eIDAS 2.0 fundamentally changes digital trust in Europe by expanding the original eIDAS framework to include a universal digital identity wallet, broader trust services, and stronger cross-border interoperability. Where the original regulation focused mainly on electronic signatures and national eID schemes, eIDAS 2.0 creates a unified European identity infrastructure that affects virtually every sector. This article walks through the most important questions organizations are asking about what eIDAS 2.0 means in practice.
What does eIDAS 2.0 actually change compared to the original eIDAS?
eIDAS 2.0 goes significantly further than the original 2014 regulation. The original eIDAS, Regulation (EU) 910/2014, established a foundation for electronic signatures and cross-border recognition of national eID schemes, but participation was largely optional for the private sector. eIDAS 2.0, formally adopted as Regulation (EU) 2024/1183, amends Regulation (EU) 910/2014 and makes digital identity infrastructure a legal requirement, extending its reach to businesses as well as governments.
The most visible change is the introduction of the European Digital Identity Wallet, which all EU Member States must provide to citizens, residents, and businesses. Beyond the wallet, eIDAS 2.0 also expands the scope of qualified trust services to include electronic ledgers, archiving services, and remote qualified signature creation devices. The regulation introduces stricter requirements for Qualified Trust Service Providers and establishes a comprehensive Architecture and Reference Framework to ensure consistent technical elaboration of the legally binding requirements set out in the implementing acts across Member States.
In short, eIDAS 2.0 moves from a framework that enabled digital trust to one that actively mandates and standardizes it across Europe.
What is the European Digital Identity Wallet and how does it work?
The European Digital Identity Wallet, often called the EUDI Wallet, is a secure digital application that allows individuals and organizations to store, manage, and share verified identity data and attestations. It works by letting users hold certified digital documents in one place and present them to public or private service providers, with full control over what information they share and with whom. Each time a user responds to a request from a relying party, they approve that specific presentation in the wallet. The wallet does not provide a single authentication that carries across all interactions.
The wallet supports a wide range of practical use cases, including:
- Storing and presenting a mobile driving license in both online and physical situations
- Signing contracts digitally with qualified electronic signatures
- Claiming prescriptions at pharmacies
- Presenting travel documents, a use case that has been piloted but is not yet operational at border or airport controls
- Proving organizational affiliation or representative authority
- Verifying identity for online payments
- Sharing educational credentials such as diplomas and degrees
- Accessing social security benefits and storing the European Health Insurance Card
The wallet relies on tamper-evident credential formats and cryptographic standards to ensure that the data it contains is authentic. The credential formats prescribed by the Architecture and Reference Framework are mdoc, as defined in ISO/IEC 18013-5 for proximity presentation and ISO/IEC TS 18013-7 for online presentation, and SD-JWT VC. Issuance uses the OID4VCI protocol and presentation uses OID4VP. Service providers, called relying parties, can request specific attributes from the wallet without receiving unnecessary personal data. This selective disclosure model is central to the wallet’s privacy-by-design approach.
When a relying party verifies a presentation from the EUDI Wallet, three separate checks are relevant. First, the issuer’s signature on the attestation is verified against the relevant national trusted list, which is part of the EU List of Trusted Lists (LOTL). This check can be performed fully offline. Second, the revocation status of the attestation is checked using status information provided by the issuer, which requires a connection to the issuer’s infrastructure. Third, the wallet unit attestation is checked to confirm that the presenting wallet is running on a certified wallet solution. These three checks are distinct and should not be described as a single cryptographic verification.
Governance of the EUDI Wallet is a shared responsibility. The European Commission manages the legal framework and adopts implementing acts that set legally binding requirements. EU Member States are responsible for providing or mandating wallet solutions, certifying and notifying them, and supervising actors within their jurisdiction. The European Digital Identity Cooperation Group supports cooperation and cross-border alignment. National competent authorities and registrars, wallet providers, issuers of Person Identification Data and attestations, Qualified Trust Service Providers, and relying parties each carry distinct obligations within this structure. No single central European authority operationally manages all EUDI Wallets.
Which sectors and organizations are most affected by eIDAS 2.0?
eIDAS 2.0 has the broadest impact on sectors where secure identity verification and trusted data exchange are already critical. Financial services, government, healthcare, and pharmaceuticals are among the most directly affected, but the regulation’s reach extends to any organization that onboards users, verifies identities, or exchanges sensitive documents digitally.
In financial services, eIDAS 2.0 intersects with existing KYC, AML, and onboarding obligations. Banks, insurers, and payment providers will need to accept EUDI Wallet attestations and integrate with the new trust infrastructure. For government organizations, the regulation creates both an obligation to issue wallets and a requirement to accept them for public services. In healthcare, the wallet enables secure sharing of prescriptions, patient records, and professional credentials across borders.
Two distinct acceptance obligations apply to private sector organizations. From 24 December 2026, public bodies must accept notified wallets for online services that require electronic identification. From 24 December 2027, Article 5f of the amended regulation applies to relevant regulated private sectors where strong user authentication is legally or contractually required. Those sectors include banking and financial services, healthcare, telecoms, energy, transport, education, social security, drinking water, postal services, digital infrastructure, and digital services. Micro and small enterprises, defined as organizations with fewer than 50 employees and an annual turnover or balance sheet total of no more than 10 million euros, are exempt. Very large online platforms fall under a separate provision of Article 5f: they must accept the EUDI Wallet where the platform requires user authentication, on the voluntary request of the user and for the minimum necessary data only.
Private sector organizations that act as relying parties, meaning they request and verify attestations from wallets, must register formally under CIR (EU) 2025/848 of 6 May 2025 with the national authority of their Member State of establishment before requesting wallet data. Registration is per intended use: a relying party specifies which attributes and attestations it will request, and the wallet checks each request against that registered scope. A relying party must be able to accept every relevant notified wallet, regardless of which provider issued it. Accepting wallet data does not in itself require a Qualified Trust Service Provider. A QTSP becomes relevant in specific situations, such as qualified signing or qualified attestations. A supplier that processes wallet data on behalf of a client does not thereby become the relying party. The registration obligation rests with the organization that delivers the service to the end user.
How does eIDAS 2.0 affect cross-border digital trust in Europe?
eIDAS 2.0 is designed to create a common trust layer across all EU Member States, making it possible for a certified digital attestation issued in one country to be recognized and verified in another. This is a significant step forward compared to the original regulation, where cross-border recognition of eID schemes was inconsistent and often required bilateral agreements or manual workarounds.
The Architecture and Reference Framework, developed with the support of the European Digital Identity Cooperation Group, provides the technical elaboration of requirements set out in the implementing acts. All Member States must follow these shared standards, protocols, and interfaces. The goal is that a German citizen’s EUDI Wallet attestation can be verified by a Spanish bank or a Dutch government portal using the same technical infrastructure. Cross-border identity matching is addressed through specific implementing regulations, ensuring that identity attributes can be reliably linked across national systems.
Cross-border interoperability does not mean that every use case will immediately be available in every Member State, that national registration requirements disappear, or that sector-specific legislation ceases to apply. The legal deadline for Member States to meet their wallet obligations is 24 December 2026. This is a legal deadline, not a predicted launch date. Practical interoperability and national rollout are expected to develop in phases, and the level of maturity across different countries and use cases will vary. Organizations should engage with the rollout as it develops in each relevant market.
For organizations operating in multiple European markets, the interoperable framework still delivers significant value. Instead of building entirely separate identity verification flows for each country, they can rely on a common technical foundation. The practical result is less duplication, lower compliance costs, and a more consistent user experience across borders, provided they account for the national and sector-specific elements that remain distinct.
What compliance steps should organizations take to prepare for eIDAS 2.0?
Organizations preparing for eIDAS 2.0 should start by mapping their current identity and trust processes against the new regulatory requirements. The key is to understand where your organization sits in the ecosystem: are you issuing attestations, verifying them, or both? From there, a structured preparation approach becomes much clearer.
- Conduct a gap analysis to identify where your current identity verification, authentication, and document signing processes fall short of eIDAS 2.0 requirements.
- Assess your role in the ecosystem by determining whether your organization will act as an attestation issuer, a relying party, or a Trust Service Provider.
- Review your technical architecture to ensure compatibility with the EUDI Wallet protocols, interfaces, and data formats defined in the Architecture and Reference Framework, including support for mdoc, SD-JWT VC, OID4VCI, and OID4VP.
- Register as a relying party under CIR (EU) 2025/848 with the national authority of your Member State of establishment before requesting wallet data, and define the intended use and attribute scope for each registration.
- Update your legal and compliance frameworks to reflect new obligations around data minimization, selective disclosure, and audit-ready evidence exchange, and ensure your organization has an appropriate legal basis under the GDPR for processing the data received.
- Engage with pilot programs and working groups to stay current with evolving implementing regulations and technical specifications.
Given the complexity of the regulatory landscape, organizations in regulated sectors should also consider working with partners who have hands-on implementation experience. Reviewing practical resources and implementation guides is a useful starting point for teams building their internal understanding.
What are the main challenges organizations face when implementing eIDAS 2.0?
The most common challenges organizations face with eIDAS 2.0 implementation are technical complexity, organizational readiness, and the pace of regulatory development. While the regulation provides a clear direction, the detailed technical specifications are still maturing, which makes early implementation decisions difficult.
On the technical side, integrating with EUDI Wallet infrastructure requires support for credential formats such as mdoc and SD-JWT VC, presentation protocols including OID4VP, and issuance protocols including OID4VCI. Many existing systems were not built to handle these standards. Legacy identity systems in particular may need significant rearchitecting. Interoperability across different national wallet implementations adds another layer of complexity, especially for organizations operating in multiple countries, where national rollout timelines and levels of certification will differ.
Organizationally, many teams are still building awareness of what eIDAS 2.0 requires. Compliance, IT, legal, and business teams often have different levels of familiarity with the regulation, which can slow down decision-making and create gaps in implementation planning. Aligning these stakeholders around a shared roadmap is frequently underestimated as a challenge.
Finally, the regulatory environment continues to evolve. Implementing regulations covering topics such as cross-border identity matching, wallet certification, and relying party registration are still being finalized. The legal deadline of 24 December 2026 sets a clear obligation for Member States on wallet issuance and public acceptance, while the obligation for relevant regulated private sectors under Article 5f applies from 24 December 2027. Organizations must balance the need to act now with the reality that some technical requirements and national implementations will continue to be refined in the months ahead. Engaging early is the more effective approach.
How TrustTech helps organizations navigate eIDAS 2.0
Preparing for eIDAS 2.0 touches your identity infrastructure, your customer experience, and your position in the European digital economy. The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
For organizations in financial services, healthcare, pharmaceuticals, and government, the ID Connector handles the technical work of connecting to the EUDI Wallet ecosystem. It manages verification against national trusted lists that form part of the EU List of Trusted Lists, checks revocation status using issuer-provided status information, validates wallet unit attestations to confirm the presenting wallet runs on a certified wallet solution, and enforces the registered attribute scope so that only the data specified in your relying party registration is requested. For use cases that involve qualified signing, the ID Connector connects to a qualified Trust Service Provider through the same interface.
TrustTech is already in production with organizations that need eIDAS 2.0 readiness to actually work. If your organization is ready to move from understanding the regulation to implementing it, get in touch with TrustTech and take the next step toward a trusted digital identity infrastructure.