The European Union is building the largest interoperable digital identity system in the world. Regulation (EU) 2024/1183 — commonly called eIDAS 2.0 — entered into force in May 2024 and requires every member state to offer citizens at least one European Digital Identity Wallet (EUDI Wallet). National wallet rollouts are underway through 2026, and businesses that authenticate customers will feel the effects well before the last country ships.
What Changed From eIDAS 1.0?
The original 2014 eIDAS regulation created mutual recognition of national eID schemes — a German citizen could log into a Spanish government portal with their German eID. But it was government-centric: each country built its own scheme, private-sector usage was marginal, and cross-border consumer authentication never reached critical mass. eIDAS 2.0 keeps that foundation and adds three major pieces:
- The EUDI Wallet. A user-controlled app holding identity credentials — not just a login. It carries the citizen's Person Identification Data (PID) plus attribute attestations: driving licences, diplomas, professional qualifications, proof of age, payment credentials.
- Attribute attestations as trust services. New regulated services — electronic attribute attestations (EAA) and their qualified counterpart (QEAA) — let recognized issuers put verifiable claims into the wallet with legal effect across the EU.
- New qualified trust services. Qualified electronic ledgers, qualified electronic archiving, and electronic registered delivery are added to the existing signature, seal, and timestamp services. Electronic ledgers in particular matter for blockchain-adjacent record-keeping.
How the Wallet Actually Works
The EUDI Wallet is an eID means at assurance level "high" — the strongest tier in the EU framework. When a user presents it, the counterparty gets cryptographic proof bound to the user's device, not a scanned document. Two properties distinguish it from every identity system businesses use today:
- Selective disclosure. A user can prove a single attribute — "over 18", "holds a valid driving licence", "authorized signatory of Company X" — without revealing name, date of birth, or anything else. For businesses this flips the data-minimization problem: you can satisfy age or entitlement checks without collecting identity documents at all.
- Verifiable credentials, standard plumbing. The technical rails come from the Architecture and Reference Framework (ARF): OpenID4VP for remote presentations, SD-JWT VC and ISO/IEC 18013-5 (the mobile driving licence format) as credential formats, with the W3C Digital Credentials API in the browser pipeline. Issuers write attestations in; relying parties request and verify presentations.
Who Must Act — and When
For citizens the wallet is voluntary. For businesses it is not entirely optional. The regulation requires relying parties to accept the wallet where strong user authentication is needed to identify a customer — by legal obligation or by contract — and explicitly pulls in very large online platforms under the DSA. In practice that means banks and payment providers performing KYC/AML onboarding, telecoms issuing SIMs, insurance companies, and large platforms should plan to accept wallet-based identification as it becomes available in their markets.
The timeline worth tracking: implementing acts were adopted through 2024–2025, member-state wallets roll out through 2026, and relying-party obligations follow on a transition period after the implementing acts — effectively a 2026–2028 compliance window depending on sector and member state. Each country implements through its own notification and certification regime, so the rollout will be uneven.
From EBSI to the EUDI Wallet
If you followed the European Blockchain Services Infrastructure, much of this will look familiar. EBSI piloted exactly these primitives — verifiable credentials, trusted issuer registries, trust-chain verification — across EU member states, which is the work we covered in our post on verifying EBSI verifiable credentials and trust chains. The EUDI Wallet inherits the conceptual model — issuer → holder → verifier, with trust anchored in registries — but standardized on a different stack: OpenID4VP and SD-JWT/mDL rather than EBSI's original W3C VC profile. The verification discipline is the same; the wire formats and trust frameworks are what changed. Several member states are in fact migrating their EBSI-based pilots into the EUDI framework rather than discarding them.
A Practical Preparation Checklist
- Map your identification flows. Onboarding, KYC, age checks, contract signing, and delegated-authority scenarios ("act on behalf of company X") are the flows the wallet will touch first.
- Decide your relying-party posture. If strong customer authentication is legally required in your sector, accepting the wallet will likely become an obligation — start tracking your national transposition.
- Prototype presentation verification. Stand up an OpenID4VP verifier in a test environment; the large-scale pilots run by member states provide sample wallets and test credentials.
- Look at attestations you could issue. Qualifications, memberships, corporate roles, and licences your organization certifies today are candidate EAAs with EU-wide effect.
- Review data flows against selective disclosure. Where you currently collect full identity documents, redesign for attribute proofs — less data, less GDPR exposure.
Frequently Asked Questions
Is the EUDI Wallet mandatory for citizens?
No — use is voluntary for individuals. What is not voluntary is the obligation on certain businesses (relying parties requiring strong customer authentication, and very large online platforms) to accept the wallet when users choose to present it. Member states are also required to offer at least one certified wallet.
When must businesses accept the EUDI Wallet?
Acceptance obligations attach to relying parties that already require strong user authentication by law or contract — banking, telecoms, insurance — plus VLOPs designated under the DSA. The obligations phase in on a transition period after the implementing acts, placing the effective compliance window around 2026–2028 depending on sector and member state.
What is the difference between eIDAS 1.0 and eIDAS 2.0?
eIDAS 1.0 mutually recognized national eID schemes — mostly government-to-government login. eIDAS 2.0 adds the EUDI Wallet as a user-held credential container, makes attribute attestations a regulated trust service, introduces qualified electronic ledgers and archiving, and creates private-sector acceptance obligations. Think of it as moving from "portable login" to "portable, selective-disclosure identity."
How does the EUDI Wallet relate to verifiable credentials and EBSI?
Same architecture, evolved standards. The issuer–holder–verifier model, trust registries, and trust-chain verification pioneered in EBSI carry over conceptually, but the EUDI framework standardized on OpenID4VP for presentation, SD-JWT VC and ISO/IEC 18013-5 as formats, and its own governance of trusted lists. Work built on EBSI VC profiles needs adapting to the EUDI stack rather than rebuilding.
