What is the EUDI Wallet and how does it work?

The EUDI Wallet, short for the European Digital Identity Wallet, is a secure mobile application that allows EU citizens, residents, and businesses to store, manage, and share verified identity data and digital documents. It is built on the legal foundation of eIDAS 2.0, Regulation (EU) 2024/1183, which amends Regulation (EU) 910/2014 and requires every Member State to offer a wallet to its citizens by 24 December 2026. This article walks through how the wallet works, what you can do with it, and what it means for your organisation.

How does the EUDI Wallet actually work?

The EUDI Wallet works by allowing users to receive verified digital attestations from trusted issuers, store them securely on their device, and share only the specific data a service requires. The wallet uses cryptographic technology to ensure that attestations are tamper-evident and that the user remains in full control of what is shared and with whom.

Think of it as a digital equivalent of your physical wallet, but significantly smarter. When you present your driving licence at a roadside check, you hand over the entire document. With the European Digital Identity Wallet, you can share only your age, your nationality, or your licence category, without revealing your home address or any other personal detail you did not explicitly choose to disclose.

This principle is called selective disclosure, and it is one of the core design features of the EU digital identity framework. It reduces the risk of personal profiling and gives users genuine control over their own data, something that physical documents cannot offer.

The wallet connects to a broader trust ecosystem involving multiple parties: the European Commission manages the legal framework and adopts implementing acts; Member States provide or mandate wallet solutions and supervise actors within their jurisdiction; the European Digital Identity Cooperation Group supports cross-border alignment; and national competent authorities, wallet providers, credential issuers, qualified trust service providers, and relying parties each carry distinct responsibilities. Attestations are issued by authorised parties, verified against national trusted lists that are brought together in the EU List of Trusted Lists (LOTL), and accepted by relying parties such as banks, government portals, and healthcare providers. The technical architecture is elaborated in the Architecture and Reference Framework (ARF), which was developed through the EU’s eIDAS Expert Group and refined through large-scale pilot programmes involving public and private entities across Member States. The implementing acts adopted by the European Commission contain the legally binding requirements; the ARF provides the technical elaboration of those requirements.

What can you store and share with the EUDI Wallet?

The EUDI Wallet is designed to hold a wide range of digital documents and attestations, covering both everyday and high-stakes interactions. Users can store government-issued identity documents, professional qualifications, healthcare records, and much more, all in one secure place.

The first four large-scale pilots ran from April 2023 to 2025 and tested the wallet across real-world use cases, giving a clear picture of its intended scope. Those pilots covered areas including:

1. Accessing government services such as filing taxes or applying for a passport
2. Opening a bank account without repeatedly submitting identity documents
3. Registering a SIM card with verified proof of identity
4. Storing and presenting a mobile driving licence, both online and at the roadside
5. Signing contracts digitally with a qualified electronic signature
6. Claiming prescriptions at pharmacies across EU Member States
7. Travelling by presenting digital travel credentials at border controls
8. Proving you are an authorised representative of an organisation
9. Verifying your identity when authorising online payments
10. Sharing educational credentials such as diplomas or degrees
11. Accessing social security benefits and documents like the European Health Insurance Card

This breadth makes the digital identity wallet genuinely useful across daily life. For businesses, it opens up new possibilities for streamlined onboarding, reduced fraud, and cross-border service delivery. It is worth noting that not every use case will be immediately available in every Member State from the outset, and national rollout may develop in phases depending on certification, notification, and the readiness of relying parties in each country. Digital travel credentials were tested in the pilots and are not yet operational at border or airport controls.

Who issues attestations to the EUDI Wallet?

Attestations in the EUDI Wallet are issued by authorised and trusted entities, which can include government bodies, financial institutions, educational institutions, healthcare providers, and other organisations that have been officially recognised within the EU trust framework.

The issuer model is central to how the wallet maintains trustworthiness. An attestation is only as reliable as the entity that issued it. For example, a national government issues your Person Identification Data, a university issues your degree certificate, and a healthcare authority issues your prescription record. Each of these issuers must meet the requirements set out in the implementing acts adopted under eIDAS 2.0 and be registered within the appropriate national or EU trust infrastructure.

Attestations fall into distinct categories: Qualified Electronic Attestations of Attributes (QEAA), issued by qualified trust service providers; Public Body-issued Electronic Attestations of Attributes (PuB-EAA), issued by or on behalf of public bodies; and non-qualified Electronic Attestations of Attributes (EAA), issued by other recognised parties. Member States themselves are legally required to act as issuers of foundational Person Identification Data. Private organisations can also become issuers of attestations, provided they meet the regulatory criteria and are recognised by the relevant national competent authority. Issuing attestations of attributes is itself a trust service, and not every private issuer is automatically placed on a national trusted list. This creates a layered ecosystem where both public authorities and vetted private parties contribute to the wallet’s attestation store, with each operating under the supervision of their respective national authority.

An issuer must make revocation status available where applicable and support re-issuance when a user moves to a new device, because private keys associated with Person Identification Data and attestations do not leave the secure cryptographic device. Attestations are therefore re-issued to the new device rather than copied across.

The open-source nature of the wallet’s reference implementation means that Member States and approved parties can build their own wallet applications and issuer services, all conforming to the same technical standards set out in the implementing acts. This promotes interoperability across borders while allowing flexibility in how individual countries carry out their national rollout. Organisations in financial services and other regulated sectors are already exploring how to become recognised attestation issuers within this framework.

Which organisations are required to accept the EUDI Wallet?

Under eIDAS 2.0, public sector bodies across all EU Member States are required to accept the EUDI Wallet for online services that require electronic identification, from 24 December 2026. For the private sector, a separate acceptance obligation applies from 24 December 2027 under Article 5f of the amended regulation.

This distinction is a significant shift from the original eIDAS framework, which focused primarily on public services. The updated regulation deliberately extends into the private sector, recognising that most digital interactions today happen with commercial platforms.

The private sector obligation under Article 5f applies to organisations in regulated sectors where strong user authentication is required by law or contract. This covers banking and financial services, healthcare, telecommunications, energy, transport, education, social security, drinking water, postal services, digital infrastructure, and digital services. Very Large Online Platforms (VLOPs) are covered by a separate provision within Article 5f: where a VLOP requires user authentication, it must accept the EUDI Wallet on the voluntary request of the user and for the minimum necessary data. Micro and small enterprises are exempt from the private sector obligation, meaning organisations with fewer than 50 employees and an annual turnover or balance sheet total of no more than 10 million euros.

Before requesting wallet data, a relying party must register with the national authority of its Member State of establishment under CIR (EU) 2025/848 of 6 May 2025. Registration is per intended use and covers which attributes and attestations will be requested. The wallet checks each request against the registered scope. A relying party must be capable of accepting every relevant notified wallet, regardless of which wallet provider issued it. A supplier that processes wallet data on behalf of a client does not thereby become the relying party: the registration obligation rests with the organisation that delivers the service to the end user.

For organisations in the public sector, the legal deadline is 24 December 2026. That date is a legal obligation, not a predicted launch date, and practical interoperability and national rollout are expected to develop in phases. For private sector organisations, the specific obligations depend on the nature of your services and the regulatory requirements that already apply to you. Either way, preparation should begin now.

How is the EUDI Wallet different from existing digital identity solutions?

The EUDI Wallet differs from existing digital identity solutions in three fundamental ways: it is standardised across the entire EU through common implementing acts and technical specifications, it gives users direct control over their data through selective disclosure, and it is legally mandated with binding acceptance obligations.

Most existing digital identity solutions are either national in scope, proprietary to a specific platform, or both. A bank’s digital onboarding process works for that bank. A national eID works within one country. A login via a social media platform trades convenience for data collection. None of these approaches offer the portability, privacy control, and cross-border recognition that the EUDI Wallet is designed to provide. It is also important to distinguish existing national digital identity systems from an EUDI Wallet: an existing national eID scheme is not automatically an EUDI Wallet, even where it provides strong authentication. A wallet must be certified and notified under the eIDAS 2.0 framework to carry that status.

The key differences can be summarised as follows:

• Cross-border recognition: A certified EUDI Wallet from one Member State is designed to be usable with appropriate relying parties in other Member States, though the availability of specific use cases cross-border will depend on national readiness and sector-specific rules
• Selective disclosure: Users share only what is necessary, rather than an entire document
• No platform dependency: Users can access services without relying on private platforms or social logins
• Regulatory backing: Acceptance is legally required for public bodies from 24 December 2026 and for relevant private sector organisations from 24 December 2027, giving the wallet genuine utility at scale
• Interoperability: Built on common technical standards set out in implementing acts, including credential formats mdoc and SD-JWT VC, allowing different certified wallet implementations to work together within the framework

This combination of privacy, portability, and legal enforceability makes the EUDI Wallet a fundamentally different proposition from anything currently available. It is a new layer of trust infrastructure for Europe’s digital economy.

What do businesses need to do to prepare for the EUDI Wallet?

Businesses need to assess their current identity processes, understand their obligations under eIDAS 2.0, and begin technical and organisational preparation to either accept wallet attestations, issue them, or both. The earlier this work starts, the smoother the transition will be.

Preparation is not a single task but a structured process. The following steps reflect the areas most organisations will need to address:

First, map your current identity touchpoints. Where do you verify who users are? Where do you issue documents or certificates that users might want in a wallet? These are the integration points that will need to change.

Second, understand your regulatory obligations. Depending on your sector and the services you provide, you may be required to accept the EUDI Wallet from 24 December 2026 if you are a public body, or from 24 December 2027 if you are a relevant private sector organisation under Article 5f. Compliance teams should review the eIDAS 2.0 requirements, the relevant implementing acts, and any sector-specific guidance that applies. Relying party registration under CIR (EU) 2025/848 must be completed with the national authority of your Member State of establishment before you can request wallet data, and you must register the specific attributes and attestations you intend to request.

Third, engage with the technical standards. The wallet is built on requirements set out in the implementing acts and elaborated in the Architecture and Reference Framework (ARF) developed by the EU’s eIDAS Expert Group. The ARF specifies credential formats including mdoc and SD-JWT VC, presentation protocols including OID4VP and ISO/IEC 18013-5 for proximity presentation, and issuance protocols including OID4VCI. Familiarity with these specifications is essential for any organisation involved in implementation.

Fourth, consider your role in the ecosystem. Will you be a relying party that accepts wallet attestations? An attestation issuer? Both? Each role comes with different technical and governance requirements, and each is subject to oversight by the relevant national competent authority. A relying party does not automatically require a qualified trust service provider for wallet acceptance; a QTSP becomes relevant where qualified signing or qualified attestations are involved.

Organisations in healthcare and other highly regulated sectors face additional complexity because they must align wallet integration with existing data protection and sector-specific compliance frameworks, including the requirement for a legal basis under Article 9(2) of the GDPR where health data is involved. Starting early allows time to address these layers without rushing.

How TrustTech helps with the EUDI Wallet

Preparing for the European Digital Identity Wallet involves navigating complex regulation, technical standards, and organisational change all at once. The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.

Here is what the ID Connector does in practice for organisations preparing for EUDI Wallet obligations:

• Wallet acceptance: The ID Connector enables relying parties to accept every notified EUDI Wallet, regardless of the issuing Member State or wallet provider
• Trust management and verification: The ID Connector verifies issuer signatures against national trusted lists brought together in the EU List of Trusted Lists, checks revocation status via issuer status information, and validates wallet unit attestations to confirm that the presenting wallet runs on a certified wallet solution
• Attribute scope management: The ID Connector checks each wallet presentation request against the attributes and attestations registered under CIR (EU) 2025/848, keeping your organisation within its registered scope
• Qualified signing: Where qualified electronic signatures are required, the ID Connector connects to an accredited QTSP for qualified signing within the wallet flow
• Reuse of verified identity data: Once a user has presented verified attestations, the ID Connector supports structured reuse of that data within the bounds of your registered intended use and applicable data protection obligations

The legal deadline for public bodies is 24 December 2026. The private sector obligation under Article 5f applies from 24 December 2027. National rollout and operational interoperability are expected to develop in phases, which means organisations that begin preparation now will be far better placed than those waiting for a single European go-live moment. The ID Connector is available for organisations in financial services, healthcare, pharma, and government. Get in touch with TrustTech to discuss how the ID Connector fits your organisation’s EUDI Wallet obligations.