Under eIDAS 2.0, Regulation (EU) 2024/1183, which amends Regulation (EU) 910/2014, an electronic attestation of attributes (EAA) is a digitally signed statement that confirms specific characteristics or qualifications about a person or organisation, such as a professional licence, age, or educational credential. An EAA does not need to prove who you are, only that a particular fact about you is true and has been verified by a trusted source. This article explains how EAAs are defined, who can issue them, and what they mean in practice for organisations and users across the EU.
What types of electronic attestation of attributes does eIDAS 2.0 recognise?
eIDAS 2.0 recognises three types of electronic attestation of attributes: qualified electronic attestations of attributes (QEAAs), public body electronic attestations of attributes (PuB-EAAs), and non-qualified electronic attestations of attributes (EAAs). QEAAs are issued by qualified trust service providers (QTSPs) that appear on a national trusted list and carry the highest level of legal certainty. PuB-EAAs are issued by or on behalf of public sector bodies responsible for authentic sources and occupy a distinct category with their own legal standing. Non-qualified EAAs are issued by other parties and carry a lower but still meaningful level of trust.
The distinction matters because it determines how much legal weight the attestation carries and who is allowed to issue it. A QEAA confirming that someone holds a valid medical licence, for example, carries the same legal standing across all EU member states as a paper certificate issued by the relevant authority, in a format that is machine-readable and cryptographically verifiable.
All three types can contain a wide range of attribute data, including:
- Professional qualifications and licences
- Educational credentials and diplomas
- Age verification and nationality
- Organisational roles and authorisations
- Health data such as prescriptions or insurance entitlements
- Driving licence information
This flexibility is one of the core design goals of the eIDAS 2.0 framework. Rather than limiting digital identity to a single national ID, eIDAS 2.0 allows a rich ecosystem of verifiable attestations to be issued, stored, and presented through the digital identity infrastructure that organisations and governments are now building.
How do electronic attestations of attributes differ from eIDs?
An eID establishes your legal identity, typically through name, date of birth, and a unique identifier. An EAA is a targeted claim issued by a relevant authority, confirming a particular fact without necessarily revealing your full identity.
Your passport is an eID. A certificate confirming you are a licensed pharmacist is an EAA. Both are digitally signed and cryptographically verifiable, but they serve different purposes and come from different issuers.
This separation is deliberate. eIDAS 2.0 is designed to support data minimisation, a principle rooted in the GDPR. When a user wants to prove they are over 18 to access a service, they should not have to share their full name, address, and date of birth. Through selective disclosure, an EAA can confirm that the age threshold is met by exposing only the relevant attribute, such as “age over 18”, without revealing any unnecessary personal data. This gives users meaningful control over what they share and with whom.
For organisations in sectors such as financial services or healthcare, this distinction is also operationally important. Accepting an EAA reduces the amount of sensitive data you handle, which in turn reduces compliance risk under data protection law.
Who can issue qualified electronic attestations of attributes under eIDAS 2.0?
Qualified electronic attestations of attributes can only be issued by qualified trust service providers (QTSPs) that have been officially recognised on a national trusted list. These providers must meet strict requirements set out in eIDAS 2.0 and its implementing acts, covering security, audit, and operational standards. National competent authorities are responsible for supervising QTSPs within their jurisdiction and maintaining the trusted lists that give these providers their recognised status.
PuB-EAAs form a separate category. They are issued by or on behalf of public sector bodies responsible for authentic sources, such as professional registers or population databases. PuB-EAAs are not non-qualified EAAs: they carry their own legal standing under the regulation.
The regulation establishes a clear chain of accountability. A QTSP issuing a QEAA must be able to verify the underlying attribute from an authoritative source before attesting to it. For example, a QTSP issuing a QEAA confirming a lawyer’s bar membership must obtain that confirmation from the relevant bar association or official register. Issuing attestations of attributes is itself a trust service under eIDAS 2.0, and issuers must where applicable make revocation status available and support re-issuance when a user moves to a new device.
This is a significant expansion from the original eIDAS framework, which focused primarily on electronic signatures and identity. Under eIDAS 2.0, the trust service ecosystem extends to cover a much broader range of attribute issuers, including employers, educational institutions, and professional bodies, provided they operate within the recognised framework.
How does the EUDI Wallet store and present electronic attestations of attributes?
The European Digital Identity Wallet (EUDI Wallet) stores electronic attestations of attributes as credentials in standardised formats, specifically mdoc and SD-JWT VC, in a cryptographically protected environment. When a user needs to present an EAA to a relying party, the wallet generates a selective disclosure response, sharing only the specific attributes the service requires.
The legal requirements for these technical mechanisms are set out in the implementing acts adopted by the European Commission. The Architecture and Reference Framework (ARF) provides the technical elaboration of those requirements. For credential issuance, the ARF specifies the OID4VCI protocol; for presentation, it specifies OID4VP. For proximity interactions, ISO/IEC 18013-5 applies; for online presentation, ISO/IEC TS 18013-7 is relevant. The High Assurance Interoperability Profile (HAIP) sets out the interoperability requirements that wallet solutions and relying parties must meet.
Verifying an attestation presented from an EUDI Wallet involves three distinct checks. First, the relying party verifies the issuer’s signature against the relevant national trusted list, which forms part of the EU List of Trusted Lists (LOTL). This check can be performed offline. Second, the relying party checks the revocation status of the attestation using status information provided by the issuer, which requires contact with the issuer’s infrastructure. Third, the relying party validates the wallet unit attestation to confirm that the presenting wallet is running on a certified wallet solution. Each of these checks serves a different purpose, and describing verification as a single cryptographic step would not be accurate.
In practical terms, a user can present their professional qualification to an employer, their age to an online platform, or their health insurance entitlement to a pharmacy, all from the same wallet app, without handing over a physical document or repeating a manual verification process. The wallet is designed to work both online and in physical interactions, such as presenting a mobile driving licence during a roadside check.
It is worth noting that EUDI Wallets are provided or mandated by individual EU member states, not by a single central European authority. Each member state is responsible for certifying and notifying its wallet solution, and national competent authorities supervise the actors operating within their jurisdiction. The European Digital Identity Cooperation Group supports cross-border alignment and cooperation between member states, but operational management of wallets remains a national responsibility.
Private keys associated with a person’s identity data and attestations are held within the Wallet Secure Cryptographic Device and do not leave that secure element. When a user moves to a new device, attestations must be re-issued rather than simply copied across.
What legal effects do electronic attestations of attributes carry across EU member states?
Qualified electronic attestations of attributes have equivalent legal effect across all EU member states. This means a QEAA issued in one member state must be accepted by relying parties in all other member states, provided it relates to attributes that fall within the scope of the regulation. PuB-EAAs carry their own legal standing. Non-qualified EAAs carry legal weight too, but their cross-border recognition depends on the specific context and the policies of the receiving organisation.
This cross-border recognition is one of the most significant practical outcomes of eIDAS 2.0. Before this regulation, a professional credential issued in Germany might not be automatically accepted by a digital service in Spain, because there was no common technical or legal framework for verifying it remotely. eIDAS 2.0 changes that by establishing a binding interoperability framework.
Cross-border interoperability operates at the level of the framework itself. The EUDI Wallet framework is designed so that a certified wallet from one member state can be used with an appropriate relying party in another member state. This does not mean that national registration requirements or sector-specific legislation disappear. Relying parties remain subject to the applicable national registration framework in their jurisdiction. Under CIR (EU) 2025/848, adopted on 6 May 2025, a relying party must register with the national authority of the member state in which it is established before it can request wallet data. Registration is per intended use, specifying which attributes and attestations will be requested. The wallet checks requests against this registered scope. Organisations should assess which elements of interoperability apply at European level and which remain governed by national or sector-specific rules.
The legal effects are structured as follows:
- QEAAs must be accepted wherever the relevant attribute type is legally recognised across the EU, with the same standing as equivalent paper-based certificates.
- PuB-EAAs carry strong evidentiary weight as a distinct category under the regulation and are expected to be widely accepted, though the legal framework may vary by use case.
- Non-qualified EAAs from private issuers are legally valid but their acceptance depends on the relying party’s policies and any applicable sector-specific rules.
For organisations operating across borders, particularly in regulated sectors such as finance, pharmaceuticals, or professional services, this framework removes a significant barrier. A verified attestation issued once can be reused across multiple services and jurisdictions, reducing duplication and speeding up processes that previously required separate verification in each country.
How the ID Connector supports electronic attestation of attributes
The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
For organisations dealing with electronic attestations of attributes, the ID Connector handles the verification steps that relying parties are required to perform: validating issuer signatures against national trusted lists that form part of the LOTL, checking attestation revocation status, and validating wallet unit attestations to confirm the presenting wallet runs on a certified wallet solution. It also enforces the registered attribute scope, so that only the attributes a relying party has registered under CIR (EU) 2025/848 are requested and processed.
This applies across sectors where attestation verification is operationally critical, including financial services, healthcare, pharma, and government. Organisations in these sectors that need to accept QEAAs, PuB-EAAs, or non-qualified EAAs as part of their workflows can connect through the ID Connector without building and maintaining the underlying trust infrastructure themselves.
To find out how the ID Connector fits your organisation’s requirements, get in touch with TrustTech.