated their systems will struggle to meet customer expectations and regulatory requirements at the same time.
From a compliance perspective, failing to accept EUDI Wallet credentials or qualified electronic signatures where required could expose insurers to regulatory scrutiny. The acceptance obligation for regulated financial services providers takes effect on 24 December 2027, and organisations without adequate infrastructure by that point may face penalties or be required to make rapid, costly changes under pressure. National competent authorities and supervisory bodies are expected to enforce these obligations within their respective jurisdictions as they come into effect.
From a competitive standpoint, insurers that adopt wallet-ready onboarding early will offer a faster, simpler customer experience. By 24 December 2026, each Member State must have at least one certified EUDI Wallet operational and available to citizens, residents, and businesses. While the pace of national rollout and the maturity of individual wallet solutions will vary, customers will increasingly expect providers to accept those credentials without friction as adoption grows. Insurers that are not ready will see higher drop-off rates and lower conversion, particularly among digitally active customers.
There is also a longer-term risk around data quality. Organisations that continue relying on self-reported or manually verified data will accumulate identity records of lower assurance than those built on wallet-based verification. This creates downstream problems for fraud prevention, claims validation, and AML compliance.
How TrustTech helps insurers navigate eIDAS 2.0
TrustTech offers the ID Connector for insurance organisations making the transition to eIDAS 2.0-ready infrastructure. The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
For insurers specifically, the ID Connector handles:
- Accepting EUDI Wallet-based identity attestations in onboarding flows, with verification against national trusted lists, revocation status checks, and wallet unit attestation validation
- Managing the registered attribute scope per intended use, so that each data request stays within what the relying party has registered under CIR (EU) 2025/848
- Qualified signing for policy contracts, renewals, and consent management, via a connected qualified trust service provider
- Reuse of verified identity data across interactions, reducing repeated verification for returning customers
- A complete audit trail linking identity attestations to every signed document and compliance decision
The ID Connector integrates via API, which means insurers can connect it to existing onboarding and policy administration systems without rebuilding those systems from scratch. If you are assessing your eIDAS 2.0 readiness or planning integration ahead of the 24 December 2027 acceptance obligation, contact TrustTech to discuss what the ID Connector can do for your organisation.