eIDAS 2.0 and verifiable credentials are closely connected but they are not the same thing. eIDAS 2.0, formally Regulation (EU) 2024/1183, amends Regulation (EU) 910/2014 and defines the legal framework for digital identity and trust services across the EU. Verifiable credentials are a technical data format, defined by the W3C, that can be used to exchange identity and attribute data in a standardised, cryptographically secure way. Compliance with eIDAS 2.0 and adopting verifiable credentials require different actions from your organisation. The sections below answer the most common questions about how these two concepts relate.
What is eIDAS 2.0 and what does it actually regulate?
eIDAS 2.0 is Regulation (EU) 2024/1183, which amends the original eIDAS Regulation (EU) 910/2014. It establishes the legal rules for electronic identification and trust services across all EU Member States and significantly expands the scope of the original regulation. Where the original regulation focused mainly on cross-border recognition of national eID systems, eIDAS 2.0 introduces a universal right for EU citizens, residents, and businesses to access a European Digital Identity Wallet (EUDI Wallet).
In practice, eIDAS 2.0 regulates several important areas:
- The obligation for every EU Member State to provide a digital identity wallet to its citizens and residents
- The legal validity of electronic signatures, seals, and trust services across borders
- The conditions under which public and private services must accept the EUDI Wallet for identification
- The privacy and data minimisation principles that govern how identity data can be shared
- The recognition of qualified trust service providers (QTSPs) operating under EU law
What makes eIDAS 2.0 particularly significant for organisations is that it extends obligations into the private sector. From 24 December 2026, public bodies must accept notified wallets for online services that require electronic identification. From 24 December 2027, Article 5f applies to relevant regulated private sectors where strong user authentication is legally or contractually required. Those sectors include banking and financial services, healthcare, telecoms, energy, transport, education, social security, drinking water, postal services, digital infrastructure, and digital services. Very large online platforms (VLOPs) are subject to a separate provision under Article 5f: where a platform requires user authentication, it must accept the EUDI Wallet on the voluntary request of the user and for the minimum necessary data. Micro and small enterprises, defined as organisations with fewer than 50 employees and an annual turnover or balance sheet total of no more than 10 million euros, are exempt from the private acceptance obligation.
Governance under eIDAS 2.0 is a shared responsibility distributed across multiple actors. The European Commission manages the legal framework and adopts implementing acts that contain the legally binding requirements. EU Member States are responsible for providing or mandating wallet solutions, certifying and notifying them, and supervising actors within their jurisdiction. The European Digital Identity Cooperation Group supports cooperation and cross-border alignment. National competent authorities and registrars, wallet providers, issuers of Person Identification Data and attestations, qualified trust service providers, and relying parties each carry distinct responsibilities within this framework. No single central European authority operationally manages all EUDI Wallets.
What are verifiable credentials and who defines the standard?
Verifiable credentials are a standardised digital data format for expressing and exchanging trusted claims about a person, organisation, or object. The standard is defined by the World Wide Web Consortium (W3C), the same international body that maintains web standards like HTML. A verifiable credential works like a digital certificate: it contains a claim, is cryptographically signed by an issuer, and can be verified by any party. Whether verification can happen fully offline depends on the type of check being performed, as explained further below.
A typical verifiable credential contains three components:
- The claim: A statement about the subject, such as “this person holds a valid driving licence” or “this employee has completed safety training”
- The issuer signature: A cryptographic proof from the organisation that issued the credential, confirming its authenticity
- The holder binding: A link between the credential and the person or entity presenting it, preventing misuse by others
Because verifiable credentials are based on open standards, they are interoperable across different systems and platforms. Any organisation that understands the W3C standard can issue, hold, or verify them. This makes verifiable credentials a powerful building block for digital identity ecosystems, independent of any single vendor or government system.
What is the difference between a trust framework and a data format?
eIDAS 2.0 is a trust framework, while verifiable credentials are a data format. A trust framework defines the legal, governance, and policy rules that determine who can issue identity data, under what conditions, and with what legal effect. A data format defines the technical structure used to represent and exchange that data.
Consider this analogy. A trust framework is like the rules of the road: it defines who is allowed to drive, what a valid licence looks like legally, and who has the authority to issue one. A data format is like the physical layout of the licence card itself: the fields, the encoding, the machine-readable zone. You need both, but they are separate layers.
eIDAS 2.0 sets the governance layer. It determines which identity providers are trusted, what legal weight a digital signature carries, and what rights users have over their data. The legally binding requirements flow from the implementing acts adopted by the European Commission. Verifiable credentials operate at the technical layer. They provide a format that can carry identity claims in a way that is portable, privacy-preserving, and tamper-evident.
Organisations often discuss the two together, which can create confusion. A verifiable credential issued outside of eIDAS 2.0 has no automatic legal standing under EU law. An eIDAS 2.0-compliant identity interaction does not necessarily use the W3C verifiable credential format. The two can work together, but they are not the same.
Does the EUDI Wallet require verifiable credentials?
The EUDI Wallet is designed to store and present identity attributes and documents in a way that is interoperable across the EU. The technical specifications for the wallet are based on standards that overlap significantly with the W3C verifiable credentials model, but the EUDI Wallet architecture also incorporates additional formats, notably mdoc as defined in ISO/IEC 18013-5 for proximity presentation and ISO/IEC TS 18013-7 for online presentation, and the SD-JWT VC format (Selective Disclosure JWT Verifiable Credentials). Credentials are issued using OID4VCI and presented using OID4VP. The High Assurance Interoperability Profile (HAIP) defines the specific combination of these standards required for EUDI Wallet interoperability. W3C Verifiable Credentials are not a format prescribed by the Architecture and Reference Framework (ARF) for the EUDI Wallet.
The ARF, developed by the European Commission, provides the technical elaboration of the requirements set out in the implementing acts. It draws on core concepts shared with verifiable credentials: cryptographic proof, selective disclosure, holder binding, and issuer trust. The implementing acts are legally binding; the ARF contains the technical detail. In practice, many of the attestations that will live in the EUDI Wallet are technically and conceptually similar to W3C verifiable credentials, even where the precise format differs.
Attestations issued within the EUDI Wallet framework are distinguished by type. Qualified Electronic Attribute Attestations (QEAAs) are issued by QTSPs and carry the highest legal standing. Public Body Attribute Attestations (PuB-EAAs) are issued by or on behalf of public bodies. Non-qualified EAAs are issued by other parties and carry no automatic qualified status. PuB-EAAs are a distinct category and are not classified as non-qualified EAAs.
For organisations preparing for the EUDI Wallet, investing in verifiable credential infrastructure is a sound strategic move. The underlying technical skills, tooling, and integration patterns transfer directly.
When should organisations focus on eIDAS 2.0 compliance versus verifiable credential adoption?
These are not competing priorities. Most organisations will need to address both, but the urgency and sequence depend on their sector and use case.
eIDAS 2.0 compliance has a regulatory timeline that cannot be ignored. The legal deadline for Member States to make EUDI Wallets available to citizens is 24 December 2026. This is a legal obligation, not a predicted launch date, and it does not guarantee that every national wallet will reach the same level of maturity on that date, or that every possible cross-border use case will be fully operational throughout Europe at that moment. Certification, notification, and acceptance by relying parties are distinct steps, and practical interoperability across Member States is likely to develop in phases. Organisations should begin preparing now and track national rollout in their relevant markets.
For service providers in regulated private sectors, acceptance of the EUDI Wallet becomes mandatory under Article 5f from 24 December 2027, subject to the conditions described above. Compliance is not optional for those organisations once the applicable requirements take effect.
Before a relying party can request wallet data, it must register with the national authority of its Member State of establishment under CIR (EU) 2025/848, adopted on 6 May 2025. Registration is per intended use, specifying which attributes and attestations will be requested. The wallet checks each presentation request against the registered scope. A relying party is not required to choose a wallet provider; it must be able to accept every relevant notified wallet, regardless of which provider issued it. A relying party does not automatically need a QTSP for wallet acceptance. A QTSP becomes relevant in specific contexts, such as qualified signing or issuing qualified attestations.
Verifiable credential adoption is often driven by business value alongside regulatory obligation. Organisations that want to enable reusable onboarding, reduce repeated identity checks, or build interoperable data exchange with partners can benefit from verifiable credentials independently of the eIDAS 2.0 timeline.
A practical way to think about it: use eIDAS 2.0 as your compliance anchor and use verifiable credentials as the technical foundation that helps you get there and go further. Organisations in financial services, healthcare, and government often find that the same infrastructure that supports EUDI Wallet integration also addresses internal identity challenges around workforce credentials, consent management, and cross-organisation data sharing.
On the question of verification: checking an attestation involves three distinct steps. The first is verifying the issuer signature against the relevant national trusted list, which is part of the EU List of Trusted Lists (LOTL). This check can be performed fully offline. The second is checking the revocation status using the status information provided by the issuer, which requires a connection to that information. The third is checking the wallet unit attestation to confirm that the presenting wallet is running on a certified wallet solution. Only the first of these three checks can be fully offline. It is therefore not accurate to describe attestation verification as a single cryptographic check that requires no contact with any external system.
Cross-border interoperability under the EUDI Wallet framework operates at a specific level. A certified wallet from one Member State is designed to be usable with an appropriate relying party in another Member State. This does not mean that national registration requirements or sector-specific legislation disappear, that every attestation automatically carries the same legal consequence in every jurisdiction, or that a central European database holds everyone’s identity data. Which elements are interoperable at European level and which remain national or sector-specific will vary by use case.
How TrustTech supports eIDAS 2.0 and verifiable credential adoption
The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
For organisations working through the relationship between eIDAS 2.0 and verifiable credentials, the ID Connector addresses several of the practical steps involved:
- Accepting every relevant notified wallet, regardless of the issuing Member State or wallet provider
- Verifying issuer signatures against national trusted lists consolidated in the EU List of Trusted Lists
- Checking revocation status and validating wallet unit attestations as part of the verification process
- Enforcing the registered attribute scope per intended use, in line with CIR (EU) 2025/848
- Supporting reuse of verified identity data for onboarding, authentication, and signing workflows
- Connecting to a qualified trust service provider for qualified signing where required
TrustTech works with organisations in financial services, healthcare, pharma, and government. If your organisation is ready to take the next step, get in touch with TrustTech to discuss your specific situation and how to move forward.