The main goals of eIDAS 2.0 are to create a universal, secure, and interoperable digital identity system across the European Union. The original eIDAS regulation focused primarily on electronic signatures and public sector identity. eIDAS 2.0, formally Regulation (EU) 2024/1183, amends Regulation (EU) 910/2014 and extends that framework to cover every EU citizen, resident, and business, with a strong emphasis on privacy, cross-border usability, and a single digital wallet that works across both public and private services. The sections below unpack each of those goals in plain terms.
What does eIDAS 2.0 actually change compared to the original eIDAS?
eIDAS 2.0 fundamentally expands the scope, reach, and obligations of the original regulation. The original eIDAS, in force since 2016, allowed EU member states to notify and recognise each other’s national electronic ID systems, but it did not require every country to build one, and it left the private sector largely outside its scope. eIDAS 2.0 closes those gaps by making participation mandatory and extending the framework to private organisations in regulated sectors.
The most significant structural change is the introduction of the European Digital Identity Wallet, which every member state is legally required to offer to citizens, residents, and businesses by 24 December 2026. The original regulation had no equivalent. Beyond the wallet, eIDAS 2.0 also tightens rules around trust services, introduces new categories such as electronic attestations of attributes, and brings private sector relying parties into the regulatory framework.
eIDAS 2.0 amends Regulation (EU) 910/2014. It does not replace it. The result is a framework that has moved from enabling cross-border recognition to establishing the foundation for a fully interoperable EU-wide digital identity ecosystem.
What is the European Digital Identity Wallet and why is it central to eIDAS 2.0?
The European Digital Identity Wallet (EUDI Wallet) is a secure digital application that allows EU citizens, residents, and businesses to store, manage, and share their identity data and personal documents. It is the primary delivery mechanism for the goals of eIDAS 2.0, which is why it sits at the heart of the regulation.
The wallet can hold a wide range of documents and credentials, including national identity information, mobile driving licences, educational qualifications, health insurance cards, and professional certifications. With a single interaction, users can share only the specific information a service needs, such as confirming they are over 18 without revealing their date of birth, or proving nationality without disclosing their full address. This selective disclosure works through credential formats such as mdoc and SD-JWT VC, as specified in the Architecture and Reference Framework (ARF).
From a regulatory standpoint, the wallet matters because it is the instrument through which eIDAS 2.0 delivers on its core promises: universal access, cross-border functionality, and user control. Member states cannot simply point to an existing national eID and call it done. They must provide a wallet that meets the technical and legal standards set out in the regulation and its implementing acts, ensuring a consistent baseline across the EU. The ARF provides the technical elaboration of those requirements, developed collaboratively by the European Commission and member states through the European Digital Identity Cooperation Group. The implementing acts are legally binding; the ARF provides the technical specifications that support them.
Governance of the EUDI Wallet ecosystem is a shared responsibility. The European Commission manages the legal framework and adopts implementing acts. Member states provide or mandate wallet solutions, certify and notify them, and supervise actors within their jurisdiction. National competent authorities and registrars, wallet providers, issuers of Person Identification Data and attestations, qualified trust service providers, and relying parties each carry distinct roles and obligations within this structure. No single central European authority operationally manages all EUDI Wallets.
Four large-scale pilot projects ran from April 2023 to 2025 across member states and associated countries, involving more than 350 public and private entities. The POTENTIAL consortium piloted government services, bank account opening, SIM registration, mobile driving licences, qualified remote signatures, and e-prescriptions. The EWC consortium covered Digital Travel Credentials, payments, and organisational digital identity. NOBID focused on payments. DC4EU addressed education and social security. A second wave of pilots started in 2025: WE BUILD focuses on business wallets and payments, and APTITUDE covers travel, ticketing, vehicle registration, and payments. The insights gathered from all these pilots are directly shaping the final design, security architecture, and interoperability standards of the wallet.
How does eIDAS 2.0 aim to give citizens more control over their personal data?
eIDAS 2.0 places data sovereignty at the centre of the digital identity framework. Citizens decide what information they share, with whom, and for how long. The regulation explicitly prohibits unnecessary data sharing: if a service only needs to verify that a user is over 18, the wallet shares that confirmation and nothing else. This selective disclosure of individual attributes, such as an age threshold, does not require zero-knowledge proofs; it is built into the credential formats specified in the ARF.
Most online services currently require users to create accounts with full personal details, or to authenticate through large platform providers that collect and retain data for their own purposes. eIDAS 2.0 addresses this by enabling users to access public and private services online without relying on commercial identity platforms and without sharing more personal data than a transaction requires. Wallet use is voluntary: no citizen is obliged to use a EUDI Wallet.
The regulation also requires that users can track which data they have shared and with which organisations through a wallet dashboard. This gives people visibility and control that is not possible with physical documents or fragmented digital credentials. It is worth noting that the wallet dashboard is a user-facing tool. It is distinct from any logging function operated by the wallet provider, and wallet providers are not permitted to track user transactions.
Privacy is a design requirement built into the wallet architecture. Each time a user responds to a relying party’s request, they approve that specific presentation. A relying party also has its own legal basis under the GDPR for processing the data it receives. Approving a presentation in the wallet is not the same as giving consent as a GDPR legal basis, and the two must not be conflated.
Which sectors and use cases must accept the EUDI Wallet under eIDAS 2.0?
eIDAS 2.0 draws a clear distinction between public sector acceptance and private sector acceptance, and between the two relevant deadlines.
From 24 December 2026, public sector bodies must accept notified EUDI Wallets for online services that require electronic identification. From 24 December 2027, Article 5f of the amended regulation applies to private sector relying parties in regulated sectors where strong user authentication is required by law or contract. The sectors covered include banking and financial services, healthcare, telecommunications, energy, transport, education, social security, drinking water, postal services, digital infrastructure, and digital services. Micro and small enterprises are excluded: organisations with fewer than 50 employees and an annual turnover or balance sheet total of no more than 10 million euros fall outside this obligation.
Very large online platforms (VLOPs) are subject to a separate provision under Article 5f. Where a VLOP requires user authentication, it must accept the EUDI Wallet on the voluntary request of the user and for the minimum necessary data. The condition of legally or contractually required strong authentication does not apply to VLOPs.
Before a relying party can request wallet data, it must register with the national authority of its member state of establishment under CIR (EU) 2025/848, adopted on 6 May 2025. Registration specifies, per intended use, which attributes and attestations the relying party is authorised to request. The wallet checks each presentation request against this registered scope. A relying party does not choose a wallet provider: it must be able to accept every relevant notified wallet, regardless of which provider issued it.
The large-scale pilots tested the wallet across eleven concrete use cases that reflect the services Europeans use most regularly:
- Accessing government services such as applying for a passport, filing taxes, or retrieving social security information
- Opening a bank account remotely without repeated document submissions
- SIM card registration to reduce fraud for mobile network operators
- Presenting a mobile driving licence in both online and physical settings
- Signing contracts digitally with qualified electronic signatures
- Claiming prescriptions at pharmacies across borders
- Travelling by presenting passport or visa information at border or airport controls, where Digital Travel Credentials have been piloted but are not yet operational
- Proving you are an authorised representative of an organisation
- Verifying identity when initiating an online payment
- Presenting educational credentials such as diplomas or degrees
- Accessing social security benefits and storing documents like the European Health Insurance Card
For organisations in financial services, government, and healthcare, the wallet acceptance obligation is particularly relevant. These sectors already operate under strict identity verification requirements, and the EUDI Wallet is designed to integrate with those existing processes. Sector-specific legislation and national registration requirements continue to apply alongside eIDAS 2.0; the wallet framework does not override them.
How does eIDAS 2.0 support cross-border digital identity across EU member states?
eIDAS 2.0 makes cross-border digital identity interoperability a legal requirement. The framework is designed so that a certified wallet from one member state can be used with an appropriate relying party in another member state. This creates a consistent identity layer across the EU that did not previously exist.
The original eIDAS regulation allowed member states to notify their national eID schemes for mutual recognition, but there was no obligation to do so. This led to significant fragmentation, with some countries having mature digital identity infrastructure and others having very little. eIDAS 2.0 resolves this by requiring every member state to provide a wallet that conforms to the shared ARF, with legally binding requirements set out in implementing acts adopted by the European Commission.
The practical ambition is that a citizen in the Netherlands can use their EUDI Wallet to access a public service in Spain, open a bank account in Germany, or present their qualifications to an employer in France. Cross-border interoperability will develop in phases. Not every use case will immediately be available in every member state, and national registration requirements as well as sector-specific rules continue to apply. The deadline of 24 December 2026 is the legal deadline for member states’ wallet obligations. Practical interoperability and national rollout maturity will vary and develop over time. Organisations should plan their implementation in step with the phased development of national wallet ecosystems.
What do organizations need to do to prepare for eIDAS 2.0 compliance?
Organizations that fall within the scope of eIDAS 2.0 need to assess their current identity infrastructure, understand their obligations as relying parties, and begin integrating wallet-compatible verification flows into their systems. The regulation entered into force on 20 May 2024. The legal deadline for member states to provide wallets is 24 December 2026, and the private sector acceptance obligation under Article 5f applies from 24 December 2027. Because national rollout maturity and the availability of specific use cases will vary across member states, organisations should plan for a phased approach.
Key preparation steps include:
- Mapping your compliance obligations: Determine whether your organisation falls into a category required to accept the EUDI Wallet, which deadline applies to you, and which use cases are relevant to your sector
- Reviewing your identity verification processes: Identify where current onboarding, authentication, or document verification flows will need to be updated to accept wallet-based credentials
- Registering as a relying party: Under CIR (EU) 2025/848, your organisation must register with the national authority of your member state of establishment, specifying per intended use which attributes and attestations you will request, before you can request wallet data
- Assessing your trust service integrations: Check whether your use of electronic signatures, seals, or timestamps aligns with the updated trust service requirements under eIDAS 2.0
- Following the ARF and implementing acts: Stay current with the legally binding technical requirements set out in implementing acts and the technical specifications being developed and tested through the large-scale pilots, as these define what wallet-compatible systems must support
- Engaging with pilot outcomes: The pilot projects running across Europe produced concrete findings on interoperability, security, and user experience that organisations can use to inform their own implementation planning
Organizations in regulated sectors such as finance, healthcare, and government face additional complexity because eIDAS 2.0 intersects with existing frameworks such as the GDPR, AML legislation, KYC requirements, and sector-specific regulations. Note that herreuse of KYC data is governed by AML rules, not by eIDAS 2.0 itself. Preparing for eIDAS 2.0 is therefore both a technical and a compliance challenge that benefits from a structured approach.
How TrustTech helps with eIDAS 2.0 readiness
The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
For organisations in financial services, healthcare, pharma, and government preparing for eIDAS 2.0, the ID Connector addresses the core technical and compliance requirements directly. Specifically, it handles:
- EUDI Wallet acceptance: Connecting your onboarding and verification flows to wallet-based credentials so you are ready when the obligation applies to your organisation
- Verification against trusted lists: Checking issuer signatures against the relevant national trusted lists, which are consolidated in the EU List of Trusted Lists, so that only credentials from recognised issuers are accepted
- Revocation status checks: Querying issuer-provided status information to confirm that a presented attestation has not been revoked
- Wallet unit attestation validation: Confirming that the presenting wallet is running on a certified wallet solution
- Registered attribute scope enforcement: Ensuring that presentation requests stay within the scope your organisation registered under CIR (EU) 2025/848
- Reusable verified identity: Replacing repeated identity checks with a single cryptographically verified identity that can be reused across interactions, within the limits of your GDPR legal basis
- Qualified digital signing: Connecting your signing processes to a qualified trust service provider so that signatures meet the eIDAS 2.0 requirements for qualified electronic signatures, with a tamper-evident audit trail linked to verified identity
- Cross-border interoperability: Building identity flows that work across EU member states, accounting for the phased nature of national rollouts and the sector-specific rules that apply in each jurisdiction
Explore our identity solutions or get in touch with our team to discuss what the ID Connector can do for your organisation.