Under eIDAS 2.0, which amends Regulation (EU) 910/2014, both public authorities and private organizations can issue attribute attestations, provided they meet the regulatory requirements for their attestation type. Private issuers can participate in the ecosystem by becoming Qualified or non-qualified Electronic Attestation of Attributes providers, depending on the level of trust and legal recognition they want to achieve. This article walks through the key questions organizations need to understand about how private issuer attestations work in practice.
Who can issue attribute attestations under eIDAS 2.0?
Under eIDAS 2.0, attribute attestations can be issued by public sector bodies, authentic sources, and private organizations. Private companies can become recognized attestation issuers by registering as trust service providers and meeting the technical and supervisory requirements set out in the regulation. This opens the ecosystem to employers, banks, healthcare institutions, universities, and other sector-specific organizations.
This is a meaningful shift compared to the original eIDAS regulation, which focused almost exclusively on public sector identity infrastructure. The updated framework recognizes that many valuable attributes, such as professional qualifications, employment status, healthcare roles, or financial credentials, are best attested by the private organizations that hold that information directly.
Private issuers do not operate without oversight. They must register with a national supervisory body and comply with the technical specifications elaborated in the Architecture and Reference Framework (ARF), which translates the legally binding requirements set out in the implementing acts into practical guidance on how attestations are structured, stored, and exchanged. The level of supervision and assurance required depends on whether the issuer provides qualified or non-qualified attestations.
What is a Qualified Electronic Attestation of Attributes (QEAA)?
A Qualified Electronic Attestation of Attributes (QEAA) is the highest level of attribute attestation defined under eIDAS 2.0. It is issued by a Qualified Trust Service Provider (QTSP) that has been officially recognized and listed on a national trusted list. A QEAA carries the strongest legal standing and can be automatically recognized across all EU Member States.
QEAAs are designed to hold attributes that need to be legally reliable and verifiable across borders. A pharmacist’s professional license, a lawyer’s bar membership, or a certified financial advisor’s credentials are examples of claims that need to be trusted without the receiving party having to verify the source separately. It is worth noting that recognition of professional qualifications as such continues to be governed by Directive 2005/36/EC; eIDAS 2.0 provides the technical and legal framework for the attestation itself, not for the underlying professional recognition.
To issue QEAAs, an organization must go through a formal conformity assessment carried out by an accredited body. Once approved, the issuer is added to the relevant national trusted list, which makes their attestations verifiable by any relying party within the EUDI Wallet ecosystem. The process is demanding, but it offers the highest level of cross-border recognition and legal certainty in return.
How does eIDAS 2.0 ensure trust in private issuer attestations?
eIDAS 2.0 ensures trust in private issuer attestations through a combination of registration requirements, cryptographic verification, and supervisory oversight. Governance in this ecosystem is a shared responsibility: the European Commission manages the legal framework and adopts implementing acts; Member States certify, notify, and supervise actors within their jurisdiction; national competent authorities and registrars handle registration; wallet providers verify issuer legitimacy; and relying parties check attestations at the point of use. Every attestation issued within the EUDI Wallet ecosystem is cryptographically signed by the issuer, meaning the receiving party can verify the integrity of the data and the identity of the issuer against the relevant national trusted list.
Verifying an attestation involves three distinct checks. First, the relying party verifies the issuer’s signature against the relevant national trusted list, which is part of the EU List of Trusted Lists (LOTL). This check can be performed offline. Second, the relying party checks the revocation status of the attestation using status information provided by the issuer, which requires a connection to that information. Third, the relying party validates the wallet unit attestation to confirm that the presenting wallet runs on a certified wallet solution. All three checks together establish that an attestation is tamper-evident, currently valid, and presented from a certified wallet.
The trust chain works as follows. Issuers must be registered with the relevant national authority and, in the case of qualified providers, listed on a national trusted list. Wallet providers verify that the issuer is legitimate before accepting credentials into a user’s EUDI Wallet. Relying parties then perform the checks described above to confirm that the attestation is valid.
This architecture reduces the need for bilateral agreements between organizations. A bank in Spain does not need a direct relationship with a Dutch employer to trust an employment attestation, as long as both parties operate within the recognized framework. The regulation also defines specific implementing acts that set out legally binding requirements for technical formats and protocols for attestation exchange. The ARF provides the technical elaboration of those requirements, supporting interoperability across Member States and sectors. Cross-border interoperability operates at the framework level: national registration requirements and sector-specific legislation remain in place, and not every credential will automatically carry the same legal consequence in every Member State.
What is the difference between QEAA and non-qualified attestations?
The key difference between a Qualified Electronic Attestation of Attributes (QEAA) and a non-qualified Electronic Attestation of Attributes (EAA) is the level of legal recognition and the requirements placed on the issuer. QEAAs carry full cross-border legal standing and are issued by supervised QTSPs. Non-qualified EAAs offer more flexibility but carry less automatic legal weight.
It is also worth noting that a separate category exists: Public Body Electronic Attestation of Attributes (PuB-EAA), which are issued by public bodies or authentic sources and carry their own distinct legal status. PuB-EAAs are not the same as non-qualified EAAs.
Here is a practical comparison of QEAA and non-qualified EAA:
- QEAA: Issued by a Qualified Trust Service Provider, listed on a national trusted list, subject to conformity assessment, automatically recognized across the EU, highest legal standing
- Non-qualified EAA: Can be issued by any registered organization, not required to appear on a trusted list, lower compliance burden, legal recognition may vary by Member State or use case
Non-qualified attestations are not second-class credentials. For many use cases, they are entirely appropriate. An employer issuing an internal access credential, a loyalty program confirming membership status, or a healthcare provider sharing a consent record may not need the full weight of a QEAA. The ecosystem is deliberately designed to support both levels, so organizations can choose the approach that matches their use case and risk profile.
The practical implication for organizations is that the choice between QEAA and non-qualified EAA should be driven by the relying party’s requirements. If the organization receiving the attestation requires qualified status, the issuer needs to invest in QTSP recognition. If the use case is internal or lower-risk, a non-qualified approach may be faster and more cost-effective to implement.
Which sectors are most affected by private issuer attestations?
The sectors most affected by private issuer attestations under eIDAS 2.0 are those where trusted, reusable credentials can replace repeated manual verification. Financial services, healthcare, pharmaceuticals, education, and government-adjacent industries are at the forefront, because they deal with high-stakes attributes that currently require slow, paper-based, or siloed verification processes.
In financial services, private issuers such as banks and insurers can issue verified KYC attributes, financial standing credentials, or professional certifications directly into a customer’s EUDI Wallet. This reduces the need for customers to re-verify their identity at every institution they engage with. It is worth noting that whether verified KYC data from one institution can be reused by another is governed by AML legislation, not by eIDAS 2.0 itself.
In healthcare, hospitals and professional bodies can issue practitioner credentials, prescriptions, or consent records as verifiable attestations. This is especially relevant in cross-border care scenarios, where a healthcare provider in one country needs to verify a patient’s medical history or a colleague’s professional license from another Member State. While the EUDI Wallet framework supports this kind of cross-border exchange at the technical level, sector-specific healthcare legislation and national registration requirements continue to apply and may affect how attestations are used in practice. Health data also requires a legal basis under Article 9(2) GDPR in addition to any other applicable ground.
In education and research, universities and certification bodies can issue diplomas, professional qualifications, and research credentials that students and professionals can carry in their wallets and share selectively with employers or institutions. The DC4EU Large Scale Pilot, which ran from April 2023 to 2025, specifically tested this use case, with results demonstrating the potential for cross-border recognition of educational credentials.
How should organizations prepare to become a private attestation issuer?
Organizations that want to become a private attestation issuer under eIDAS 2.0 should start by clarifying which type of attestation they need to issue and what the relying parties in their ecosystem will require. From there, the preparation process involves technical, legal, and organizational steps that need to run in parallel.
A practical starting point looks like this:
- Define your attestation scope: Identify which attributes you hold that others need to trust, and whether those use cases require QEAA or non-qualified EAA status.
- Assess your current infrastructure: Review whether your existing systems can support cryptographic signing, credential issuance in the required formats (mdoc and SD-JWT VC as specified in the ARF), and integration with EUDI Wallet protocols including OID4VCI for issuance and OID4VP for presentation.
- Understand the regulatory path: If you are pursuing QEAA status, engage early with your national supervisory body and understand the conformity assessment process.
- Align with the Architecture and Reference Framework: Ensure your technical implementation follows the ARF specifications for credential formats, protocols, and interoperability requirements, keeping in mind that the ARF elaborates the legally binding requirements set out in the implementing acts.
- Plan for governance and lifecycle management: Attestations need to be revocable, updatable, and auditable. You must make revocation status available and support re-issuance when a user moves to a new device, because private keys bound to a wallet unit cannot be copied to another device. Build processes for credential lifecycle management from the start.
Organizations that act early have a clear advantage. The legal deadline for Member States to make EUDI Wallets available is 24 December 2026. The obligation for relevant regulated private sector organizations to accept the EUDI Wallet applies from 24 December 2027 under Article 5f of the regulation. Practical interoperability, national rollout maturity, and acceptance by relying parties are likely to develop in phases. Issuers who are ready when demand materializes in their sector will be positioned as trusted partners.
How TrustTech supports attribute attestation under eIDAS 2.0
For organizations preparing to issue or accept attribute attestations under eIDAS 2.0, the ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
For attestation issuers and relying parties, the ID Connector handles:
- Verification of issuer signatures against the relevant national trusted lists, which are part of the EU List of Trusted Lists (LOTL)
- Revocation status checks using issuer-provided status information
- Validation of wallet unit attestations to confirm that a presenting wallet runs on a certified wallet solution
- Enforcement of the registered attribute scope, so that only attributes declared in the relying party’s registration under CIR (EU) 2025/848 are requested
- Integration into existing onboarding flows, compliance processes, and qualified signing workflows via a connected QTSP
The ID Connector is relevant across financial services, healthcare, pharma, and government, where trusted, reusable attestations reduce repeated verification and support cross-border interactions. To see how it applies to your use case, get in touch with TrustTech.