The eIDAS 2.0 wallet ecosystem is governed through a shared responsibility structure involving the European Commission, EU Member States, the European Digital Identity Cooperation Group (EDICG), national competent authorities, and a range of private actors. The Commission sets the legal framework and adopts implementing acts. Member States provide or mandate wallet solutions, certify and notify them, and supervise actors within their jurisdiction. The EDICG supports cooperation and cross-border alignment. This article unpacks the key questions organisations ask when trying to understand how the ecosystem works and what it means for them.
Who is responsible for governing the eIDAS 2.0 wallet ecosystem?
Governance of the eIDAS 2.0 wallet ecosystem is a shared responsibility distributed across several distinct layers. The European Commission sets the overarching legal framework, adopts implementing and delegated acts, and maintains the Architecture and Reference Framework (ARF), which provides the technical elaboration of the requirements set out in those legally binding acts. Member States are responsible for providing or mandating a wallet solution for their citizens and businesses, certifying those solutions, notifying them to the Commission, and supervising actors within their jurisdiction. The European Digital Identity Cooperation Group (EDICG), formerly known as the eIDAS Expert Group, supports cooperation and cross-border alignment across the ecosystem.
The EDICG is responsible for exchanging best practices, advising the Commission on implementing and delegated acts, supporting national supervisory bodies, and helping develop the technical toolbox that underpins the entire ecosystem. No single central European authority operationally manages all EUDI Wallets. Instead, governance works through structured cooperation, with the Commission holding responsibility for the legal framework and Member States holding responsibility for execution within their jurisdiction.
National competent authorities and registrars oversee compliance within their jurisdiction, including the certification of wallet solutions and the registration of relying parties. This multi-level structure is intentional: it ensures accountability at both the European and national levels while keeping the ecosystem interoperable across borders.
What are the main components of the EUDI Wallet ecosystem?
The EUDI Wallet ecosystem consists of several interconnected components that work together to enable secure, cross-border digital identity. At its core are the wallet itself, the identity data it holds, the parties that issue that data, and the parties that accept it. Understanding how these fit together helps organisations identify where they sit in the ecosystem and what obligations apply to them.
The main components include:
- The EUDI Wallet application: A secure app provided by a Member State or a recognised private provider, allowing users to store and share their digital identity and attestations.
- Person Identification Data (PID): The core identity attributes issued by a Member State, such as name, date of birth, and nationality.
- Electronic Attestations of Attributes (EAA): Additional verified data, such as professional qualifications, diplomas, or driving licences, issued by authorised providers. These include Qualified Electronic Attestations of Attributes (QEAA), issued by Qualified Trust Service Providers (QTSPs), and Public Body Electronic Attestations of Attributes (PuB-EAA), issued by or on behalf of public bodies. Non-qualified EAAs form a separate category distinct from both.
- Relying Parties: Organisations that request and accept data from the wallet to deliver a service, such as a bank verifying identity or a government portal granting access. A relying party must register with the national authority of its Member State of establishment under CIR (EU) 2025/848 before requesting wallet data.
- Trust Service Providers: Organisations that issue certificates, signatures, and attestations that underpin the trust layer of the ecosystem.
- The Architecture and Reference Framework (ARF): The technical blueprint that elaborates on the legally binding requirements and defines how all components interact, ensuring interoperability across Member States. The ARF is a living document and is not itself legislation.
Together, these components create a system where users can share only the data they choose, with verified parties, in a way that is legally recognised across the EU.
What is the difference between a wallet provider and an attestation provider?
A wallet provider builds and operates the EUDI Wallet solution itself, the certified product in which users store and manage their digital identity through a wallet instance installed on their device. An attestation provider issues the verified data that goes inside the wallet. These are distinct roles, and in many cases they are held by different organisations.
Wallet providers can be governments or private companies, but they must be officially certified and notified under eIDAS 2.0, which amends Regulation (EU) 910/2014. Their responsibility is to ensure the wallet solution is secure, functional, and compliant with the technical specifications elaborated in the ARF and required by the implementing acts. They do not necessarily issue the data the wallet contains.
Attestation providers, on the other hand, are responsible for issuing specific attestations to users. A national government might issue Person Identification Data. A university might issue a diploma as a Qualified Electronic Attestation of Attributes. A healthcare authority might issue a prescription or professional licence as a PuB-EAA. Each of these is a separate attestation, issued by a different provider, all stored in the same wallet. An attestation provider must make revocation status available where applicable and support re-issuance when a user moves to a new device, since private keys do not leave the secure cryptographic device and attestations cannot simply be copied across.
This separation of roles is a deliberate design choice. It means the wallet itself remains a neutral, user-controlled container, while the trust and validity of each attestation depend on the issuing authority behind it, not on the wallet provider.
How does trust get established between parties in the ecosystem?
Trust in the eIDAS 2.0 ecosystem is established through a combination of certification, registration, and cryptographic verification. Every party in the ecosystem, wallet providers, attestation issuers, and relying parties, must be registered or certified under the framework before they can participate. This creates a verifiable chain of trust that does not rely on any single central authority.
When a user presents an attestation from their wallet to a relying party, the relying party performs several distinct checks. First, it verifies the issuer’s signature against the relevant national trusted list. Second, it checks the revocation status of the attestation using status information provided by the issuer. Third, it validates the wallet unit attestation to confirm that the presenting wallet instance runs on a certified wallet solution. Only the first of these checks can be performed fully offline. It is therefore not accurate to say that an attestation can be verified entirely without contact with the issuer or the wallet infrastructure.
National trusted lists, brought together in the EU List of Trusted Lists (LOTL), play a key role here. These lists publish which wallet providers, trust service providers, and attestation issuers are officially recognised within each jurisdiction. Relying parties check these lists to confirm they are dealing with a legitimate source before accepting any data. Where relevant, Lists of Trusted Entities (LoTE) may also apply alongside trusted lists.
For organisations operating in regulated sectors such as finance, healthcare, or government, this trust infrastructure is particularly valuable. Identity data received through the wallet carries a level of assurance that is legally recognised across the EU, reducing the need for repeated verification and supporting compliance with applicable regulations. Note that the extent to which verified identity data can be reused for KYC purposes is determined by AML legislation, not by eIDAS 2.0 itself. Organisations looking at how this applies to their sector can explore digital identity in financial services for more context.
Which organisations are required to accept the EUDI Wallet?
Under eIDAS 2.0, the obligation to accept the EUDI Wallet applies in two distinct phases and to different categories of organisations.
From 24 December 2026, public sector bodies that offer online services requiring electronic identification must accept notified EUDI Wallets. This deadline is a legal deadline under the regulation, not a predicted launch date.
From 24 December 2027, Article 5f of eIDAS 2.0 extends the obligation to certain regulated private sectors where strong user authentication is required by law or contract. The sectors covered include banking and financial services, healthcare, telecoms, energy, transport, education, social security, drinking water, postal services, digital infrastructure, and digital services. Micro and small enterprises are excluded from this obligation: organisations with fewer than 50 employees and an annual turnover or balance sheet total of no more than 10 million euros fall outside the scope.
Very Large Online Platforms (VLOPs) designated under the Digital Services Act are addressed by a separate provision within Article 5f. For VLOPs, the obligation applies where the platform requires user authentication, on the voluntary request of the user, and limited to the minimum necessary data. The condition relating to legally or contractually required strong authentication does not apply to VLOPs.
Any organisation that falls within the mandatory scope must register with the applicable national registration framework under CIR (EU) 2025/848, adopted on 6 May 2025, before requesting wallet data. Registration is per intended use: the relying party specifies which attributes and attestations it will request, and the wallet checks each request against that registered scope. A relying party does not choose a wallet provider. It must be able to accept every relevant notified wallet, regardless of which Member State issued it or which provider built it. Registration requirements remain connected to national frameworks and do not fall away simply because a credential originates from another Member State.
The large-scale pilots that ran from April 2023 to 2025 tested wallet acceptance across a range of real-world scenarios, including:
- Accessing digital government services such as tax filing and benefit applications, piloted under POTENTIAL
- Opening a bank account remotely without repeated document submission, piloted under POTENTIAL
- Registering a SIM card with verified identity, piloted under POTENTIAL
- Presenting Digital Travel Credentials, piloted under EWC
- Sharing educational qualifications with employers or institutions, piloted under DC4EU
- Authorising payments with verified identity, piloted under EWC and NOBID
These pilots involved organisations across Member States as well as Norway and Iceland, giving a clear picture of where wallet acceptance will become standard practice. A second wave of pilots started in 2025, with WE BUILD focusing on business wallets and payments, and APTITUDE covering travel, ticketing, vehicle registration, and payments. Organisations in government services and healthcare are among those with the strongest compliance drivers.
What rules define how the wallet ecosystem must operate?
The wallet ecosystem operates under a detailed set of legally binding rules defined through eIDAS 2.0, Regulation (EU) 2024/1183, which amends Regulation (EU) 910/2014, and a series of Commission Implementing Regulations that cover every major aspect of the framework. These implementing acts address everything from technical protocols to certification requirements and supervisory procedures. The ARF provides the technical elaboration of those requirements, translating legal obligations into specifications that wallet providers and service providers can build against. The ARF is a living document and is not itself legislation.
Key areas covered by these rules include:
- The formats and requirements for Person Identification Data and Electronic Attestations of Attributes, including QEAA, PuB-EAA, and non-qualified EAA
- Protocols and interfaces for how wallets communicate with relying parties and issuers, including OID4VCI for issuance and OID4VP for presentation
- Credential formats, specifically mdoc and SD-JWT VC, as defined in the ARF
- Certification requirements for wallet solutions and conformity assessment bodies
- Registration and obligations for wallet relying parties under CIR (EU) 2025/848
- Procedures for cross-border identity matching
- How security breaches must be reported and managed
- Standards for qualified electronic signatures, seals, timestamps, and registered delivery services
- Annual reporting requirements for supervisory bodies
The ARF is publicly available and open source, allowing Member States and private organisations to develop compliant implementations. It is updated as the ecosystem matures and as implementing acts are adopted, so organisations should treat it as a reference that evolves over time.
For organisations trying to navigate these rules in practice, the volume of implementing regulations can be substantial. The key is to identify which rules apply to your specific role in the ecosystem, whether you are a wallet provider, an attestation issuer, or a relying party, and to build your compliance roadmap around those obligations. Organisations can explore relevant resources on digital identity compliance to support that process.
How the ID Connector connects organisations to the EUDI Wallet ecosystem
The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
For organisations preparing to operate as relying parties in the EUDI Wallet ecosystem, the ID Connector addresses the practical challenges that the regulatory framework creates. A relying party must accept every relevant notified wallet, verify attestations against national trusted lists, check revocation status, validate wallet unit attestations, and stay within the attribute scope registered under CIR (EU) 2025/848. The ID Connector handles these checks as part of the integration, so organisations do not need to build and maintain that verification infrastructure independently.
Depending on the role an organisation plays in the ecosystem, the ID Connector supports:
- Wallet acceptance across Member States: Accept every notified EUDI Wallet regardless of the issuing Member State or wallet provider.
- Verification against national trusted lists and the LOTL: Confirm that each attestation originates from a recognised and certified source.
- Revocation status checking: Verify that an attestation has not been revoked at the time of presentation.
- Wallet unit attestation validation: Confirm that the presenting wallet instance runs on a certified wallet solution.
- Registered attribute scope management: Ensure that each data request stays within the scope registered with the national authority.
- Qualified signing via a connected QTSP: Support qualified electronic signatures for sectors such as financial services, healthcare, and government where legally binding signing is required.
Organisations in financial services, healthcare, pharma, and government are among those facing the earliest and most specific compliance requirements under eIDAS 2.0. To find out how the ID Connector fits your situation, get in touch with TrustTech.