eIDAS 2.0 is the updated European regulation on electronic identification and trust services, designed to create a unified digital identity framework across all EU Member States. It amends the original eIDAS regulation, Regulation (EU) 910/2014, and goes much further by making digital identity accessible to every EU citizen, resident, and business through a standardised digital wallet. The sections below answer the most important questions about what this regulation means and what your organisation needs to do.
How does eIDAS 2.0 differ from the original eIDAS regulation?
The original eIDAS regulation, Regulation (EU) 910/2014, in force since 2014, allowed EU Member States to notify and recognise each other’s national electronic ID systems. Any scheme that was notified had to be accepted across the EU from 2018 onwards. However, there was no obligation for every country to create a national electronic ID or to make it compatible with others. This led to significant gaps and inconsistencies between Member States.
eIDAS 2.0, Regulation (EU) 2024/1183, which entered into force on 20 May 2024, amends Regulation (EU) 910/2014 and closes those gaps in three important ways. First, it makes participation mandatory: every Member State is now required to offer a digital identity solution to its citizens and businesses. Second, it extends the scope to the private sector, meaning that private organisations offering services online are also brought into the framework. Third, it introduces a new tool at the heart of the regulation: the European Digital Identity Wallet.
Where the original regulation created a foundation, eIDAS 2.0 builds a more complete structure on top of it. The goal is a consistent, interoperable, and user-controlled digital identity experience across the entire European Union.
What is the European Digital Identity Wallet?
The European Digital Identity Wallet, often referred to as the EUDI Wallet, is a secure digital application that allows EU citizens, residents, and businesses to store, manage, and share identity data and documents. Users can prove who they are, share specific attributes such as age or nationality, and sign documents digitally, all from a single app they fully control.
The wallet is designed with privacy at its core. Users decide exactly what information they share and with whom. If a service only needs to verify that someone is over 18, the wallet can confirm that attribute through selective disclosure without revealing a full date of birth or any other personal data. This approach is a significant improvement over traditional identity checks. It is worth noting that selective disclosure does not eliminate all risk of tracking or profiling, and relying parties remain subject to their own obligations under the GDPR.
Governance of the EUDI Wallet is a shared responsibility across multiple layers. The European Commission manages the legal framework and adopts implementing acts that contain legally binding requirements. EU Member States are responsible for providing or mandating wallet solutions, certifying and notifying them, and supervising actors within their jurisdiction. The European Digital Identity Cooperation Group supports cooperation and cross-border alignment between Member States. At the operational level, wallet providers, issuers of Person Identification Data and attestations, qualified trust service providers, and relying parties each carry distinct responsibilities within the framework. No single central European authority operationally manages all EUDI Wallets.
Wallets can be provided either directly by national governments or by private companies that have received official recognition. The European Commission has also published a reference implementation as open-source software. The Architecture and Reference Framework provides the technical elaboration of the requirements set out in the implementing acts, giving Member States and developers a common technical foundation to build on.
The first four Large Scale Pilots ran from April 2023 to 2025 and covered a wide range of real-world scenarios. The POTENTIAL consortium tested government services, bank account opening, SIM registration, mobile driving licences, remote qualified signatures, and e-prescriptions. The EWC consortium focused on Digital Travel Credentials, payments, and organisational digital identity. NOBID concentrated on payments, and DC4EU covered education and social security. A second wave of pilots started in 2025: WE BUILD focuses on business wallets and payments, and APTITUDE covers travel, ticketing, vehicle registration, and payments. Digital Travel Credentials have been piloted, but wallet use at border or airport controls is not yet an operational capability.
Which organisations are required to accept the EUDI Wallet?
eIDAS 2.0 creates two distinct acceptance obligations with different deadlines and scopes.
From 24 December 2026, public authorities across all Member States must accept notified EUDI Wallet solutions for online services that require electronic identification.
From 24 December 2027, Article 5f of the amended regulation applies to relevant regulated private sectors where strong user authentication is required by law or contract. The sectors covered include:
- Financial services, including banks and institutions offering account opening or regulated services
- Telecommunications providers requiring identity verification for SIM registration
- Healthcare providers handling prescriptions or patient records
- Transport and mobility services
- Educational institutions issuing or verifying credentials
- Energy suppliers
- Social security bodies
- Drinking water providers
- Postal services
- Digital infrastructure and digital services providers
Very large online platforms, known as VLOPs, fall under a separate provision of Article 5f. For VLOPs, the obligation applies where the platform requires user authentication, on voluntary request from the user and limited to the minimum necessary data. The condition requiring strong authentication by law or contract does not apply to VLOPs.
Micro and small enterprises are exempt from the private sector acceptance obligation. The exemption covers organisations with fewer than 50 employees and an annual turnover or balance sheet total of no more than 10 million euros.
For organisations in financial services and healthcare, this is particularly relevant because identity verification is already a regulatory requirement. eIDAS 2.0 does not replace those existing obligations but provides a standardised, interoperable method for fulfilling them. Sector-specific legislation remains in force alongside eIDAS 2.0, and relying parties must continue to meet any applicable national requirements within their own jurisdiction.
Before a relying party can request wallet data, it must register with the national authority of its Member State of establishment under CIR (EU) 2025/848, adopted on 6 May 2025. Registration is per intended use: the relying party specifies which attributes and attestations it will request, and the wallet checks each request against that registered scope. A relying party must be able to accept every relevant notified wallet solution, regardless of which provider issued it.
What are verifiable credentials and how do they relate to eIDAS 2.0?
Verifiable credentials are digital equivalents of physical documents or certificates, such as a driving licence, diploma, or proof of employment. They are cryptographically signed by the issuing authority, which means recipients can verify their authenticity. The holder stores them in their digital wallet and shares them when needed.
eIDAS 2.0 places attestations at the heart of how the EUDI Wallet operates. The regulation distinguishes between qualified electronic attribute attestations (QEAAs), issued by qualified trust service providers; public body electronic attribute attestations (PuB-EAAs), issued by or on behalf of public bodies; and non-qualified electronic attribute attestations (EAAs). When a citizen stores their national ID, professional qualification, or European Health Insurance Card in the wallet, these are issued as attestations by a trusted authority. The legal consequences of a given attestation may vary depending on applicable national or sector-specific rules in each Member State, so organisations operating across borders should verify the relevant requirements in each jurisdiction.
Verifying an attestation presented through the EUDI Wallet involves three separate checks. First, the relying party verifies the issuer’s signature against the relevant national trusted list, which forms part of the EU List of Trusted Lists. This check can be performed offline. Second, the relying party checks the revocation status using the status information provided by the issuer, which requires a connection to the issuer’s infrastructure. Third, the relying party validates the wallet unit attestation to confirm that the presenting wallet is running on a certified wallet solution. These three checks together provide a reliable basis for accepting an attestation, and it is not accurate to describe verification as a single cryptographic operation that requires no contact with any external party.
The credential formats prescribed by the Architecture and Reference Framework are mdoc, used with ISO/IEC 18013-5 for proximity presentation and ISO/IEC TS 18013-7 for online presentation, and SD-JWT VC. Issuance uses the OID4VCI protocol and presentation uses OID4VP. The High Assurance Interoperability Profile (HAIP) sets out the interoperability requirements that apply across these formats.
For organisations that need to comply with know-your-customer requirements or other identity-based regulations, accepting attestations through the EUDI Wallet can streamline compliance considerably. It is important to note that the reuse of KYC data is governed by AML legislation, not by eIDAS 2.0 itself, and organisations should verify the applicable rules in their jurisdiction.
When does eIDAS 2.0 come into force and what are the key deadlines?
Regulation (EU) 2024/1183 entered into force on 20 May 2024. The first five core implementing acts were adopted at the end of 2024, starting the relevant 24-month period. The key dates organisations should be aware of are:
- 20 May 2024: Regulation (EU) 2024/1183 entered into force, amending Regulation (EU) 910/2014.
- End of 2024: The first five core implementing acts were adopted. These contain legally binding requirements, with the Architecture and Reference Framework providing the technical elaboration of those requirements.
- 6 May 2025: CIR (EU) 2025/848 on registration of wallet relying parties was adopted.
- 24 December 2026: The legal deadline by which Member States must make wallet solutions available. Public authorities must accept notified wallets for online services requiring electronic identification. National wallet availability, certification status, and operational interoperability will vary by country at this point.
- 24 December 2027: The Article 5f private sector acceptance obligation applies. Organisations in scope must be capable of accepting the wallet for relevant services where strong user authentication is required by law or contract.
- Ongoing: Sectors with specific obligations will need to implement acceptance and integrate wallet-based flows into their digital services as national rollouts progress and cross-border interoperability matures.
These are legal deadlines, not predicted launch dates. Practical interoperability and national rollout are expected to develop in phases, and organisations should plan accordingly. For organisations that have not yet started preparing, neither deadline is a distant horizon. The technical and compliance groundwork takes time, and waiting until wallet adoption is widespread before beginning preparation is a risk most regulated organisations cannot afford.
How should organisations start preparing for eIDAS 2.0?
Preparing for eIDAS 2.0 starts with understanding whether and how your organisation falls within scope, then mapping the gap between your current identity infrastructure and what the regulation requires. Most organisations in regulated sectors will need to make meaningful changes to how they verify identities, manage credentials, and handle digital signatures.
A practical starting point involves three areas of focus. First, assess your current identity verification and onboarding processes to identify where wallet-based verification could or must replace existing methods. Second, review your compliance framework to understand how eIDAS 2.0 interacts with obligations you already have under the GDPR, AML legislation, KYC requirements, or sector-specific rules. Third, engage with your technology partners early to understand what integrations will be needed to accept and process EUDI Wallet attestations.
Organisations in government and highly regulated industries should monitor national implementation timelines closely, as the pace of wallet rollout, certification, and notification will vary by country. The status of individual national wallet programmes is time-sensitive and should be verified against current authoritative sources before making planning assumptions, since existing national eID systems and new EUDI Wallet solutions are distinct and should not be treated as equivalent without confirmation.
For more practical guidance and resources on navigating digital identity regulation, the TrustTech resource library is a useful starting point.
How TrustTech helps with eIDAS 2.0
eIDAS 2.0 changes how digital identity works across Europe, and organisations that prepare well will benefit from faster onboarding, less friction, and stronger trust with their customers and partners.
The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
For organisations in financial services, healthcare, pharma, and government, the ID Connector addresses the specific requirements that arise from eIDAS 2.0 alongside existing sector obligations. Practically, this means:
- Wallet acceptance covering every notified EUDI Wallet solution, regardless of the issuing Member State
- Verification against national trusted lists, revocation status checks, and wallet unit attestation validation as part of each transaction
- Monitoring of registered attribute scope to ensure requests stay within what the relying party has registered under CIR (EU) 2025/848
- Reuse of verified identity data to reduce the need for customers to re-verify across touchpoints
- Qualified signing via a connected qualified trust service provider
- Support for regulated sectors including financial services, government, healthcare, and pharmaceuticals
Get in touch with TrustTech to discuss where your organisation stands and what the next steps look like.