Notified eID schemes under eIDAS 2.0 are national electronic identification systems that EU Member States have officially registered with the European Commission, making them legally recognised across all EU Member States. eIDAS 2.0, Regulation (EU) 2024/1183, amends Regulation (EU) 910/2014 and places these schemes at the foundation of cross-border digital identity recognition in Europe. This article walks through how the notification process works, what assurance levels apply, and what organisations need to do to stay compliant.
How does the eID notification process work under eIDAS 2.0?
The eID notification process under eIDAS 2.0 requires EU Member States to formally register their national electronic identification schemes with the European Commission. Once a scheme is notified and published in the Official Journal of the EU, other Member States are legally obligated to recognise it for cross-border access to public services. This mutual recognition is what makes the system work at a European scale.
The process itself involves several steps. A Member State submits detailed technical and security documentation about its eID scheme to the Commission. The scheme then undergoes a peer review by other Member States to verify that it meets the required standards. Only after this review is successfully completed does the scheme receive official notification status.
One important shift under eIDAS 2.0 is that the rules now apply more broadly. Where the original regulation focused mainly on public sector services, the updated framework extends recognition obligations to the private sector as well. This means that banks, insurers, and other private organisations in regulated sectors that require strong identity verification will also need to accept notified eID schemes from other Member States, subject to the applicable deadlines and scope described below.
Another key change is that every Member State is now required to provide citizens, residents, and businesses with access to a European Digital Identity Wallet. Member States may issue these wallets directly or recognise wallet solutions provided by private entities that have received official certification. Governance of the wallet ecosystem is a shared responsibility: the European Commission manages the legal framework and adopts implementing acts, Member States certify and notify wallet solutions and supervise actors within their jurisdiction, and the European Digital Identity Cooperation Group supports cross-border alignment. This represents a significant expansion of the eID ecosystem beyond the traditional government-to-government model.
What assurance levels apply to notified eID schemes?
Notified eID schemes under eIDAS 2.0 are categorised into three assurance levels: low, substantial, and high. These levels indicate how confident a relying party can be that the person presenting a digital identity is genuinely who they claim to be. The higher the assurance level, the more rigorous the identity proofing and authentication requirements.
- Low: Provides limited confidence in the claimed identity. Suitable for lower-risk services where the consequences of a false identity are minimal.
- Substantial: Provides significant confidence that the identity is genuine. Requires stronger identity verification and at least single-factor authentication. Most cross-border public services use this level as a baseline.
- High: Provides the highest level of confidence. Requires in-person or equivalent identity proofing and multi-factor authentication. This level is required for sensitive services such as accessing healthcare records, applying for regulated financial products, or interacting with government systems that hold critical personal data.
Under eIDAS 2.0, Member States are only required to recognise notified schemes from other countries at the same assurance level or higher than what their own service requires. So if your service requires substantial assurance, you must accept any notified scheme that meets at least that level. This creates a consistent, interoperable framework across borders without forcing every service to accept every identity method.
For organisations in regulated sectors, understanding which assurance level applies to their specific use case is essential. Getting this wrong can lead to either unnecessary friction for users or insufficient identity verification that creates compliance risk.
How do notified eID schemes relate to the EUDI Wallet?
Notified eID schemes and the European Digital Identity Wallet are closely connected but serve different functions. Notified eID schemes are the national identity systems that countries register under eIDAS 2.0. The EUDI Wallet is a new type of digital tool that builds on these national identities and packages them into a single, user-controlled application that works across the EU.
In practical terms, the EUDI Wallet uses verified identity data from notified national eID schemes as its foundation. When a citizen sets up their wallet, their identity is anchored to their national eID, which has already been verified to a recognised assurance level. The wallet then allows them to store and share their core identity as well as additional attributes such as professional qualifications, driving licences, or health information. It is important to note that the legally binding requirements governing the wallet come from the implementing acts adopted under eIDAS 2.0. The Architecture and Reference Framework provides the technical elaboration of those requirements and does not itself constitute legislation.
The key difference is in user control and flexibility. Traditional notified eID schemes typically work as authentication tools: you prove who you are to access a service. The EUDI Wallet goes further by allowing users to selectively disclose specific attributes without revealing everything. For example, a user can prove they are over 18 without sharing their date of birth, or confirm their nationality without exposing their full identity document. Each time a user responds to a request, they approve that specific presentation from the wallet.
From an organisational perspective, accepting the EUDI Wallet will effectively mean accepting a notified eID at a high assurance level. The wallet is designed to meet the highest standards of the eIDAS framework, making it suitable for even the most sensitive cross-border transactions. The legal deadline for Member States to make wallets available to all citizens and businesses is 24 December 2026. This deadline does not guarantee that every national wallet will reach the same level of maturity on that date, nor that every cross-border use case will be fully operational throughout Europe from that point. Practical interoperability and national rollout are expected to develop in phases, and organisations should plan for a progressive implementation.
Which sectors are most affected by notified eID scheme requirements?
The sectors most affected by notified eID scheme requirements under eIDAS 2.0 are those that rely on strong identity verification for access to services, compliance with regulations, or the execution of legally binding transactions. The framework distinguishes between public sector obligations, which apply from 24 December 2026, and private sector obligations under Article 5f, which apply from 24 December 2027 to relevant regulated sectors. Micro and small enterprises with fewer than 50 employees and an annual turnover or balance sheet total not exceeding 10 million euros are exempt from the private sector acceptance obligation.
The regulated private sectors covered by Article 5f include financial services, healthcare, telecommunications, energy, transport, education, social security, drinking water, postal services, digital infrastructure, and digital services. Very large online platforms fall under a separate provision of Article 5f: they are required to accept the EUDI Wallet where they require user authentication, on the voluntary request of the user and for the minimum necessary data.
In financial services, the requirements are particularly significant. Banks, insurers, and payment service providers must already comply with KYC, AML, and PSD2 regulations. eIDAS 2.0 adds a layer by requiring these organisations to accept notified eID schemes and, from 24 December 2027, EUDI Wallets for customer onboarding and authentication. Wallet-based identity verification can streamline compliance processes by enabling reusable, cryptographically signed identity data. Sector-specific legislation continues to apply alongside eIDAS 2.0, and organisations will need to assess how both frameworks interact for their specific use cases. Note that the reuse of KYC data is governed by AML regulation, not by eIDAS itself.
For government organisations, the obligations are direct: public services that require identity verification must accept notified eID schemes from other Member States at the appropriate assurance level from 24 December 2026. Cross-border acceptance does not remove national requirements, and relying parties must register with the national authority of their Member State of establishment under CIR (EU) 2025/848 before requesting wallet data.
In healthcare, patient identity verification is critical for data security, consent management, and cross-border care. eIDAS 2.0 enables healthcare providers to verify patient identities using trusted national eID schemes, reducing reliance on paper-based processes and improving the security of digital health records. Cross-border healthcare use cases will depend on both the interoperability of wallet solutions and the applicable national and sector-specific rules in each Member State. Processing health data also requires a legal basis under Article 9(2) GDPR in addition to a standard processing ground.
Education and research organisations are also affected, particularly those involved in cross-border student enrolment, credential verification, or access to shared research infrastructure. The EUDI Wallet’s ability to carry verified academic attestations makes it a practical tool for these sectors as well, though the availability and legal recognition of specific attestations may vary by Member State and will develop over time.
What should organisations do to prepare for notified eID scheme compliance?
Organisations should start preparing for notified eID scheme compliance by mapping their current identity verification processes against the requirements of eIDAS 2.0. This means identifying which services require identity verification, what assurance level is appropriate for each, and whether existing systems can accept notified eID schemes from other Member States.
Here is a practical sequence to guide your preparation:
- Audit your current identity infrastructure: Understand what identity methods you currently accept, what assurance levels they meet, and where gaps exist in cross-border recognition.
- Identify applicable assurance levels: For each service or transaction type, determine whether low, substantial, or high assurance is required under applicable regulations and your own risk assessment.
- Assess EUDI Wallet readiness: Plan for wallet integration as a core requirement. The legal deadline for Member States to issue wallets is 24 December 2026, and the private sector acceptance obligation under Article 5f applies from 24 December 2027. National rollouts and relying party acceptance obligations are expected to develop progressively. Begin planning now so your systems can adapt as national wallet solutions become certified and available.
- Register as a relying party: Under CIR (EU) 2025/848, adopted on 6 May 2025, organisations that intend to request wallet data must register with the national authority of their Member State of establishment before doing so. Registration is per intended use and specifies which attributes and attestations will be requested. The wallet checks requests against this registered scope.
- Update legal and compliance frameworks: Review your terms of service, privacy policies, and data processing agreements to reflect the use of notified eID schemes and wallet-based identity attributes. Each approval a user gives in the wallet is specific to that request and is separate from the GDPR legal basis your organisation needs for processing. Consider how sector-specific legislation interacts with eIDAS 2.0 obligations in your context.
- Engage with technical standards: Familiarise your technical teams with the Architecture and Reference Framework, which provides the technical elaboration of the requirements set out in the implementing acts published under eIDAS 2.0. The implementing acts are the legally binding source. The ARF explains how those requirements are to be implemented in practice.
One practical advantage of the new framework is that it enables reusable identity verification. Once a user has been verified to a sufficient assurance level, that verification can be reused across multiple services and organisations, reducing friction and cost for everyone involved. Organisations that build their systems to take advantage of this from the start will be better positioned than those that treat each interaction as a standalone verification event.
Given the pace of regulatory development and the number of implementing acts already published under eIDAS 2.0, staying current requires ongoing attention. Organisations that follow regulatory resources closely will be better equipped to adapt as the framework continues to evolve.
How TrustTech helps with notified eID scheme compliance
Preparing for notified eID schemes and the EUDI Wallet requires aligning your identity infrastructure, compliance processes, and digital services with a fast-moving regulatory framework. The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
TrustTech works with organisations in financial services, government, healthcare, and other regulated sectors. Here is what the ID Connector does in the context of notified eID scheme compliance:
- Accepts notified eID schemes at the correct assurance level, covering both the public sector deadline of 24 December 2026 and the private sector obligation of 24 December 2027
- Verifies presentations against national trusted lists, checks revocation status via issuer status information, and validates wallet unit attestations to confirm the presenting wallet runs on a certified wallet solution
- Enforces the registered attribute scope per relying party, so requests stay within the bounds registered under CIR (EU) 2025/848
- Enables reusable identity verification, reducing friction for users and reducing the compliance burden for your organisation
- Supports qualified electronic signing via a connected QTSP, integrating identity into legally binding transactions
- Provides cross-border interoperability so your services work for users across EU Member States, regardless of which certified wallet solution they use
Get in touch with TrustTech to discuss how the ID Connector fits your organisation’s identity verification requirements.