eIDAS 2.0 affects single sign-on solutions, but it does not make them obsolete. Most existing SSO implementations will need to be updated or extended to support the new authentication assurance levels, wallet-based credentials, and interoperability requirements introduced by the regulation. Organizations that rely on SSO for access to regulated services will need to assess where their current setup falls short and plan accordingly. The sections below address the key questions organizations are asking right now.
Will existing SSO solutions still be compliant under eIDAS 2.0?
Most existing SSO solutions will not be fully compliant with eIDAS 2.0 out of the box. The regulation raises the bar for identity assurance, introduces stricter requirements around authentication levels, and mandates support for the European Digital Identity Wallet. SSO systems built on older identity standards or lower assurance levels will need to be reviewed and updated to remain compliant in regulated contexts.
This does not mean organizations need to replace everything from scratch. Many modern SSO platforms are built on standards like OpenID Connect and OAuth 2.0, which form part of the technical foundation for eIDAS 2.0-compatible authentication. The question is whether those implementations meet the required assurance levels and can integrate with wallet-based credentials. In many cases, the existing SSO architecture can be extended, but that requires a clear understanding of what the regulation actually demands.
Compliance also depends on context. An SSO solution used purely for internal employee access may face different requirements than one used to authenticate customers accessing financial or healthcare services. Organizations should map their SSO use cases against the applicable eIDAS 2.0 requirements before drawing conclusions about what needs to change.
How does the EUDI Wallet change the way SSO authentication works?
The European Digital Identity Wallet introduces a new authentication model where users carry verified credentials in a personal digital wallet and present them directly to services, rather than relying on a centralized identity provider to authenticate on their behalf. This shifts some of the control away from the SSO provider and toward the user, which has real implications for how federated identity flows are designed.
In a traditional SSO setup, an identity provider authenticates the user and issues a token that services trust. With the EUDI Wallet, the user’s wallet holds cryptographically signed attributes, such as their name, age, or professional qualifications, and presents only the data a service actually needs. This selective disclosure model is fundamentally different from the token approach most SSO systems use today.
For organizations running SSO infrastructure, this means building or integrating a relying party interface that can accept wallet-based presentations alongside traditional token-based authentication. The two models are not mutually exclusive. Many organizations will run them in parallel for a transition period, supporting wallet credentials for new regulatory use cases while maintaining existing SSO flows for legacy systems.
24 December 2026 is the legal deadline by which EU Member States must have at least one certified EUDI Wallet available for citizens, residents, and businesses, and by which public sector services must begin accepting notified wallet credentials. Practical interoperability and national rollout may develop in phases: not every national wallet will necessarily reach the same level of maturity or support every cross-border use case immediately from that date. The Large Scale Pilots tested real-world scenarios including bank account opening, accessing government services, and signing contracts. Organizations in financial services and other regulated sectors should treat wallet integration as a near-term priority, particularly given that the acceptance obligation for regulated private sector parties under Article 5f takes effect on 24 December 2027.
What is the difference between eIDAS 2.0 authentication and traditional SSO?
The key difference is where trust originates. Traditional SSO relies on a trusted identity provider that authenticates the user and vouches for their identity to other services. eIDAS 2.0 authentication, particularly through the EUDI Wallet, shifts trust to cryptographically verifiable credentials that the user holds and controls directly. This changes the trust model from provider-centric to user-centric.
In traditional SSO, the identity provider is the single point of trust. If a user logs in through their employer’s identity provider, downstream services trust that provider’s assertion. This works well within a single organization or a tightly governed federation, but it creates friction when users need to authenticate across organizations, borders, or sectors.
eIDAS 2.0 addresses this by standardizing the assurance levels and technical formats that credentials must meet. A credential issued by a government authority in one EU Member State must be accepted by a service in another, provided the relevant relying party registration and sector-specific requirements are satisfied. This cross-border, cross-sector interoperability is something traditional SSO was not designed to deliver at scale. It is important to understand that not every credential automatically carries the same legal consequence in every Member State, and sector-specific legislation continues to apply alongside the eIDAS 2.0 framework.
Another important distinction is data minimization. Traditional SSO tokens often carry a broad set of user attributes, many of which the receiving service does not actually need. eIDAS 2.0, through the wallet model, enables selective disclosure, meaning users share only the specific attributes required for a given interaction. This aligns with GDPR principles and reduces the risk of unnecessary personal data exposure.
Which industries are most affected by eIDAS 2.0’s impact on SSO?
The industries most affected are those where identity assurance is a regulatory requirement and where users regularly authenticate across organizational boundaries. Financial services, government, healthcare, and other regulated sectors face the most immediate pressure to adapt their SSO and authentication infrastructure to meet eIDAS 2.0 standards.
- Financial services: Banks, insurers, and payment providers must support high-assurance authentication for customer onboarding, account access, and strong customer authentication under PSD2. eIDAS 2.0 changes the assurance landscape and introduces wallet-based credentials as a recognized authentication method. Under Article 5f of the regulation, financial services organizations are among the regulated private sector parties required to accept notified EUDI Wallet credentials by 24 December 2027, where strong user authentication is legally or contractually required.
- Government: Public sector services are required to accept EUDI Wallet credentials for citizens accessing digital services from 24 December 2026, which is the legal deadline for Member States’ wallet obligations. The practical scope of cross-border use cases available on that date will depend on the certification and notification status of individual national wallets and the readiness of relying party infrastructure in each Member State.
- Healthcare: Patient identity, consent management, and cross-border health data exchange all depend on reliable, high-assurance authentication. eIDAS 2.0 enables more secure and interoperable identity flows in a sector where data sensitivity is extremely high. Healthcare providers are also among the regulated private sector parties subject to the acceptance obligation under Article 5f by 24 December 2027.
- Telecoms, energy, and transport: Organizations in these sectors are included among the regulated private parties required to accept EUDI Wallet credentials by 24 December 2027, where strong user authentication is legally or contractually required.
- Education: Credential verification and cross-border recognition of qualifications were active use cases in the EUDI Wallet pilots, making education another sector where SSO and identity infrastructure will need to evolve. Education is also among the sectors covered by the Article 5f acceptance obligation by 24 December 2027.
Organizations in these sectors can explore how healthcare-specific identity requirements and other regulated contexts are shaping the practical implementation of eIDAS 2.0-compatible authentication.
What technical standards underpin eIDAS 2.0-compatible authentication?
eIDAS 2.0-compatible authentication is built on a combination of established and emerging standards. OpenID Connect and OAuth 2.0 remain central, but they are extended and constrained by eIDAS-specific profiles and new protocols designed for wallet-based credential exchange. Understanding these layers is essential for technical teams planning SSO updates.
The core technical building blocks include:
- OpenID Connect for Identity Assurance (OIDC4IDA): An extension of OpenID Connect that adds structured identity assurance claims, enabling services to request and receive verified identity data at a specified assurance level.
- OpenID for Verifiable Credential Issuance (OID4VCI): The protocol used for issuing verifiable credentials from an issuer to a wallet, forming the basis for how the EUDI Wallet receives credentials from trusted sources.
- OpenID for Verifiable Presentations (OID4VP): The protocol used for presenting credentials from a wallet to a relying party, enabling services to request and verify wallet-held attributes.
- ISO/IEC 18013-5: The international standard for proximity-based credential presentation, referenced in the EUDI Wallet architecture. For online presentation, ISO/IEC TS 18013-7 applies.
- SD-JWT VC (Selective Disclosure JWT Verifiable Credential): A credential format that enables selective disclosure of specific attributes within a signed credential, supporting the data minimization principles of eIDAS 2.0.
For organizations already running SSO on OpenID Connect and OAuth 2.0, the eIDAS 2.0 technical architecture builds on these foundations. The challenge lies in implementing the right profiles, integrating with wallet endpoints, and meeting the assurance level requirements defined in the legally binding implementing acts adopted by the European Commission. The Architecture and Reference Framework (ARF), developed by the eIDAS Expert Group, provides the technical elaboration of those requirements and serves as a key reference for implementation. The implementing acts carry legal force; the ARF provides the technical detail that supports them.
How should organizations start adapting their SSO infrastructure for eIDAS 2.0?
Organizations should start by mapping their current SSO use cases against the eIDAS 2.0 assurance level requirements and identifying where gaps exist. This means understanding which services require high-assurance authentication, which user journeys cross organizational or national boundaries, and which credential types the EUDI Wallet will need to support. From there, a phased adaptation plan is more practical than a full replacement.
A realistic starting point involves three parallel workstreams. First, assess the current state: audit existing identity providers, SSO configurations, and the assurance levels they actually deliver. Second, engage with the regulatory requirements directly: the eIDAS 2.0 regulation and its implementing acts, which contain the legally binding requirements, define which services must accept wallet credentials and at what assurance level. Third, begin technical preparation by evaluating whether existing SSO platforms support or can be extended to support OID4VP and the relevant credential formats.
Organizations should also pay attention to the reusability of verified identity data. One of the practical benefits of eIDAS 2.0 is that a user who has already been verified by their bank or government does not need to go through the same process again with every new service. Building SSO infrastructure that can accept and rely on previously issued verifiable credentials reduces friction for users and compliance costs for organizations. This is especially relevant for sectors like government services, where cross-agency identity reuse is both a user experience and an efficiency goal.
Organizations should also be aware that the EUDI Wallet ecosystem involves shared governance responsibilities. The European Commission manages the legal framework and adopts implementing acts. EU Member States provide or mandate wallet solutions, certify and notify them, and supervise actors within their jurisdiction. National competent authorities, wallet providers, issuers of Person Identification Data and attestations, qualified trust service providers, and relying parties each carry distinct responsibilities within this structure. Under CIR (EU) 2025/848, adopted on 6 May 2025, relying parties must register with the national authority of their Member State of establishment before requesting wallet data. Registration is scoped to the intended use: a relying party registers the specific attributes and attestations it will request, and the wallet checks incoming requests against that registered scope. Organizations should engage with their relevant national authority on registration requirements.
Finally, the governance and process dimension deserves attention. Technical updates to SSO infrastructure need to be accompanied by updated data processing agreements, privacy impact assessments, and staff training. eIDAS 2.0 compliance is not purely a technology project. It requires alignment across legal, compliance, IT, and business teams.
How TrustTech helps with eIDAS 2.0 and single sign-on
Adapting SSO infrastructure for eIDAS 2.0 combines regulatory requirements, technical standards, and organizational readiness. The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
For organizations updating their SSO infrastructure, the ID Connector addresses the specific technical and compliance requirements that eIDAS 2.0 introduces:
- Assessing the current SSO setup against eIDAS 2.0 assurance level requirements to identify concrete gaps
- Integrating EUDI Wallet-compatible authentication into existing identity flows using standards including OID4VP and OpenID Connect for Identity Assurance
- Managing trust by verifying issuer signatures against national trusted lists, checking revocation status, and validating wallet unit attestations to confirm the presenting wallet runs on a certified wallet solution
- Enforcing the registered attribute scope so that only the attributes a relying party has registered under CIR (EU) 2025/848 are requested
- Enabling reusable, cryptographically signed identity data so users can present previously issued attestations across multiple services
- Connecting identification, authentication, and qualified electronic signatures through a single integration built for regulated sectors
TrustTech’s platform is designed for organizations in financial services, healthcare, pharma, and government operating under eIDAS 2.0. Whether you are mapping your current SSO setup against the new requirements or already planning a technical migration, the ID Connector gives you a concrete starting point. Get in touch with TrustTech to discuss how your organization can adapt its identity infrastructure for the next generation of digital trust.