eIDAS 2.0, Regulation (EU) 2024/1183, amends Regulation (EU) 910/2014 and supports decentralized identity architectures by shifting control of identity data away from central brokers and toward individuals themselves. The regulation introduces the European Digital Identity Wallet, which lets users hold, manage, and selectively share their own verified attestations. The sections below unpack how this works technically, what standards it relies on, and what organizations should do to prepare.
What makes eIDAS 2.0 architecturally different from eIDAS 1.0?
The fundamental difference is that eIDAS 1.0 was built around centralized national identity schemes, while eIDAS 2.0 introduces a user-controlled wallet model that distributes identity data to the edges of the network. Under the original framework, Member States could notify their national eID systems for cross-border recognition, but there was no obligation to do so, and the private sector was largely excluded. This created a fragmented landscape where recognition varied widely across borders.
eIDAS 2.0 addresses this directly. Every Member State is now legally required to offer citizens, residents, and businesses a European Digital Identity Wallet. The wallet sits on the user’s device and acts as a personal identity hub. Verified attributes, such as a driving licence or professional qualification, are stored as digital attestations that users can present directly to relying parties.
This architectural shift has real consequences for organizations. Previously, a service provider in one country might need to integrate with multiple national identity systems to serve users across the EU. Under eIDAS 2.0, a single integration point with the wallet ecosystem is sufficient. The result is a more interoperable, scalable, and privacy-respecting infrastructure across the entire European Union.
How does the EUDI Wallet enable decentralized identity?
The EUDI Wallet enables decentralized identity by acting as a personal data store that sits under the user’s control, on the user’s device. When a user wants to prove their age, nationality, or professional status, they present a cryptographically signed attestation directly from their wallet to the requesting party. Verification involves checking the issuer’s signature against the relevant national trusted list, consulting the issuer’s revocation status information, and validating the wallet unit attestation to confirm that the presenting wallet runs on a certified wallet solution. Only the first of these checks can be performed fully offline.
A government authority or trusted institution issues an attestation into the wallet. From that point forward, the user can share that attestation with any service that accepts it, across borders and sectors. Each time the user responds to a relying party’s request, they individually approve that presentation in the wallet.
The wallet also gives users granular control over what they share. Using selective disclosure, a user can disclose only the specific attribute a service needs. Proving you are over 18 does not require revealing your exact date of birth. This principle of selective disclosure is central to the decentralized identity model and is a core design requirement of the EUDI Wallet.
Four Large Scale Pilots ran from April 2023 to 2025 and tested these capabilities across sectors including financial services, healthcare, education, and transport. Those pilots involved over 350 entities from 26 Member States and collected real-world feedback on usability, security, and interoperability. A second wave of pilots started in 2025, with WE BUILD focusing on business wallets and payments, and APTITUDE covering travel, ticketing, vehicle registration, and payments.
What are verifiable attestations and how do they fit into eIDAS 2.0?
Attestations are digitally signed statements issued by a trusted authority. Their authenticity and integrity can be checked by a relying party through a combination of signature verification against the relevant national trusted list, revocation status checking, and validation of the wallet unit attestation. They are the building blocks of the EUDI Wallet ecosystem and the mechanism through which eIDAS 2.0 makes decentralized identity work in practice.
Think of an attestation as the digital equivalent of a stamped certificate, except that the stamp is tamper-evident and the verification process is structured and governed. An employer, university, government body, or regulated institution issues an attestation that gets stored in the user’s wallet. When that user presents the attestation to a bank, healthcare provider, or online platform, the receiving party can check its authenticity and integrity through the steps described above.
eIDAS 2.0 distinguishes between different categories of attestation:
- Qualified Electronic Attestations of Attributes (QEAA), issued by qualified trust service providers and carrying the highest level of assurance
- Public Body Electronic Attestations of Attributes (PuB-EAA), issued by or on behalf of public bodies
- Non-qualified Electronic Attestations of Attributes (EAA), issued by other recognized entities
Within the eIDAS 2.0 framework, attestations can represent a wide range of identity attributes and documents:
- National identity documents and passports
- Academic qualifications and diplomas
- Professional licences and certifications
- Employment records and KYC data
- Healthcare credentials and prescriptions
- Payment credentials and financial compliance records
For organizations in regulated sectors such as finance, healthcare, and government, attestations open up the possibility of reusing trusted identity data across processes. A customer who has already completed identity verification at their bank could present that same verified attestation when onboarding with an insurer or a healthcare provider, reducing friction on both sides. Note that whether KYC data from one institution can be reused by another is governed by AML regulation, not by eIDAS itself.
How does eIDAS 2.0 handle trust without a central identity broker?
eIDAS 2.0 replaces the central broker model with a trust framework built on cryptographic proof and a network of recognized issuers and verifiers. Trust is established by ensuring that every attestation in the ecosystem has been issued by a party whose identity and authority can be independently verified through national trusted lists, which are brought together in the EU List of Trusted Lists (LOTL). Where relevant, Lists of Trusted Entities (LoTE) may also apply.
Governance under this model is a shared responsibility. The European Commission manages the legal framework and adopts implementing acts that set out legally binding requirements. Member States provide or mandate wallet solutions, certify and notify them, and supervise actors within their jurisdiction. The European Digital Identity Cooperation Group supports cooperation and cross-border alignment between Member States. National competent authorities and registrars operate within their respective jurisdictions, while wallet providers, issuers of Person Identification Data and attestations, qualified trust service providers, and relying parties each carry defined responsibilities within the ecosystem. No single central European authority operationally manages all EUDI Wallets.
The Architecture and Reference Framework (ARF), developed to support the European Digital Identity Cooperation Group’s work, provides the technical elaboration of the requirements set out in the implementing acts. It specifies how wallets must be certified, how attestations must be structured and signed, and how relying parties can verify that an attestation is genuine and tamper-evident. The ARF is a technical reference document, not legislation in itself. The implementing acts are legally binding.
Trusted issuers, such as government agencies, banks, universities, and qualified trust service providers, appear on national trusted lists that relying parties can consult to confirm that an attestation source is legitimate. This means a hospital in Spain can check a professional qualification attestation issued by a Dutch authority, because both operate within the same governed framework.
This approach distributes trust across the ecosystem. It is more resilient, more scalable, and more privacy-respecting than architectures that require every identity transaction to pass through a central node.
Which standards and protocols does eIDAS 2.0 rely on?
eIDAS 2.0 relies on a combination of open standards for attestation formats, cryptographic signing, and wallet communication protocols. These standards ensure that wallets, issuers, and verifiers from different countries and technology providers can interoperate reliably across the EU.
The Architecture and Reference Framework specifies the technical foundations that all EUDI Wallet implementations must follow. Key standards and components include:
- ISO/IEC 18013-5 for proximity presentation of document-based attestations such as mobile driving licences, defining how attestations are structured and presented from a device.
- ISO/IEC TS 18013-7 for online presentation of the same document-based attestation formats.
- OpenID for Verifiable Credential Issuance (OID4VCI) and OpenID for Verifiable Presentations (OID4VP), which define how attestations are issued to wallets and how they are presented to verifying parties.
- Qualified Electronic Signatures (QES) under the existing eIDAS trust service framework, which remain central to legally binding digital signing under eIDAS 2.0.
- SD-JWT VC (Selective Disclosure JSON Web Tokens for Verifiable Credentials) and mdoc, the two attestation formats specified in the ARF, which enable selective disclosure of individual attestation attributes.
- The High Assurance Interoperability Profile (HAIP), which defines the specific combination of protocols and parameters required for EUDI Wallet interoperability at high assurance level.
The open-source nature of the EUDI Wallet reference implementation means that Member States and private providers can build on a shared, publicly vetted codebase. This accelerates adoption and reduces the risk of fragmentation across national implementations.
What should organizations do now to prepare for eIDAS 2.0 compliance?
Organizations should start preparing for eIDAS 2.0 by assessing which of their processes involve identity verification, attestation exchange, or electronic signing, and then mapping those processes against the requirements of the new framework.
The legal deadline for Member States to make wallets available is 24 December 2026. From that date, public sector bodies must accept notified wallets for online services that require electronic identification. That date marks the point at which Member States must fulfil their wallet obligations under the regulation. It does not mean that every national wallet will have reached the same level of maturity on that date, or that every cross-border use case will be fully operational throughout Europe immediately.
For relevant regulated private sectors, including financial services, healthcare, telecoms, energy, transport, education, social security, drinking water, postal services, digital infrastructure, and digital services, the obligation under Article 5f of the amended regulation applies from 24 December 2027, where strong user authentication is required by law or contract. Very large online platforms (VLOPs) are covered by a separate provision of Article 5f: for VLOPs, the obligation applies where the platform requires user authentication, on the voluntary request of the user and for the minimum necessary data. Micro and small enterprises, defined as organizations with fewer than 50 employees and an annual turnover or balance sheet total of no more than 10 million euros, are exempt.
A relying party must register with the national authority of its Member State of establishment under CIR (EU) 2025/848, adopted on 6 May 2025, before it can request wallet data. Registration specifies, per intended use, which attributes and attestations the relying party will request. The wallet checks incoming requests against this registered scope. A relying party does not choose a wallet provider. It must be able to accept every relevant notified wallet, regardless of provider.
Practical preparation steps include:
- Reviewing current identity verification and onboarding flows to identify where EUDI Wallet integration will be required or beneficial
- Assessing existing digital signature infrastructure against eIDAS 2.0 qualified signature requirements
- Engaging with the Architecture and Reference Framework to understand technical specifications relevant to your sector
- Evaluating interoperability requirements, particularly for organizations operating across multiple EU Member States, and understanding that relying party registration is connected to the national framework of the Member State of establishment
- Identifying which attestations your organization may need to issue, accept, or verify under the new framework, and which category applies: QEAA, PuB-EAA, or non-qualified EAA
Organizations in financial services face particular urgency, given the overlap between eIDAS 2.0 requirements and existing AML, KYC, and PSD2 obligations. Similarly, organizations in healthcare and government will need to align their identity infrastructure with wallet-based attestation exchange early. The TrustTech resources section offers further guidance on sector-specific preparation.
How the ID Connector supports eIDAS 2.0 and decentralized identity
The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
For organizations preparing for eIDAS 2.0, the ID Connector handles:
- Wallet acceptance across all notified EUDI Wallet solutions, regardless of the issuing Member State
- Trust management and verification against national trusted lists, brought together in the EU List of Trusted Lists
- Revocation status checking against issuer-provided status information
- Validation of wallet unit attestations to confirm that a presenting wallet runs on a certified wallet solution
- Monitoring of registered attribute scope, so that presentation requests stay within the scope registered under CIR (EU) 2025/848
- Reuse of verified identity data across onboarding, authentication, and signing workflows
- Qualified signing via a connected qualified trust service provider
Organizations in financial services, healthcare, pharma, and government can use the ID Connector to connect identity, attestation, and signing processes into a single, auditable workflow. To find out how the ID Connector fits your situation, explore the TrustTech solutions or get in touch.