The EUDI Wallet relies on a set of open, internationally recognized technical standards to ensure secure, interoperable, and privacy-respecting identity exchanges across Europe. The core standards include SD-JWT VC, ISO/IEC 18013-5 (mdoc), OpenID for Verifiable Credentials (OpenID4VC), and the Architecture and Reference Framework (ARF) published by the European Commission. These standards work together to define how identity data is formatted, requested, and exchanged between wallets, issuers, and relying parties. This article unpacks each standard, explains how they relate to one another, and outlines what organizations should do to prepare.
Which technical standards does the EUDI Wallet actually use?
The EUDI Wallet is built on a combination of credential format standards, protocol standards, and a governance framework. The main technical building blocks are SD-JWT VC (Selective Disclosure JWT Verifiable Credentials), ISO/IEC 18013-5 (the mdoc format), and the OpenID4VC protocol suite. These are brought together under the Architecture and Reference Framework (ARF), which acts as the technical blueprint for all EUDI Wallet implementations.
Each standard plays a distinct role. Credential format standards define how identity data is structured and encoded. Protocol standards define how that data is requested and transferred. The ARF ties everything together by specifying which standards are required, how they interact, and what conformance means in the context of eIDAS 2.0.
The ARF is maintained by the eIDAS Expert Group and updated as the regulation and its implementing acts evolve. It provides the technical elaboration of the legally binding requirements contained in those implementing acts, and references a wide range of adopted Commission Implementing Regulations covering everything from credential formats and wallet certification to cross-border identity matching and trust service requirements. Governance of the EUDI Wallet is a shared responsibility: the European Commission manages the legal framework and adopts implementing acts, EU Member States provide or mandate wallet solutions and supervise actors within their jurisdiction, the European Digital Identity Cooperation Group supports cross-border alignment, and national competent authorities, wallet providers, credential issuers, qualified trust service providers, and relying parties each carry their own obligations. For organizations preparing for eIDAS 2.0 technical compliance, the ARF is the primary technical reference document.
What is the difference between SD-JWT and mdoc credential formats?
SD-JWT VC and mdoc are two different formats for encoding verifiable credentials, and the EUDI Wallet supports both. SD-JWT VC is a web-native format built on JSON and JWT standards, while mdoc (mobile document) is an ISO standard originally designed for mobile driving licenses and physical document use cases.
SD-JWT VC
SD-JWT VC stands for Selective Disclosure JSON Web Token Verifiable Credential. It builds on the widely used JWT format and adds selective disclosure, meaning the holder can choose to reveal only specific attributes from a credential without exposing the rest. This is particularly important for privacy, since a user can prove their age without sharing their full date of birth, or confirm their nationality without revealing their home address. SD-JWT VC is well suited to online and app-based interactions where JSON and web protocols are the norm.
mdoc (ISO/IEC 18013-5)
The mdoc format is defined by ISO/IEC 18013-5 and was originally developed for mobile driving licenses. It uses CBOR (Concise Binary Object Representation) encoding, making it more compact and efficient for certain environments. mdoc also supports selective disclosure and is designed with strong security properties for both proximity (in-person) and remote interactions. Because of its physical document heritage, it is well suited to use cases like border crossing, age verification at a point of sale, or presenting a digital driving license to a police officer.
In practice, the EUDI Wallet supports both formats because different use cases call for different approaches. The ARF specifies when each format applies and how relying parties should handle both.
How does OpenID4VC enable credential exchange in the wallet?
OpenID4VC is a suite of protocols that defines how verifiable credentials are issued to and presented from a digital identity wallet. It consists of two main components: OpenID for Verifiable Credential Issuance (OID4VCI), which governs how a wallet receives credentials from an issuer, and OpenID for Verifiable Presentations (OID4VP), which governs how a wallet presents credentials to a relying party.
OID4VCI allows an issuer, such as a government authority or a bank, to securely deliver a credential into the user’s wallet. The protocol handles authentication, authorization, and the actual transfer of the credential in a standardized way. This means any wallet that supports OID4VCI can receive credentials from any issuer that also supports it, regardless of who built either system.
OID4VP handles the presentation side. When a relying party, such as an online service or a physical kiosk, needs to verify an attribute, it sends a presentation request to the wallet. The wallet, with the user’s approval, responds with the relevant credential data. OID4VP works with both SD-JWT VC and mdoc formats, making it a flexible layer that connects the credential formats to the real-world exchange scenarios the wallet is designed for.
Together, OID4VCI and OID4VP form the backbone of how digital identity standards flow through the EUDI ecosystem. They are built on well-established OAuth 2.0 and OpenID Connect foundations, which means many organizations already have some familiarity with the underlying patterns.
What role does ISO/IEC 18013-5 play in the eIDAS 2.0 ecosystem?
ISO/IEC 18013-5 defines the mdoc credential format and the associated data model and protocols for mobile documents. In the eIDAS 2.0 ecosystem, it plays a central role in use cases that require high-assurance, proximity-based identity verification, as well as regulated document types like the mobile driving license (mDL). For online presentation scenarios, ISO/IEC TS 18013-7 extends this foundation to remote interactions.
The standard is particularly relevant for government-issued credentials. Because ISO/IEC 18013-5 was developed through the ISO standards process with strong input from governments and document issuance authorities, it carries significant weight in regulated contexts. The EUDI Wallet’s support for mdoc ensures that high-assurance credentials like national identity documents and driving licenses can be represented in a format that meets both EU regulatory requirements and international standards.
For organizations in sectors like financial services or government services, ISO/IEC 18013-5 matters because it defines the trust model and security requirements for the credentials they will receive and verify. Verifying an mdoc credential involves three distinct checks: confirming the issuer’s signature against the relevant national trusted list (which can be done offline), checking the revocation status via the issuer’s status information, and validating the wallet unit attestation to confirm that the presenting wallet runs on a certified wallet solution. The last two checks require a connection to external sources. Understanding this standard is essential for building relying party integrations that can handle government-issued mdoc credentials correctly. Relying party registration is governed by CIR (EU) 2025/848 of 6 May 2025, which requires organizations to register with the national authority of their Member State of establishment before requesting wallet data, so organizations operating across borders should account for national registration requirements alongside the shared European technical standards.
Are these standards finalized, or are they still evolving?
The standards supporting the EUDI Wallet are at different stages of maturity, and some are still being refined. ISO/IEC 18013-5 is a published, stable ISO standard. The OpenID4VC specifications (OID4VCI and OID4VP) are mature drafts that have reached a high level of stability, but they continue to be updated through the OpenID Foundation’s working groups. SD-JWT VC is similarly stable but still progressing through the IETF standardization process.
The ARF itself is updated regularly by the European Commission as new implementing regulations are adopted and as feedback from the large-scale pilot projects is incorporated. The first four large-scale pilots ran from April 2023 to 2025 and have concluded. Their insights are feeding into the final technical specifications. A second wave of pilots started in 2025, including WE BUILD, which focuses on business wallets and payments, and APTITUDE, which covers travel, ticketing, vehicle registration, and payments. This means the overall direction is clear and stable enough for organizations to begin implementation, but specific details can still change.
The practical implication for organizations is this: building on the current ARF version is the right approach, but staying connected to updates from the European Commission and the relevant standards bodies is equally important. The core patterns, such as using OpenID4VC for credential exchange and supporting both SD-JWT VC and mdoc formats, are unlikely to change fundamentally. The fine-grained details of profiles, conformance requirements, and interoperability specifications are where updates are most likely to occur.
How should organizations prepare for eIDAS 2.0 technical compliance?
Preparing for eIDAS 2.0 technical compliance means understanding which standards apply to your role in the ecosystem, whether you are a wallet provider, a credential issuer, or a relying party, and then building or adapting your systems accordingly. The legal deadline for Member States to make EUDI Wallet solutions available and for public bodies to accept notified wallets for online services requiring electronic identification is 24 December 2026. This is an ultimate date, not a predicted launch date, and practical interoperability and national rollout are likely to develop in phases. For relevant regulated private sectors, including financial services, healthcare, telecoms, energy, and transport, the obligation under Article 5f of eIDAS 2.0 applies from 24 December 2027. Organizations should plan for both deadlines and start technical preparation now, rather than waiting for a single European go-live moment.
Here is a practical sequence to follow:
- Identify your role in the EUDI ecosystem. Are you issuing credentials, accepting them, or both? Your role determines which standards and compliance requirements apply directly to you.
- Review the current ARF version. The Architecture and Reference Framework is the authoritative technical reference for implementation requirements. Make sure your team is working from the latest version.
- Assess your credential format readiness. Determine whether your systems need to support SD-JWT VC, mdoc, or both, and what changes are needed to your data models and issuance pipelines.
- Evaluate your protocol support. Check whether your existing infrastructure can support OID4VCI and OID4VP, or whether new components are needed.
- Review the large-scale pilot outputs. The first four pilots generated valuable real-world feedback. This information is publicly available and can save significant time during your own implementation.
- Plan for ongoing updates. Build a process for monitoring changes to the ARF and the implementing regulations so your compliance posture stays current.
Organizations in healthcare, finance, and other regulated sectors should also consider how verifiable credentials connect to their existing identity verification and compliance workflows. The goal is to extend what you already have in a way that is wallet-ready and eIDAS 2.0 compliant. Exploring how to approach this transition early will help you avoid last-minute scrambles.
How TrustTech supports eIDAS 2.0 technical standards
Navigating the technical landscape of eIDAS 2.0 is complex, especially when standards are still evolving and your organization needs to stay compliant while continuing to serve customers. The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
Here is what the ID Connector delivers for organizations working with EUDI Wallet standards:
- Support for SD-JWT VC, mdoc, OID4VCI, and OID4VP out of the box, so your integration covers the credential formats and protocols the ARF requires
- Verification against national trusted lists, revocation status checks, and validation of wallet unit attestations, covering all three verification steps that a relying party needs to perform
- Enforcement of registered attribute scope, so that each presentation request stays within the attributes registered under CIR (EU) 2025/848
- Reusable identity workflows that connect wallet-based credentials to your onboarding, signing, and verification processes
- Qualified signing via a connected QTSP, for use cases that require a qualified electronic signature
- Ongoing alignment with ARF updates and the Commission’s implementing regulations, so your integration stays current as specifications evolve
The ID Connector is relevant across financial services, healthcare, pharma, and government, where wallet-based identity verification connects directly to regulated onboarding and authentication requirements. Get in touch with TrustTech to discuss your eIDAS 2.0 technical requirements and find out how the ID Connector fits your implementation.