eIDAS 2.0 and FIDO2 are not the same thing, and they are not competitors. eIDAS 2.0 is a European regulatory framework, established by Regulation (EU) 2024/1183, which amends Regulation (EU) 910/2014 and defines how digital identity must be managed, verified, and trusted across the EU. FIDO2 is an open authentication standard that defines how users can log in securely without passwords. The two operate at different layers of the identity stack, which means they can, and often should, work together. This article walks through the key differences, the gaps each one fills, and what that means for your organization in practice.
Can eIDAS 2.0 and FIDO2 be used together?
Yes, eIDAS 2.0 and FIDO2 can be used together, and in many real-world deployments they complement each other well. eIDAS 2.0 defines the regulatory requirements for identity assurance and trust, while FIDO2 provides a strong, user-friendly authentication mechanism that can operate within that framework. Using them together means combining regulatory compliance with a smooth, passwordless login experience.
eIDAS 2.0 sets the rules for who someone is and how that identity must be verified and trusted. FIDO2 addresses how that person authenticates when accessing a service. These are related but distinct problems. A user might have their identity verified and stored in an EUDI Wallet under eIDAS 2.0, and then use a FIDO2-based authenticator to unlock and present that wallet credential to a service provider.
In practice, organizations building compliant digital identity flows increasingly look at FIDO2 as the authentication layer that sits beneath or alongside an eIDAS 2.0-compliant identity process. The two standards do not conflict. They each solve a different piece of the puzzle, and combining them can result in a system that is both legally compliant and genuinely easy to use.
What problems does eIDAS 2.0 solve that FIDO2 does not?
eIDAS 2.0 solves regulatory, legal, and cross-border identity recognition problems that FIDO2 was never designed to address. Where FIDO2 focuses on the authentication event itself, eIDAS 2.0 governs the entire identity lifecycle: how identity data is verified, what level of assurance it carries, how it can be shared across borders, and what legal weight it holds in different contexts.
Specifically, eIDAS 2.0 introduces capabilities and obligations that go well beyond authentication:
- Legal recognition across EU Member States: An identity verified under eIDAS 2.0 must be accepted by public sector services across the EU for online services requiring electronic identification. Private sector acceptance obligations apply from 24 December 2027 for relevant regulated sectors. FIDO2 has no such legal standing.
- Verifiable credentials and the EUDI Wallet: eIDAS 2.0 introduces the European Digital Identity Wallet, which allows citizens to store and selectively share verified attributes such as diplomas, driving licences, or professional qualifications. The legal framework is set through implementing acts adopted by the European Commission, while Member States are responsible for providing or mandating wallet solutions, certifying them, and notifying them to the Commission. Wallet providers, issuers of Person Identification Data and attestations, qualified trust service providers, and relying parties each carry distinct responsibilities within this shared governance structure.
- Qualified trust services: eIDAS 2.0 governs qualified electronic signatures, qualified certificates, and other trust services that carry legal equivalence to handwritten signatures or certified documents.
- Data minimization and selective disclosure: The EUDI Wallet framework requires that users can share only the specific attributes a service needs, without exposing unnecessary personal information.
- Obligations for large online platforms and regulated sectors: Under eIDAS 2.0, certain services are required to accept EUDI Wallet credentials. Very Large Online Platforms are subject to a specific provision under Article 5f, where the obligation applies when the platform requires user authentication, on voluntary request from the user and for the minimum necessary data. FIDO2 imposes no such obligations on relying parties.
For organizations in regulated sectors like financial services or healthcare, these regulatory dimensions are not optional. FIDO2 alone cannot satisfy eIDAS 2.0 compliance requirements because it does not address the legal recognition of identity, the assurance of the underlying identity proofing process, or the portability of verified credentials.
What does FIDO2 cover that falls outside eIDAS 2.0?
FIDO2 covers the technical mechanics of strong, passwordless authentication in a way that eIDAS 2.0 does not specify. eIDAS 2.0 defines what outcomes must be achieved in terms of identity assurance, but it largely leaves the choice of authentication technology open. FIDO2 fills that gap with a concrete, widely supported, and device-bound authentication protocol.
FIDO2 is built on two core components: the WebAuthn standard and the CTAP protocol. Together, they allow users to authenticate using biometrics, hardware security keys, or device PINs, without transmitting passwords or shared secrets across a network. This makes FIDO2 highly resistant to phishing, credential stuffing, and man-in-the-middle attacks.
Key areas where FIDO2 adds value beyond what eIDAS 2.0 prescribes include:
- Passwordless login for consumer and enterprise applications: FIDO2 enables a smooth, secure login experience that works across browsers and operating systems without requiring a regulatory framework to back it.
- Device-bound credential security: Private keys never leave the user’s device, which significantly reduces the attack surface compared to traditional authentication methods.
- Global applicability: FIDO2 is not limited to the EU or to regulated sectors. It is used by organizations worldwide, across industries, regardless of whether eIDAS applies to them.
- Rapid deployment: FIDO2 can be implemented relatively quickly using existing standards and broad platform support, without the need to integrate into a national identity scheme or trust framework.
For organizations that need strong authentication but are not yet subject to eIDAS 2.0 obligations, FIDO2 provides a practical and proven solution. It is also a strong candidate as the authentication mechanism inside eIDAS 2.0-compliant flows, particularly for unlocking EUDI Wallet credentials on a mobile device.
Which assurance levels apply to eIDAS 2.0 and FIDO2?
eIDAS 2.0 defines three formal levels of assurance: Low, Substantial, and High. These levels describe how confident a relying party can be that a person’s identity has been correctly verified and that the authentication event is genuine. FIDO2 does not define its own assurance levels, but depending on how it is implemented, it can support authentication at the Substantial or High level within an eIDAS-compliant system.
Under eIDAS 2.0, the assurance level is determined by the full identity proofing and authentication process, not just the authentication mechanism in isolation. This means that a FIDO2 authenticator used in combination with a properly verified identity and a compliant wallet could contribute to a High assurance level claim, provided the underlying identity proofing meets the required standard.
It is important to understand that FIDO2 on its own does not guarantee any particular eIDAS assurance level. A FIDO2 login backed by a weak or unverified identity is not equivalent to a High assurance identity claim. The assurance level depends on the strength of the initial identity verification, the binding between the credential and the verified identity, and the security of the authentication process as a whole.
For organizations in government services or other sectors where High assurance is required by law, this distinction matters significantly. Choosing FIDO2 as an authentication layer is a sound technical decision, but it must be paired with a compliant identity proofing process to meet eIDAS 2.0 assurance requirements.
Which framework should organizations prioritize in 2025 and beyond?
Organizations operating in the EU should prioritize eIDAS 2.0 compliance as their primary strategic framework, while treating FIDO2 as a valuable and complementary authentication technology. eIDAS 2.0 is a legal obligation for many organizations, while FIDO2 is a technical choice. Regulatory requirements set the floor; authentication standards help you build on top of it.
The legal deadline for Member States to make EUDI Wallets available is 24 December 2026. By that date, public sector bodies must be able to accept notified wallet solutions for online services requiring electronic identification. From 24 December 2027, Article 5f of eIDAS 2.0 extends acceptance obligations to relevant regulated private sectors, including financial services, healthcare, telecoms, energy, transport, education, social security, drinking water, postal services, digital infrastructure, and digital services, where strong user authentication is required by law or contract. Micro and small enterprises, defined as organizations with fewer than 50 employees and an annual turnover or balance sheet total not exceeding 10 million euros, are exempt from the private sector obligation.
These are legal deadlines, not predicted launch dates. Practical interoperability and national rollout are likely to develop in phases, and organizations should plan accordingly.
The direction of travel is clear, and organizations in regulated sectors are increasingly expected to be ready to accept and process wallet-based credentials. Organizations that delay risk falling behind on onboarding efficiency, cross-border service delivery, and customer trust.
Before a relying party can request wallet data, it must register with the national authority of its Member State of establishment under CIR (EU) 2025/848, adopted on 6 May 2025. Registration specifies per intended use which attributes and attestations may be requested. The wallet validates each presentation request against this registered scope.
FIDO2 remains highly relevant as a practical implementation choice. As organizations build or update their authentication infrastructure, adopting FIDO2 aligns well with the security expectations embedded in eIDAS 2.0 and positions them to support wallet-based authentication flows as those become more common.
A sensible approach for most organizations is to:
- Map your current identity and authentication processes against eIDAS 2.0 requirements
- Identify where FIDO2 can replace weaker authentication methods and improve user experience
- Plan for EUDI Wallet integration in customer-facing flows, especially for onboarding and verification, keeping in mind that the public sector deadline is 24 December 2026 and the private sector obligation under Article 5f applies from 24 December 2027
- Complete relying party registration under CIR (EU) 2025/848 before requesting wallet data
- Work with partners who understand both the regulatory and technical dimensions of digital identity
The two frameworks are not in competition. Organizations that understand how eIDAS 2.0 and FIDO2 fit together will be better placed to build identity infrastructure that is both compliant and genuinely user-friendly. For practical guidance on how to approach this, it helps to start with a clear picture of your current state and what each regulation requires for your specific sector.
How TrustTech supports eIDAS 2.0 and FIDO2 alignment
For organizations building eIDAS 2.0-compliant identity infrastructure, the ID Connector is a concrete starting point. The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
In the context of eIDAS 2.0 and FIDO2 alignment, the ID Connector handles several of the technical layers that sit between a relying party and a wallet-based authentication flow:
- Wallet acceptance across certified solutions: The ID Connector lets relying parties accept every notified EUDI Wallet, regardless of which Member State issued it or which wallet provider the user has chosen.
- Verification against national trusted lists: The ID Connector validates issuer signatures against the relevant national trusted lists, which are aggregated in the EU List of Trusted Lists (LOTL).
- Revocation status checks: The ID Connector performs revocation checks using the status information provided by the issuer, which requires a live connection and cannot be done fully offline.
- Wallet unit attestation validation: The ID Connector verifies that the presenting wallet instance is running on a certified wallet solution, using the wallet unit attestation.
- Registered attribute scope enforcement: The ID Connector ensures that each presentation request stays within the scope registered by the relying party under CIR (EU) 2025/848.
- Qualified signing via a connected QTSP: For flows that require a qualified electronic signature, the ID Connector connects to a qualified trust service provider. TrustTech does not itself issue qualified electronic signatures.
The ID Connector is relevant for organizations in financial services, healthcare, pharma, and government that need to meet the acceptance obligations under eIDAS 2.0 while maintaining a strong authentication layer. Ready to take the next step? Contact TrustTech to discuss how the ID Connector fits your organization’s identity infrastructure.