eIDAS 2.0 does affect single sign-on solutions, but it does not make them obsolete. Most existing SSO implementations will need to be updated or extended to support the new authentication assurance levels, wallet-based credentials, and interoperability requirements introduced by the regulation. Organizations that rely on SSO for access to regulated services will need to assess where their current setup falls short and plan accordingly. The sections below break down the key questions organizations are asking right now.

Will existing SSO solutions still be compliant under eIDAS 2.0?

Most existing SSO solutions will not be fully compliant with eIDAS 2.0 out of the box. The regulation raises the bar for identity assurance, introduces stricter requirements around authentication levels, and mandates support for the European Digital Identity Wallet. SSO systems built on older identity standards or lower assurance levels will need to be reviewed and updated to remain compliant in regulated contexts.

This does not mean organizations need to replace everything from scratch. Many modern SSO platforms are built on standards like OpenID Connect and OAuth, which form part of the technical foundation for eIDAS 2.0-compatible authentication. The question is whether those implementations meet the required assurance levels and can integrate with wallet-based credentials. In many cases, the existing SSO architecture can be extended rather than replaced, but that requires a clear understanding of what the regulation actually demands.

It is also worth noting that compliance depends on context. An SSO solution used purely for internal employee access may face different requirements than one used to authenticate customers accessing financial or healthcare services. Organizations should map their SSO use cases against the applicable eIDAS 2.0 requirements before drawing conclusions about what needs to change.

How does the EUDI Wallet change the way SSO authentication works?

The European Digital Identity Wallet introduces a new authentication model where users carry verified credentials in a personal digital wallet and present them directly to services, rather than relying on a centralized identity provider to authenticate on their behalf. This shifts some of the control away from the SSO provider and toward the user, which has real implications for how federated identity flows are designed.

In a traditional SSO setup, an identity provider authenticates the user and issues a token that services trust. With the EUDI Wallet, the user’s wallet holds cryptographically signed attributes, such as their name, age, or professional qualifications, and presents only the data a service actually needs. This selective disclosure model is fundamentally different from the all-or-nothing token approach most SSO systems use today.

For organizations running SSO infrastructure, this means building or integrating a relying party interface that can accept wallet-based presentations alongside traditional token-based authentication. The two models are not mutually exclusive. Many organizations will run them in parallel for a transition period, supporting wallet credentials for new regulatory use cases while maintaining existing SSO flows for legacy systems.

Each EU member state is required to have at least one certified EUDI Wallet available for citizens, residents, and businesses by 24 December 2026, at which point public sector services must also begin accepting notified wallet credentials. Large-scale pilots have already tested real-world scenarios including bank account opening, accessing government services, and signing contracts. Organizations in financial services and other regulated sectors should treat wallet integration as a near-term priority, not a future consideration, particularly given that the acceptance obligation for regulated private sector parties takes effect on 24 December 2027.

What is the difference between eIDAS 2.0 authentication and traditional SSO?

The key difference is where trust originates. Traditional SSO relies on a trusted identity provider that authenticates the user and vouches for their identity to other services. eIDAS 2.0 authentication, particularly through the EUDI Wallet, shifts trust to cryptographically verifiable credentials that the user holds and controls directly. This changes the trust model from provider-centric to user-centric.

In traditional SSO, the identity provider is the single point of trust. If a user logs in through their employer’s identity provider, downstream services trust that provider’s assertion. This works well within a single organization or a tightly governed federation, but it creates friction when users need to authenticate across organizations, borders, or sectors.

eIDAS 2.0 addresses this by standardizing the assurance levels and technical formats that credentials must meet. A credential issued by a government authority in one EU member state must be accepted by a service in another. This cross-border, cross-sector interoperability is something traditional SSO was never designed to deliver at scale.

Another important distinction is data minimization. Traditional SSO tokens often carry a broad set of user attributes, many of which the receiving service does not actually need. eIDAS 2.0, through the wallet model, enables selective disclosure, meaning users share only the specific attributes required for a given interaction. This aligns with GDPR principles and reduces the risk of unnecessary personal data exposure.

Which industries are most affected by eIDAS 2.0’s impact on SSO?

The industries most affected are those where identity assurance is a regulatory requirement and where users regularly authenticate across organizational boundaries. Financial services, government, healthcare, and other regulated sectors face the most immediate pressure to adapt their SSO and authentication infrastructure to meet eIDAS 2.0 standards.

• Financial services: Banks, insurers, and payment providers must support high-assurance authentication for customer onboarding, account access, and strong customer authentication under PSD2. eIDAS 2.0 changes the assurance landscape and introduces wallet-based credentials as a recognized authentication method. Under Article 5f of the regulation, financial services organizations are among the regulated private sector parties required to accept notified EUDI Wallet credentials by 24 December 2027, where strong user authentication is legally or contractually required.
• Government: Public sector services are required to accept EUDI Wallet credentials for citizens accessing digital services from 24 December 2026. This directly affects the identity infrastructure behind citizen-facing portals and SSO gateways.
• Healthcare: Patient identity, consent management, and cross-border health data exchange all depend on reliable, high-assurance authentication. eIDAS 2.0 enables more secure and interoperable identity flows in a sector where data sensitivity is extremely high. Healthcare providers are also among the regulated private sector parties subject to the acceptance obligation under Article 5f by 24 December 2027.
• Telecoms, energy, and transport: Organizations in these sectors are included among the regulated private parties required to accept EUDI Wallet credentials by 24 December 2027, where strong user authentication is legally or contractually required.
• Education: Credential verification and cross-border recognition of qualifications are active use cases in the EUDI Wallet pilots, making education another sector where SSO and identity infrastructure will need to evolve. Education is also among the sectors covered by the Article 5f acceptance obligation by 24 December 2027.

Organizations in these sectors can explore how healthcare-specific identity requirements and other regulated contexts are shaping the practical implementation of eIDAS 2.0-compatible authentication.

What technical standards underpin eIDAS 2.0-compatible authentication?

eIDAS 2.0-compatible authentication is built on a combination of established and emerging standards. OpenID Connect and OAuth 2.0 remain central, but they are extended and constrained by eIDAS-specific profiles and new protocols designed for wallet-based credential exchange. Understanding these layers is essential for technical teams planning SSO updates.

The core technical building blocks include:

1. OpenID Connect for Identity Assurance (OIDC4IDA): An extension of OpenID Connect that adds structured identity assurance claims, enabling services to request and receive verified identity data at a specified assurance level.
2. OpenID for Verifiable Credential Issuance (OID4VCI): The protocol used for issuing verifiable credentials from an issuer to a wallet, forming the basis for how the EUDI Wallet receives credentials from trusted sources.
3. OpenID for Verifiable Presentations (OID4VP): The protocol used for presenting credentials from a wallet to a relying party, enabling services to request and verify wallet-held attributes.
4. ISO/IEC 18013-5 (mDL): The international standard for mobile driving licenses, which is referenced in the EUDI Wallet architecture for proximity-based credential presentation.
5. SD-JWT (Selective Disclosure JWT): A credential format that enables selective disclosure of specific attributes within a signed credential, supporting the data minimization principles of eIDAS 2.0.

For organizations already running SSO on OpenID Connect and OAuth, the good news is that the eIDAS 2.0 technical architecture builds on these foundations rather than replacing them. The challenge lies in implementing the right profiles, integrating with wallet endpoints, and meeting the assurance level requirements defined in the Architecture and Reference Framework developed by the eIDAS Expert Group.

How should organizations start adapting their SSO infrastructure for eIDAS 2.0?

Organizations should start by mapping their current SSO use cases against the eIDAS 2.0 assurance level requirements and identifying where gaps exist. This means understanding which services require high-assurance authentication, which user journeys cross organizational or national boundaries, and which credential types the EUDI Wallet will need to support. From there, a phased adaptation plan is more practical than a full replacement.

A realistic starting point involves three parallel workstreams. First, assess the current state: audit existing identity providers, SSO configurations, and the assurance levels they actually deliver. Second, engage with the regulatory requirements directly: the eIDAS 2.0 regulation and its implementing acts define which services must accept wallet credentials and at what assurance level. Third, begin technical preparation by evaluating whether existing SSO platforms support or can be extended to support OID4VP and the relevant credential formats.

Organizations should also pay attention to the reusability of verified identity data. One of the most practical benefits of eIDAS 2.0 is that a user who has already been verified by their bank or government does not need to go through the same process again with every new service. Building SSO infrastructure that can accept and rely on previously issued verifiable credentials reduces friction for users and compliance costs for organizations. This is especially relevant for sectors like government services, where cross-agency identity reuse is both a user experience and an efficiency goal.

Finally, do not underestimate the governance and process dimension. Technical updates to SSO infrastructure need to be accompanied by updated data processing agreements, privacy impact assessments, and staff training. eIDAS 2.0 compliance is not purely a technology project. It requires alignment across legal, compliance, IT, and business teams.

How TrustTech helps with eIDAS 2.0 and single sign-on

Adapting SSO infrastructure for eIDAS 2.0 is a multi-layered challenge that combines regulatory requirements, technical standards, and organizational readiness. TrustTech helps organizations navigate this transition with practical expertise and purpose-built infrastructure designed for the European digital identity landscape.

Working with TrustTech, organizations can:

• Assess their current SSO setup against eIDAS 2.0 assurance level requirements and identify concrete gaps
• Integrate EUDI Wallet-compatible authentication into existing identity flows using standards like OID4VP and OpenID Connect for Identity Assurance
• Enable reusable, cryptographically verified identity data so users verify once and authenticate across multiple services without repeating the process
• Connect identity proofing, authentication, and qualified electronic signatures in a single compliant platform built for regulated sectors
• Prepare for cross-border and cross-sector identity interoperability, reducing compliance risk as eIDAS 2.0 requirements come into full effect

TrustTech’s platform is eIDAS 2.0-ready by design and trusted by organizations in finance, healthcare, government, and life sciences. Whether you are starting your assessment or already planning a technical migration, TrustTech can help you move forward with confidence. Get in touch with TrustTech to discuss how your organization can adapt its identity infrastructure for the next generation of digital trust.