What is the eIDAS 2.0 trust framework and how does it work?

The eIDAS 2.0 trust framework is the updated European legal and technical infrastructure that governs how digital identities and trust services are verified, issued, and accepted across EU member states. It amends the original eIDAS regulation, Regulation (EU) 910/2014, through Regulation (EU) 2024/1183, which entered into force on 20 May 2024. The framework significantly expands its scope to include the European Digital Identity Wallet, stronger rules for qualified trust service providers, and mandatory acceptance across a broader range of sectors. This article walks through the key questions organizations are asking as they prepare for what eIDAS 2.0 means in practice.

What components make up the eIDAS 2.0 trust framework?

The eIDAS 2.0 trust framework consists of three core components: electronic identification (eID), trust services, and the European Digital Identity Wallet (EUDI Wallet). Together, these elements define how identities are established, how digital transactions are authenticated, and how credentials are shared securely across borders and sectors within the EU.

Electronic identification covers the means by which individuals and organizations prove who they are in digital environments. Under eIDAS 2.0, every EU member state is required to provide a digital identity wallet to citizens, residents, and businesses, creating a common baseline that did not exist under the original regulation.

Trust services form the second pillar. These include qualified electronic signatures, seals, timestamps, registered delivery services, and website authentication certificates. Each service type has defined assurance levels and must be provided by recognized trust service providers operating under national supervision.

The EUDI Wallet is the third and newest component. It acts as a secure container where users can store verified identity attributes and digital documents, and selectively share only what is needed for a given interaction. The wallet is designed to work across both public and private sector services throughout the EU. Governance of the EUDI Wallet is a shared responsibility: the European Commission manages the legal framework and adopts implementing acts; member states provide or mandate wallet solutions, certify and notify them, and supervise actors within their jurisdiction; the European Digital Identity Cooperation Group supports cross-border alignment; and national competent authorities, wallet providers, issuers of Person Identification Data and attestations, qualified trust service providers, and relying parties each carry distinct roles within that structure.

How does eIDAS 2.0 differ from the original eIDAS regulation?

The original eIDAS regulation, Regulation (EU) 910/2014, established a framework for cross-border recognition of national electronic ID schemes and defined rules for trust services. eIDAS 2.0, formally adopted as Regulation (EU) 2024/1183 and in force since 20 May 2024, amends that regulation by making digital identity universally available, mandatory for key sectors, and accessible to both public and private service providers.

Several key differences stand out:

• Universal availability: Under the original eIDAS, member states could choose whether to create a national eID scheme. Under eIDAS 2.0, every member state must provide a digital identity wallet to any citizen, resident, or business that wants one.
• Private sector inclusion: The original regulation primarily targeted public sector services. eIDAS 2.0 extends obligations to large private sector platforms and services, including banks, telecoms, and health providers.
• User control: The EUDI Wallet introduces selective disclosure, meaning users can share only the specific attributes needed for a transaction rather than exposing an entire identity document.
• Interoperability: eIDAS 2.0 introduces a common Architecture and Reference Framework (ARF) to ensure wallets and credentials work consistently across all member states. The ARF provides the technical elaboration of requirements set out in legally binding implementing acts adopted by the European Commission.
• Expanded trust services: New categories of qualified trust services have been added, including electronic attestation of attributes, which allows verified professional or personal credentials to be stored and shared digitally.

The practical effect is that eIDAS 2.0 moves from a fragmented, opt-in model to a consistent, mandatory infrastructure for digital identity across Europe.

What role do qualified trust service providers play under eIDAS 2.0?

Qualified trust service providers (QTSPs) are the organizations authorized to issue and manage the highest-assurance digital trust services under the eIDAS framework. Under eIDAS 2.0, their role expands significantly because the regulation introduces new categories of qualified services, including the qualified electronic attestation of attributes (QEAA), which is central to how the EUDI Wallet functions.

QTSPs must be listed on a national trusted list maintained by a supervisory body in their member state. These national trusted lists are brought together in the EU List of Trusted Lists (LOTL). This listing signals to relying parties that the provider meets the strict technical and organizational requirements set out in the regulation. For organizations accepting digital signatures or verified credentials, working with a QTSP is relevant where a transaction requires qualified trust services under EU law, such as qualified electronic signatures or QEAAs.

Under eIDAS 2.0, QTSPs can issue qualified electronic attestations of attributes. These are machine-readable, tamper-evident credentials that confirm specific facts about a person or organization. This might include a professional qualification, an employment relationship, or a regulatory certification. These attestations can be stored in an EUDI Wallet and presented to any service that requests them. It is worth noting that not every relying party requires a QTSP: a QTSP becomes relevant specifically where qualified signing or qualified attestations are involved.

The regulation also distinguishes between QEAAs issued by QTSPs, public body attestations of attributes (PuB-EAA) issued by or on behalf of public bodies, and non-qualified electronic attestations of attributes. Each category carries different legal weight and governance requirements.

For organizations in regulated sectors such as financial services or healthcare, understanding which trust services they need to consume or provide is one of the most practical compliance questions raised by eIDAS 2.0.

How does the EUDI Wallet fit into the eIDAS 2.0 trust framework?

The EUDI Wallet is the central user-facing component of the eIDAS 2.0 trust framework. It is a secure mobile application that allows individuals to store verified identity attributes and digital documents, and share them selectively with public and private services across the EU.

The legal deadline for member states to make wallets available is 24 December 2026. This is the date by which member states must fulfil their wallet issuance obligations and by which public sector services that require electronic identification must accept notified wallets. It does not mean that every national wallet will have reached the same level of maturity on that date, or that every possible cross-border use case will be fully operational throughout Europe from that moment. Practical interoperability and national rollout are expected to develop in phases, and organizations should plan accordingly.

Within the trust framework, the wallet serves as the bridge between identity issuers and relying parties. An identity issuer, such as a government authority or a qualified trust service provider, places a verified credential into the wallet. A relying party can then request that credential and verify it against the relevant national trusted list, check its revocation status using the issuer’s status information, and confirm that the presenting wallet runs on a certified wallet solution by checking the wallet unit attestation. These are three distinct verification steps, and only the first can be performed fully offline.

The wallet also enforces privacy by design. Users control which attributes they share and with whom. If a service only needs to confirm that a user is over 18, the wallet can provide that confirmation through selective disclosure of the relevant attribute, without revealing the user’s full date of birth or any other personal data. Use of the wallet is voluntary: users approve each presentation request individually.

It is also important to understand the distinction between the wallet solution, the wallet instance, and the wallet unit. The wallet solution is the certified product of a wallet provider. The wallet instance is the application as installed on a single user’s device. The wallet unit is the wallet instance together with the Wallet Secure Cryptographic Application and the Wallet Secure Cryptographic Device in which the private keys are held. Private keys for Person Identification Data and attestations do not leave the secure element, so when a user moves to a new device, attestations must be reissued rather than simply copied.

Large-scale pilot programs tested the wallet across real-world scenarios. The first four Large Scale Pilots ran from April 2023 to 2025. The POTENTIAL consortium piloted government services, opening bank accounts, SIM registration, mobile driving licences, remote qualified signatures, and e-prescriptions. The EWC consortium focused on Digital Travel Credentials, payments, and organisational digital identity. NOBID concentrated on payments, and DC4EU covered education and social security credentials. A second wave of pilots started in 2025: WE BUILD focuses on business wallets and payments, and APTITUDE covers travel, ticketing, vehicle registration, and payments. The insights from these pilots are shaping the final technical specifications that will govern wallet deployment across Europe.

Which sectors are required to accept eIDAS 2.0 identity credentials?

Under eIDAS 2.0, mandatory acceptance obligations apply in two phases, with a clear distinction between public sector obligations and private sector obligations.

From 24 December 2026, public sector services that require electronic identification for online services must accept notified EUDI Wallet credentials.

From 24 December 2027, Article 5f of the amended regulation applies to private sector relying parties in regulated sectors where strong user authentication is required by law or contract. The sectors covered include banking and financial services, healthcare, telecommunications, energy, transport, education, social security, drinking water, postal services, digital infrastructure, and digital services. Micro and small enterprises are exempt: organizations with fewer than 50 employees and an annual turnover or balance sheet total of no more than 10 million euros fall outside this obligation.

Very large online platforms (VLOPs) subject to the Digital Services Act are covered by a separate provision within Article 5f. For VLOPs, the obligation applies where the platform requires user authentication, on the voluntary request of the user, and limited to the minimum necessary data. The condition relating to legally or contractually required strong authentication does not apply to VLOPs.

Before a relying party can request wallet data, it must register with the national authority of the member state where it is established, in accordance with CIR (EU) 2025/848 of 6 May 2025. Registration is per intended use: the relying party specifies which attributes and attestations it will request, and the wallet checks each request against that registered scope. A relying party must be able to accept every relevant notified wallet, regardless of which wallet provider issued it.

The sectors and service types subject to mandatory acceptance obligations include:

1. Public sector services: All government and public administration services that require identity verification for online services must accept EUDI Wallet credentials from 24 December 2026.
2. Banking and financial services: Banks and financial institutions carrying out customer onboarding, KYC checks, and account opening are required to accept wallet-based identity from 24 December 2027.
3. Telecommunications: Mobile operators registering SIM cards must accept digital identity credentials from 24 December 2027.
4. Healthcare: Health service providers accessing patient records or providing regulated services online are covered from 24 December 2027.
5. Very large online platforms: Platforms subject to the Digital Services Act with more than 45 million monthly users in the EU must accept EUDI Wallet authentication on the voluntary request of the user and for the minimum necessary data, under the separate VLOP provision of Article 5f.
6. Further regulated sectors: Energy, transport, education, social security, drinking water, postal services, digital infrastructure, and digital services are also within scope of the private sector obligation from 24 December 2027.

Cross-border use of EUDI Wallet credentials does not remove national registration requirements or sector-specific legal obligations. A certified wallet from one member state can be used with an appropriate relying party in another member state, but the legal consequences of a given credential may vary depending on national law and sector regulation. Organizations operating in government services or regulated industries should already be assessing their technical readiness.

How can organizations prepare for eIDAS 2.0 compliance?

Organizations can prepare for eIDAS 2.0 compliance by first understanding which obligations apply to them, then assessing gaps in their current identity and trust infrastructure, and finally building or integrating the technical capabilities needed to meet those requirements. Starting early matters because the regulatory timelines are firm and implementation takes time. National rollout and the maturation of cross-border interoperability will develop in phases, and early preparation reduces the risk of being caught short when the deadlines of 24 December 2026 and 24 December 2027 arrive.

A practical preparation approach involves several steps:

1. Map your obligations: Determine whether your organization is a relying party, a trust service provider, or both. Identify which services you offer that fall under mandatory acceptance requirements, and whether the public sector deadline of 24 December 2026 or the private sector deadline of 24 December 2027 applies to you.
2. Audit existing identity flows: Review how you currently verify identity, manage credentials, and handle electronic signatures. Identify where current processes rely on methods that will not meet eIDAS 2.0 assurance levels.
3. Assess interoperability: Check whether your systems can interact with EUDI Wallet credentials and qualified electronic attestations of attributes. This often involves reviewing your API infrastructure and authentication protocols. Cross-border interoperability will develop progressively, and not every use case will be available in every member state from day one.
4. Understand registration requirements: If your organization will request wallet data as a relying party, you must register with the national authority of your member state of establishment under CIR (EU) 2025/848 before doing so. Registration covers the specific attributes and attestations you intend to request.
5. Engage with qualified trust services where relevant: Identify whether you need to work with a QTSP for signature issuance, qualified credential attestation, or identity verification at the required assurance levels. A QTSP is not required for all wallet acceptance scenarios.
6. Follow the Architecture and Reference Framework: The ARF published by the European Commission provides the technical elaboration of requirements set out in legally binding implementing acts. Aligning your technical roadmap with the ARF reduces the risk of costly rework later.
7. Test early: Engage with pilot programs or sandbox environments where available to validate your integration before mandatory deadlines arrive.

A well-implemented digital identity infrastructure reduces onboarding friction, lowers verification costs, and enables reusable trust across every customer interaction. You can explore how this plays out in practice by reviewing customer examples from organizations already working with digital identity infrastructure.

How the ID Connector supports eIDAS 2.0 trust framework implementation

The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.

For organizations preparing for the mandatory acceptance deadlines under eIDAS 2.0, the ID Connector addresses several of the practical integration challenges directly. It handles wallet acceptance across notified wallet solutions, manages verification against national trusted lists brought together in the EU List of Trusted Lists, checks revocation status using issuer-provided status information, and validates wallet unit attestations to confirm that a presenting wallet runs on a certified wallet solution. It also enforces the registered attribute scope defined under CIR (EU) 2025/848, so that each wallet presentation request stays within the bounds of what the relying party has registered with its national authority.

For relying parties that require qualified signing, the ID Connector connects to a qualified trust service provider for that purpose. The connector does not itself issue qualified electronic signatures or attestations.

Organizations in financial services, healthcare, pharma, and government services are among those already working with this infrastructure to prepare for the deadlines ahead. If your organization is working through what eIDAS 2.0 means for your systems, processes, or compliance obligations, get in touch with TrustTech to discuss your situation and find out what the right next step looks like for your organization.