The ARF (Architecture and Reference Framework) is the central technical blueprint for the European Digital Identity Wallet ecosystem under eIDAS 2.0. It defines how EUDI Wallets must be built, how they communicate with other systems, and what standards all parties in the ecosystem need to follow. In short, it is the shared technical rulebook that makes interoperability across EU Member States possible. The ARF provides the technical elaboration of requirements that are made legally binding through implementing acts adopted by the European Commission.
For organisations preparing to issue credentials, accept wallet-based verification, or build wallet-compatible services, understanding the ARF is essential. It shapes every technical and compliance decision involved in EUDI Wallet implementation. The sections below walk through the most important questions surrounding the ARF and what it means in practice.
What does the ARF actually define for EUDI Wallet implementations?
The ARF defines the technical architecture, data formats, protocols, and trust mechanisms that all EUDI Wallet implementations must follow. It sets out how wallets store and present credentials, how relying parties verify them, and how the entire ecosystem maintains security and interoperability across borders and sectors.
Think of the ARF as the technical constitution of the EUDI Wallet ecosystem. Without it, each Member State could build a wallet that works perfectly within its own borders but cannot communicate with systems in other countries. The ARF prevents that fragmentation by establishing a common foundation.
In practical terms, the ARF covers:
- The data models used to represent identity attributes and credentials
- The communication protocols between wallets, issuers, and relying parties
- The trust model, including how national trusted lists and the EU List of Trusted Lists (LOTL) are structured
- Security requirements for wallet applications and backend systems
- Privacy-by-design principles, including selective disclosure and minimal data sharing
- The roles and responsibilities of each actor in the ecosystem
One of the most important concepts the ARF introduces is selective disclosure. Users can share only the specific attributes a service needs — for example, confirming they are over 18 without revealing their full date of birth. This is a fundamental shift from how traditional identity documents work and requires specific technical mechanisms that the ARF specifies in detail. Selective disclosure of a single attribute such as “age over 18” does not require zero-knowledge proofs; it can be achieved through the credential formats the ARF prescribes.
Who publishes and maintains the ARF?
The ARF is published and maintained by the European Commission, working closely with the eIDAS Expert Group. The document is developed collaboratively and made available as an open repository on GitHub, where Member States, technical experts, and other stakeholders can follow its development and contribute feedback.
This open development model is deliberate. The European Commission wanted the ARF to reflect real-world technical expertise from across the EU. The four original large-scale pilot projects ran from April 2023 to 2025 and have concluded. They involved a broad range of entities from across the EU and neighbouring countries and actively fed insights back into the ARF as they tested the wallet in real scenarios. A second wave of pilots started in 2025, including WE BUILD, which focuses on business wallets and payments, and APTITUDE, which covers travel, ticketing, vehicle registration, and payments.
Governance of the EUDI Wallet ecosystem is a shared responsibility distributed across several layers. The European Commission manages the legal framework and adopts implementing acts. Member States provide or mandate wallet solutions, certify and notify them, and supervise actors within their jurisdiction. The European Digital Identity Cooperation Group supports cross-border alignment and cooperation between Member States. National competent authorities and registrars handle certification and oversight at the national level. Wallet providers, issuers of Person Identification Data and attestations, qualified trust service providers, and relying parties each carry defined responsibilities within this structure. No single central European authority operationally manages all EUDI Wallets.
The eIDAS Expert Group plays a central coordinating role in ARF development. This group brings together representatives from Member States, technical bodies, and industry to review proposals, resolve ambiguities, and ensure the ARF remains technically sound and practically implementable. Updates go through a structured review process before they become part of the authoritative version.
What are the core components of the ARF?
The ARF is structured around several core components that together describe the complete EUDI Wallet ecosystem. These components cover the wallet itself, the parties that interact with it, the credentials it handles, and the trust infrastructure that underpins everything.
The main components are:
- The EUDI Wallet instance — the application running on a user’s device that stores credentials and manages identity interactions. Together with the Wallet Secure Cryptographic Application and the Wallet Secure Cryptographic Device in which keys are held, it forms the wallet unit.
- Wallet providers — the organisations (typically Member States or certified providers) responsible for issuing and maintaining wallet solutions
- Credential issuers — organisations that issue verifiable attestations into the wallet, such as government bodies issuing digital driving licences or employers issuing professional qualifications. Issuing attestations of attributes is itself a trust service under eIDAS 2.0, and a distinction applies between qualified electronic attestations of attributes (QEAA), public-body-issued EAA (PuB-EAA), and non-qualified EAA.
- Relying parties — organisations that request and verify credentials from wallets to grant access to services. Under CIR (EU) 2025/848, adopted on 6 May 2025, a relying party must register with the national authority of its Member State of establishment before it can request wallet data, specifying per intended use which attributes and attestations it will request.
- National trusted lists — authoritative lists, brought together in the EU List of Trusted Lists (LOTL), that confirm which issuers and other trust service providers are certified to participate in the ecosystem
- The common toolbox — the shared set of technical specifications, protocols, and reference implementations that all parties build on
Each component has defined interfaces and responsibilities. The ARF specifies exactly how these components interact, which standards apply at each interface, and what security requirements each party must meet. This level of detail is what allows a certified wallet issued in Finland to be used with an appropriate relying party in Spain, provided the relevant national and sector-specific requirements are met on both sides.
How does the ARF relate to other eIDAS 2.0 technical standards?
The ARF sits at the top of the eIDAS 2.0 technical standards hierarchy. It is the overarching framework that references and coordinates all the more specific standards beneath it. Individual technical specifications, such as those for credential formats, communication protocols, and cryptographic requirements, are defined separately but must align with what the ARF establishes.
For example, the ARF references ISO/IEC 18013-5 for proximity presentation of mobile driving licence formats and ISO/IEC TS 18013-7 for online presentation. It also draws on OpenID for Verifiable Credential Issuance (OID4VCI) and OpenID for Verifiable Presentations (OID4VP) as the protocols for credential issuance and exchange. The prescribed credential formats are mdoc and SD-JWT VC. The W3C Verifiable Credentials Data Model is not a prescribed EUDI Wallet credential format under the ARF. None of these standards are invented by the ARF, but the ARF defines how and where they apply within the EUDI Wallet ecosystem, including through the High Assurance Interoperability Profile (HAIP).
This relationship matters for organisations building wallet-compatible systems. Compliance with the ARF means compliance with a specific, curated set of underlying standards applied in a particular way. The implementation must fit within the broader architecture the ARF defines.
Which organisations need to comply with the ARF?
Any organisation that participates in the EUDI Wallet ecosystem must comply with the ARF. This includes wallet providers, credential issuers, and relying parties. The scope is broad: financial institutions, healthcare providers, government agencies, educational bodies, and any private sector organisation that wants to accept or issue wallet-based credentials.
Under eIDAS 2.0, which amends Regulation (EU) 910/2014, acceptance obligations are split across two deadlines. From 24 December 2026, public sector bodies must accept notified EUDI Wallets for online services that require electronic identification. From 24 December 2027, Article 5f of the amended regulation applies to relevant regulated private sectors where strong user authentication is required by law or contract. Those sectors include banking and financial services, healthcare, telecoms, energy, transport, education, social security, drinking water, postal services, digital infrastructure, and digital services. Very large online platforms (VLOPs) are covered by a separate provision of Article 5f: where a platform requires user authentication, it must accept the EUDI Wallet on the voluntary request of the user and for the minimum necessary data. Micro and small enterprises, defined as organisations with fewer than 50 employees and an annual turnover or balance sheet total not exceeding 10 million euros, are exempt.
Organisations in regulated sectors face the most immediate pressure. A bank that wants to use an EUDI Wallet for customer onboarding needs to register as a relying party under CIR (EU) 2025/848 with the relevant national authority, meet the ARF’s security requirements, and ensure its requests stay within the registered attribute scope. A hospital that wants to issue digital health credentials needs to become a certified attestation issuer under the applicable framework. It is worth noting that registration as a relying party is tied to the national framework of the Member State of establishment. Cross-border interoperability at the European level does not remove national registration requirements or sector-specific legal obligations.
How does the ARF change as eIDAS 2.0 moves toward full implementation?
The ARF is a living document that evolves as eIDAS 2.0 moves from regulation to full deployment. New versions are released as technical decisions are finalised, pilot feedback is incorporated, and implementing acts from the European Commission add further detail. Organisations should treat the ARF as an ongoing reference rather than a fixed specification. Before relying on a specific version, verify the current release number; if ARF v3.0.0 is the version in use, that should be confirmed explicitly.
The large-scale pilot projects were particularly important in driving ARF updates. When pilots uncovered gaps, ambiguities, or practical challenges in earlier versions, those findings fed directly into revisions. This iterative approach means the ARF has become progressively more concrete and implementation-ready over time.
Looking ahead, the ARF will continue to evolve as the Commission issues additional implementing acts and as the first wave of certified wallets enters the market. The legal deadline for Member States’ wallet obligations is 24 December 2026. This date is a legal milestone, not a predicted launch date, and it does not guarantee that every national wallet will reach the same level of maturity simultaneously or that every possible cross-border use case will be fully operational throughout Europe on that date. Practical interoperability and national rollout are expected to develop in phases. Organisations that have been tracking the ARF since earlier versions will find that the core architecture remains stable, but the level of detail around specific use cases, credential types, and security requirements continues to grow. Staying current with ARF releases is therefore an ongoing responsibility for any organisation building on the EUDI Wallet ecosystem.
How the ID Connector supports ARF compliance
The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
In the context of the ARF, the ID Connector addresses several of the technical requirements that organisations must meet when becoming a relying party. Verification under the ARF involves three distinct checks: validating the issuer’s signature against the relevant national trusted list within the LOTL; checking the revocation status of the attestation using the issuer’s status information; and validating the wallet unit attestation to confirm that the presenting wallet runs on a certified wallet solution. The ID Connector handles these checks as part of the verification flow, including revocation status checks and wallet unit attestation validation.
The ID Connector also helps relying parties manage their registered attribute scope under CIR (EU) 2025/848, so that data requests remain within the boundaries declared during national registration. For relying parties in financial services, healthcare, or government that need to accept EUDI Wallets before the 24 December 2026 deadline for public-facing services or prepare for the 24 December 2027 obligation for regulated private sectors, the ID Connector provides a single integration point that handles the ARF’s layered technical requirements. To find out how the ID Connector fits your organisation’s situation, get in touch with TrustTech.