eIDAS 2.0 is the revised European Union regulation on electronic identification and trust services, adopted as Regulation (EU) 2024/1183, which amends the original eIDAS Regulation (EU) No 910/2014. In digital identity, its central change is the European Digital Identity Wallet (EUDI Wallet): every member state must offer citizens and residents a free wallet app that stores identity data and verifiable credentials and shares them under the user’s control.
The regulation entered into force on 20 May 2024. It keeps the existing framework for electronic signatures, seals and other trust services, extends it with new qualified services and turns cross-border digital identity from an optional system into an obligation for governments and many private services.
What eIDAS 2.0 changes compared with eIDAS 1
The original eIDAS Regulation of 2014 created mutual recognition of national eID schemes and a legal framework for trust services. Adoption of national eIDs remained uneven, and private services were not required to accept them. eIDAS 2.0 addresses these gaps, as the table below shows.
| Area | eIDAS 1 (2014) | eIDAS 2.0 (2024) |
|---|---|---|
| Identity model | Notified national eID schemes | Mandatory EUDI Wallet in every member state |
| Obligation for states | Notification was voluntary | Each state must provide at least one wallet |
| Private sector acceptance | Not required | Required for regulated sectors and very large platforms |
| Attributes and credentials | Mostly identity data only | Electronic attestations of attributes, including qualified ones |
| New trust services | Signatures, seals, timestamps, delivery, website certificates | Adds electronic archiving, ledgers and remote signature devices |
| User control | Limited | Selective disclosure, dashboards and privacy safeguards |
Under the regulation, member states must make wallets available within 24 months of the adoption of the key implementing acts, which were adopted from late 2024 onward. This places the first mandatory wallets around the end of 2026, while large-scale pilot projects have tested use cases since 2023.
How the European Digital Identity Wallet works
The EUDI Wallet is a user-held application, usually on a smartphone, that stores two kinds of data. The first is person identification data (PID), issued by a public authority, which establishes who the user is. The second is a growing set of electronic attestations of attributes, such as a diploma, a driving license, a professional qualification or proof of age.
- Issuance: a trusted issuer verifies the user, then signs a credential and sends it to the wallet.
- Storage: keys are protected by secure hardware or a remote secure element, at level of assurance high.
- Presentation request: a relying party, such as a bank or a car rental company, asks for specific attributes.
- User consent: the wallet shows who is asking and for what, and the user approves or refuses.
- Verification: the relying party checks the issuer’s signature against EU trusted lists and registration data.
The technical rules are set out in an Architecture and Reference Framework and in implementing acts. They support credential formats such as ISO/IEC 18013-5 mobile documents, the format behind the mobile driver’s license, and SD-JWT verifiable credentials, which allow revealing only selected claims.
Privacy safeguards in eIDAS 2.0
Because a single wallet can link many areas of life, eIDAS 2.0 contains specific privacy guarantees in addition to the GDPR. The table summarizes the most important ones.
| Safeguard | What it requires | Purpose |
|---|---|---|
| Selective disclosure | Share only requested attributes | Data minimization, for example age over 18 only |
| No tracking by providers | Wallet provider may not collect usage data beyond what is necessary | Prevents profiling of transactions |
| Pseudonyms | Users may use pseudonyms where identification is not legally required | Limits linkability across services |
| Relying party registration | Services must register what data they intend to request | Exposes over-asking |
| Transaction dashboard | Log of all data shared, with reporting options | Transparency and complaint basis |
| Voluntary use | No discrimination against people who do not use a wallet | Protects freedom of choice |
Privacy advocates and security researchers have raised concerns about unlinkability. Some credential formats allow colluding verifiers to correlate presentations through repeated signatures or identifiers. Work on zero-knowledge proof techniques and batch-issued single-use credentials aims to reduce this risk, but it is not fully solved in current implementations.
Obligations for relying parties and trust service providers
eIDAS 2.0 makes acceptance of the wallet mandatory for many organizations. Public sector bodies that require electronic identification must accept it, and private relying parties in regulated sectors must follow within the transition periods set by the regulation.
| Relying party | Obligation | Typical use case |
|---|---|---|
| Public sector services | Accept wallets for online identification | Tax filing, benefits, registrations |
| Banking and financial services | Accept where strong customer authentication is required | Account opening, customer due diligence |
| Very large online platforms | Accept on user request for authentication | Account login and age checks |
| Transport, energy, health, telecoms | Accept where law requires strong identification | Contracts and regulated services |
For each trust service provider, the revision tightens supervision and adds new qualified services. Natural persons must be able to create qualified electronic signatures free of charge for non-professional purposes. The rules on qualified website authentication certificates require browsers to recognize them, a provision that drew strong objections from browser makers and security experts concerned about certificate trust.
Implementation challenges and misconceptions
eIDAS 2.0 is often described in simplified terms that hide its practical complexity. The following points correct common misunderstandings.
- There is no single EU app; each member state provides or approves its own certified wallets built on shared specifications.
- The wallet does not replace identity cards; it adds a digital channel alongside physical documents.
- Use is voluntary for citizens, while acceptance is mandatory for many relying parties.
- Certification and interoperability testing across 27 states is a major technical and organizational effort.
- Identity proofing at enrollment remains a weak point; a wallet is only as trustworthy as the initial identity check.
The idea in brief
eIDAS 2.0 is an EU law that gives every person in the European Union the option of a free digital identity wallet on their phone. The wallet can hold an official ID, a driving license, diplomas and similar documents.
When a bank or a public office asks for proof, the person decides what to share. A wine shop, for example, can learn only that the buyer is over 18. The person stays in control of their own data, and the same wallet works in every EU country.
A practical scenario
A software engineer from Portugal accepts a job in the Netherlands. Instead of mailing certified paper copies, she uses her national EUDI Wallet. To open a Dutch bank account, she shares her person identification data at a high level of assurance, and the bank completes its customer due diligence in minutes without a branch visit.
Her new employer requests proof of her engineering degree. The university in Lisbon has issued a qualified electronic attestation of attributes to her wallet, and she shares only the degree title, institution and date. Later, she signs her rental contract with a free qualified electronic signature from the same wallet. Three cross-border procedures that once took weeks are completed in a day, and the wallet dashboard records exactly which data went to whom.