Before accepting the European Digital Identity Wallet, businesses must register as a Relying Party under eIDAS 2.0, meet defined technical integration standards, and put data protection measures in place that comply with GDPR and the specific requirements of the EUDI Wallet framework. These obligations apply to any organization that wants to accept wallet-based credentials for identity verification or attribute sharing. The sections below walk through each compliance area in practical detail.
Which regulations govern EUDI Wallet acceptance for businesses?
EUDI Wallet acceptance is primarily governed by eIDAS 2.0, Regulation (EU) 2024/1183, which amends Regulation (EU) 910/2014. Alongside eIDAS 2.0, businesses must comply with GDPR when processing personal data retrieved from wallet credentials. Together, these two frameworks define the legal basis for accepting, verifying, and storing identity data presented through the European Digital Identity Wallet.
eIDAS 2.0 introduces a new category called Relying Parties: organizations that request and verify credentials from wallet holders. Any business wishing to accept the EUDI Wallet must formally register as a Relying Party with the relevant national competent authority under CIR (EU) 2025/848, adopted on 6 May 2025. This registration is not optional. It is a legal prerequisite that must be completed before wallet data can be requested, and it establishes accountability by ensuring that only verified organizations can request wallet-based identity data from users. Registration is tied to the Member State of establishment, so organizations operating across multiple Member States should verify the specific process in each jurisdiction.
As part of registration, a Relying Party must specify per intended use which attributes and attestations it will request. The wallet checks incoming requests against this registered scope. Beyond registration, eIDAS 2.0 sets rules around which attributes businesses are permitted to request, how those requests must be structured, and what trust levels apply to different use cases. The regulation also mandates that Relying Parties request only the minimum data necessary for their specific purpose, a principle that directly connects to GDPR’s data minimization requirements. The legally binding requirements are set out in the implementing acts adopted by the European Commission; the Architecture and Reference Framework provides the technical elaboration of those requirements.
Sector-specific regulations add further layers. Financial institutions must align EUDI Wallet compliance with AML directives and KYC obligations. Healthcare organizations face additional requirements under health data regulations. Understanding which regulatory frameworks apply to your sector is therefore an essential starting point before any technical work begins.
What technical requirements must businesses meet to accept the EUDI Wallet?
To accept the EUDI Wallet, businesses must integrate with the wallet’s technical infrastructure using standardized protocols. The legally binding technical requirements are set out in the implementing acts adopted by the European Commission. The Architecture and Reference Framework (ARF) provides the technical elaboration of those requirements, including support for OID4VP for credential presentation and ISO/IEC 18013-5 for proximity presentation of mobile documents, as well as ISO/IEC TS 18013-7 for online presentation. These standards are designed to ensure interoperability across certified wallet implementations issued by EU Member States. The High Assurance Interoperability Profile (HAIP) sets out the specific profile requirements for interoperable implementations.
In practical terms, this means your systems need to be capable of the following:
- Generating and sending compliant credential requests to wallet holders, within the attribute scope registered under CIR (EU) 2025/848
- Receiving and verifying signed credential responses, including verification of the issuer signature against the relevant national trusted list
- Checking the revocation status of received attestations via the issuer’s status information
- Validating the wallet unit attestation to confirm that the presenting wallet runs on a certified wallet solution
- Supporting both online (remote) and proximity (in-person) verification flows where relevant
- Logging verification events in a way that supports audit requirements
Verification is not a single cryptographic check. It involves three distinct steps: verifying the issuer’s signature against the relevant national trusted list, which is part of the EU List of Trusted Lists (LOTL); checking the revocation status via the issuer’s status information; and validating the wallet unit attestation to confirm the presenting wallet runs on a certified wallet solution. Only the first of these steps can be performed fully offline.
Businesses also need to ensure their backend systems can handle the selective disclosure model that the EUDI Wallet uses. Your system will receive only the specific attributes the user has approved sharing for that request, such as age confirmation or nationality. Credential formats supported under the ARF include mdoc and SD-JWT VC. Your verification logic must be built to work with these granular, attribute-level responses.
For most organizations, meeting these technical requirements will involve either building a custom integration or working with a platform that already supports the relevant standards. Starting with a clear mapping of your existing identity infrastructure against the implementing act requirements, using the ARF as a technical reference, will reveal where gaps exist and what needs to change.
What data protection obligations apply when verifying EUDI Wallet credentials?
When verifying EUDI Wallet credentials, businesses must comply with GDPR as data controllers. This means establishing a lawful basis for processing the identity data received, applying data minimization strictly, informing users about how their data is used, and ensuring that verified attributes are not retained longer than necessary for the stated purpose.
The EUDI Wallet framework reinforces these obligations through its design. Users approve each individual presentation request in the wallet. This approval is distinct from consent as a GDPR legal basis: as a Relying Party, you need your own GDPR legal basis for the processing you carry out. For KYC purposes, that basis is typically a legal obligation. For health-related attributes, which fall under the special categories of personal data in Article 9 GDPR, an additional ground under Article 9(2) GDPR is required alongside the standard legal basis.
Your credential request must specify exactly which attributes you need and why, in line with your registered scope. Requesting more data than your use case justifies is both a GDPR violation and a breach of eIDAS 2.0 Relying Party obligations.
Retention is a particularly important area to address. Many organizations default to storing identity verification records for extended periods, but under the EUDI Wallet model, you should retain only what is genuinely necessary. For some use cases, you may only need to log that a verification occurred and what the outcome was, without storing the underlying attribute data at all.
Businesses should also update their privacy notices and data processing agreements to reflect the new verification method. If you use a third-party service provider to handle wallet verification on your behalf, that provider processes data on your behalf but does not become the Relying Party. The registration obligation remains with the organization delivering the service to the end user. A data processing agreement under Article 28 GDPR is required with any such provider. Conducting a Data Protection Impact Assessment (DPIA) before going live is strongly recommended, particularly for high-risk processing contexts such as financial services or healthcare.
How should businesses update their legal and compliance frameworks?
Businesses should update their legal and compliance frameworks by formally incorporating EUDI Wallet acceptance into their existing identity governance documentation, updating relevant policies, and assigning clear internal ownership for ongoing compliance. This is not a one-time technical project but a sustained compliance function that needs to be embedded in how your organization manages digital identity.
A structured approach to updating your compliance framework typically involves these steps:
- Register as a Relying Party with the national competent authority in your Member State under CIR (EU) 2025/848, specifying per intended use which attributes and attestations you will request.
- Update your identity and access management policies to include EUDI Wallet as an accepted verification method, alongside your existing methods.
- Revise your data processing records under Article 30 GDPR to document wallet-based verification as a new processing activity.
- Conduct a DPIA if your use case involves sensitive data categories or large-scale processing of identity attributes.
- Update contractual documentation with vendors and partners who are involved in the verification process, including Article 28 GDPR data processing agreements where applicable.
- Train relevant teams, including compliance, legal, IT, and customer-facing staff, on how the wallet works and what obligations it creates.
It is also worth reviewing your incident response and breach notification procedures. If a verification event is later found to involve fraudulent credentials, your organization needs a clear process for responding, notifying the relevant authorities, and documenting the incident. Building this into your existing frameworks now avoids gaps later.
Which sectors face the strictest EUDI Wallet compliance deadlines?
Financial services, government, and healthcare are among the sectors facing the most immediate and stringent EUDI Wallet compliance obligations. Under eIDAS 2.0, public sector bodies and public service providers must accept notified EUDI Wallets as a means of identification from 24 December 2026. This is the legal deadline by which Member States must have their wallet obligations in place; it does not guarantee that every national wallet will have reached the same level of maturity or that every cross-border use case will be fully operational throughout Europe on that date. Practical interoperability and national rollout are expected to develop in phases.
For regulated private sector organizations, the mandatory acceptance obligation under Article 5f of eIDAS 2.0 applies from 24 December 2027, where strong user authentication is legally or contractually required. The sectors in scope include banks and financial services providers, healthcare providers, telecoms operators, energy suppliers, transport companies, education providers, social security bodies, drinking water providers, postal services, digital infrastructure providers, and digital services providers. Micro and small enterprises, defined as organizations with fewer than 50 employees and an annual turnover or balance sheet total of no more than 10 million euros, are exempt from this obligation.
Very large online platforms (VLOPs) fall under a separate provision of Article 5f. For VLOPs, the obligation applies where the platform requires user authentication, on the voluntary request of the user and for the minimum data necessary, without the condition of legally or contractually required strong authentication that applies to other private sector organizations.
These sectors also carry the most overlapping regulatory requirements from existing frameworks. For financial institutions, the intersection of EUDI Wallet compliance with AML, KYC, PSD2, and Strong Customer Authentication requirements creates a complex compliance landscape. The wallet can simplify some of these obligations by providing cryptographically signed identity data, but only if the integration is built correctly from the start. It is also worth noting that the evolving AML framework, with AMLR becoming applicable in July 2027, is moving towards identity verification via notified schemes, the EUDI Wallet, and qualified trust services. This is a parallel development that reinforces the case for early preparation, though it operates under a separate legal basis from the eIDAS 2.0 acceptance obligation.
Government organizations are both issuers and verifiers in the EUDI Wallet ecosystem. Public sector bodies must accept the wallet for access to digital public services from 24 December 2026 and, in many cases, are also responsible for issuing official credentials into citizens’ wallets. This dual role, spanning both issuer and Relying Party responsibilities, means their compliance obligations are broader than those of most private sector organizations. The governance of national wallet solutions rests with individual Member States, which are responsible for providing or mandating wallet solutions, certifying and notifying them, and supervising actors within their jurisdiction.
Healthcare providers face strict requirements around the handling of health-related attributes, which fall under the special categories of personal data in GDPR. Any use of the EUDI Wallet to share or verify health data requires a legal basis under Article 9(2) GDPR and additional safeguards beyond standard identity verification.
Organizations in education, telecommunications, energy, and other regulated sectors also have compliance timelines to meet under the 24 December 2027 deadline. For private sector organizations in scope, 2026 is the year to have your compliance framework well advanced: wallets will become available and testable as national rollouts progress from 24 December 2026, so that you are fully prepared ahead of the 2027 acceptance obligation. Organizations should not wait for a single European go-live moment, as national availability and the maturity of cross-border use cases will vary.
Where should businesses start their EUDI Wallet readiness assessment?
Businesses should start their EUDI Wallet readiness assessment by mapping their current identity verification processes against the requirements of eIDAS 2.0 and identifying the gaps. This means looking at your existing onboarding flows, authentication methods, data processing practices, and legal documentation to understand what already aligns with EUDI Wallet requirements and what needs to change.
A practical readiness assessment covers four areas. First, your regulatory position: have you identified your obligations as a Relying Party, and do you know which attributes your use cases require and how to register them under CIR (EU) 2025/848? Second, your technical infrastructure: can your systems support the protocols required for wallet-based verification, including the three verification steps covering issuer signature, revocation status, and wallet unit attestation? Third, your data governance: are your GDPR documentation, retention policies, and DPIAs up to date and fit for purpose in a wallet context? Fourth, your organizational readiness: do the right people in your organization understand what is coming and who owns the compliance response?
Starting with a gap analysis across these four dimensions gives you a clear picture of where you stand and what your priorities should be. From there, you can build a realistic roadmap with timelines, resource requirements, and measurable milestones. Organizations that begin their assessment now have time to make thoughtful decisions. Explore the resources available to support your readiness planning.
How TrustTech supports EUDI Wallet acceptance
The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
In the context of the compliance obligations described in this article, the ID Connector handles the technical steps that sit between your systems and the wallet: verifying issuer signatures against the relevant national trusted lists within the EU List of Trusted Lists, checking revocation status via issuer status information, validating wallet unit attestations to confirm the presenting wallet runs on a certified wallet solution, and enforcing the attribute scope registered under CIR (EU) 2025/848. This means your organization does not need to build and maintain each of these verification steps independently.
The ID Connector is relevant across the sectors where EUDI Wallet obligations are most pressing. For financial services organizations preparing for the intersection of eIDAS 2.0 with AML and KYC requirements, for healthcare providers handling health-related attributes under Article 9 GDPR, for government bodies that are both issuers and verifiers, and for pharma organizations working with regulated identity data, the same integration layer applies.
If you want to understand where your organization stands against the requirements set out in this article, get in touch with TrustTech to discuss how the ID Connector fits your use case.