eIDAS 2.0 affects virtually every sector that operates digital services in Europe. Financial services, healthcare, government, and telecommunications are among the most directly impacted, but the regulation affects any organization that verifies identities, handles sensitive data, or provides access to digital services. The sections below break down what the regulation means for each major sector and when compliance is required.
Which sectors are required to accept the EUDI Wallet?
Under eIDAS 2.0, a defined set of sectors is legally required to accept the European Digital Identity Wallet as a means of identification. These include banking and financial services, telecommunications, transport, energy, healthcare, public services, education, social security, drinking water, postal services, digital infrastructure, and digital services. Any organization in these sectors that currently requires identity verification must integrate EUDI Wallet support, subject to the applicable acceptance deadline for their sector.
This is one of the most significant shifts introduced by eIDAS 2.0, which amends Regulation (EU) 910/2014. The updated framework extends mandatory acceptance to private sector organizations, not only cross-border government recognition as under the original regulation. In practice, this means that if you run a regulated service where users must prove who they are, you will need to accept wallet-based credentials.
The obligation applies to relying parties in these sectors, but the timing differs between public and private organizations. Public bodies must accept notified EUDI Wallets for online services requiring electronic identification from 24 December 2026. For regulated private sector organizations, Article 5f of the amended regulation sets the acceptance deadline at 24 December 2027, where strong user authentication is required by law or contract. Very large online platforms, known as VLOPs, fall under a separate provision of Article 5f: they must accept EUDI Wallet credentials where the platform requires user authentication, on voluntary request of the user and for the minimum necessary data only. The condition regarding legally or contractually required strong authentication does not apply to VLOPs.
Micro and small enterprises are exempt from the private acceptance obligation. This exemption applies to organizations with fewer than 50 employees and an annual turnover or balance sheet total of no more than 10 million euros.
Under CIR (EU) 2025/848, adopted on 6 May 2025, relying parties must register with the national authority of the Member State where they are established before requesting wallet data. Registration covers the intended uses, the specific attributes and attestations to be requested, and the purpose for each. The wallet checks incoming requests against this registered scope.
How does eIDAS 2.0 change identity verification in financial services?
For financial services, eIDAS 2.0 introduces a new baseline for digital identity that reshapes how banks, insurers, and payment providers verify customers. Organizations in this sector will be required to accept EUDI Wallet credentials for customer onboarding, authentication, and Know Your Customer (KYC) processes, supplementing or replacing existing manual and fragmented verification flows.
The practical impact is significant. Today, financial institutions often run their own identity checks from scratch every time a new customer applies for a product. Under eIDAS 2.0, a customer who has already been verified through a government-issued digital identity or a trusted wallet can share that verified data directly with a bank or insurer. This reduces redundant checks and speeds up onboarding.
There are also implications for Strong Customer Authentication (SCA) under PSD2. EUDI Wallet credentials are expected to qualify as a high-assurance authentication method, which means financial institutions may be able to use wallet-based authentication to meet SCA requirements. This creates an opportunity to simplify compliance while improving the user experience.
For compliance and risk teams in financial services, eIDAS 2.0 also means rethinking how KYC data is stored, reused, and shared. The regulation supports reusable identity, meaning a customer verified once can share that credential across multiple institutions. However, whether and how KYC data can be reused is governed by AML legislation, not by eIDAS 2.0 itself. Organizations must manage both frameworks together. AML directives, including AMLR from July 2027, continue to apply alongside eIDAS 2.0, and sector-specific obligations are not displaced by the wallet framework.
What does eIDAS 2.0 mean for healthcare and pharmaceutical organizations?
Healthcare and pharmaceutical organizations face meaningful changes under eIDAS 2.0, particularly around patient identity, prescription handling, and cross-border data exchange. The EUDI Wallet has been piloted specifically for prescription claims, allowing patients to present verified prescription data to pharmacies digitally, and for storing the European Health Insurance Card. These use cases were tested in the POTENTIAL pilot consortium, which ran from April 2023 to 2025.
For hospitals, clinics, and healthcare providers, the regulation creates an opportunity to streamline patient onboarding and consent processes. Instead of collecting identity documents manually or relying on fragmented local systems, providers can accept wallet-based identity credentials that carry a high level of assurance. This reduces administrative burden and improves accuracy.
Pharmaceutical companies operating across borders have an additional layer of complexity to manage. Cross-border prescription fulfillment, clinical trial participant verification, and regulatory submissions all involve identity and trust. eIDAS 2.0 provides a common framework that can support these processes across EU Member States. The practical availability of cross-border use cases will develop in phases, and not every credential will carry the same legal consequence in every Member State. Sector-specific national rules continue to apply alongside the eIDAS framework.
For healthcare organizations preparing for these changes, the priority is understanding where identity verification currently sits in patient and staff workflows, and how wallet-based credentials can replace or complement existing methods. Organizations that handle sensitive health data also need to consider how eIDAS 2.0 interacts with GDPR obligations. Processing health data requires both a lawful basis under Article 6 GDPR and a specific ground under Article 9(2) GDPR. Approving a data request in the wallet is a separate act from providing a GDPR legal basis for processing: relying parties need their own lawful basis for the data they receive.
How does eIDAS 2.0 affect government and public sector services?
Government and public sector organizations are at the center of eIDAS 2.0. The legal deadline for Member States to make EUDI Wallets available to citizens, residents, and businesses is 24 December 2026. Public services such as tax filing, passport applications, social security access, and driver’s license management are among the first use cases being tested and deployed.
For public sector organizations, the regulation has two dimensions. First, they are issuers: governments must provide wallets and ensure that official attributes such as national identity, address, and civil status can be stored and shared securely through those wallets. Second, they are relying parties: public digital services must accept wallet credentials as a valid form of identification from 24 December 2026. Governance is a shared responsibility across the European Commission, which manages the legal framework and adopts implementing acts; EU Member States, which provide or mandate wallet solutions, certify and notify them, and supervise actors within their jurisdiction; and the European Digital Identity Cooperation Group, which supports cooperation and cross-border alignment.
The Large Scale Pilots that ran from April 2023 to 2025 demonstrated how this works in practice. Citizens used their EUDI Wallet to access government portals, apply for benefits, or prove their identity at a public authority without presenting physical documents. For governments that have already invested in national eID systems, eIDAS 2.0 requires those systems to connect with the wider EU wallet ecosystem and meet updated interoperability and certification standards. An existing national digital identity system is not automatically equivalent to a certified EUDI Wallet.
Agencies responsible for digital public services should assess their current identity infrastructure against the new technical standards. The government sector also has a coordination role: ensuring that the wallets they issue are certified and trusted, that citizens understand how to use them, and that cross-border recognition works reliably for EU residents moving between Member States. Practical interoperability and national rollout are likely to develop in phases beyond the legal deadline. Organizations should plan progressively rather than waiting for a single European go-live moment.
Which industries face the biggest compliance challenges with eIDAS 2.0?
Financial services, healthcare, and telecommunications face the steepest compliance challenges under eIDAS 2.0. These sectors combine high regulatory complexity, legacy identity infrastructure, and large volumes of customer interactions that must meet strict security and data protection requirements simultaneously.
The challenges vary by sector, but several common themes emerge:
- Legacy systems: Many organizations built their identity verification processes years ago, often around document uploads, manual checks, or proprietary authentication tools. Integrating EUDI Wallet acceptance requires changes to existing infrastructure that can be technically complex and time-consuming.
- Overlapping regulations: Financial institutions must align eIDAS 2.0 compliance with GDPR, AML directives, PSD2, and AMLR from July 2027. Healthcare organizations face similar overlap with GDPR and sector-specific data protection rules. Managing these frameworks together demands careful coordination, as eIDAS 2.0 does not displace existing sector-specific obligations.
- Cross-border interoperability: Organizations operating in multiple EU countries must ensure their systems recognize wallet credentials issued by different Member States. This requires adherence to common technical standards and ongoing monitoring as national implementations evolve. Not every cross-border use case will be fully operational in every Member State at the same time, and relying parties must register under CIR (EU) 2025/848 in each Member State where they are established.
- User adoption: Even once the technical infrastructure is in place, organizations need to support users in transitioning to wallet-based identification. This includes customer communication, support processes, and fallback options for users who have not yet adopted a wallet.
Smaller organizations in regulated sectors may also face resource constraints when implementing and maintaining compliant identity infrastructure. Micro and small enterprises meeting the threshold of fewer than 50 employees and a turnover or balance sheet total of no more than 10 million euros are exempt from the private acceptance obligation under Article 5f. For other organizations, working with a technology partner that already operates within the eIDAS framework can be a practical path to compliance.
When do organizations need to be compliant with eIDAS 2.0?
eIDAS 2.0, formally Regulation (EU) 2024/1183, entered into force on 20 May 2024, amending Regulation (EU) 910/2014. The first five core implementing acts were adopted by the end of 2024, starting the relevant 24-month period for certain obligations. The legal deadline for Member States to make EUDI Wallets available to citizens and businesses is 24 December 2026. Public bodies must accept notified wallets for online services requiring electronic identification from that same date. For regulated private sector organizations covered by Article 5f, the acceptance deadline is 24 December 2027.
It is important to distinguish between the legal deadlines, national wallet availability, certification and notification, operational interoperability, and acceptance by relying parties. The 24 December 2026 date is a legal obligation on Member States, not a guarantee that every national wallet will have reached the same level of maturity or that every cross-border use case will be fully operational across Europe on that date. Practical rollout and interoperability are likely to develop in phases. Organizations should track national developments and prepare progressively.
The timeline for compliance breaks down into several stages:
- Assessment (now): Identify which parts of your organization are affected, map your current identity verification processes, and determine where wallet acceptance needs to be integrated.
- Technical preparation (2025 to 2026): Update or replace identity infrastructure to support EUDI Wallet credentials. This includes API integrations, trust framework alignment, and testing against the technical specifications set out in the Architecture and Reference Framework (ARF) and the relevant implementing acts.
- Go-live (aligned with national wallet availability): Begin accepting EUDI Wallet credentials for relevant services as certified wallets become available in your markets, with appropriate fallback mechanisms for users not yet using a wallet.
- Ongoing compliance: Monitor updates to national wallet implementations, certification and notification status, technical standards, and regulatory guidance. eIDAS 2.0 compliance is not a one-time project but an ongoing operational requirement.
Organizations that treat eIDAS 2.0 as a future concern rather than a current priority risk being unprepared when national wallets come online. The technical changes required are not trivial, and building compliant identity infrastructure takes time. Starting the assessment and planning process now gives organizations the best chance of meeting their obligations without disruption.
How TrustTech helps organizations prepare for eIDAS 2.0
Navigating eIDAS 2.0 across multiple sectors, regulations, and technical standards is a significant undertaking. The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
For organizations in financial services, healthcare, government, and other regulated sectors, the ID Connector handles:
- Wallet acceptance across certified wallet solutions, so your systems recognize EUDI Wallet credentials regardless of which Member State issued them
- Verification against national trusted lists, aggregated in the EU List of Trusted Lists, covering issuer signature verification, revocation status checks, and wallet unit attestation validation
- Scope management aligned with your CIR (EU) 2025/848 registration, so that only the attributes and attestations registered for your intended use are requested
- Reuse of verified identity data across onboarding and authentication flows, reducing repeated verification for returning users
- Qualified signing via a connected QTSP, for processes that require a qualified electronic signature
Whether you are preparing for your first EUDI Wallet integration or updating a legacy identity system, the ID Connector is designed to get you to production and keep your integration aligned as implementing acts and national wallet certifications evolve. Contact TrustTech to discuss how your organization can prepare for eIDAS 2.0.