eIDAS 2.0 and self-sovereign identity (SSI) are related but distinct concepts in the digital identity space. eIDAS 2.0 is a European regulatory framework that defines how identity is issued, verified, and recognised across EU Member States. SSI is a design philosophy that gives individuals direct control over their own identity data, independent of any central authority. The two share common values around user control and privacy, but they differ significantly in governance, legal standing, and implementation. This article walks through the key questions organisations ask when trying to understand how these two approaches relate and what that means in practice.
How do eIDAS 2.0 and self-sovereign identity actually relate to each other?
eIDAS 2.0 and self-sovereign identity are not the same thing, and they are not opposites either. eIDAS 2.0, established by Regulation (EU) 2024/1183 amending Regulation (EU) 910/2014, creates a legal and technical framework for digital identity across Europe. SSI is an architectural and philosophical approach to identity that prioritises individual control and decentralisation. The two overlap in their shared emphasis on user-controlled data and privacy, but eIDAS 2.0 operates within a state-governed trust model while SSI traditionally envisions a world without central authorities.
In practical terms, eIDAS 2.0 draws on SSI-influenced concepts, particularly the use of verifiable credentials and decentralised identifiers. This means organisations building for eIDAS 2.0 compliance will encounter technology that has roots in the SSI movement. Understanding SSI therefore gives teams a useful conceptual foundation for understanding what eIDAS 2.0 is trying to achieve technically, even if the regulatory and governance layers look quite different.
What are the core principles of self-sovereign identity?
Self-sovereign identity is a model of digital identity in which individuals hold and control their own identity data without relying on a central issuer or intermediary to authenticate them. Instead of storing identity information in a centralised database owned by a government, bank, or platform, SSI enables users to carry cryptographically signed credentials in a personal wallet and present them directly to any party that needs to verify them.
The SSI model is typically built around three core principles:
- User control: Individuals decide what information they share, with whom, and when. No third party can share or revoke that data without the user’s knowledge.
- Verifiable credentials: Identity claims are issued as cryptographically signed digital documents that any relying party can verify by checking the issuer’s signature against a trusted list, confirming the credential’s revocation status, and validating the wallet unit attestation of the presenting wallet.
- Decentralisation: Trust is established through open standards and distributed registries, rather than through a single trusted authority.
These principles emerged partly as a response to the privacy risks and power imbalances built into traditional centralised identity systems, where users have little visibility into how their data is used or shared.
Where does eIDAS 2.0 align with SSI principles, and where does it diverge?
eIDAS 2.0 aligns with SSI principles in three important ways: it requires user-controlled wallets, it uses tamper-evident credential formats as the technical format for identity data, and it enforces selective disclosure so users share only what is necessary. These are all hallmarks of SSI thinking applied at a regulatory scale.
However, eIDAS 2.0 diverges from pure SSI in one fundamental respect: governance. In the SSI model, trust is established through open, decentralised systems where no single entity holds authority. Under eIDAS 2.0, trust is rooted in a layered governance structure. The European Commission sets the legal framework and adopts implementing acts that contain binding requirements. Member States are legally obligated to provide or mandate wallet solutions, certify and notify them, and supervise actors within their jurisdiction. National competent authorities, wallet providers, issuers of Person Identification Data and attestations, qualified trust service providers, and relying parties each carry defined responsibilities within this structure. The European Digital Identity Cooperation Group supports cross-border alignment and cooperation across Member States. This creates a governed trust hierarchy that SSI purists would argue contradicts the decentralisation principle at the heart of the movement.
It is also worth noting that the Architecture and Reference Framework provides the technical elaboration of eIDAS 2.0 requirements but is not itself legislation. The legally binding requirements are contained in the implementing acts adopted by the European Commission.
In short, eIDAS 2.0 borrows the technology and user experience of SSI but places it within a regulated, government-anchored trust framework. For organisations operating in regulated industries, this is actually a feature rather than a limitation, since it provides the legal certainty that pure SSI systems currently lack.
Does the EUDI Wallet use self-sovereign identity technology?
The European Digital Identity Wallet uses technology closely associated with the SSI movement, most notably selective disclosure mechanisms and credential formats such as mdoc and SD-JWT VC. Users can store identity attributes and documents in their wallet, present only the specific data a service requires, and do so without the receiving party needing to contact the original issuer for the issuer signature check. That said, a complete verification involves three distinct steps: checking the issuer’s signature against the relevant national trusted list, confirming the credential’s revocation status using the issuer’s status information, and validating the wallet unit attestation to confirm that the presenting wallet runs on a certified wallet solution. Only the first of these can be performed fully offline.
The EUDI Wallet is not a pure SSI implementation. The wallet ecosystem is governed through a shared responsibility model. Member States are obligated to provide or mandate wallet solutions for their citizens, residents, and businesses, and to certify and notify those solutions. Credentials are issued by officially recognised authorities, including issuers of Person Identification Data and qualified trust service providers, rather than by any entity a user chooses to trust. Governance is distributed across the European Commission, Member States, national competent authorities, and the other actors defined in the regulatory framework, with national trusted lists brought together in the EU List of Trusted Lists. The trust model is therefore hybrid: SSI-style technology operating within a structured, multi-actor governance infrastructure.
The four large-scale pilot programmes that ran from April 2023 to 2025 tested this hybrid model in real-world scenarios. The POTENTIAL consortium covered government services, opening bank accounts, SIM registration, mobile driving licences, remote qualified signatures, and e-prescriptions. EWC focused on Digital Travel Credentials, payments, and organisational digital identity. NOBID concentrated on payments, and DC4EU addressed education and social security. A second wave of pilots started in 2025, with WE BUILD covering business wallets and payments, and APTITUDE addressing travel, ticketing, vehicle registration, and payments. The insights gathered from these programmes are helping refine the architecture so that the wallet works securely and interoperably across all Member States.
Which approach should organisations implement: eIDAS 2.0 or SSI?
For most organisations operating in Europe, eIDAS 2.0 is a compliance requirement. If your organisation serves EU citizens or operates within the EU, you will need to accept EUDI Wallets and recognise eIDAS-compliant credentials as a legal obligation. The question is not whether to implement eIDAS 2.0, but how to do it effectively.
The compliance timeline has two distinct stages. From 24 December 2026, public sector bodies must accept notified wallets for online services that require electronic identification. From 24 December 2027, the obligation under Article 5f extends to relevant regulated private sectors where strong user authentication is legally or contractually required, including banking and financial services, healthcare, telecoms, energy, transport, education, social security, drinking water, postal services, digital infrastructure, and digital services. Very large online platforms are covered by a separate provision of Article 5f: where a platform requires user authentication, it must accept EUDI Wallets on the voluntary request of the user and for the minimum necessary data. Micro and small enterprises, defined as organisations with fewer than 50 employees and an annual turnover or balance sheet total of no more than ten million euros, are exempt.
SSI as a standalone approach remains more relevant for organisations exploring identity solutions beyond the EU regulatory context, or for those building systems where no government-backed trust anchor exists. It is also relevant as a design philosophy that can inform how you build internal identity infrastructure, even when the external-facing layer must comply with eIDAS 2.0.
The practical recommendation for most organisations is to build eIDAS 2.0 readiness as the foundation, while designing systems in a way that is compatible with SSI principles. This means adopting open standards, designing for selective disclosure from the start, and avoiding proprietary identity architectures that will create migration costs later. Organisations in financial services and government services in particular should treat the period leading up to the 24 December 2026 legal deadline as the time to move from planning to implementation, while recognising that practical interoperability and national rollout across Member States may develop in phases beyond that date.
How does understanding SSI help organisations prepare for eIDAS 2.0?
Understanding SSI helps organisations prepare for eIDAS 2.0 because the two share the same underlying technical vocabulary. Teams that are familiar with credential formats such as mdoc and SD-JWT VC, with protocols such as OID4VCI for issuance and OID4VP for presentation, and with selective disclosure will find it significantly easier to evaluate eIDAS 2.0 tooling, ask the right questions of vendors, and make sound architectural decisions.
Beyond the technical layer, SSI thinking encourages a user-centric mindset that is directly applicable to eIDAS 2.0 compliance. Regulations such as eIDAS 2.0 and the GDPR both require organisations to give users meaningful control over their data. Organisations that have already internalised this principle, rather than treating it as a compliance checkbox, will build better products and face fewer integration challenges when wallet-based identity becomes the norm.
There is also a strategic benefit. SSI has been evolving as a field for over a decade, and the standards it has produced are now reflected in the eIDAS 2.0 technical architecture, as elaborated in the Architecture and Reference Framework. Organisations that engage with these standards now, rather than waiting for regulatory deadlines, will be better positioned to build reusable identity infrastructure that works across multiple regulatory contexts.
For organisations in healthcare and life sciences, this is especially relevant. Identity verification in those sectors must satisfy multiple overlapping regulatory requirements, and an SSI-informed approach to eIDAS 2.0 implementation provides a flexible foundation that can adapt as regulations evolve.
- Start with the standards: Familiarise your team with the credential formats and protocols mandated in the eIDAS 2.0 implementing acts and elaborated in the Architecture and Reference Framework, including mdoc, SD-JWT VC, OID4VCI, and OID4VP.
- Audit your current identity flows: Identify where users currently verify themselves and where those flows will need to accept wallet-based credentials.
- Design for selective disclosure: Build systems that request only the minimum necessary data, both as a privacy best practice and as a compliance requirement.
- Follow the pilot outcomes: Review the findings from the large-scale pilot programmes to understand real-world implementation lessons before you build.
- Plan for interoperability: Ensure your identity infrastructure can interact with wallets and credentials from multiple Member States, and account for the fact that cross-border use cases and national rollout may mature at different rates across the EU.
How TrustTech supports eIDAS 2.0 and self-sovereign identity readiness
The intersection of eIDAS 2.0 compliance and SSI-based identity architecture raises concrete technical and operational questions, particularly for organisations in regulated sectors. TrustTech addresses these through the ID Connector.
The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
For organisations working through eIDAS 2.0 readiness, the ID Connector handles:
- Wallet acceptance and trust management: verification of issuer signatures against national trusted lists brought together in the EU List of Trusted Lists, revocation status checks, and validation of wallet unit attestations to confirm that a presenting wallet runs on a certified wallet solution
- Registered attribute scope enforcement: ensuring that data requests stay within the scope registered with the national authority under CIR (EU) 2025/848
- Reuse of verified identity data: so that users present credentials once and those credentials are accepted across subsequent interactions without repeated verification steps
- Qualified signing: connected to a qualified trust service provider for transactions that require a qualified electronic signature
This applies across financial services, healthcare, pharma, and government, where the 24 December 2026 and 24 December 2027 deadlines each carry distinct compliance obligations. Explore our identity solutions or get in touch to discuss what eIDAS 2.0 acceptance means for your organisation specifically.