Under eIDAS 2.0, Regulation (EU) 2024/1183, which amends Regulation (EU) 910/2014, mobile ID documents are digital representations of physical identity credentials stored and presented through the European Digital Identity Wallet. The regulation sets out specific requirements covering document types, technical standards, assurance levels, and privacy rules that apply to any mobile ID used in regulated interactions across the EU. This article walks through each of those requirements so your organisation knows exactly what to prepare for.
Which mobile ID documents fall under eIDAS 2.0?
eIDAS 2.0 covers a broad range of mobile ID documents that can be stored and presented through the EUDI Wallet. The most prominent example is the mobile driving licence (mDL), but the framework also applies to digital passports, national identity cards, residence permits, and other government-issued credentials presented in digital form.
Beyond these foundational identity documents, eIDAS 2.0 extends to a wider category of attestations that carry legal weight in regulated interactions. The large-scale pilots that ran from April 2023 to 2025 tested the EUDI Wallet across several document types, including:
- Mobile driving licences (mDL): Used for both roadside checks and online age or identity verification, piloted under POTENTIAL
- Travel documents: Digital Travel Credentials were piloted under EWC for use at border crossings and airport security, though this functionality is not yet operationally deployed
- Social security and health documents: Including the European Health Insurance Card, supporting cross-border healthcare access, piloted under DC4EU
- Educational credentials: Diplomas, degrees, and certificates stored as verifiable digital attestations, piloted under DC4EU
- Organisational identity documents: Credentials that prove a person is an authorised representative of a business, piloted under EWC
The common thread is that all of these documents must be issued by a recognised authority, stored securely in the wallet, and presented in a way that allows the receiving party to verify their authenticity. Whether that verification can happen fully offline depends on which checks are required, as explained in the section on verification below.
What technical standards must mobile ID documents meet under eIDAS 2.0?
Mobile ID documents under eIDAS 2.0 must conform to internationally recognised technical standards to ensure interoperability across EU Member States. For mobile driving licences, the relevant standards are ISO/IEC 18013-5 for proximity-based presentation and ISO/IEC TS 18013-7 for online presentation.
ISO/IEC 18013-5 specifies the data model, the communication protocols for device-to-device transfer (such as Bluetooth Low Energy and NFC), and the cryptographic mechanisms used to protect the credential. This means a mobile driving licence issued in one Member State can be verified by a reader in another Member State using the same technical process, provided both sides have implemented the relevant standards and any applicable national requirements are met.
For the broader EUDI Wallet ecosystem, mobile ID documents must also align with the Architecture and Reference Framework (ARF) developed by the eIDAS Expert Group. The ARF contains the technical elaboration of the requirements set out in the implementing acts adopted by the European Commission, which are legally binding. The ARF defines the technical building blocks that all wallet implementations must support, including:
- Selective disclosure, so users can share only the specific attributes needed for a transaction
- Cryptographic binding between the credential and the wallet device
- Support for both online and offline presentation scenarios
- Interoperability with qualified trust services as defined in the eIDAS trust framework
The credential formats prescribed by the ARF are mdoc and SD-JWT VC. Credential issuance uses OID4VCI and presentation uses OID4VP. The High Assurance Interoperability Profile (HAIP) applies where high assurance is required. Organisations that plan to accept mobile ID documents must ensure their verification infrastructure supports these standards. Relying parties need to validate the cryptographic signature attached to the credential, which requires dedicated technical integration.
What assurance level is required for mobile ID documents under eIDAS 2.0?
Mobile ID documents used in regulated interactions under eIDAS 2.0 must meet the High assurance level as defined in the regulation. This is the highest level in the eIDAS framework, meaning the identity behind the credential has been verified through a rigorous process that provides strong confidence in the person’s claimed identity.
High assurance requires that the original identity proofing was carried out using reliable and verifiable sources, typically involving in-person verification or remote identification with equivalent security guarantees. The credential itself must be bound to a secure element or trusted execution environment on the user’s device, making it tamper-evident and resistant to unauthorised transfer.
For context, eIDAS defines three assurance levels: Low, Substantial, and High. Most cross-border public services and regulated private sector use cases, such as opening a bank account or accessing government benefits, require at least Substantial assurance. For mobile ID documents that serve as legal equivalents to physical identity documents, the High level is the expected baseline.
This has direct implications for wallet providers and document issuers. The identity verification process used to issue a mobile ID document must itself meet High assurance requirements, which means organisations in sectors like financial services or government need to review their existing onboarding and verification processes to confirm they qualify.
How does the EUDI Wallet handle mobile ID document verification?
Verifying a mobile ID document presented through the EUDI Wallet involves three distinct checks, and not all of them can be completed offline.
The first check is verification of the issuer’s signature against the relevant national trusted list. National trusted lists are consolidated in the EU List of Trusted Lists (LOTL). This check confirms that the credential was issued by a recognised authority and has not been altered, and it can be completed without a live connection to the issuer.
The second check is the revocation status of the credential. This requires consulting the status information made available by the issuer and cannot be completed fully offline.
The third check is validation of the wallet unit attestation, which confirms that the presenting wallet instance is running on a certified wallet solution. This check also requires connectivity.
The verification process works differently depending on whether the interaction is online or in person. In an online context, the wallet communicates with the relying party’s system through a secure protocol, and the relying party’s infrastructure validates the credential. In a physical context, such as a traffic stop where a driver presents their mobile driving licence, the exchange happens device-to-device using proximity protocols like NFC or Bluetooth under ISO/IEC 18013-5. In that scenario, the issuer’s signature can be checked offline, but revocation status and wallet unit attestation validation may not be available without connectivity.
The four large-scale pilot programmes that ran across 26 Member States tested these verification flows across real-world scenarios, from SIM card registration to qualified remote signing, generating practical feedback that shaped the final technical specifications.
What are the privacy requirements for mobile ID documents in eIDAS 2.0?
eIDAS 2.0 places strong privacy requirements at the centre of mobile ID document design. The regulation requires that mobile ID documents support selective disclosure, meaning users must be able to share only the specific attributes required for a transaction rather than their full identity document.
For example, when proving age for an online service, a user can share only the attribute confirming they are above a certain age, without revealing their date of birth, name, or any other personal data. Zero-knowledge proofs are not required for this: selective disclosure of a single attribute such as “age over 18” is sufficient. This principle of data minimisation is a core technical requirement that all compliant mobile ID documents and wallet implementations must support.
The privacy framework also requires that each presentation of a mobile ID document is unlinkable to other presentations, so that neither the issuer nor any third party can build a profile of a user’s activity based on their credential use. This does not eliminate all risk of tracking or profiling, but it removes the issuer as a source of that data.
Users approve each presentation individually. The EUDI Wallet is designed so that nothing is shared without the user’s explicit approval for that specific interaction. This gives individuals control over what they share and with whom. The wallet dashboard is available to users to review their own transaction history; it is not a logging facility operated by the wallet provider.
For organisations operating in healthcare or other sensitive sectors, these privacy requirements also intersect with GDPR obligations. Processing health-related attributes requires both a lawful basis under Article 6 GDPR and a condition under Article 9(2) GDPR. Approval in the wallet is separate from the relying party’s own GDPR lawful basis, which must be established independently.
What do organisations need to do to accept eIDAS 2.0-compliant mobile IDs?
To accept eIDAS 2.0-compliant mobile ID documents, organisations need to register as a relying party within the EUDI Wallet ecosystem and implement the technical infrastructure required to verify cryptographically signed credentials. Under CIR (EU) 2025/848, adopted on 6 May 2025, relying parties must register with the national authority of their Member State of establishment before they can request wallet data. Registration specifies, per intended use, which attributes and attestations will be requested. The wallet checks incoming requests against this registered scope.
The practical steps organisations should work through include:
- Understand which use cases apply: Identify the identity interactions in your services where mobile ID documents could replace or complement existing verification methods.
- Register as a relying party: Complete the formal registration process under CIR (EU) 2025/848 with the national authority in each Member State where you operate, specifying the attributes and attestations you intend to request.
- Implement compliant verification infrastructure: Integrate the technical protocols required to validate ISO/IEC 18013-5 and ISO/IEC TS 18013-7 credentials and other wallet-based attestations, including signature verification against national trusted lists, revocation status checks, and wallet unit attestation validation.
- Update your data minimisation practices: Ensure your systems request only the attributes genuinely needed for each transaction, in line with selective disclosure requirements and your registered attribute scope.
- Review your existing assurance level requirements: Confirm that the assurance levels your services currently require align with what the EUDI Wallet can provide.
- Train relevant teams: Compliance, legal, IT, and customer-facing teams all need to understand what eIDAS 2.0-compliant mobile IDs mean for their processes.
Organisations that already handle identity verification at scale, such as banks, insurers, or public service providers, will likely need to update their onboarding flows and back-end validation logic. Those starting from a lower baseline of digital identity maturity may need to invest more significantly in new infrastructure.
The timeline for preparation is narrowing. 24 December 2026 is the legal deadline by which every EU Member State must have at least one certified EUDI Wallet available for citizens, residents, and businesses, and public sector bodies must accept notified wallets as a means of identification for online services requiring electronic identification from that date. This deadline is an outer limit, not a predicted launch date. Practical interoperability and national rollout are expected to develop in phases, and organisations should plan accordingly.
From 24 December 2027, Article 5f of the regulation requires regulated private sector organisations to accept the EUDI Wallet where strong user authentication is legally or contractually required. The sectors in scope include banking and financial services, healthcare, telecoms, energy, transport, education, social security, drinking water, postal services, digital infrastructure, and digital services. Very large online platforms with more than 45 million users in the EU are subject to a separate provision under Article 5f: they must accept the EUDI Wallet where the platform requires user authentication, on the voluntary request of the user and for the minimum necessary data. Micro and small enterprises, defined as organisations with fewer than 50 employees and an annual turnover or balance sheet total of no more than 10 million euros, are exempt from the private acceptance obligation. Reviewing your implementation approach now is the practical next step.
How the ID Connector supports eIDAS 2.0 mobile ID acceptance
The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
For organisations preparing to accept mobile ID documents, the ID Connector handles the technical layer that makes compliant verification possible in practice:
- Wallet acceptance across Member States: The ID Connector accepts every certified EUDI Wallet regardless of the issuing Member State, so organisations do not need separate integrations per national wallet solution
- Signature verification against trusted lists: The ID Connector validates issuer signatures against the relevant national trusted lists consolidated in the EU List of Trusted Lists (LOTL)
- Revocation status checks: The ID Connector consults issuer-provided status information to confirm that a credential has not been revoked at the time of presentation
- Wallet unit attestation validation: The ID Connector verifies that the presenting wallet instance is running on a certified wallet solution before accepting the presentation
- Registered attribute scope enforcement: The ID Connector ensures that data requests stay within the scope registered under CIR (EU) 2025/848, keeping requests aligned with what the relying party is authorised to ask for
- Qualified signing via a connected QTSP: For use cases requiring a qualified electronic signature, the ID Connector connects to a qualified trust service provider without requiring a separate integration
Organisations in financial services, healthcare, pharma, and government face the most immediate compliance requirements under eIDAS 2.0, given the assurance levels and sector-specific obligations that apply to them. If your organisation is preparing to accept eIDAS 2.0-compliant mobile IDs, get in touch with TrustTech to discuss what the ID Connector can do for your specific situation.