eIDAS 2.0 came into effect on 20 May 2024, when Regulation (EU) 2024/1183 was published in the Official Journal of the European Union, amending Regulation (EU) 910/2014. Member States have until 24 December 2026 to make European Digital Identity (EUDI) Wallets available to their citizens, residents, and businesses. For most organizations, the preparation window is already open.
The regulation does not simply update a few technical rules. It fundamentally reshapes how digital identity works across Europe, who is responsible for it, and which sectors must accept it. This article walks through the most important questions organizations are asking right now.
What has changed since the original eIDAS regulation?
The original eIDAS regulation, in force since 2016, created a framework that allowed EU Member States to notify and recognize each other’s national electronic ID systems. Since 2018, any notified scheme had to be accepted across the EU. However, participation was voluntary. There was no obligation for every country to create an eID, and no requirement for private sector organizations to accept them. The result was a fragmented landscape with significant differences between Member States.
eIDAS 2.0 addresses these gaps directly. The key changes include:
- Universal availability: Every Member State must now provide a European Digital Identity Wallet to all citizens, residents, and businesses who want one.
- Public and private sector inclusion: The regulation introduces acceptance obligations for public bodies from 24 December 2026, and for relevant regulated private sectors from 24 December 2027 under Article 5f.
- User control and privacy: Wallet users decide exactly what data they share and with whom. Only the minimum necessary information is disclosed, reducing the risk of personal profiling.
- Expanded trust services: New qualified trust services have been added, including electronic archiving, electronic ledgers, and remote signing, broadening the scope of what falls under the regulation.
- Interoperability by design: The Architecture and Reference Framework (ARF) sets out the technical elaboration of requirements established in the implementing acts, so that wallets can work across borders and sectors. The legally binding requirements are contained in the implementing acts themselves; the ARF provides the technical foundation that supports them.
In short, eIDAS 2.0 moves from a voluntary, government-focused framework to a mandatory, cross-sector digital identity infrastructure. The EUDI Wallet is the most visible expression of this shift. Governance is a shared responsibility: the European Commission manages the legal framework and adopts implementing acts; Member States provide or mandate wallet solutions, certify and notify them, and supervise actors within their jurisdiction; the European Digital Identity Cooperation Group supports cross-border alignment; and national competent authorities, wallet providers, issuers of Person Identification Data and attestations, qualified trust service providers, and relying parties each carry distinct roles within that structure.
What are the key eIDAS 2.0 implementation deadlines?
The eIDAS 2.0 implementation timeline runs in stages. The regulation entered into force on 20 May 2024. By the end of 2024, the first five core implementing acts had been adopted, starting the relevant 24-month period. The legal deadline for Member States to make EUDI Wallets available to their citizens, residents, and businesses is 24 December 2026. Large-scale pilot projects ran until 2025 to test real-world readiness.
It is important to distinguish between the legal deadline, national wallet availability, certification and notification, operational interoperability, and acceptance by relying parties. The legal deadline of 24 December 2026 is an outer limit, not a predicted launch date. It does not guarantee that every national wallet will reach the same level of maturity on that date, or that every possible cross-border use case will be fully operational throughout Europe from that moment. Practical interoperability and national rollout are likely to develop in phases, and organizations should plan accordingly.
The most important dates to keep in mind are:
- 20 May 2024: eIDAS 2.0 entered into force following publication in the Official Journal of the EU.
- End of 2024: The first five core implementing acts were adopted, starting the relevant 24-month period for wallet availability.
- 6 May 2025: CIR (EU) 2025/848 on the registration of wallet relying parties was adopted.
- 2025: The first four large-scale pilot projects concluded, providing feedback on wallet functionality, interoperability, and security across more than 350 participating entities from 26 Member States.
- 24 December 2026: The legal deadline by which Member States must make EUDI Wallets available to all citizens, residents, and businesses. From this date, public bodies must accept notified wallets for online services that require electronic identification. National rollout and cross-border operational readiness may continue to mature beyond this date.
- 24 December 2027: The acceptance obligation under Article 5f takes effect for relevant regulated private sectors where strong user authentication is legally or contractually required.
- Ongoing: Implementing acts covering specific technical and procedural requirements continue to be adopted. Organizations need to monitor these as they are published, as they contain the legally binding obligations that apply to their sector.
For organizations in regulated sectors, the 24 December 2026 deadline marks the point at which public-sector acceptance must be in place, and 24 December 2027 is when the private-sector obligation under Article 5f applies. Many of the technical and operational preparations need to be in place before wallets go live at scale.
Which sectors are affected first by eIDAS 2.0?
eIDAS 2.0 affects all sectors that rely on digital identity verification, but some face earlier and more direct obligations than others. From 24 December 2026, public bodies providing online services that require electronic identification must accept EUDI Wallets. From 24 December 2027, the acceptance obligation under Article 5f applies to relevant regulated private sectors where strong user authentication is legally or contractually required. The sectors in scope include financial services and banking, healthcare, telecommunications, energy, transport, education, social security, drinking water, postal services, digital infrastructure, and digital services. Very large online platforms (VLOPs) fall under a separate provision of Article 5f: for VLOPs, the obligation applies where the platform requires user authentication, on the voluntary request of the user and for the minimum necessary data. Micro and small enterprises, defined as organizations with fewer than 50 employees and an annual turnover or balance sheet total of no more than 10 million euros, are excluded from the private-sector acceptance obligation.
The first four large-scale pilot projects tested the wallet across real-world scenarios, giving a clear picture of which sectors are on the front line. The pilots were organized across four consortia:
- EWC covered Digital Travel Credentials, payments, and organizational digital identity.
- POTENTIAL covered government services, opening bank accounts, SIM registration, mobile driving licences, remote qualified signing, and electronic prescriptions.
- NOBID focused on payments.
- DC4EU covered education and social security.
A second wave of pilots started in 2025: WE BUILD focuses on business wallets and payments, and APTITUDE covers travel, ticketing, vehicle registration, and payments.
Cross-border use is a core design principle of the EUDI Wallet framework. A certified wallet from one Member State is designed to be usable with an appropriate relying party in another Member State. This does not mean that every use case will immediately be available in every Member State, that national registration requirements disappear, or that sector-specific legislation ceases to apply. Which elements are interoperable at European level and which remain national or sector-specific will depend on the applicable implementing acts and national frameworks. Under CIR (EU) 2025/848, a relying party must register with the national authority of its Member State of establishment before it can request wallet data. Registration is per intended use: the relying party specifies which attributes and attestations it will request, and the wallet checks each request against that registered scope. A relying party must be able to accept every relevant notified wallet, regardless of which provider issued it.
If your organization operates in financial services, healthcare, or any other sector that currently relies on identity verification as part of its customer journey, eIDAS 2.0 is directly relevant to your operations.
What do organizations need to do before the 2026 deadline?
Organizations need to assess their current identity infrastructure, understand where EUDI Wallet acceptance is required, and begin integrating the technical and compliance changes before wallets are issued at scale. The preparation work spans technology, compliance, and governance.
On the technical side, organizations need to evaluate whether their current onboarding and authentication systems can accept wallet-based credentials. The EUDI Wallet uses attestations in mdoc and SD-JWT VC formats, with OID4VCI for issuance and OID4VP for presentation, as elaborated in the Architecture and Reference Framework. Systems that were not designed with these standards in mind will need updating. Verification involves three separate checks: confirming the issuer’s signature against the relevant national trusted list (part of the EU List of Trusted Lists); checking the revocation status of the attestation via the issuer’s status information; and validating the wallet unit attestation to confirm that the presenting wallet runs on a certified wallet solution. Only the first of these checks can be performed fully offline.
On the compliance side, organizations should map which of their existing processes are affected. KYC, AML, strong customer authentication, and age verification are all areas where wallet-based identity can replace or supplement current methods. Understanding which implementing acts apply to your sector is an essential first step, as these contain the legally binding requirements your organization must meet. Note that KYC reuse is governed by AML regulation, and eIDAS 2.0 does not itself determine whether a wallet-based verification satisfies AML obligations.
From a governance perspective, organizations should assign clear ownership for eIDAS 2.0 readiness. This is a cross-functional undertaking. Compliance teams, legal counsel, digital transformation leads, and business owners all need to be involved.
Key actions before the 24 December 2026 deadline include reviewing current identity verification workflows, identifying gaps against eIDAS 2.0 requirements, engaging with wallet reference implementations where possible, and ensuring data minimization principles are built into any new or updated processes. Organizations should also monitor the ongoing adoption of implementing acts, as these will continue to shape the specific obligations that apply to their sector.
What happens if an organization misses the eIDAS 2.0 compliance deadline?
Missing the applicable eIDAS 2.0 compliance deadline carries real regulatory and business risk. Public bodies that fail to accept EUDI Wallets from 24 December 2026, and regulated private organizations that fail to comply from 24 December 2027, may face enforcement action from national supervisory authorities, who are responsible for overseeing compliance within their Member States. Beyond formal penalties, non-compliant organizations risk being unable to serve customers who choose to use their wallet as their primary means of identification.
The business consequences extend further than regulatory fines. As EUDI Wallets become the standard way for citizens to prove their identity online, organizations that cannot accept them will create friction in their customer journeys. Competitors who are wallet-ready will offer faster, simpler onboarding. In sectors like banking and financial services, where customer experience and conversion rates are closely tied to identity verification speed, falling behind on eIDAS 2.0 readiness has a direct commercial cost.
There is also a reputational dimension. eIDAS 2.0 places user privacy and data control at its core. Organizations that are slow to adopt privacy-respecting identity methods may face scrutiny from customers and regulators alike, particularly as awareness of digital identity rights grows among consumers.
The organizations facing the greatest risk are those that are still treating eIDAS 2.0 as a future concern. The public-sector acceptance deadline is 24 December 2026. The private-sector obligation under Article 5f applies from 24 December 2027. National rollout and cross-border operational readiness will develop in phases, but the compliance obligations are real and the preparation work must start now.
How TrustTech helps with eIDAS 2.0 readiness
The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
For organizations in financial services, healthcare, pharma, and government preparing for the 24 December 2026 and 24 December 2027 deadlines, the ID Connector handles the technical complexity of wallet acceptance in one place. Specifically, the ID Connector:
- Accepts every certified European wallet regardless of the issuing Member State or wallet provider, so relying parties meet their acceptance obligation without building separate integrations
- Manages trust verification by checking issuer signatures against national trusted lists, validating revocation status, and confirming wallet unit attestations
- Enforces registered attribute scope so that each wallet data request stays within the attributes and attestations registered under CIR (EU) 2025/848
- Supports reuse of verified identity data across services, reducing repeated verification steps while keeping each user approval separate
- Connects to qualified trust service providers for qualified signing workflows where a QES is required
Explore the TrustTech platform to see how the ID Connector fits your context, or get in touch to discuss your eIDAS 2.0 readiness today.