eIDAS 2.0 introduces a significant amendment to Regulation (EU) 910/2014, most notably by requiring every EU Member State to provide citizens, residents, and businesses with a European Digital Identity Wallet. Where the original regulation focused primarily on mutual recognition of national eID schemes, the revised framework extends obligations to the private sector, introduces new trust services, and establishes a single, interoperable digital identity standard across Europe. The sections below walk through each of the key changes in detail.
How does eIDAS 2.0 differ from the original eIDAS regulation?
Regulation (EU) 2024/1183, known as eIDAS 2.0, amends Regulation (EU) 910/2014 and goes significantly further than the original framework. Where the original regulation, in force since 2016, created a voluntary framework for EU Member States to mutually recognise each other’s national electronic ID schemes, eIDAS 2.0 makes participation mandatory, extends the rules to private sector services, and introduces the European Digital Identity Wallet as a universal tool for every EU citizen, resident, and business.
Under the original regulation, Member States could choose whether to notify their national eID scheme for cross-border recognition. This led to uneven adoption and large differences in how digital identity worked from one country to another. Some countries had mature, widely used eID systems; others had almost nothing in place. The result was a fragmented landscape that made cross-border digital services unnecessarily complicated.
eIDAS 2.0 addresses this directly. Member States are now legally required to make a digital identity wallet available to all citizens, residents, and businesses. Private sector organisations that provide services in certain categories are also required to accept these wallets. The regulation shifts from an optional framework to a binding infrastructure obligation, which is a fundamental change in both scope and ambition.
What is the European Digital Identity Wallet and what does it do?
The European Digital Identity Wallet, or EUDI Wallet, is a secure digital application that allows EU citizens, residents, and businesses to store, manage, and share verified identity data and documents. It enables users to prove who they are online and in person, share only the specific information needed for a given interaction, and sign documents electronically, all from a single app.
The wallet can hold a wide range of credentials, including national identity data, driving licences, academic qualifications, professional certificates, and health documents. When a user needs to access a service, they can share only the relevant attributes, for example their age or nationality, without disclosing additional personal information. This selective disclosure is one of the wallet’s most important privacy features.
The EUDI Wallet is designed to reduce repeated identity checks. A user presents verified identity attributes from the wallet when accessing a service, whether opening a bank account, registering a SIM card, or accessing a government portal. Each presentation requires the user to approve the specific data request in the wallet. Large-scale pilot programmes across Member States tested exactly these scenarios, covering use cases from opening bank accounts and accessing government services to cross-border payments and SIM registration.
The EUDI Wallet framework is governed through shared responsibility. The European Commission manages the legal framework and adopts implementing acts that set legally binding requirements. EU Member States are responsible for providing or mandating wallet solutions, certifying and notifying them, and supervising actors within their jurisdiction. The European Digital Identity Cooperation Group supports cooperation and cross-border alignment between Member States. National competent authorities and registrars, wallet providers, issuers of Person Identification Data and attestations, qualified trust service providers, and relying parties each carry distinct roles and obligations within this structure. No single central European authority operationally manages all EUDI Wallets.
The Architecture and Reference Framework provides the technical elaboration of requirements established in the implementing acts. It defines how wallets must work technically and has been developed iteratively based on feedback from large-scale pilot programmes. Member States and private providers can build their own wallet implementations as long as they conform to those technical specifications. Some countries are developing new wallet solutions; others are building on existing digital identity infrastructure. Where the current status of a specific national wallet cannot be established reliably from authoritative sources, it is worth checking directly with the relevant national competent authority before drawing conclusions.
Which sectors and organisations are affected by eIDAS 2.0?
eIDAS 2.0 affects a broad range of sectors, with the strongest obligations falling on organisations that provide digital services requiring identity verification. The regulation draws a clear distinction between public sector obligations and private sector obligations, and between different categories of private sector actors.
From 24 December 2026, public sector bodies across all EU Member States must accept notified EUDI Wallets for online services that require electronic identification.
From 24 December 2027, Article 5f of the amended regulation applies to relevant regulated private sectors where strong user authentication is required by law or contract. The sectors covered include banking and financial services, healthcare, telecommunications, energy, transport, education, social security, drinking water, postal services, digital infrastructure, and digital services. Micro and small enterprises are excluded from this obligation, specifically organisations with fewer than 50 employees and an annual turnover or balance sheet total of no more than 10 million euros.
Very large online platforms fall under a separate provision of Article 5f. For those platforms, the obligation applies where the platform requires user authentication, on the voluntary request of the user and limited to the minimum necessary data. The condition of legally or contractually required strong authentication does not apply to very large online platforms.
Before a relying party can request wallet data, it must register with the national authority of its Member State of establishment under CIR (EU) 2025/848, adopted on 6 May 2025. Registration is per intended use and specifies which attributes and attestations will be requested. The wallet checks each presentation request against this registered scope. A relying party must be able to accept every relevant notified wallet, regardless of which wallet provider issued it. A vendor that processes wallet data on behalf of a client does not become the relying party by doing so. The registration obligation rests with the organisation delivering the service to the end user.
The sectors most immediately affected include:
- Financial services and banking, where wallet-based identity verification can complement existing KYC and AML processes, subject to applicable AML regulation
- Government and public administration, which must both issue wallets and accept them for access to public services from 24 December 2026
- Healthcare and pharmaceuticals, where verified identity is relevant for patient records, prescriptions, and professional credentials
- Telecommunications, particularly for SIM registration and contract management
- Education, for the issuance and verification of academic credentials across borders
- Online platforms that fall above the thresholds for very large online platforms
It is also important to note that cross-border interoperability under the EUDI Wallet framework is designed so that a certified wallet from one Member State can be used with an appropriate relying party in another Member State. This does not mean that every use case will immediately be available in every Member State, that national registration requirements disappear, or that sector-specific legislation is overridden. Certain credentials may carry different legal consequences depending on the jurisdiction and sector in question.
What new trust services does eIDAS 2.0 introduce?
eIDAS 2.0 expands the list of qualified trust services recognised under EU law. In addition to the existing services such as electronic signatures, seals, timestamps, and website authentication certificates, the revised regulation introduces several new categories that reflect how digital interactions have evolved.
The new and expanded trust services include:
- Electronic attestation of attributes (EAA): A new service type that allows trusted parties to issue verified claims about a person or organisation, such as professional qualifications or age, in a machine-readable and cryptographically verifiable format. These attestations can be stored in the EUDI Wallet. A distinction applies between qualified electronic attestations of attributes (QEAA), issued by qualified trust service providers and carrying greater legal weight across EU Member States; attestations issued by public bodies or bodies designated by public bodies (PuB-EAA); and non-qualified EAA issued by other parties.
- Qualified electronic attestation of attributes (QEAA): A higher-assurance attestation issued by qualified trust service providers, carrying greater legal weight across EU Member States.
- Electronic archiving services: Qualified services for the long-term preservation of electronic documents and signatures, ensuring their legal validity over time.
- Electronic ledger services: A new category covering the recording of data in a tamper-evident and verifiable way, relevant for use cases involving audit trails and data provenance.
- Remote qualified signature creation devices (QSCDs): Management of remote signing infrastructure as a qualified trust service, enabling legally valid electronic signatures without requiring physical hardware in the user’s possession. Remote signing was already possible under the original regulation; eIDAS 2.0 brings its management explicitly within the qualified trust service framework.
These additions reflect a broader shift toward a richer, more interoperable trust ecosystem. Organisations in healthcare and other regulated sectors will find the attribute attestation services particularly relevant, as they enable the secure and portable sharing of professional credentials and patient data across organisational and national boundaries. The legal consequences of a given attestation may still vary depending on national rules and sector-specific legislation in the receiving Member State.
What are the compliance deadlines organisations need to know?
eIDAS 2.0, Regulation (EU) 2024/1183, entered into force on 20 May 2024. The key compliance deadlines are as follows.
By 24 December 2026, all EU Member States must make a conformant EUDI Wallet available to citizens, residents, and businesses, and public sector bodies must accept notified wallets for online services requiring electronic identification. By 24 December 2027, the private sector acceptance obligation under Article 5f applies to relevant regulated sectors. From July 2027, the Anti-Money Laundering Regulation (AMLR) becomes applicable, which intersects with digital identity requirements for financial services.
It is important to distinguish between a legal deadline and a predicted launch date. The date of 24 December 2026 establishes when Member States must meet their wallet obligations under the regulation. It does not guarantee that every national wallet will have reached the same level of maturity on that date, or that every possible cross-border use case will be fully operational throughout Europe from that moment. Practical interoperability and national rollout are likely to develop in phases, reflecting differences in national implementation timelines, certification and notification processes, and the readiness of relying parties to accept wallet-based interactions.
The groundwork has been laid over several years. The first four large-scale pilot programmes ran from April 2023 through 2025 and have concluded. The EWC consortium piloted Digital Travel Credentials, payments, and organisational digital identity. POTENTIAL covered government services, opening bank accounts, SIM registration, mobile driving licences, remote qualified signatures, and electronic prescriptions. NOBID focused on payments. DC4EU addressed education and social security. A second wave of pilots started in 2025: WE BUILD focuses on business wallets and payments, and APTITUDE covers travel, ticketing, vehicle registration, and payments.
The Architecture and Reference Framework, which provides the technical elaboration of requirements set out in the implementing acts, has been developed iteratively based on feedback from those pilots. A series of Commission Implementing Regulations have been adopted, covering protocols and interfaces, certification requirements, and cross-border identity matching. The first five core implementing acts were adopted at the end of 2024, starting the relevant 24-month period.
For organisations, practical preparation means several workstreams running in parallel. Technical integration with wallet infrastructure, legal and contractual updates to reflect new data-sharing arrangements, staff training, and updates to onboarding and authentication flows all take time. There will not be a single European go-live moment; readiness is built incrementally.
eIDAS 2.0 does not operate in isolation. AMLR and PSD2 intersect with digital identity requirements, and organisations in regulated sectors will need to ensure their compliance approach addresses all relevant frameworks together.
How TrustTech helps organisations prepare for eIDAS 2.0
Aligning your technology, processes, and compliance frameworks with eIDAS 2.0 requires a concrete integration approach, particularly for organisations in financial services, healthcare, pharma, and government.
The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login, and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs, and identity documents, inside and outside the EU.
Concretely, the ID Connector handles:
- Wallet acceptance for every notified EUDI Wallet, regardless of the issuing Member State or wallet provider
- Verification against national trusted lists, aggregated in the EU List of Trusted Lists, to confirm the validity of issuer signatures on presented attestations
- Revocation status checks against issuer-provided status information
- Wallet unit attestation validation to confirm that the presenting wallet runs on a certified wallet solution
- Registered attribute scope enforcement so that each presentation request stays within the scope registered under CIR (EU) 2025/848
- Reuse of verified identity data across services without requiring users to repeat the full verification process for each interaction
- Qualified signing via a connected qualified trust service provider, with identity linked to every signature and a complete audit trail
To discuss where your organisation stands and what the next steps look like, get in touch with our team.