eIDAS 2.0 Guide: What Agencies Need to Know in 2026

How Does the EUDI Wallet Work?

The EUDI Wallet operates on several key principles:

Decentralized Identity Management: Unlike traditional centralized databases, the wallet stores credentials directly on the user’s device, giving them full control over their data.

Selective Disclosure: Users can choose exactly what information to share. For example, when buying age-restricted products, the wallet can simply confirm “over 18” without revealing the exact birth date.

Interoperability: The wallet works across all EU member states and sectors, eliminating the need for multiple accounts and credentials.

Offline Functionality: Critical functions work even without internet connectivity, enabling use in areas with limited network access.

Strong Authentication: Multi-factor authentication, biometrics, and cryptographic keys ensure only the rightful owner can access and use the wallet.

Technical Architecture

The EUDI Wallet follows a distributed architecture with several components:

• Wallet Instance: The mobile application on the user’s device
• Wallet Provider: The entity (typically government or certified provider) that issues and manages the wallet
• Credential Issuers: Organizations authorized to issue verified credentials (governments, universities, employers, etc.)
• Relying Parties: Services that accept and verify credentials from the wallet (banks, online platforms, government agencies)
• Trust Infrastructure: Certificate authorities, attribute registries, and revocation services that maintain the trustworthiness of the ecosystem

Implementation Requirements for Government Agencies

Government agencies and identity authorities face several key requirements under eIDAS 2.0. Understanding these requirements is critical for planning your digital transformation roadmap.

Mandatory Obligations

1. Wallet Issuance (by November 2026) Every member state must offer at least one European Digital Identity Wallet to all citizens and residents free of charge. Governments can issue wallets directly or certify private sector providers.
2. High Level of Assurance All EUDI Wallets must support LoA High identification, which requires:

• Multi-factor authentication
• Strong cryptographic keys
• Secure enrollment processes with identity proofing
• Regular security audits and certifications

3. Cross-Border Recognition Member states must recognize and accept EUDI Wallets issued by other EU countries without additional authentication requirements. Your systems must be prepared for interoperability.
4. Attribute Provider Registration Government agencies that issue credentials (driving licenses, permits, professional qualifications) must register as Qualified Trust Service Providers (QTSPs) and issue Qualified Electronic Attestations of Attributes (QEAAs).
5. Relying Party Readiness All public sector online services must accept EUDI Wallets for authentication and must support selective disclosure of attributes.

Technical Standards to Implement

ISO/IEC 18013-5 (mDL Standard) The mobile driving license standard, which forms the basis for many wallet credential formats. Supports both online and offline verification.

W3C Verifiable Credentials The data model for expressing credentials in a way that is cryptographically secure and privacy-respecting.

OpenID for Verifiable Credentials (OpenID4VC) Protocol suite for issuing and verifying credentials between wallets, issuers, and relying parties.

European Blockchain Services Infrastructure (EBSI) Optional blockchain infrastructure for credential revocation, auditing, and trusted issuer registries.

eIDAS Bridge and Gateway Infrastructure Connection points between national eID systems and the European ecosystem for cross-border interoperability.

Data Requirements

To issue credentials compatible with EUDI Wallets, agencies must:

• Digitize Authoritative Data: Ensure citizen data in government databases is accurate, complete, and structured
• Implement Unique Identifiers: Maintain consistent person identifiers across systems
• Establish Attribute Schemas: Define standardized formats for credentials (what data fields, formats, validation rules)
• Create Issuance Workflows: Develop processes for verifying identity, generating credentials, and delivering them to wallets
• Build Revocation Infrastructure: Implement systems to invalidate compromised or expired credentials

Security and Privacy Considerations

Security and privacy are paramount in digital identity systems. eIDAS 2.0 incorporates multiple layers of protection, but implementation requires careful attention to best practices.

Security Requirements

1. Cryptographic Protection

• Use of public-key infrastructure (PKI) with qualified certificates
• Hardware security modules (HSMs) for key management
• Cryptographic algorithms meeting ETSI standards
• Secure element or trusted execution environment on mobile devices

2. Authentication Mechanisms

• Multi-factor authentication (MFA) for wallet access
• Biometric authentication (fingerprint, face recognition) where available
• PIN or password as fallback
• Anti-phishing and anti-cloning protections

3. Secure Communication

• End-to-end encryption for credential issuance and presentation
• Mutual TLS authentication between systems
• Secure channels preventing man-in-the-middle attacks

4. Incident Response

• Real-time monitoring for suspicious activity
• Rapid credential revocation capabilities
• Security audit logs for all transactions
• Breach notification procedures compliant with GDPR

Privacy Protections

1. Data Minimization Wallets implement selective disclosure, ensuring only necessary attributes are shared. For example:

• Age verification: Only “over 18” status shared, not full date of birth
• Address verification: Only city and country, not complete street address
• Professional qualification: Only credential validity, not full academic history

2. User Consent Every credential presentation requires explicit user consent. Users must clearly see what information will be shared before approving.
3. Unlinkability Transactions are designed to be unlinkable, preventing relying parties from tracking users across different services. This is achieved through:

• Zero-knowledge proofs where applicable
• Pseudonymous identifiers unique to each relying party
• No centralized tracking or logging

4. Data Sovereignty Users maintain full control over their credentials. They can:

• View all stored credentials
• Delete credentials at any time
• Revoke consent for shared information
• Export their data

5. GDPR Compliance The EUDI Wallet architecture is designed for full GDPR compliance:

• Right to access: Users can view all their data
• Right to erasure: Users can delete their wallets and credentials
• Right to portability: Credentials can be transferred between wallet providers
• Privacy by design: Minimal data collection and processing