What is the EU Digital Identity Wallet?

The EU Digital Identity Wallet (EUDI Wallet) is a mobile app that all EU member states must offer to citizens and residents by the end of 2026. It lets you store and share verified identity credentials — such as your national ID, driving licence, or educational qualifications — for use with public and private services online.

Who must accept the EUDI Wallet?

Under eIDAS 2.0, both public services and designated private sector services — including banks, telecoms providers, transport operators, and healthcare providers — are obligated to accept the EUDI Wallet for user authentication and identification.

What is a qualified electronic signature under eIDAS?

A qualified electronic signature (QES) is the highest level of electronic signature defined by eIDAS. It is legally equivalent to a handwritten signature across all EU member states and requires the signer to use a qualified certificate issued by a trust service provider on the EU Trusted List.

How does eIDAS 2.0 differ from the original eIDAS regulation?

The original eIDAS (2014) established mutual recognition of national eIDs and defined trust services. eIDAS 2.0 (2024) goes much further by mandating a universal EUDI Wallet for all citizens, requiring private sector acceptance, and extending trust services to include electronic attestation of attributes.

Does eIDAS apply outside the EU?

eIDAS is an EU regulation binding only on EU member states. However, businesses operating in the EU — including non-EU companies offering services to EU citizens — must accept eIDAS-compliant digital signatures and, from 2026, honor the EUDI Wallet where mandated.

eIDAS Regulation: European Digital Identity Wallet Explained

Q: What is the eIDAS regulation?

The eIDAS regulation (Electronic Identification and Trust Services) is an EU legal framework that governs how people and organizations authenticate their digital identity and sign documents electronically across EU member states. The updated eIDAS 2.0, published in 2024, extends these rules and introduces the EU Digital Identity Wallet.

Introduction

When you log into your bank with a national eID in Finland, the Swedish health service accepts your Estonian digital identity without any friction. This seamless cross-border authentication is not an accident — it is the product of the eIDAS regulation, the European Union’s foundational law for digital trust.

Now the European Commission is raising the stakes dramatically. As of May 2024, Regulation (EU) 2024/1183 — commonly called eIDAS 2.0 — entered into force. Every EU member state must issue citizens a standardized EU Digital Identity Wallet by the end of 2026, and private sector companies from banks to healthcare providers will be legally required to accept it.

For organizations doing business across Europe, understanding eIDAS is no longer optional. The regulation reshapes how identity is verified, how documents are signed, and how data is shared across borders — with legally binding obligations that carry significant penalties for non-compliance.

This article explains what the eIDAS regulation covers, how the new digital wallet works, and what businesses and individuals need to do to prepare.

What Is the eIDAS Regulation?

eIDAS stands for Electronic Identification and Trust Services for Electronic Transactions in the Internal Market. It is an EU regulation (not a directive — it applies directly and uniformly across all 27 member states without national transposition) governing two core areas:

Electronic Identification (eID): The mutual recognition of national digital identity schemes across the EU. If your national eID has been notified and registered with the European Commission, other member states must accept it for cross-border public services.
Trust Services: A legally defined set of electronic services that establish and verify digital trust — including electronic signatures, electronic seals, timestamps, registered delivery services, and website authentication certificates.

The original eIDAS regulation was adopted in 2014. While it achieved mutual recognition of eIDs for public services, it had two critical gaps: private sector participation was voluntary, and the user experience varied wildly across member states. eIDAS 2.0 closes both gaps.

How eIDAS 2.0 Works

The centrepiece of eIDAS 2.0 is the EU Digital Identity Wallet (EUDI Wallet) — a government-issued, standards-based mobile application that every EU citizen and resident is entitled to receive for free.

The wallet operates on a principle of selective disclosure: you can prove a specific attribute (e.g., “I am over 18” or “I hold a valid driving licence”) without revealing your full identity document. This is achieved through electronic attestations of attributes (EAAs) — cryptographically signed credentials issued by authoritative sources such as government agencies, professional bodies, or universities.

The technical architecture is built on open standards. The wallet must support:

ISO/IEC 18013-5 for mobile driving licence presentation (proximity flow via NFC/BLE).
W3C Verifiable Credentials for remote online presentation flows.
OpenID4VP (OpenID for Verifiable Presentations) as the protocol for relying parties to request credentials.
PKCE-secured OAuth 2.0 flows for wallet issuance and presentation.

The levels of assurance mirror the original eIDAS framework — Low, Substantial, and High — with the wallet targeting “High” assurance through hardware-backed key storage (typically a device Secure Enclave or FIDO2-compliant hardware).

KuppingerCole's deep-dive covers the decentralized identity architecture and W3C/OpenID standards stack that powers the EUDI Wallet — essential context for architects and compliance teams.

eIDAS Trust Service Levels vs eID Assurance Levels

The eIDAS framework defines two parallel hierarchies that are often confused.

Feature	Electronic Signature Types	eID Assurance Levels
Level 1 (Basic)	Simple Electronic Signature — any digital method (e.g., typed name).	Low — Minimal identity verification; self-declared.
Level 2 (Advanced)	Advanced Electronic Signature (AdES) — uniquely linked to signatory, detects changes.	Substantial — Remote identity verification with some evidence.
Level 3 (Highest)	Qualified Electronic Signature (QES) — requires a qualified certificate, legally equivalent to handwritten signature.	High — In-person or equivalent verification; hardware-backed keys.
Legal weight	Varies; QES is cross-EU equivalent to wet ink.	Determines which services you can access.
Who issues	Qualified Trust Service Providers (QTSPs) on the EU Trusted List.	National identity authorities.

A Qualified Electronic Signature (QES) is the crown of digital signature law. Under Article 25 of eIDAS, a QES has the equivalent legal effect of a handwritten signature across all EU member states. Courts in France must accept a QES generated in Ireland.

Real-World Use Cases

eIDAS is already deeply embedded in European commerce and public administration. eIDAS 2.0 dramatically expands the scope.

Cross-Border Public Services: An Italian citizen living in Germany can use their Italian eID wallet to file German tax returns, register with a German municipality, or open a German bank account — all without needing to present physical documents. The German government service is legally required to accept the Italian credential at the appropriate assurance level.

Digital-First Contract Signing: A Spanish law firm executing a real estate purchase agreement can use QES to sign legally binding contracts with a French buyer. The digital signatures are recognised without notarisation, apostilles, or couriers — reducing closing timelines from days to minutes.

Healthcare and Prescriptions: Under the European Health Data Space, patients will be able to present their EUDI Wallet to access medical records and receive electronic prescriptions in any member state. A German patient on holiday in Portugal can collect their regular medication using their wallet without a physical prescription.

Common Mistakes to Avoid

The most common compliance mistake organisations make is treating eIDAS as a technology project rather than a legal obligation. The regulation mandates specific legal liability for Qualified Trust Service Providers (QTSPs). If a QTSP issues a qualified certificate that is later used to commit fraud, the QTSP bears legal liability unless they can demonstrate the breach was not due to their negligence. Verify that your QTSP is listed on the EU Trusted List and carries adequate professional liability insurance.

Another frequent error is misclassifying signature levels. Many organisations assume that any digital signature satisfies legal requirements. For contracts above certain values — or in regulated sectors like real estate, insurance, and healthcare — a QES may be legally required. Using a simple or advanced signature where a QES is mandated renders the contract legally contestable.

For developers building relying party integrations, failing to implement proper certificate chain validation against the EU Trusted List is a serious security flaw. The EU Trusted List (available as a machine-readable XML file) is the authoritative source of approved QTSPs. Any certificate not chaining to a QTSP on this list should be rejected.

Getting Started

Whether you are a citizen preparing to use the wallet or an organisation required to accept it, the steps to eIDAS readiness are concrete.

Audit your current signature processes: Identify all processes where you require signatures — from customer onboarding to internal approvals. Classify each by the legal signature level required. This gap analysis reveals where upgrading to AdES or QES is necessary.
Register as a Relying Party: If your service will accept the EUDI Wallet, you must register as a relying party with your national wallet scheme. Each member state’s reference implementation follows the Architecture and Reference Framework (ARF) published by the European Commission.
Select a Qualified Trust Service Provider: For issuing QES, choose a QTSP from the EU Trusted List. Evaluate providers on their level of assurance, supported signature formats (CAdES, PAdES, XAdES), and API integration capability.
Implement Validation Infrastructure: Relying parties must validate signatures against the EU Trusted List programmatically. Open-source SDKs such as the European Commission’s DSS (Digital Signature Service) library simplify this.
Prepare for EUDI Wallet integration: Review the EUDI Wallet’s Architecture and Reference Framework and the OpenID4VP specification. Begin planning how your authentication flows will accept wallet presentations alongside existing login methods such as FIDO2 Passwordless Authentication.

Understanding eIDAS sits at the intersection of identity, cryptography, and EU law. To understand how the underlying certificate infrastructure ensures trust in these digital signatures, see our guide on Public Key Infrastructure (PKI) Explained.