eIDAS 2.0 & the EU Digital Identity Wallet

What it is

eIDAS 2.0 is the revised electronic identification, authentication and trust services regulation, Regulation (EU) 2024/1183 of 11 April 2024, which amends Regulation (EU) No 910/2014. Its headline requirement: every EU member state must offer citizens, residents and businesses a European Digital Identity Wallet (EUDI Wallet), a state-recognized digital identity wallet for holding and presenting identity data and verifiable credentials. It is the single largest program turning decentralized identity from pilots into population-scale infrastructure.

Three layers decide what you build: the regulation sets obligations and dates, the implementing acts set legally binding technical rules, and the ARF describes the architecture and points at standards. For the legal picture, see eIDAS 2 in the regulations hub and the compliance calendar.

Timeline (official sources)

The five December 2024 acts cover PID and electronic attestations of attributes (2024/2977), integrity and core functions (2024/2979), notifications (2024/2980), certification (2024/2981) and protocols and interfaces (2024/2982). The Commission's implementing acts page now lists about 30 adopted acts, including relying-party registration rules updated by Implementing Regulation (EU) 2026/1730 and amendments to several of the 2024 acts in 2026/1731. Two practical consequences recorded in the ARF: the portrait attribute in the PID becomes mandatory only 24 months after the regulation amending 2024/2977 enters into force, and wallets must check relying-party registration certificates only 24 months after the regulation amending 2024/2982.

How it works

• PID and attestations. The member state's PID provider issues a Person Identification Data credential to the wallet. Other providers issue electronic attestations of attributes (EAAs): diplomas, licenses, payment mandates. Qualified EAAs and attestations from public authentic sources carry legal weight. See EUDI Wallet.
• Formats. The ARF names ISO/IEC 18013-5 mdoc (mDL) and SD-JWT VC. It allows W3C VC Data Model 2.0 for some non-qualified EAAs but does not require it.
• Protocols. Issuance runs on OpenID4VCI. For remote presentation the ARF lists OpenID4VP with the W3C Digital Credentials API, ISO/IEC 18013-7 with the Digital Credentials API, and OpenID4VP with a custom URI scheme. In-person presentation uses ISO/IEC 18013-5.
• Relying parties. Services register with a Registrar in the member state where they are established, declaring each intended use and the data it will request. They present access and registration certificates, and each registration certificate carries exactly one intended use.
• Trust. ARF v3.0.0 added requirements for retrieving trust anchors from both Trusted Lists and Lists of Trusted Entities.

A worked example: a Dutch bank onboarding a customer from Spain sends an OpenID4VP request for family name, given name, birth date and nationality from the PID. The customer's Spanish wallet checks the bank's access certificate and registration certificate, shows the customer who is asking, and returns an SD-JWT VC presentation disclosing only those four claims. The bank validates the PID provider's signature against the trust anchors it retrieved, and checks the credential's status.

Security and privacy design

• Unlinkability. The regulation requires privacy-preserving techniques that ensure unlinkability where attestations do not require identifying the user. The ARF implements this with batch issuance: once-only attestations (Method A, each copy used once) with a fallback to limited-time attestations (Method B).
• Pseudonyms. The ARF requires pseudonym implementations to enable unlinkability between transactions and relying parties. Article 5f(3) protects the right of users to freely chosen pseudonyms on very large online platforms.
• Minimization. The recitals require only the minimal necessary data be transferred to authorised relying parties.
• Free signatures. Wallets must offer natural persons qualified electronic signatures by default and free of charge, quoted in the ARF.
• Proofs of age and personhood. The ARF discusses zero-knowledge proof schemes, for example for proof of personhood, but the formats named today are mdoc and SD-JWT VC. Showing the same issued copy twice reveals the same issuer signature, which is why the batch methods above matter. See zero-knowledge proof.

Who implements it

The Commission publishes open-source reference components on the EU Digital Identity Wallet GitHub, including a PID issuer and verifier endpoints. Vendors aligned with the program include Talao, which describes "the complete EUDI Wallet solution for enterprises and governments"; Gataca, which says its platform is aligned with the ARF; Procivis, whose docs target eIDAS 2.0 and the Swiss e-ID; and walt.id, whose feature list covers the mdoc and SD-JWT VC formats the ARF names. For a shortlist, see best decentralized identity platforms.

Pitfalls

• Building to the ARF alone. The implementing acts are the binding text, and they are being amended. Track the act numbers, not just ARF releases.
• Assuming one wallet. Each member state certifies its own, and national rollout readiness varies. Test against several, plus the reference implementation.
• Over-requesting. Your registration certificate declares what you may ask for. Once wallets are required to verify registration certificates, a request that goes beyond what you registered is exactly what they are built to catch.
• Ignoring status. Check revocation status on every PID presentation; HAIP uses Token Status List for SD-JWT VC.
• Timeline optimism. Treat "end of 2026" as the legal deadline for availability, not proof that your customers' wallets are ready. Keep existing KYC paths.

How it connects

eIDAS 2 is where the other standards meet: OpenID4VC for transport, SD-JWT VC and mdoc for formats, X.509 trust lists rather than DIDs for issuer trust. The European Union digital ID page tracks the wallet as a scheme, alongside national eIDs in digital IDs by country.

Related

Guides: what is decentralized identity, reusable identity and KYC with verifiable credentials, customer identity verification guide. Standards: OpenID4VC, Verifiable Credentials, mDL, DIDs. Directories: regulations by country, European Union regulations, digital IDs by country. Glossary: EUDI Wallet, eIDAS, selective disclosure, relying party.

Who wrote it

The wallet architecture draws on the OpenID4VC work of Kristina Yasuda and Torsten Lodderstedt, who leads Germany's wallet project at SPRIND, and on SD-JWT VC from Daniel Fett. More in the experts directory.