The EUDI Wallet regulation is legally grounded in Regulation (EU) 2024/1183, which amends the original eIDAS Regulation (EU) No 910/2014. This updated framework, widely known as eIDAS 2.0, establishes the European Digital Identity Wallet as a mandatory offering for all EU Member States and creates binding obligations for both governments and businesses across Europe. Governance is a shared responsibility, involving the European Commission, EU Member States, national competent authorities, wallet providers, issuers of Person Identification Data and attestations, qualified trust service providers, and relying parties. The sections below walk through the most important legal questions organizations are asking right now.
Which EU laws and treaties form the legal basis of the EUDI Wallet?
The EUDI Wallet is established by Regulation (EU) 2024/1183, which amends the original eIDAS Regulation (EU) No 910/2014. This regulation was adopted by the European Parliament and the Council under Article 114 of the Treaty on the Functioning of the European Union (TFEU), which covers the internal market. It is directly applicable in all EU Member States without requiring national implementation measures.
Beyond the core regulation, the legal framework is supported by a growing set of Commission Implementing Regulations. These contain legally binding requirements covering specific technical and operational aspects such as personal identification data, wallet certification, protocols and interfaces, cross-border identity matching, and the registration of relying parties. Together, these implementing acts form the detailed rulebook that organizations must follow when building, deploying, or accepting the wallet.
The Architecture and Reference Framework (ARF), developed by the eIDAS Expert Group, provides the technical elaboration of the requirements set out in the implementing acts. The ARF is not legislation, but it is the authoritative technical reference for what compliant wallet solutions must look like in practice.
Governance of the EUDI Wallet ecosystem does not rest with a single central European authority. The European Commission manages the legal framework and adopts implementing acts. EU Member States are responsible for providing or mandating wallet solutions, certifying and notifying them, and supervising actors within their jurisdiction. The European Digital Identity Cooperation Group supports cooperation and cross-border alignment between Member States. National competent authorities and registrars handle registration and oversight at the national level, while wallet providers, issuers, qualified trust service providers, and relying parties each carry distinct responsibilities within the ecosystem.
How does eIDAS 2.0 differ from the original eIDAS regulation?
The original eIDAS Regulation, adopted in 2014, focused on enabling EU Member States to mutually recognize each other’s national electronic identification schemes. Since 2018, notified national eID schemes had to be accepted across EU borders. However, participation was voluntary for Member States, and the private sector was largely excluded. This led to significant fragmentation across Europe, with very uneven adoption between countries.
eIDAS 2.0 makes several fundamental changes:
- Mandatory wallet provision: Every Member State must now offer a European Digital Identity Wallet to all citizens, residents, and businesses, removing the voluntary nature of the original framework.
- Private sector inclusion: Organizations in designated regulated sectors are now legally required to accept the wallet, not only public authorities. This obligation applies from 24 December 2027 under Article 5f of the regulation.
- Expanded trust services: New qualified trust services have been added, including electronic ledgers, electronic archiving, and remote qualified signature creation devices.
- Stronger user control: Users gain explicit rights to selective disclosure, meaning they can share only the minimum data needed for a given interaction.
- Interoperability by design: A common technical framework ensures that a certified wallet from one Member State can be used with an appropriate relying party in another Member State, though the availability of specific cross-border use cases and the maturity of national implementations will develop in phases.
In short, eIDAS 2.0 shifts digital identity from a fragmented, government-only system to a unified, cross-sector ecosystem built around user sovereignty and genuine interoperability.
What obligations does the EUDI Wallet regulation place on member states?
Under eIDAS 2.0, EU Member States are legally required to provide at least one European Digital Identity Wallet to any citizen, resident, or business that requests one. This obligation applies to all 27 Member States and must be fulfilled in accordance with the binding requirements set out in the implementing regulations, with the Architecture and Reference Framework providing the technical elaboration of those requirements.
Member States may choose to issue wallets directly through government bodies or to recognize wallets provided by certified private operators. Either way, the wallet must meet the requirements for high assurance level authentication, certified security, and interoperability with wallets from other Member States.
In addition to issuing wallets, Member States are responsible for:
- Establishing and maintaining national notification and certification processes for wallet solutions.
- Ensuring that authentic sources, such as civil registries or professional qualification databases, are connected to the wallet ecosystem so that verified attributes can be issued.
- Participating in peer review processes to ensure their eID schemes meet the required standards.
- Submitting annual reports to supervisory bodies as required by the implementing regulations.
These obligations mean that governments are active infrastructure providers in the European digital identity ecosystem. It is important to distinguish between existing national digital identity systems and a country’s EUDI Wallet: an existing national eID scheme is not automatically an EUDI Wallet unless it has been certified and notified as such under the eIDAS 2.0 framework. Organizations working with government sector clients should factor these obligations into their planning and advisory work.
Which sectors and use cases are legally required to accept the EUDI Wallet?
eIDAS 2.0 establishes two separate acceptance obligations with different timelines and scopes.
From 24 December 2026, public authorities must accept notified EUDI Wallets for online services that require electronic identification.
From 24 December 2027, Article 5f of the regulation requires acceptance by relying parties in designated regulated private sectors where strong user authentication is required by law or contract. The sectors covered include:
- Banking and financial services: Online banking, account opening, and payment authentication where strong customer authentication is required.
- Telecommunications: SIM registration and identity verification for mobile contracts.
- Energy: Service providers subject to regulated customer identification requirements.
- Transport: Services where identity verification is legally required.
- Healthcare: Access to patient records and cross-border health data exchange.
- Education: Services requiring verified identity for access to qualifications or records.
- Social security: Digital access to benefits and entitlements.
- Drinking water, postal services, and digital infrastructure: Where identity verification obligations apply.
Micro and small enterprises are exempt from the private acceptance obligation. The exemption applies to organizations with fewer than 50 employees and an annual turnover or balance sheet total of no more than 10 million euros.
Very large online platforms designated under the Digital Services Act are covered by a separate provision within Article 5f. For these platforms, the obligation applies where the platform requires user authentication, on the voluntary request of the user and for the minimum data necessary. The condition of legally or contractually required strong authentication does not apply to very large online platforms.
Mandatory acceptance does not remove sector-specific legislation or national registration requirements. Before requesting wallet data, a relying party must register with the national authority of its Member State of establishment under CIR (EU) 2025/848, adopted on 6 May 2025. Registration specifies the intended use and the attributes or attestations the relying party is authorized to request. The wallet checks each presentation request against this registered scope. A relying party must be able to accept every relevant notified wallet, regardless of which provider issued it.
The first four Large Scale Pilot projects, which ran from April 2023 to 2025, tested these use cases extensively and their findings directly shaped the final implementing requirements. The pilots covered use cases including Digital Travel Credentials, payments, government services, account opening, SIM registration, mobile driving licences, remote qualified signatures, e-prescriptions, education credentials, and social security. Organizations in financial services and healthcare should pay particular attention to how mandatory acceptance translates into technical integration requirements.
How does the EUDI Wallet regulation interact with GDPR?
The EUDI Wallet regulation and the General Data Protection Regulation (GDPR) are designed to work alongside each other. The EUDI Wallet does not replace GDPR; it operates within the GDPR framework and reinforces several of its core principles, particularly data minimization and purpose limitation.
One of the most important features of the wallet from a data protection perspective is selective disclosure. Users can choose to share only the specific attributes needed for a given interaction, such as confirming they are over 18 without revealing their exact date of birth. This directly supports the GDPR principle of data minimization and reduces the risk of unnecessary personal profiling. This type of age verification does not require zero-knowledge proofs; selective disclosure of a single attribute such as “age over 18” is sufficient.
The regulation also gives users explicit control over which relying parties can access their data and for what purpose. It is important to distinguish between a user approving a presentation request in the wallet and consent as a legal basis under GDPR. Each approval in the wallet is a separate user action; it does not automatically constitute GDPR consent, and relying parties must establish their own lawful basis for processing the data they receive.
For organizations acting as relying parties, accepting the wallet does not exempt them from their GDPR obligations. They remain responsible for lawful processing, data retention policies, and responding to data subject rights requests. Where the legal basis for processing is a legal obligation, such as in KYC contexts, that basis applies independently of the wallet interaction. For health data, an additional condition under Article 9(2) GDPR is required. The wallet provides a more privacy-respecting mechanism for the identity verification step of a transaction, but it does not determine the lawful basis for what happens to the data afterwards.
In practice, the combination of eIDAS 2.0 and GDPR creates a strong legal foundation for privacy-by-design digital interactions, which is increasingly expected by both regulators and end users.
When do organizations need to be legally compliant with the EUDI Wallet?
The legal deadline for Member States to make the EUDI Wallet available to citizens, residents, and businesses is 24 December 2026. This is a legal deadline, not a predicted launch date, and it does not guarantee that every national wallet will have reached the same level of maturity on that date, or that every possible cross-border use case will be fully operational throughout Europe from that moment. Practical interoperability and national rollout are expected to develop in phases, and organizations should plan accordingly.
For relying parties in designated regulated private sectors, the acceptance obligation under Article 5f applies from 24 December 2027. This is a separate and later deadline from the obligation on public authorities.
It is also important to distinguish between the legal deadlines, the availability of individual national wallets, the certification and notification of those wallets, the achievement of operational interoperability across borders, and the readiness of relying parties to accept the wallet. These are separate milestones that will not all occur simultaneously in every Member State.
The practical reality is that compliance is not a single deadline but a rolling set of requirements tied to specific implementing acts. Some obligations, such as registering as a relying party under CIR (EU) 2025/848 or integrating wallet-compatible authentication flows, require significant lead time. Organizations that wait until the final deadlines risk being unprepared when regulators and auditors begin checking compliance.
The first four Large Scale Pilot projects ran until 2025 and provided the technical feedback needed to finalize the implementing regulations. The regulatory picture is now substantially clearer, and organizations have enough information to begin concrete implementation planning.
For most businesses in regulated sectors, the question is no longer whether to prepare but how quickly to move. Practical implementation resources can help teams understand what steps to take and in what order.
How the ID Connector supports EUDI Wallet compliance
The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
For organizations preparing for the acceptance obligations under eIDAS 2.0, the ID Connector addresses several concrete requirements:
- Accepting every relevant notified wallet solution, regardless of the issuing Member State or wallet provider.
- Verifying issuer signatures against the relevant national trusted lists, which are brought together in the EU List of Trusted Lists.
- Checking revocation status using issuer-provided status information.
- Validating wallet unit attestations to confirm that a presenting wallet runs on a certified wallet solution.
- Enforcing the attribute scope registered under CIR (EU) 2025/848, so that only attributes and attestations within the registered intended use are requested.
- Supporting qualified signing through a connected qualified trust service provider.
Organizations in financial services, healthcare, pharma, and government each face distinct timelines and technical requirements under eIDAS 2.0. The ID Connector is built to support those requirements in production environments. Contact TrustTech to discuss how the ID Connector fits into your organization’s compliance timeline.