eIDAS 2.0 and eIDAS 1.0 are both EU regulations for digital identity, but they differ significantly in scope, ambition, and who they apply to. The original regulation, Regulation (EU) 910/2014, has been in force since 2016 and focused mainly on cross-border recognition of national eID schemes for public services. eIDAS 2.0, Regulation (EU) 2024/1183, amends that framework and entered into force on 20 May 2024. It goes considerably further by introducing the European Digital Identity Wallet, extending obligations to regulated private sector services, and establishing a unified standard that every Member State must meet. This article walks through the key differences and what they mean for your organisation.
What changed when eIDAS 2.0 amended eIDAS 1.0?
eIDAS 1.0 created a legal framework for recognising national electronic identity schemes across EU borders, but it left Member States largely free to decide whether and how to participate. eIDAS 2.0 replaces that optional approach with binding obligations, a new wallet infrastructure, and a much broader scope that includes regulated private sector services for the first time.
Under eIDAS 1.0, the rules were straightforward but limited. Member States could notify their national eID schemes to the European Commission, and once notified, other Member States were required to accept them for access to public services. In practice, however, many countries did not notify their schemes, and those that did often had systems that worked quite differently from one another. The result was a patchwork of digital identity solutions with limited real-world cross-border use.
eIDAS 2.0 addresses this directly. Every Member State is now required to issue a European Digital Identity Wallet to citizens, residents, and businesses. The regulation also sets common technical standards, governance rules, and trust frameworks that apply across the entire EU. Governance under eIDAS 2.0 is a shared responsibility: the European Commission manages the legal framework and adopts implementing acts; Member States provide or mandate wallet solutions, certify and notify them, and supervise actors within their jurisdiction; and the European Digital Identity Cooperation Group supports cross-border alignment and cooperation between national competent authorities.
What does eIDAS 2.0 include that eIDAS 1.0 did not?
eIDAS 2.0 introduces several entirely new concepts that were absent from the original regulation. The most significant additions are the European Digital Identity Wallet, the framework for verifiable attestations known as Electronic Attestations of Attributes (EAAs), and mandatory acceptance obligations for public administrations and, from 24 December 2027, regulated private sector services.
Here are the key additions eIDAS 2.0 brings:
- European Digital Identity Wallet (EUDI Wallet): A government-backed digital wallet that allows users to store identity data, attestations, and documents in one secure app and share them with public and private services.
- Electronic Attestations of Attributes (EAAs): Attestations that can confirm specific attributes about a person, such as a professional qualification, a diploma, or a driving licence, without sharing unnecessary personal data.
- Qualified Electronic Attestations of Attributes (QEAAs): A higher-assurance category of EAAs issued by qualified trust service providers, carrying the same legal weight across all Member States.
- Public-body-issued EAAs (PuB-EAAs): Attestations issued by or on behalf of public bodies, forming a distinct category alongside QEAAs and non-qualified EAAs.
- Mandatory relying party obligations: Public administrations must accept the EUDI Wallet from 24 December 2026. Regulated private sector services fall under the acceptance obligation of Article 5f from 24 December 2027.
- Selective disclosure: Users can share only the specific attributes needed for a transaction, which significantly improves privacy protection.
- Expanded trust services: New categories of qualified trust services, including electronic ledgers and electronic archiving services, are introduced under eIDAS 2.0.
Together, these additions transform eIDAS from a narrow cross-border recognition framework into a comprehensive digital identity ecosystem for the entire EU.
How does the EUDI Wallet differ from eIDAS 1.0 identity schemes?
The EUDI Wallet is fundamentally different from the national eID schemes under eIDAS 1.0. Where eIDAS 1.0 schemes were country-specific systems that other Member States had to recognise, the EUDI Wallet is a single, standardised solution that works across the EU by design, is user-controlled, and can be used with both public and private services.
Under eIDAS 1.0, a national eID such as a government-issued digital identity card or mobile ID app was built around that country’s own infrastructure. If it was notified under eIDAS 1.0, it could be used to access public services in other Member States, but the user experience, the technical standards, and the data it could carry varied considerably. Private sector use was largely outside the scope of the regulation.
The EUDI Wallet takes a different approach. It establishes one common wallet format that every Member State must provide. The wallet can hold a wide range of attestations, from a government-issued personal identification data (PID) set to professional qualifications, health documents, and payment credentials. Users decide exactly what they share and with whom, and selective disclosure is built into the technical architecture itself. No single central European authority operationally manages all EUDI Wallets; each Member State is responsible for providing or mandating a certified wallet solution within its jurisdiction.
Another important distinction is reusability. With eIDAS 1.0, a user verified their identity once with a national scheme, but that verification rarely carried over to private sector interactions. With the EUDI Wallet, a verified identity can be reused across many services and organisations. The framework is designed so that a certified wallet from one Member State can be used with an appropriate relying party in another Member State, though sector-specific legislation and national registration requirements remain in place. This has real implications for onboarding, compliance, and user experience across industries. Organisations working in financial services or healthcare will feel this shift most directly.
Which organisations are affected by eIDAS 2.0 that were not under eIDAS 1.0?
eIDAS 2.0 significantly expands the range of organisations that have obligations under the regulation. While eIDAS 1.0 primarily affected public sector bodies and a small number of trust service providers, eIDAS 2.0 brings regulated private sector organisations and large online platforms firmly within scope.
The obligations apply in two phases. From 24 December 2026, public administrations offering online services that require electronic identification must accept notified EUDI Wallets at the appropriate assurance level. From 24 December 2027, the acceptance obligation under Article 5f applies to regulated private sector services where strong user authentication is required by law or contract. This includes service providers in the following sectors:
- Financial institutions such as banks and payment service providers, particularly those performing identity verification for account opening or strong customer authentication.
- Healthcare providers and pharmacies accessing or sharing health data, including across borders through the European Health Data Space.
- Telecommunications providers registering SIM cards, where identity verification is required by law.
- Energy, transport, and drinking water providers in regulated contexts where user authentication is required.
- Postal services, digital infrastructure, and digital services where strong authentication obligations apply.
- Education and social security bodies where identity verification forms part of service delivery.
Micro and small enterprises are exempt from the Article 5f obligation. The exemption covers organisations with fewer than 50 employees and an annual turnover or balance sheet total of no more than 10 million euros.
Very large online platforms (VLOPs) designated under the Digital Services Act fall under a separate provision of Article 5f. For VLOPs, the obligation applies where the platform requires user authentication, on the voluntary request of the user, and limited to the minimum necessary data. The condition of legally or contractually required strong authentication does not apply to VLOPs.
Any relying party that accepts the EUDI Wallet must register with the national authority of its Member State of establishment under CIR (EU) 2025/848, adopted on 6 May 2025, before requesting wallet data. Registration covers the intended use and specifies which attributes and attestations will be requested. The wallet checks each presentation request against that registered scope. A relying party must be able to accept every relevant notified wallet, regardless of which Member State issued it or which wallet provider supplied it.
Beyond mandatory relying parties, any organisation that handles identity verification, issues attestations, or provides trust services will need to assess how eIDAS 2.0 affects their processes. This includes businesses in government services, education, insurance, and any sector where verifying who someone is forms part of the customer or compliance journey.
When do organisations need to comply with eIDAS 2.0?
eIDAS 2.0 entered into force on 20 May 2024, but the compliance timeline is phased. The legal deadline for Member States to make the EUDI Wallet available to citizens and businesses is 24 December 2026. Public administrations must accept notified wallets for online services requiring electronic identification from that date. The acceptance obligation for regulated private sector services under Article 5f applies from 24 December 2027.
These are legal deadlines, not predicted launch dates. Practical interoperability and national rollout are likely to develop in phases, reflecting differences in certification, notification, and national implementation timelines. The first five core implementing acts were adopted by the end of 2024, starting the relevant 24-month periods. Further implementing acts covering wallet certification, cross-border identity matching, and qualified trust service standards are still being finalised.
In the lead-up to these deadlines, the EUDI Wallet moved from pilot to live deployment. The first four Large Scale Pilots ran from April 2023 to 2025 and are now complete. The POTENTIAL consortium tested government services, bank account opening, SIM registration, mobile driving licence, remote qualified signing, and e-prescriptions. The EWC consortium covered Digital Travel Credentials, payments, and organisational digital identity. NOBID focused on payments, and DC4EU addressed education and social security credentials. The lessons from those pilots shaped the technical specifications set out in the implementing acts. A second wave of pilots started in 2025: WE BUILD covers business wallets and payments, and APTITUDE covers travel, ticketing, vehicle registration, and payments.
For most organisations, the practical question is how much preparation is required to meet the applicable deadline. Integrating the EUDI Wallet into existing onboarding flows, updating compliance frameworks to reflect new trust service categories, and ensuring systems can handle verifiable attestations all take time. Organisations that have not yet started should treat 24 December 2026 and 24 December 2027 as active targets and begin assessing their readiness now.
eIDAS 2.0 compliance is an ongoing process. Staying current with the implementing acts as they are published is part of what compliance looks like in practice. Exploring the available resources on eIDAS 2.0 can help your team stay informed as the regulatory picture continues to develop.
How TrustTech supports EUDI Wallet acceptance
The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
For organisations preparing for the 24 December 2026 and 24 December 2027 deadlines, the ID Connector addresses the core technical requirements directly:
- Wallet acceptance across Member States: Accept every notified EUDI Wallet regardless of the issuing Member State or wallet provider, in line with the interoperability requirements of the regulation.
- Verification against trusted lists: Issuer signatures are verified against the relevant national trusted lists, which are consolidated in the EU List of Trusted Lists (LOTL), covering the full chain from PID to attestation.
- Revocation and wallet unit attestation checks: The Connector performs revocation status checks against issuer-provided status information and validates wallet unit attestations to confirm that the presenting wallet runs on a certified wallet solution.
- Registered attribute scope management: Presentation requests are kept within the scope registered under CIR (EU) 2025/848, so each request reflects only the attributes and attestations declared at registration.
- Reuse of verified identity data: Verified identity data from a wallet presentation can be reused across services, reducing repeated verification steps for returning users in financial services, healthcare, pharma, and government contexts.
- Qualified signing via a connected QTSP: The same integration supports qualified electronic signatures through a connected qualified trust service provider, for use cases where a legally binding signature is required.
If your organisation needs to be ready to accept the EUDI Wallet, get in touch with our team to discuss your situation and find out what the next steps look like for you.