The EU Digital Identity Wallet is a smartphone app that lets European citizens and residents store, manage, and share verified personal data digitally, such as a national ID, driving licence, or professional qualifications, without needing to carry physical documents or repeat identity checks from scratch. Governed by eIDAS 2.0, which amends Regulation (EU) 910/2014 through Regulation (EU) 2024/1183, every EU member state is required to offer citizens access to a wallet by 24 December 2026. Governance is a shared responsibility: the European Commission manages the legal framework and adopts implementing acts; member states provide or mandate wallet solutions, certify and notify them, and supervise actors within their jurisdiction; the European Digital Identity Cooperation Group supports cross-border alignment; and national competent authorities, wallet providers, issuers, qualified trust service providers, and relying parties each carry distinct roles. The sections below answer the most common questions about how the EUDI Wallet works, what it stores, who is involved, and what organizations need to do to get ready.
What can you actually do with the EU Digital Identity Wallet?
The EU Digital Identity Wallet lets you prove who you are, share specific personal attributes, sign documents electronically, and access public and private services online, all from your phone, without handing over more information than necessary.
In practical terms, the EUDI Wallet covers a wide range of everyday situations:
- Logging in to government portals or healthcare services without a separate username and password
- Proving your age on an online platform by disclosing only the attribute “over 18” through selective disclosure, without sharing your full date of birth
- Opening a bank account or completing KYC checks without sending physical copies of documents
- Sharing a verified professional qualification with a new employer
- Signing contracts and forms with a qualified electronic signature
- Accessing cross-border services across EU member states using a single digital identity, where the relevant use case and relying party registration framework support it
The wallet is designed to work for both public and private sector interactions. Whether you are booking a GP appointment, registering a business, or applying for a loan, the wallet can streamline the process by providing verified data securely.
What data does the EU Digital Identity Wallet store and share?
The EU Digital Identity Wallet stores verified digital attestations, structured data packages that have been issued and cryptographically signed by a trusted authority. These attestations can include a national identity document, driving licence, diplomas, professional licences, health insurance information, and other official records. The wallet does not store raw documents; it stores tamper-evident, machine-readable attestations of facts about you.
The wallet only shares what is strictly necessary for a given transaction. This principle is called selective disclosure. If a service only needs to know that you are over 18, the wallet shares that single confirmation without revealing your full name, address, or date of birth. This is a meaningful step forward compared to presenting a passport or ID card, which reveals far more information than most situations actually require.
Attestations are stored locally on the user’s device. This means there is no single point of failure and no third party continuously monitoring your activity. The user remains in control of their own data at all times.
Private keys for the Person Identification Data (PID) and other attestations are held within the Wallet Secure Cryptographic Device and do not leave that secure element. If a user switches to a new device, attestations must be re-issued by the relevant issuer rather than simply copied across.
Who issues and verifies credentials in the EUDI Wallet?
Attestations in the EUDI Wallet are issued by trusted entities called Attestation Providers, and they are verified by relying parties, the organizations or services that accept the wallet as proof of identity or qualification. Governance is distributed: member states certify and notify wallet solutions, national competent authorities supervise participants within their jurisdiction, and the European Digital Identity Cooperation Group supports alignment across borders. Governments, public institutions, banks, universities, and licensed professional bodies can all act as issuers, depending on the type of attestation.
Attestation Providers
An Attestation Provider is any organization authorized to issue a verified attestation into the wallet. A national government, for example, issues the Person Identification Data (PID), the core identity attestation. Other issuers might include a national driving authority issuing a digital driving licence, or a university issuing a verified diploma. Each attestation is cryptographically signed so its authenticity can be checked against the relevant national trusted list.
Attestations fall into distinct categories: Qualified Electronic Attestations of Attributes (QEAA), issued by qualified trust service providers; Public Body Electronic Attestations of Attributes (PuB-EAA), issued by or on behalf of public bodies; and non-qualified Electronic Attestations of Attributes (EAA). Each category carries different legal weight and supervision requirements. Issuing attestations of attributes is itself a trust service under eIDAS 2.0.
Verification
Verifying a wallet presentation involves three separate checks, not a single cryptographic step. First, the relying party verifies the issuer’s signature against the relevant national trusted list, which is part of the EU List of Trusted Lists (LOTL). This check can be performed offline. Second, the relying party checks the revocation status of the attestation using status information provided by the issuer, which requires contact with the issuer’s infrastructure. Third, the relying party validates the wallet unit attestation to confirm that the presenting wallet is running on a certified wallet solution. Because the second and third checks require network access, it is not accurate to state without qualification that attestations can always be verified without contacting any external party.
Relying Parties
A relying party is any organization that requests and accepts attestations from the wallet to verify a user’s identity or attributes. Banks, insurers, healthcare providers, and government agencies are all potential relying parties. Under CIR (EU) 2025/848, adopted on 6 May 2025, a relying party must register with the national authority of the member state where it is established before it can request wallet data. Registration covers each intended use and specifies which attributes and attestations will be requested. The wallet checks incoming requests against this registered scope.
A relying party is not required to choose a wallet provider. It must be able to accept every relevant notified wallet solution, regardless of which member state issued it or which provider operates it. A relying party does not automatically need a qualified trust service provider simply to accept wallet presentations; a QTSP becomes relevant in contexts such as qualified signing or qualified attestations.
Where a vendor processes wallet data on behalf of a client organization, that vendor does not become the relying party. The registration obligation rests with the organization delivering the service to the end user.
How does the EUDI Wallet protect user privacy?
The EUDI Wallet is built around privacy by design. It protects user privacy through selective disclosure, local data storage, cryptographic verification, and strict limitations on tracking.
Selective disclosure means the wallet can present a single attribute, such as proof of age or nationality, without revealing the full underlying document. This is achieved through the credential formats supported by the Architecture and Reference Framework (ARF): mdoc, defined in ISO/IEC 18013-5 for proximity presentation and ISO/IEC TS 18013-7 for online presentation, and SD-JWT VC. These formats enable attribute-level disclosure without exposing the entire attestation.
Because attestations are stored on the user’s device, there is no central registry tracking which services a person has accessed or when. Issuers cannot observe where their attestations are being used after issuance. This unlinkability is a deliberate design choice to limit profiling. It does not eliminate all tracking risk, but it substantially reduces the data exposure compared to traditional identity verification methods.
Wallet use is voluntary. Approving a data request in the wallet is a separate act from giving consent as a legal basis under the GDPR. A relying party must have its own lawful basis for processing the data it receives. For KYC, that basis is typically a legal obligation. For health data, an additional condition under Article 9(2) GDPR is required.
The wallet dashboard gives users visibility over their own attestations and interactions. It is a user-facing tool, not a logging facility for the wallet provider.
Which organizations are required to accept the EU Digital Identity Wallet?
eIDAS 2.0 establishes two distinct acceptance obligations with different timelines and scopes.
From 24 December 2026, public sector bodies must accept notified EUDI Wallets for online services that require electronic identification. This obligation applies to public authorities across all member states.
From 24 December 2027, Article 5f of eIDAS 2.0 extends mandatory acceptance to regulated private sector organizations where strong user authentication is required by law or contract. The sectors covered include banking and financial services, healthcare, telecoms, energy, transport, education, social security, drinking water, postal services, digital infrastructure, and digital services. Micro and small enterprises are exempt: organizations with fewer than 50 employees and an annual turnover or balance sheet total of no more than 10 million euros fall outside the mandatory acceptance scope.
Very large online platforms (VLOPs) designated under the Digital Services Act are subject to a separate provision within Article 5f. For VLOPs, the obligation applies where the platform requires user authentication, on the voluntary request of the user, and limited to the minimum necessary data. The condition relating to legally or contractually required strong authentication does not apply to VLOPs.
It is important to note that acceptance obligations are set out in the legally binding implementing acts under eIDAS 2.0. The Architecture and Reference Framework provides the technical elaboration of those requirements but is not itself legislation. In practice, the timing and scope of mandatory acceptance will also depend on national execution, sector-specific rules, and the certification and notification status of individual wallet solutions.
For organizations outside the mandatory categories, accepting the EUDI Wallet is optional. As wallet adoption grows and users expect reusable identity verification, organizations that integrate wallet support ahead of the deadlines will be better positioned than those that wait.
How should organizations prepare for the EUDI Wallet rollout?
Organizations should start preparing for the EUDI Wallet now by assessing their current identity verification processes, understanding their regulatory obligations under eIDAS 2.0, and identifying where wallet-based attestations can replace or improve existing workflows. The legal deadline for member states to make wallets available is 24 December 2026, and the private sector acceptance deadline under Article 5f is 24 December 2027. These are legal deadlines, not predicted launch dates. National execution is likely to develop in phases, and waiting for a single European go-live moment is not a sound strategy.
A practical preparation approach involves the following steps:
- Map your identity touchpoints. Identify every point in your customer or employee journey where identity is verified, documents are collected, or authentication is required.
- Assess your regulatory obligations. Determine whether your organization falls within the mandatory acceptance scope under eIDAS 2.0, and which existing compliance requirements such as KYC, AML, and PSD2 wallet-based attestations can help fulfil. Bear in mind that KYC re-use is governed by AML regulation, not by eIDAS 2.0 itself.
- Evaluate your technical infrastructure. Check whether your current systems can support the credential formats and protocols specified in the ARF, including OID4VP for wallet-based presentation and OID4VCI for issuance.
- Define your relying party role. Decide which attestations you need to accept, what attributes you require, and how credential verification will integrate into your onboarding or authentication flows. Register your intended uses with the relevant national authority under CIR (EU) 2025/848 before requesting wallet data.
- Plan for governance and data minimization. Review your data handling practices to align with the selective disclosure model, requesting only the data you genuinely need for each interaction, and ensure your organization has a lawful basis under the GDPR for each category of data you process.
Organizations in financial services and government face the most immediate obligations and should prioritize readiness planning well ahead of the 24 December 2026 deadline. Those in healthcare and other regulated sectors should also begin reviewing how wallet-based identity verification aligns with their existing compliance frameworks, including sector-specific legislation that continues to apply alongside eIDAS 2.0. A clear internal roadmap covering both technical integration and process redesign will make the transition significantly smoother.
How the ID Connector supports EUDI Wallet acceptance
The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
For organizations preparing to meet the obligations set out above, the ID Connector addresses the core technical requirements of relying party integration:
- Wallet acceptance: Connecting your existing systems to every notified wallet solution, regardless of the issuing member state or wallet provider
- Trust management and verification: Verifying issuer signatures against national trusted lists consolidated in the EU List of Trusted Lists, checking revocation status, and validating wallet unit attestations to confirm that presentations come from certified wallet solutions
- Registered attribute scope: Ensuring that data requests stay within the attributes and attestations registered under CIR (EU) 2025/848, so that every presentation request is within the scope your organization declared at registration
- Reuse of verified identity data: Enabling verified attestations received at onboarding to be carried through subsequent interactions, reducing repeated verification steps within the bounds of your registered intended use
- Qualified signing: Linking identity to document signatures through a connected qualified trust service provider, with a complete audit trail
Organizations in financial services, healthcare, pharma, and government can connect through the ID Connector to meet their wallet acceptance obligations under eIDAS 2.0. Explore our identity solutions or get in touch with our team to discuss what the EUDI Wallet means for your organization.