The European Commission plays a central role in eIDAS 2.0 governance, but that role is one part of a broader shared responsibility. The Commission develops the regulatory framework, publishes implementing acts, oversees the Architecture and Reference Framework (ARF), and coordinates implementation across EU Member States. Member States, in turn, are responsible for providing or mandating wallet solutions, certifying and notifying them, and supervising actors within their jurisdiction. The European Digital Identity Cooperation Group (EDICG) supports cooperation and cross-border alignment, while national competent authorities, wallet providers, issuers of Person Identification Data and attestations, qualified trust service providers, and relying parties each carry their own distinct obligations. The sections below explain what the Commission’s role means in practice, from its legislative powers to how organizations should engage with Commission-led processes.
What powers does the European Commission have under eIDAS 2.0?
Under eIDAS 2.0, the European Commission holds significant legislative and executive powers. It can adopt delegated and implementing acts that set binding technical standards, define certification requirements, and establish interoperability rules for the EUDI Wallet and the broader trust services framework. These powers allow the Commission to shape how digital identity works across all 27 Member States. The ARF provides the technical elaboration of those legally binding requirements. It is not itself legislation, but it translates the implementing acts into the technical blueprint that wallet solutions must follow.
More specifically, the Commission’s authority under eIDAS 2.0 covers a broad range of responsibilities:
- Adopting implementing acts on topics such as identity matching, wallet certification, protocols and interfaces, and security breach management
- Developing and maintaining the Architecture and Reference Framework (ARF), which provides the technical elaboration of the requirements set out in implementing acts
- Funding and coordinating the Large Scale Pilots that test the wallet in real-world scenarios
- Providing a reference implementation of the EUDI Wallet as an open-source prototype for Member States and other parties to build on
- Establishing and overseeing the European Digital Identity Cooperation Group (EDICG), which advises the Commission on policy and technical matters and supports cross-border alignment
These powers make the Commission the central authority for the legal and technical framework of eIDAS 2.0. The Commission does not operationally manage EUDI Wallets. That responsibility sits with Member States and the wallet providers they certify and notify. Governance is shared, not centralised.
How does the European Commission enforce eIDAS 2.0 compliance?
The European Commission enforces eIDAS 2.0 compliance primarily through its power to adopt legally binding implementing acts and through oversight of national supervisory bodies. While day-to-day enforcement sits with Member State authorities, the Commission sets the rules those authorities must apply and can take action when Member States fail to implement the regulation correctly.
Enforcement works at several levels. At the regulatory level, the Commission publishes implementing acts that define mandatory requirements for wallet providers, trust service providers, and relying parties. These are not optional guidelines but binding EU law. Member States must apply them within their national frameworks, since EU regulations are directly applicable and do not require national transposition.
At the oversight level, the Commission works with national supervisory bodies that are responsible for monitoring compliance within their borders. The EDICG supports this by facilitating peer reviews of electronic identification schemes and helping supervisory bodies align their approaches. If a Member State persistently fails to meet its obligations, the Commission has the option to initiate infringement proceedings through the European Court of Justice.
For organizations operating in regulated sectors such as financial services or healthcare, compliance with eIDAS 2.0 is a legal obligation. The Commission’s implementing acts define the floor, not the ceiling.
What is the Commission’s role in the EUDI Wallet governance framework?
The European Commission is the architect of the legal and technical framework within which EUDI Wallets operate. It defines the binding requirements through implementing acts, provides the ARF as the technical elaboration of those requirements, funds the pilots, and supplies a reference implementation. Member States are responsible for issuing wallets to their citizens and residents, certifying wallet solutions, and notifying them at European level. No single central European authority operationally manages all EUDI Wallets. Governance is distributed across the Commission, Member States, national competent authorities, and the other actors in the ecosystem.
In practical terms, the Commission’s role in EUDI Wallet governance includes three core functions.
Setting the technical foundation
The ARF, developed and maintained by the Commission in collaboration with the EDICG, provides the technical elaboration of the requirements set out in implementing acts. It defines how wallets must be built, what data formats they must support, and how they must interact with relying parties and trust service providers. The Commission has also published an open-source reference implementation of the wallet, which Member States and private parties can use as a starting point for their own solutions. The ARF is a technical document. The legally binding requirements are contained in the implementing acts themselves.
Funding and coordinating the pilots
In April 2023, the Commission launched four Large Scale Pilots involving over 350 entities from 26 Member States, Norway, Iceland, and Ukraine. These pilots ran until 2025 and tested the wallet across real-world scenarios. The POTENTIAL consortium covered government services, opening bank accounts, SIM registration, mobile driving licences, remote qualified signing, and e-prescriptions. The EWC consortium focused on Digital Travel Credentials, payments, and organisational digital identity. NOBID concentrated on payments, and DC4EU addressed education and social security. Digital Travel Credentials were piloted in this context; wallet-based border or airport controls are not yet operational. A second pilot wave started in 2025, with WE BUILD covering business wallets and payments, and APTITUDE covering travel, ticketing, vehicle registration, and payments. The Commission co-funds these consortia and uses the findings to refine the ARF and improve the wallet’s security, usability, and interoperability ahead of the 24 December 2026 legal deadline for wallet issuance and public sector acceptance. Pilot outcomes inform the technical specifications, but practical interoperability and national rollout are expected to develop in phases.
How does the Commission work with Member States on eIDAS 2.0 implementation?
The Commission works with Member States through a structured cooperation framework built around the European Digital Identity Cooperation Group (EDICG). This group, formerly known as the eIDAS Expert Group, brings together representatives from Member States and the Commission to exchange best practices, advise on delegated and implementing acts, and co-develop the technical toolbox that underpins eIDAS 2.0 implementation.
This cooperation model is deliberately collaborative. The Commission provides the framework, the standards, and the funding, while Member States retain responsibility for issuing wallets to their citizens and residents, certifying wallet solutions, and notifying them at European level. By 24 December 2026, every Member State is legally required to have at least one certified EUDI Wallet operational and available to citizens, residents, and businesses that want one. Public sector bodies must also accept notified wallets as a means of identification from that date. This is a legal deadline. It does not guarantee that every national wallet will have reached the same level of maturity, or that every possible cross-border use case will be fully operational throughout Europe on that date. National rollout, certification progress, and operational interoperability are expected to develop in phases.
The EDICG also plays an important role in organising peer reviews of national electronic identification schemes and supporting supervisory bodies as they work to apply the regulation. This helps ensure that the level of assurance and security remains consistent across borders, which is essential for the wallet to function as a genuinely pan-European tool. Organizations operating across multiple Member States, including those in the public sector, benefit directly from this harmonisation effort, though cross-border use cases may become available progressively rather than all at once.
What implementing acts has the European Commission already published for eIDAS 2.0?
The European Commission has published a substantial body of implementing acts under eIDAS 2.0, covering the technical and procedural requirements for the EUDI Wallet and the broader trust services ecosystem. These acts translate the high-level requirements of the regulation into specific, enforceable rules that organizations must follow.
Among the implementing acts already published, organizations will find rules covering:
- Person Identification Data (PID) and Electronic Attestation of Attributes (EAA) — defining what identity data wallets must support and how it must be structured
- Wallet integrity and core functionalities — setting minimum security and functional requirements for wallet solutions
- Certification of wallet solutions — establishing how wallets must be assessed and certified before deployment
- Protocols and interfaces — defining how wallets communicate with relying parties and trust service providers
- Cross-border identity matching — specifying how identities are matched when a wallet is used across Member State borders
- Registration of wallet relying parties — setting out how organizations that accept wallet credentials must register with the national authority of their Member State of establishment before requesting wallet data, as established under CIR (EU) 2025/848 of 6 May 2025. Each relying party registers per intended use the attributes and attestations it will request, and the wallet checks requests against that registered scope.
- Qualified trust services — updating requirements for qualified electronic signatures, seals, timestamps, registered delivery services, and preservation services
- Supervisory body reporting — defining the formats and procedures for annual compliance reports by national supervisory bodies
This is not an exhaustive list, but it illustrates the breadth of the Commission’s legislative output under eIDAS 2.0. Organizations preparing for compliance need to track these implementing acts closely, as they define the specific obligations that apply to their use cases. The ARF provides the technical elaboration of these requirements and should be read alongside the implementing acts.
How should organizations engage with Commission-led eIDAS 2.0 processes?
Organizations should engage with Commission-led eIDAS 2.0 processes by monitoring the ARF and implementing acts as they are published, participating in public consultations where possible, and aligning their internal compliance and technology roadmaps with the Commission’s published timelines and technical specifications.
For most organizations, direct participation in Commission processes such as the EDICG is limited to Member State authorities and formally recognised stakeholders. However, there are several practical ways to stay engaged and prepared:
- Follow the ARF repository and public discussion topics, which are open for stakeholder input
- Track the Commission’s published implementing acts and assess their impact on your current systems
- Engage with your national supervisory body or national competent authority, which participates in EDICG peer reviews and can provide guidance on domestic implementation
- Monitor the Large Scale Pilot outcomes, which will directly influence the final technical specifications organizations must implement
The 24 December 2026 deadline marks the legal point by which every Member State must have at least one certified EUDI Wallet available and by which public sector bodies must accept notified wallets as a means of identification. This is a legal obligation. It is not a prediction that every national wallet will have reached the same level of maturity or that every cross-border use case will be fully operational on that date. National rollout and operational interoperability are expected to develop in phases. For regulated private sector organizations, including those in banking, financial services, healthcare, telecoms, energy, transport, education, social security, drinking water, postal services, digital infrastructure, and digital services, the obligation to accept the EUDI Wallet within contexts where strong user authentication is legally or contractually required applies from 24 December 2027, under Article 5f of the regulation. Very large online platforms with more than 45 million users in the EU fall under a separate provision of Article 5f: for those platforms, the obligation applies where the platform requires user authentication, on the voluntary request of the user and for the minimum necessary data. Micro and small enterprises, defined as those with fewer than 50 employees and an annual turnover or balance sheet total of no more than 10 million euros, are exempt from the Article 5f private sector obligation. Organizations that wait before starting preparation risk falling behind. The implementing acts already published provide enough detail to begin assessing gaps in current identity infrastructure, compliance processes, and technology capabilities.
How TrustTech helps with eIDAS 2.0 governance readiness
When the regulatory framework is clear, the next step is making it work in practice. The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
For organizations preparing for the obligations that take effect on 24 December 2026 and 24 December 2027, the ID Connector addresses several concrete requirements:
- Accepting every notified EUDI Wallet, regardless of the issuing Member State or wallet provider
- Verifying attestations against national trusted lists, checking revocation status, and validating wallet unit attestations to confirm the presenting wallet runs on a certified wallet solution
- Enforcing the registered attribute scope so that only the attributes and attestations declared in the relying party’s registration under CIR (EU) 2025/848 are requested
- Supporting reuse of verified identity data across identification, login, and qualified signing workflows
- Connecting to a qualified trust service provider for qualified electronic signing where required
Whether your organization operates in financial services, healthcare, pharma, or government, the eIDAS 2.0 governance framework creates obligations that require concrete technical and procedural preparation. TrustTech’s solutions are built on European digital identity standards and designed to be eIDAS 2.0 ready by design. To discuss your specific situation, get in touch with TrustTech.