eIDAS 2.0, Regulation (EU) 2024/1183, amends Regulation (EU) 910/2014 and applies to a wide range of organizations operating in or serving users within the European Union. This includes public sector bodies, financial institutions, healthcare providers, telecommunications companies, and any private organization that offers services requiring identity verification. If your organization interacts with EU users digitally and relies on trust, authentication, or identity data, eIDAS 2.0 is relevant to you. The sections below break down exactly who is covered, what obligations apply, and what the consequences of non-compliance look like.
Which types of organizations are covered by eIDAS 2.0?
eIDAS 2.0 covers a broad spectrum of organizations, both public and private, that operate within or provide services to users in the European Union. The regulation places obligations on EU Member States, public institutions, trust service providers, and a wide range of private sector businesses that offer online services requiring identity verification or authentication.
At the government level, all EU Member States are legally required to provide a European Digital Identity Wallet to every citizen, resident, and business by 24 December 2026. This means national governments and their agencies must build and maintain compatible wallet infrastructure. This deadline is the point from which the obligation becomes enforceable. It does not guarantee that every national wallet will reach the same level of maturity or that every cross-border use case will be fully operational throughout Europe on that date. Practical interoperability and national rollout are expected to develop in phases.
On the private sector side, the scope is equally significant. Organizations that fall under eIDAS 2.0 include:
- Financial institutions such as banks, insurers, and payment service providers that must accept EUDI Wallets for customer onboarding and identity verification
- Healthcare organizations that handle patient identity, prescriptions, or cross-border health data
- Telecommunications providers required to support wallet-based SIM registration and identity verification
- Trust service providers offering electronic signatures, seals, timestamps, and other qualified trust services
- Online platforms and service providers that fall under the category of relying parties and must accept verified identity credentials from wallets
The regulation also introduces the concept of a relying party: any organization that accepts identity data from an EUDI Wallet to provide a service. Under CIR (EU) 2025/848, adopted on 6 May 2025, relying parties must register with the national competent authority of their Member State of establishment before they can request or process wallet-based credentials. Registration is per intended use: the relying party specifies which attributes and attestations it will request, and the wallet checks each presentation request against that registered scope.
What specific obligations does eIDAS 2.0 create for businesses?
eIDAS 2.0 creates concrete obligations for businesses depending on their role in the digital identity ecosystem. Organizations classified as relying parties must register with the appropriate national authority under CIR (EU) 2025/848, accept EUDI Wallet credentials, and ensure their systems are technically capable of processing verified identity data securely and in compliance with data minimization principles.
For qualified trust service providers, the obligations go further. They must meet strict security standards, undergo conformity assessments, and maintain compliance with the legally binding requirements set out in the regulation’s implementing acts. The Architecture and Reference Framework elaborates on these requirements at a technical level, but it is the implementing acts that carry legal force. These requirements cover everything from electronic signatures and seals to electronic timestamps and registered delivery services.
For businesses in regulated sectors, eIDAS 2.0 overlaps with existing frameworks such as GDPR, AML, KYC, and PSD2. Compliance is therefore not a standalone exercise. Organizations need to align their identity infrastructure with multiple regulatory requirements simultaneously. A key principle embedded in eIDAS 2.0 is data minimization: businesses may only request the identity attributes they genuinely need for a given service. Requesting more than necessary is a violation of the regulation.
Practically speaking, this means many organizations will need to update their onboarding flows, authentication systems, and data handling processes. The digital identity solutions that support this transition must be wallet-ready and built around EU standards from the ground up.
Does eIDAS 2.0 apply outside the European Union?
eIDAS 2.0 primarily applies within the European Union, but it has real implications for organizations based outside the EU if they offer services to EU users. Any non-EU business that operates as a relying party and accepts EUDI Wallet credentials to provide services to EU citizens or residents must comply with the relevant requirements, including registration with the applicable national authority under CIR (EU) 2025/848 and adherence to the relevant technical standards.
This is similar in principle to how GDPR applies to non-EU companies that process the personal data of EU residents. The determining factor is not where the organization is based, but whether it targets or serves users in the EU.
For organizations in countries with existing bilateral agreements or interoperability arrangements with the EU, the situation may evolve as the regulation matures. The core compliance obligations for non-EU entities remain tied to their active role in the EU digital identity ecosystem. Registration under CIR (EU) 2025/848 is linked to the national framework of a specific Member State. There is no single European registration process that covers all jurisdictions at once.
How does eIDAS 2.0 compliance differ across sectors?
eIDAS 2.0 compliance is not a one-size-fits-all requirement. The specific obligations an organization faces depend heavily on its sector, its role in the digital identity chain, and the nature of the services it provides. While the regulation creates a shared framework, the practical implementation looks quite different across industries.
Financial services and banking
Banks and financial institutions face some of the most direct obligations under eIDAS 2.0. From 24 December 2027, Article 5f of the regulation requires relevant regulated private sector organizations, including those in financial services, to accept EUDI Wallets where strong user authentication is required by law or contract. This obligation does not apply to micro and small enterprises, defined as organizations with fewer than 50 employees and an annual turnover or balance sheet total not exceeding 10 million euros. The wallet framework intersects with existing KYC and AML obligations, creating both compliance complexity and an opportunity to streamline repeated identity checks. It is important to note that sector-specific legislation such as AML directives continues to apply alongside eIDAS 2.0. The wallet framework does not replace those requirements, and heruse of KYC data is governed by AML regulation. Organizations in financial services and digital identity need to plan carefully for this convergence.
Government and public services
Public sector bodies have a dual role: they act as both issuers of identity attributes and relying parties that accept wallet credentials. From 24 December 2026, public sector bodies must accept notified wallets for online services that require electronic identification. Member States are responsible for providing or mandating wallet solutions, certifying and notifying them to the European Commission, and supervising the actors within their jurisdiction. The European Digital Identity Cooperation Group supports cross-border alignment and cooperation between Member States, while the European Commission manages the overarching legal framework and adopts implementing acts. Governments must ensure that citizens can use their EUDI Wallets to access public services such as tax filing, social security, and official document requests. Cross-border interoperability is a central design goal of the framework, meaning that a certified wallet from one Member State can in principle be used with an appropriate relying party in another Member State, though not every use case will be available in every country from the outset. Organizations working in government digital identity contexts need to plan for both technical and regulatory alignment.
Healthcare and pharmaceuticals
Healthcare organizations must handle identity data with particular care given the sensitivity of health information. eIDAS 2.0 enables patients to carry verified health credentials in their wallets, such as prescriptions or vaccination records, and share them across borders. Compliance in this sector requires careful attention to both eIDAS 2.0 requirements and applicable health data regulations, which continue to apply independently. Processing health data requires a legal basis under both Article 6 and Article 9(2) of the GDPR. Cross-border use of health credentials depends on both the interoperability of wallet infrastructure and the alignment of national health data frameworks, which may develop at different rates across Member States. For organizations active in healthcare and identity verification, the wallet framework opens up new possibilities for secure, patient-controlled data sharing.
What happens if an organization does not comply with eIDAS 2.0?
Organizations that fail to comply with eIDAS 2.0 face a combination of legal, operational, and reputational risks. While the regulation sets out the framework, enforcement is handled at the national level by supervisory bodies and competent authorities in each Member State. Non-compliant trust service providers can lose their qualified status, which effectively removes them from the relevant national trusted lists, which are compiled in the EU List of Trusted Lists, and disqualifies their services from legal recognition across the EU.
For relying parties, non-compliance can mean being unable to legally accept or process wallet-based identity credentials, which increasingly becomes a barrier to operating in digital markets. As the EUDI Wallet becomes the standard method for identity verification across EU services, organizations that have not adapted their systems risk being excluded from key workflows and losing customers to competitors who have.
Beyond regulatory sanctions, there is a practical business risk. Customers and partners will increasingly expect wallet-compatible interactions. Organizations that delay compliance may also face higher implementation costs later, as retrofitting legacy systems tends to be more expensive and disruptive than building compliance in from the start. The 24 December 2026 deadline marks the point from which public sector obligations are enforceable, and the 24 December 2027 deadline marks the point from which the private sector acceptance obligation under Article 5f applies. Organizations should plan their implementation timelines accordingly.
The message from regulators is clear: eIDAS 2.0 compliance is not optional, and the window to prepare is narrowing.
How TrustTech supports eIDAS 2.0 compliance
eIDAS 2.0 creates obligations that cut across multiple regulatory frameworks, and the technical requirements for wallet acceptance, relying party registration, and verified credential processing are specific and detailed. TrustTech addresses these requirements through the ID Connector.
The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
For organizations in financial services, healthcare, pharma, and government, the ID Connector handles:
- Wallet acceptance for every certified EUDI Wallet, regardless of the issuing Member State
- Verification against national trusted lists, compiled in the EU List of Trusted Lists, to confirm issuer validity
- Revocation status checks against issuer-provided status information
- Wallet unit attestation validation to confirm that the presenting wallet runs on a certified wallet solution
- Registered attribute scope management so that each presentation request stays within the scope registered under CIR (EU) 2025/848
- Reuse of verified identity data across interactions, in line with data minimization requirements
- Qualified signing via a connected qualified trust service provider
Get in touch with TrustTech to discuss how the ID Connector fits your eIDAS 2.0 obligations.