What are the biggest compliance challenges with eIDAS 2.0?

The biggest compliance challenges with eIDAS 2.0 include adapting legacy identity infrastructure to new technical standards, navigating cross-border interoperability requirements, managing the tension between data minimization under GDPR and the wallet’s data exchange model, and meeting hard regulatory deadlines that are already in effect. These challenges apply to a wide range of organizations, from banks and healthcare providers to government agencies and technology platforms. The sections below break down each challenge in practical terms and explain what organizations should do about it.

Which organizations are actually required to comply with eIDAS 2.0?

eIDAS 2.0 compliance obligations apply to a broad range of organizations, not just public authorities. Any organization that offers digital services to EU citizens or businesses and requires identity verification is likely affected. This includes banks, insurance companies, healthcare providers, telecoms, energy providers, e-commerce platforms, and any entity classified as a relying party under the regulation.

The regulation introduces a specific mandatory acceptance obligation for certain regulated private-sector organizations, including banks and financial services, healthcare providers, telecoms, energy providers, transport, education, social security, drinking water, postal services, digital infrastructure, and very large online platforms (VLOPs) with more than 45 million users in the EU. For regulated private-sector parties, this obligation is rooted in Article 5f of the regulation and requires them to accept the European Digital Identity Wallet (EUDI Wallet) as a means of authentication in contexts where strong user authentication is legally or contractually required. For VLOPs, the obligation under Article 5f applies where the platform requires user authentication, on the user’s voluntary request and for the minimum necessary data. The deadline for this private-sector acceptance obligation is 24 December 2027. Public sector bodies in all EU Member States are required to support wallet-based authentication for digital public services from 24 December 2026, which is also the legal deadline by which each Member State must have at least one certified EUDI Wallet available for citizens, residents, and businesses. Whether individual national wallets reach the same level of maturity or cover the same range of use cases by that date will depend on each Member State’s rollout progress. The legal deadline does not guarantee uniform capability across the EU from day one.

It is also worth noting that micro and small enterprises are exempt from the Article 5f acceptance obligation. This exemption covers organizations with fewer than 50 employees and an annual turnover or balance sheet total not exceeding 10 million euros.

Beyond these direct obligations, many organizations will feel indirect pressure to comply. If your competitors or partners integrate the EUDI Wallet and you do not, you risk losing customers who expect seamless, reusable digital identity across services. Organizations in financial services and healthcare face particularly strong compliance incentives, given the overlap with existing AML, KYC, and patient data regulations.

What makes eIDAS 2.0 technically harder to implement than eIDAS 1.0?

eIDAS 2.0, formally Regulation (EU) 2024/1183 amending Regulation (EU) 910/2014, is significantly more complex to implement than its predecessor because it introduces a completely new technical architecture built around verifiable credentials, cryptographic proofs, and wallet-based identity. eIDAS 1.0 was primarily about recognizing national eID schemes across borders. eIDAS 2.0 goes further by defining how identity attributes are issued, stored, and selectively disclosed.

The key technical shift is the move toward verifiable credentials and the Architecture and Reference Framework (ARF). The ARF is the technical elaboration of requirements set out in the implementing acts adopted by the European Commission; it is not itself legally binding, but the implementing acts that give it grounding are. The ARF specifies how wallets, issuers, and relying parties must interact in practice, including credential formats such as mdoc and SD-JWT VC, issuance via OID4VCI, and presentation via OID4VP. For proximity presentation, ISO/IEC 18013-5 applies; for online presentation, ISO/IEC TS 18013-7 applies. Organizations that built their identity verification flows on traditional username-password or single sign-on systems will need to re-engineer significant parts of their infrastructure.

Governance under eIDAS 2.0 is a shared responsibility. The European Commission manages the legal framework and adopts implementing acts. EU Member States provide or mandate wallet solutions, certify and notify them, and supervise actors within their jurisdiction. The European Digital Identity Cooperation Group supports cross-border alignment and cooperation. National competent authorities and registrars, wallet providers, issuers of Person Identification Data and attestations, qualified trust service providers, and relying parties each carry distinct responsibilities within this ecosystem. No single central European authority operationally manages all EUDI Wallets.

Specific technical challenges include:

• Integrating with wallet protocols that may differ between Member States during the transition period
• Supporting selective disclosure, which allows users to share only specific attributes rather than full identity documents
• Implementing verification of credentials against national trusted lists, which are brought together in the EU List of Trusted Lists (LOTL), including checking revocation status and validating the wallet unit attestation to confirm the presenting wallet runs on a certified wallet solution
• Ensuring your systems can handle both legacy eID methods and new wallet-based flows simultaneously
• Meeting the security and assurance level requirements for different use cases, from low-assurance logins to high-assurance transactions
• Registering as a relying party under CIR (EU) 2025/848 before requesting wallet data, specifying per intended use which attributes and attestations will be requested

Organizations that have not yet invested in modern identity infrastructure will find that the gap between where they are and where they need to be is substantial. Exploring the right digital identity solutions early in the process is essential to avoid costly rework later.

How do cross-border interoperability requirements create compliance risk?

Cross-border interoperability is one of the most complex compliance risks in eIDAS 2.0 because it requires your systems to accept and validate identity credentials issued by any EU Member State. If your platform cannot reliably verify a wallet credential from another country, you are technically non-compliant and risk excluding users or failing regulatory audits.

The EUDI Wallet framework is designed so that a certified wallet from one Member State can be used with an appropriate relying party in another Member State. However, this does not mean that every use case will immediately be available in every Member State, that national registration requirements disappear, or that every credential automatically carries the same legal consequence in every jurisdiction. Sector-specific legislation continues to apply, and relying-party registration under CIR (EU) 2025/848 remains connected to the applicable national registration framework. What is interoperable at European level is the underlying technical and trust infrastructure. What remains national or sector-specific includes registration, supervision, and the legal effect of particular credentials in particular contexts.

The challenge is that while eIDAS 2.0 defines a common framework, implementation details vary across Member States during the rollout phase. National wallet implementations may differ in how they encode attributes, which trust anchors they use, or how they handle edge cases. This creates a moving target for organizations that need to build interoperable systems before all national implementations are finalized. It is also important to understand that the 24 December 2026 legal deadline for wallet issuance and public-sector acceptance does not guarantee full functional interoperability across the entire EU from that date. Practical interoperability and national rollout will continue to develop in phases as each Member State’s implementation matures.

The first four Large-Scale Pilots ran from April 2023 through 2025 and have concluded. They involved over 350 entities from 26 Member States plus Norway, Iceland, and Ukraine, and covered a wide range of use cases: the EWC pilot addressed Digital Travel Credentials, payments, and organisational digital identity; POTENTIAL covered government services, bank account opening, SIM registration, mobile driving licence, remote qualified signatures, and e-prescriptions; NOBID focused on payments; and DC4EU addressed education and social security. The insights from these pilots fed back into the technical specifications. A second wave of pilots started in 2025, with WE BUILD focusing on business wallets and payments, and APTITUDE covering travel, ticketing, vehicle registration, and payments. Organizations cannot simply wait for any pilot phase to conclude before starting their own preparations, and there will be no single European go-live moment to wait for.

Practical interoperability risks include rejecting valid credentials from users in other countries, failing to recognize trust anchors from foreign wallet issuers, and building integrations that work today but break when national implementations are updated. Organizations in government services and cross-border financial transactions face this risk most acutely.

What data protection conflicts arise between eIDAS 2.0 and GDPR?

The most significant tension between eIDAS 2.0 and GDPR centers on the legal basis for processing identity data and the principle of data minimization. eIDAS 2.0 enables rich, verified identity attributes to flow between parties, while GDPR requires that only the minimum necessary data is collected and processed for a specified purpose. Balancing these two obligations in practice is genuinely difficult.

One concrete conflict arises with audit trails. eIDAS 2.0 requires organizations to maintain records of identity transactions for accountability and legal certainty. GDPR, on the other hand, limits how long personal data can be retained and requires a clear legal basis for doing so. Organizations must define retention policies that satisfy both frameworks, which often requires legal analysis rather than a simple technical fix.

A second tension involves the wallet’s selective disclosure feature. While the EUDI Wallet is designed to let users share only the attributes they choose, relying parties must not request more data than they need. Each relying party must register the specific attributes and attestations it intends to request, per intended use, under CIR (EU) 2025/848. If your onboarding or verification flow requests more attributes than strictly necessary, you risk a GDPR violation even if the user approves sharing them in the wallet. It is important to distinguish between a user approving a data request in the wallet and consent as a legal basis under GDPR. A relying party needs its own GDPR legal basis for processing the data received. For KYC purposes, that basis is typically a legal obligation. For health data, an additional condition under Article 9(2) GDPR is required.

Organizations should treat eIDAS 2.0 implementation as a data protection project as much as a technical one. Privacy impact assessments, updated data processing agreements, and clear documentation of the legal basis for each identity transaction are all necessary steps. This is especially relevant for organizations handling sensitive categories of data, such as health or financial information.

When do organizations need to be fully compliant with eIDAS 2.0?

The eIDAS 2.0 regulation entered into force on 20 May 2024, and by the end of 2024 the first implementing acts were adopted by the European Commission, covering technical specifications, security standards, and interoperability rules for the EUDI Wallet. These first implementing acts also started the relevant 24-month period for subsequent deadlines. A second wave of technical implementing acts followed in 2025, addressing areas such as qualified electronic archiving, validation, certificates, and qualified trust service providers (QTSPs). For organizations in scope, the practical preparation window is now. Waiting significantly increases implementation risk.

The timeline breaks down roughly as follows:

1. 20 May 2024: eIDAS 2.0, Regulation (EU) 2024/1183 amending Regulation (EU) 910/2014, entered into force; the starting point for all subsequent deadlines
2. End of 2024: First implementing acts adopted by the European Commission, including technical specifications, security standards, and interoperability rules for the EUDI Wallet; these acts start the relevant 24-month period
3. 6 May 2025: CIR (EU) 2025/848 adopted, establishing the registration framework for relying parties wishing to request wallet data
4. 2025: Second wave of technical implementing acts published; first Large-Scale Pilots concluded; second-wave pilots underway; national wallet implementations accelerating
5. 24 December 2026: Legal deadline by which each Member State must have at least one certified EUDI Wallet available; public sector bodies must accept notified wallets as a means of identification for online services requiring electronic identification from this date. Practical maturity and cross-border interoperability will continue to develop in phases beyond this date.
6. 24 December 2027: Mandatory acceptance obligation takes effect for regulated private-sector parties in scope under Article 5f, in contexts where strong user authentication is legally or contractually required, and for VLOPs where authentication is required, on the user’s voluntary request and for the minimum necessary data
7. Ongoing: Supervision and enforcement ramp up; non-compliant organizations face regulatory scrutiny

Organizations that have not yet begun their eIDAS 2.0 implementation are already behind. The technical complexity, the need for legal and compliance review, and the time required to integrate new identity infrastructure mean that organizations realistically need 12 to 24 months of lead time for a full implementation. Starting now is not early; it is necessary.

How should organizations start preparing for eIDAS 2.0 compliance today?

Organizations should start by mapping their current identity verification flows against eIDAS 2.0 requirements to identify where the gaps are. This means understanding which of your services require identity verification, what assurance levels are needed, and whether your existing infrastructure can support wallet-based credentials. A gap analysis is the foundation of any realistic compliance roadmap.

From there, practical preparation involves several parallel workstreams. On the technical side, organizations should begin testing integrations with available wallet reference implementations and reviewing the Architecture and Reference Framework alongside the implementing acts that give it legal grounding. On the legal and compliance side, teams should update data processing documentation, review contracts with identity service providers, and assess the GDPR implications of new data flows. Organizations also need to register as a relying party under CIR (EU) 2025/848 with the national authority of their Member State of establishment before they can request wallet data, specifying per intended use which attributes and attestations they will request.

It is also worth following the outputs of the Large-Scale Pilots, whose findings are designed to be shared broadly. Organizations that track pilot outcomes will have a clearer picture of what works in practice.

Finally, do not underestimate the organizational dimension. eIDAS 2.0 touches compliance, legal, IT, product, and customer experience teams simultaneously. Assigning clear ownership and building cross-functional alignment early will save significant time and cost later. You can explore how other organizations in similar sectors have approached this challenge by reviewing customer experiences and sector-specific use cases.

How TrustTech helps with eIDAS 2.0 compliance challenges

TrustTech provides the ID Connector, an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.

In the context of the compliance challenges described in this article, the ID Connector addresses several concrete problems:

• EUDI Wallet acceptance: Connecting your systems to wallet-based identity flows so you can accept verified credentials from any EU Member State, regardless of which wallet provider issued the wallet
• Trust management and verification: Verifying issuer signatures against national trusted lists brought together in the EU List of Trusted Lists, checking revocation status via issuer status information, and validating wallet unit attestations to confirm the presenting wallet runs on a certified wallet solution
• Registered attribute scope: Ensuring that data requests stay within the scope of attributes and attestations registered per intended use under CIR (EU) 2025/848, so your integration remains compliant as the regulatory framework develops
• Reusable identity: Enabling customers to present verified credentials across your services, reducing onboarding friction and repeated KYC checks, within the limits set by applicable AML regulation
• Qualified signing: Linking identity to every signature via a connected QTSP, with a tamper-evident audit trail that satisfies both eIDAS 2.0 and GDPR requirements
• Cross-border interoperability: Handling the complexity of different national implementations so your team does not need to build and maintain those integrations independently

The ID Connector sits between the parties that need to interact, without owning any of them, making it a neutral infrastructure layer for your digital identity ecosystem. It is relevant across financial services, healthcare, pharma, and government, where identity compliance is a core operational requirement. Get in touch with TrustTech to discuss your eIDAS 2.0 compliance roadmap.