eIDAS 2.0 differs from the original eIDAS regulation primarily by introducing the European Digital Identity Wallet, extending the framework to private sector services, and creating new obligations for Member States to provide interoperable digital identity solutions to all citizens and businesses. Where the original eIDAS focused on mutual recognition of national eID schemes and electronic signatures, eIDAS 2.0 builds a far more comprehensive and user-controlled digital identity ecosystem across the EU.
The original regulation, Regulation (EU) 910/2014, has been in force since 2016. It laid important groundwork but left significant gaps in coverage and adoption. eIDAS 2.0, Regulation (EU) 2024/1183, amends Regulation (EU) 910/2014 and entered into force on 20 May 2024. It addresses those gaps directly and raises the bar for what digital identity infrastructure must deliver. The sections below walk through the most common questions organizations are asking as they work to understand what has changed and what it means for them.
What changed between eIDAS and eIDAS 2.0?
The original eIDAS regulation allowed EU Member States to notify and mutually recognize each other’s national electronic ID schemes, but it did not require every country to create one. This led to significant variation across the EU, with some Member States offering mature eID solutions and others offering very little. eIDAS 2.0 fundamentally changes this by making digital identity provision mandatory and by introducing a common standard that applies across both public and private sectors.
The key shifts from eIDAS to eIDAS 2.0 can be summarized as follows:
- Mandatory wallets: Every Member State must now provide a European Digital Identity Wallet to citizens, residents, and businesses.
- Private sector inclusion: Designated service providers in regulated sectors are required to accept the EUDI Wallet for authentication, subject to the applicable deadline and scope.
- Expanded attribute sharing: Users can store and share verified credentials beyond identity, such as qualifications, licenses, and health data.
- Stronger user control: Users decide exactly what data they share, with whom, and when, reducing unnecessary data disclosure.
- New trust service categories: eIDAS 2.0 introduces additional qualified trust services, including electronic attestations of attributes, electronic archiving, and electronic ledgers.
The original eIDAS created a foundation. eIDAS 2.0 builds substantially on top of it.
What is the European Digital Identity Wallet and why was it introduced?
The European Digital Identity Wallet (EUDI Wallet) is a secure mobile application that allows EU citizens, residents, and businesses to store, manage, and share verified identity data and digital documents. It can hold anything from a national ID and driving license to professional qualifications and healthcare credentials. Users share only the information that is strictly necessary for a given interaction, keeping full control over their personal data.
The wallet was introduced because the original eIDAS framework produced an uneven landscape. Not all Member States built interoperable eID systems, and those that did often limited them to public sector use. Citizens were repeatedly asked to prove the same things to different organizations, starting from scratch every time. The EUDI Wallet addresses this by creating a single, portable, and universally recognized identity layer that works across borders and across sectors.
Governance of the EUDI Wallet is a shared responsibility distributed across multiple actors. The European Commission manages the legal framework and adopts implementing acts that contain the legally binding requirements. Member States provide or mandate wallet solutions, certify and notify them, and supervise actors within their jurisdiction. The European Digital Identity Cooperation Group supports cooperation and cross-border alignment. National competent authorities and registrars, wallet providers, issuers of Person Identification Data and attestations, qualified trust service providers, and relying parties each carry distinct responsibilities within this structure. No single central European authority operationally manages all EUDI Wallets.
The Architecture and Reference Framework (ARF) provides the technical elaboration of the requirements set out in the implementing acts. It is a technical reference document, not legislation in itself.
The legal deadline for Member States to make the wallet available is 24 December 2026. This deadline marks a legal obligation, not a guarantee that every national wallet will have reached the same level of maturity or that every possible cross-border use case will be fully operational throughout Europe on that date. Practical interoperability and national rollout are expected to develop in phases, and organizations should plan accordingly. Wallets can be issued directly by governments or by private entities that receive official recognition. The wallet is built on open-source principles, meaning the reference implementation is publicly available and Member States can develop their own solutions on top of it.
For organizations in sectors such as financial services or government, the wallet represents a practical shift in how identity verification and onboarding will work in the near future.
How does eIDAS 2.0 expand the scope beyond government services?
eIDAS 2.0 explicitly extends the digital identity framework to private sector services. Under the new rules, two distinct acceptance obligations apply. From 24 December 2026, public sector bodies must accept notified EUDI Wallets for online services that require electronic identification. From 24 December 2027, Article 5f of the amended regulation requires designated private sector relying parties to accept the EUDI Wallet. This obligation applies in regulated sectors where strong user authentication is required by law or contract, including banking and financial services, healthcare, telecoms, energy, transport, education, social security, drinking water, postal services, digital infrastructure, and digital services. Very large online platforms (VLOPs) are covered by a separate provision of Article 5f: they must accept the EUDI Wallet where the platform requires user authentication, on the voluntary request of the user and for the minimum necessary data. Micro and small enterprises, defined as organizations with fewer than 50 employees and an annual turnover or balance sheet total not exceeding ten million euros, are exempt from the private acceptance obligation.
The practical implications are significant. A person could use their wallet to open a bank account, register a SIM card, access healthcare services, sign contracts, or verify their age for an online platform, without creating new accounts or submitting documents repeatedly. The four Large Scale Pilots, which ran from April 2023 to 2025, tested exactly these scenarios across more than 350 participating entities from 26 Member States, Norway, Iceland, and Ukraine.
The pilots explored real-world use cases distributed across four consortia. POTENTIAL covered government services, opening bank accounts, SIM registration, mobile driving licences, remote qualified signing, and e-prescriptions. EWC focused on Digital Travel Credentials, payments, and organisational digital identity. NOBID concentrated on payments. DC4EU addressed education and social security credentials. The feedback gathered from these pilots directly informed the technical specifications and architecture that underpin the final wallet design. A second wave of pilots started in 2025: WE BUILD focuses on business wallets and payments, and APTITUDE covers travel, ticketing, vehicle registration, and payments.
Cross-border use of the EUDI Wallet is designed so that a certified wallet from one Member State can be used with an appropriate relying party in another Member State. This does not mean that every use case will immediately be available in every Member State, that national registration requirements disappear, or that sector-specific legislation is overridden. Which elements are interoperable at European level and which remain national or sector-specific will depend on the use case and the applicable regulatory framework. Before a relying party can request wallet data, it must register with the national authority of its Member State of establishment under CIR (EU) 2025/848, adopted on 6 May 2025. Registration specifies per intended use which attributes and attestations the relying party is authorized to request. The wallet checks incoming requests against this registered scope.
For organizations in healthcare or other regulated industries, this expansion means that the wallet is an incoming channel through which customers and patients will expect to interact with you.
What are qualified electronic attestations of attributes (QEAAs)?
Qualified electronic attestations of attributes (QEAAs) are a new type of trust service introduced by eIDAS 2.0. They are digitally signed statements, issued by a qualified trust service provider, that confirm specific attributes about a person or organization. Examples include a verified professional qualification, a confirmed address, or an employer-issued credential. A QEAA carries a high level of legal and technical assurance.
This concept did not exist in the original eIDAS framework, which focused mainly on identity authentication and electronic signatures. QEAAs fill an important gap by enabling organizations to share and accept verified data that goes beyond basic identity to include qualifications, authorizations, and other confirmed attributes.
eIDAS 2.0 also introduces two further categories of attestation. Public body attestations of attributes (PuB-EAAs) are issued by or on behalf of a public body and carry their own distinct legal status. Non-qualified electronic attestations of attributes (non-qualified EAAs) can be issued by private entities that are not qualified trust service providers and carry a lower level of assurance. These three categories are distinct and should not be conflated.
Within the EUDI Wallet, users can store QEAAs alongside their identity documents and present them to relying parties on demand. A hospital could issue a PuB-EAA confirming a doctor’s credentials. A university could issue a QEAA confirming a degree. A government authority could confirm a business license. Each of these attestations is cryptographically signed and portable across borders, though the legal consequences of a given attestation may vary depending on the applicable national or sector-specific rules in the receiving jurisdiction.
When a relying party verifies an attestation, this involves three distinct checks: verification of the issuer’s signature against the relevant national trusted list, which is part of the EU List of Trusted Lists (LOTL); a check of the revocation status using the issuer’s status information; and a check of the wallet unit attestation to confirm that the presenting wallet is running on a certified wallet solution. Only the first of these checks can be performed fully offline. It is therefore not accurate to describe attestation verification as a process that requires no contact with the issuer.
For compliance teams and digital transformation managers, QEAAs represent a meaningful shift in how verified data can flow between organizations, reducing duplication and improving trust in the data being exchanged.
How do trust levels and assurance levels differ between the two frameworks?
Both eIDAS and eIDAS 2.0 use a three-tier assurance model: Low, Substantial, and High. These levels describe how reliably an identity has been verified before it is used in a transaction. The higher the assurance level, the more rigorous the identity proofing process that was used. This structure remains consistent between the two frameworks, but eIDAS 2.0 applies it more broadly and ties it to a wider range of credentials and trust services.
Under the original eIDAS, assurance levels applied primarily to notified eID schemes used for accessing public services. Under eIDAS 2.0, the same assurance framework now applies to the EUDI Wallet and to the new categories of trust services, including QEAAs. This means a relying party can know, with a high degree of legal certainty, what level of verification sits behind any credential presented through the wallet.
eIDAS 2.0 also introduces more detailed technical requirements for achieving each assurance level, backed by implementing acts and elaborated in the Architecture and Reference Framework (ARF). This gives organizations clearer guidance on what they need to do to issue or accept credentials at a given level, which simplifies compliance decisions.
For risk and security professionals, the practical takeaway is that the assurance model itself is familiar, but its application is now much wider and better specified than before.
What does eIDAS 2.0 mean for organizations that must comply?
For organizations in regulated sectors, eIDAS 2.0 introduces concrete obligations and changes the expectations placed on digital identity infrastructure. Member States must make the EUDI Wallet available by 24 December 2026. Public sector bodies must accept notified wallets for online services requiring electronic identification from that same date. Designated private sector relying parties in regulated sectors must accept the EUDI Wallet from 24 December 2027. Trust service providers must meet updated requirements. Organizations that interact with customers digitally need to understand how the wallet fits into their onboarding, authentication, and data-sharing processes.
Before a relying party can request wallet data, registration under CIR (EU) 2025/848 is required. The registration specifies which attributes and attestations may be requested per intended use, and the wallet enforces this scope. A relying party must be capable of accepting every relevant notified wallet, regardless of which Member State issued it or which provider supplies it.
Because national rollout, certification, notification, and acceptance by relying parties are distinct steps that will develop at different paces across Member States, organizations should begin planning now. Practical interoperability will mature over time, and early preparation will allow organizations to adapt as national implementations progress.
The compliance landscape is also broader than eIDAS 2.0 alone. Organizations are simultaneously navigating GDPR, AML, KYC, PSD2, and the AMLR, which becomes applicable in July 2027. eIDAS 2.0 amends Regulation (EU) 910/2014 but does not replace or override these frameworks. It intersects with all of them. A well-designed digital identity infrastructure can help satisfy requirements across multiple regulations at once, rather than building separate solutions for each. Note that the reuse of KYC data is governed by AML regulation, and recognition of professional qualifications continues to run through Directive 2005/36/EC.
Key actions organizations should consider include:
- Assess your current identity infrastructure against eIDAS 2.0 requirements and identify gaps in assurance levels, interoperability, and attribute handling.
- Map your customer journeys to understand where the EUDI Wallet will be relevant, from onboarding and authentication to consent and signing.
- Engage with technical specifications to understand how your sector-specific use cases are being addressed in the Architecture and Reference Framework and the relevant implementing acts.
- Plan for reusable identity flows so that once a customer has completed a verified interaction, that verification can be trusted and reused across subsequent interactions within the scope permitted by applicable law.
- Align compliance and technology teams so that regulatory requirements and technical implementation decisions are made together, not in isolation.
Organizations that start preparing now will be better positioned to meet the 24 December 2026 and 24 December 2027 deadlines and to benefit from faster, more trusted digital interactions with their customers. You can explore practical resources to support your preparation.
How TrustTech supports organizations preparing for eIDAS 2.0
The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login, and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs, and identity documents, inside and outside the EU.
For organizations in financial services, healthcare, pharma, and government, the ID Connector addresses the practical steps that eIDAS 2.0 compliance requires. It handles verification of issuer signatures against national trusted lists consolidated in the EU List of Trusted Lists, checks revocation status using issuer-provided status information, and validates wallet unit attestations to confirm that a presenting wallet runs on a certified wallet solution. It enforces the registered attribute scope so that only the data a relying party is authorized to request under CIR (EU) 2025/848 is exchanged. It also supports reuse of verified identity data across interactions and connects to a qualified trust service provider for qualified signing where that is required.
TrustTech’s platform sits between the parties that need to interact, without owning any of them, making it a neutral layer for identity, qualification, and signing. Whether you are in finance, government, healthcare, or another regulated sector, the TrustTech approach is built to match your context.
Get in touch with TrustTech to discuss what eIDAS 2.0 means for your organization and how the ID Connector fits into your identity infrastructure.