eIDAS 2.0 supports the EU Digital Single Market by creating a unified, interoperable digital identity framework that works across all Member States. It amends Regulation (EU) 910/2014 and removes the fragmented approach of its predecessor, giving citizens, residents, and businesses a single trusted way to identify themselves online, whether they are accessing public services in their home country or completing transactions in another EU state.
For businesses operating across borders, this matters enormously. The regulation directly addresses the identity-related friction that has long prevented the Digital Single Market from reaching its full potential. The sections below unpack the specific barriers it removes, how the EUDI Wallet works in practice, which sectors benefit most, and what compliance looks like for your organisation.
What specific barriers to the Digital Single Market does eIDAS 2.0 address?
eIDAS 2.0 addresses three core barriers that have held back the Digital Single Market: the uneven adoption of electronic identity across Member States, the exclusion of the private sector from cross-border identity recognition, and the lack of user control over personal data. Together, these gaps have made it difficult for individuals and businesses to interact digitally across EU borders with any consistency or confidence.
Under the original eIDAS regulation, Member States were required to recognise notified national eID schemes from other countries, but they were not obligated to create or notify their own. This led to significant variation across the EU. Some countries had well-developed national eID systems; others had very little. The result was a patchwork of digital identity infrastructure that made seamless cross-border digital services practically impossible for many organisations.
eIDAS 2.0 closes these gaps in several important ways:
- Universal availability: Every Member State must now offer a European Digital Identity Wallet to all citizens, residents, and businesses, making digital identity access consistent across the EU.
- Private sector inclusion: The regulation extends acceptance obligations to certain private service providers in regulated sectors, opening up trusted identity verification for banking, healthcare, telecoms, and more. From 24 December 2027, Article 5f applies to the relevant regulated private sectors where strong user authentication is legally or contractually required. Very large online platforms are subject to a separate provision under Article 5f: they must accept the EUDI Wallet where the platform requires user authentication, on the voluntary request of the user and for the minimum necessary data.
- Data minimisation by design: Users can share only the specific attributes required for a transaction, such as age or nationality, without revealing unnecessary personal information. This is achieved through selective disclosure, for example by presenting an attribute such as “over 18” without disclosing the full date of birth.
- Interoperability across borders: A certified wallet solution from one Member State is designed to be usable with compatible relying parties in another Member State, removing the need for country-specific identity solutions. The extent to which specific use cases are available cross-border will depend on national rollout progress and sector-specific requirements.
These changes transform digital identity from a national concern into a shared European infrastructure, which is exactly what the Digital Single Market needs to function effectively.
How does the EUDI Wallet enable cross-border digital transactions?
The EUDI Wallet enables cross-border digital transactions by giving users a single, standardised digital identity that is designed to be recognised and accepted across all EU Member States. Instead of managing different credentials for different countries or services, users carry one secure app that holds their verified identity attributes, documents, and attestations, all of which can be shared with any compatible relying party across the EU.
Practically speaking, the wallet functions as a secure container. A user might store their national ID, driving licence, professional qualifications, European Health Insurance Card, or educational certificates all in one place. When they need to access a service, whether it is opening a bank account in another country, registering a SIM card, or claiming a prescription abroad, they can share only the relevant information in a single interaction. The user approves each presentation request individually within the wallet.
It is important to understand that cross-border interoperability operates at the framework level: a certified wallet solution from one Member State can be used with an appropriate relying party in another Member State. This does not mean that every use case will immediately be available everywhere, that national registration requirements disappear, or that sector-specific legislation ceases to apply. Attestations may also carry different legal consequences depending on the jurisdiction and the applicable national or sectoral rules.
Before a relying party can request wallet data, it must register with the national authority of its Member State of establishment under CIR (EU) 2025/848, adopted on 6 May 2025. The relying party registers per intended use, specifying which attributes and attestations it will request. The wallet checks each request against this registered scope. A relying party must be able to accept every relevant notified wallet, regardless of which provider issued it.
When a relying party receives a presentation, verification involves three distinct checks: confirming the issuer’s signature against the relevant national trusted lists, which are brought together in the EU List of Trusted Lists (LOTL); checking the revocation status using the issuer’s status information; and verifying the wallet unit attestation to confirm that the presenting wallet is running on a certified wallet solution. Only the first of these checks can be performed fully offline.
The large-scale pilots that ran from April 2023 to 2025 tested exactly these scenarios. Four consortia covered distinct use cases: EWC focused on Digital Travel Credentials, payments, and organisational digital identity; POTENTIAL covered government services, opening a bank account, SIM registration, mobile driving licence, remote qualified signing, and e-prescriptions; NOBID focused on payments; and DC4EU covered education and social security. A second wave of pilots started in 2025, with WE BUILD addressing business wallets and payments, and APTITUDE covering travel, ticketing, vehicle registration, and payments. The insights from these pilots are feeding directly into the final technical specifications for the wallet.
For businesses, this means that cross-border digital services no longer require building separate identity verification flows for each country. A single integration with the EUDI Wallet infrastructure can serve customers across the EU, significantly reducing both technical complexity and compliance overhead, provided the relevant use cases are supported and the applicable national frameworks are met.
Which industries benefit most from eIDAS 2.0 in the Digital Single Market?
The industries that benefit most from eIDAS 2.0 are those where identity verification is frequent, high-stakes, or cross-border in nature. Financial services, government, healthcare, and pharmaceuticals stand to gain the most, but the benefits extend to any sector that currently relies on repeated manual identity checks or struggles with cross-border onboarding.
Financial services and banking
Banks and financial institutions face significant friction in customer onboarding, particularly for cross-border clients. eIDAS 2.0 enables reusable, cryptographically signed identity attestations, which means a customer who has already been verified through their national wallet does not need to repeat the full process when accessing a new provider. This can accelerate onboarding and reduce KYC-related costs, though the extent to which KYC data can be reused is governed by AML regulation, not by eIDAS itself. Financial services organisations can also use wallet-based identity for strong customer authentication under PSD2, creating a more seamless and secure experience.
Government and public services
Public authorities play a central role in the eIDAS 2.0 framework. Member States are responsible for providing or mandating wallet solutions, certifying and notifying them, and supervising actors within their jurisdiction. From 24 December 2026, public authorities must accept notified EUDI Wallets for online services that require electronic identification. For government organisations, this creates an opportunity to modernise citizen-facing services and reduce administrative burden, while improving security and auditability.
Healthcare and pharmaceuticals
Healthcare is one of the priority use cases covered in the large-scale pilots. The wallet enables patients to share verified health attestations, claim prescriptions across borders, and access their European Health Insurance Card digitally. For healthcare providers and pharmaceutical companies, this can simplify cross-border care and reduce the risk of errors in patient identification. Processing health data requires a legal basis under both Article 6 and Article 9(2) of the GDPR. The practical availability of these use cases across borders will depend on national rollout progress and the applicable healthcare regulations in each Member State.
What is the difference between eIDAS 1.0 and eIDAS 2.0 for businesses?
The key difference between eIDAS 1.0 and eIDAS 2.0 for businesses is scope and obligation. eIDAS 1.0 focused primarily on public sector identity recognition and electronic trust services. eIDAS 2.0, formally Regulation (EU) 2024/1183 which amends Regulation (EU) 910/2014, extends these requirements to certain private sector actors, introduces the EUDI Wallet as a mandatory infrastructure element, and creates new obligations for businesses that offer digital services to EU users.
Under eIDAS 1.0, private companies were largely outside the recognition framework. A business could choose to accept notified eIDs, but there was no requirement to do so. The system worked reasonably well for government-to-citizen interactions but left the private sector without a consistent, trusted identity layer.
eIDAS 2.0 changes this in several meaningful ways for businesses:
- Mandatory acceptance for regulated private service providers: From 24 December 2027, Article 5f requires certain categories of private service providers in regulated sectors, including banking, healthcare, telecoms, energy, transport, education, social security, drinking water, postal services, digital infrastructure, and digital services, to accept the EUDI Wallet where strong user authentication is legally or contractually required. Micro and small enterprises with fewer than 50 employees and an annual turnover or balance sheet total not exceeding 10 million euros are exempt. Very large online platforms are subject to a separate provision under Article 5f.
- New trust service categories: eIDAS 2.0 introduces additional qualified trust services, including electronic attestations of attributes and electronic archiving, which businesses can use to build more robust digital workflows.
- Reusable attestations across the private sector: Businesses can rely on wallet-verified attestations rather than conducting their own identity checks from scratch, reducing duplication and cost.
- Stronger user control and data minimisation: The regulation enforces data minimisation and individual approval of each presentation request at the infrastructure level, which means businesses must design their identity flows accordingly. A relying party also requires its own legal basis under the GDPR for processing the data it receives.
eIDAS 1.0 created the foundations. eIDAS 2.0 extends and deepens those foundations with obligations that now reach into the private sector.
When do businesses need to comply with eIDAS 2.0 requirements?
Businesses need to start preparing for eIDAS 2.0 compliance now. The regulation entered into force on 20 May 2024. The legal deadline for Member States to make the EUDI Wallet available to all citizens, residents, and businesses is 24 December 2026. However, this deadline should not be read as a guarantee that every national wallet will reach the same level of maturity on that date, or that every possible cross-border use case will be fully operational throughout Europe from that point. Practical interoperability and national rollout are likely to develop in phases, reflecting differences in national certification progress, relying party readiness, and sector-specific implementation.
The first five core implementing acts were adopted at the end of 2024, starting the relevant 24-month periods tied to those acts. The Architecture and Reference Framework provides the technical elaboration of the wallet requirements, while the implementing acts are legally binding. CIR (EU) 2025/848, adopted on 6 May 2025, sets out the registration obligations for relying parties.
Governance of the EUDI Wallet is a shared responsibility. The European Commission manages the legal framework and adopts implementing acts. Member States provide or mandate wallet solutions, certify and notify them, and supervise actors within their jurisdiction. The European Digital Identity Cooperation Group supports cooperation and cross-border alignment. National competent authorities, wallet providers, issuers of Person Identification Data and attestations, qualified trust service providers, and relying parties each carry distinct responsibilities within this structure.
For most businesses, compliance is a rolling process rather than a single deadline. The practical steps depend on your sector, your current identity infrastructure, and how your customers interact with you. Organisations that wait for a single European go-live moment before acting risk falling behind on both technical readiness and competitive positioning.
The areas where preparation is most urgent include reviewing your current identity verification and onboarding flows, understanding which qualified trust services apply to your business, assessing your obligations under related regulations such as AML and KYC, and beginning integration planning for EUDI Wallet compatibility. Explore the available resources to get a clearer picture of where to start.
How TrustTech helps organisations prepare for eIDAS 2.0
eIDAS 2.0 is a fundamental shift in how digital identity works across Europe, and it creates real opportunities for organisations that prepare early. The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
For organisations in financial services, healthcare, pharma, and government, the ID Connector addresses the concrete steps that eIDAS 2.0 compliance requires:
- Wallet acceptance across Member States: The ID Connector handles acceptance of every relevant notified wallet, regardless of provider, so your organisation does not need to build separate integrations per country.
- Verification against trusted lists: The integration verifies issuer signatures against the national trusted lists brought together in the EU List of Trusted Lists, checks revocation status using issuer-provided status information, and validates wallet unit attestations to confirm the presenting wallet runs on a certified wallet solution.
- Registered attribute scope management: The ID Connector enforces the attribute and attestation scope your organisation has registered under CIR (EU) 2025/848, so each wallet request stays within the bounds of your registered intended use.
- Reuse of verified identity data: Once a user has presented verified attestations, your organisation can reuse that data across onboarding, authentication, and signing workflows without repeating the full verification process.
- Qualified signing via a connected QTSP: Where your workflows require a qualified electronic signature, the ID Connector connects to a qualified trust service provider to support remote qualified signing.
Get in touch with TrustTech to discuss how the ID Connector fits your organisation’s identity flows and compliance requirements.