eIDAS 2.0 & EUDI Wallet: What Businesses Need to Know

For businesses, the EUDI Wallet creates new opportunities to digitally verify identities, attributes, and authorizations and integrate them into business processes. In addition, certain online services may be required to accept the EUDI Wallet in the future.

What does this mean for businesses? We explain how the EUDI Wallet works, what changes eIDAS 2.0 introduces, and what opportunities it creates for digital business processes.

Which Businesses Could Be Affected by eIDAS 2.0?

eIDAS 2.0 may be particularly relevant for businesses that need to verify identities, attributes, or authorizations in their digital processes or provide corresponding credentials. For example, the EUDI Wallet could play an important role in Know Your Customer (KYC) processes during customer onboarding. Similar requirements can also arise in B2B, contract, and HR processes.

There is also a regulatory dimension: Certain providers of online services may in the future be required to accept the EUDI Wallet for identification purposes. We explain below which businesses may be affected, what requirements apply, and when the mandatory acceptance requirements take effect.

What changes with eIDAS 2.0?

The original eIDAS Regulation already established an EU-wide legal framework for electronic identification and trust services such as electronic signatures, seals, and timestamps. eIDAS 2.0 builds on this framework and, in particular, expands it to include an EU-wide infrastructure for digital identities and electronic credentials.

Key changes include:

• EUDI Wallet: Individuals gain new ways to identify themselves digitally and to manage and provide electronic credentials.
• Digital credentials and attributes: In addition to identity information, individual attributes, such as characteristics and authorizations, can be verified electronically.
• Expanded trust services: The existing eIDAS framework is extended to include additional trust services, while existing rules are further developed.
• EU-wide interoperability: Digital identities and credentials are intended to work across borders and across different national solutions.

Greater control over personal data: Users should be able to control which information they provide for a specific purpose

The EUDI Wallet as a key innovation

The European Digital Identity Wallet, or EUDI Wallet, can be thought of as a digital wallet for identity data and electronic credentials. Users can use it to manage their digital identity, store credentials, and present them to public or private services.

However, the EUDI Wallet is intended to be more than a digital version of an ID card. It can also be used to manage other digital credentials and authorizations and selectively present them when needed. Examples include driver’s licenses, educational credentials, and other certificates.

The key idea is that users should be able to use these credentials across the EU and across different services. Instead of requiring a separate digital identity and process for each service provider, eIDAS 2.0 establishes a common European framework for their use.

How does the EUDI Wallet work?

The EUDI Wallet enables users to exchange digital credentials with a service that requires specific identity data or digital credentials.

The service requests the information needed for a particular transaction. The wallet shows the user which data is being requested.

The user decides which requested information to share. The service then receives the corresponding data or credentials and can electronically verify their origin and validity.

In simple terms, the process involves four steps:

1. A service requests specific information or credentials.
2. The EUDI Wallet shows the user which data is being requested.
3. The user decides whether to share the requested information.
4. The service receives the shared information and can verify the credential.

Identity or individual attribute: What data is really needed?

Not every digital transaction requires a person’s full identity. Often, it is enough to verify a specific attribute or authorization. This is where the EUDI Wallet comes into play.

A simple example is age verification:
Instead of sharing the exact date of birth, it may be sufficient for a specific transaction to confirm that the person meets the required age threshold.

This also changes the way we think about digital identities. The question is no longer just “Who are you?” but increasingly “What attribute or authorization can you prove?”

However, digital identities and credentials are only one aspect of eIDAS 2.0.

Data privacy: Who controls the data in the EUDI Wallet?

A key principle of the EUDI Wallet is to give users greater control over which personal data they share for a specific purpose. A service should not automatically have access to all the information available in the wallet, but only to the data or credentials requested for the specific use case.

This follows the principle of data minimization:
Where a single attribute is sufficient, users do not need to disclose their full identity.
This also follows the need-to-know principle: Only the information actually required for the specific purpose is provided.

The EUDI Wallet is not designed as a centralized European database for personal identity data. Users should be able to see what information a service is requesting and decide for themselves which information to share.

For businesses, this also changes the perspective on digital identification processes: Instead of requesting as much identity data as possible, the focus increasingly shifts to determining which information is actually required for a specific business transaction.

Expanded electronic trust services

Digital credentials are most useful when their origin and integrity can be reliably verified. This is where electronic trust services come into play. They provide the foundation for establishing trust in electronic information and transactions.

Electronic signatures, seals, and timestamps already existed under the original eIDAS Regulation. eIDAS 2.0 adds further trust services:

• Electronic attestations of attributes: These confirm attributes or authorizations of a person or organization, such as age, qualifications, or authority to represent an organization. These credentials can also be used and presented through the EUDI Wallet.
• Electronic archiving services: These help preserve verifiable evidence of the integrity and origin of electronic data and documents over time.
• Electronic ledgers: These make it possible to verify the chronological sequence and integrity of electronic data records.
• Management of qualified remote electronic signature and seal creation devices: This enables qualified electronic signatures and seals to be created securely and remotely.

 
eIDAS 2.0 thus extends the European trust framework beyond digital identification. Attributes and authorizations can be verified electronically, digital information can be exchanged in a trusted manner, and its integrity can be preserved over time.

How do the EUDI Wallet and trust services work together?

For businesses in particular, the interaction between the two is important: The EUDI Wallet enables users to manage and present digital identities and credentials. Trust services provide the foundation for reliably verifying the origin and integrity of this electronic information.

This enables digital business processes in which businesses can not only receive information electronically, but also verify its trustworthiness.

What does eIDAS 2.0 mean for businesses?

For businesses, eIDAS 2.0 opens up two key perspectives: They can integrate digital identities and credentials into their own business processes. At the same time, they can provide credentials for customers, employees, or business partners.

This becomes particularly relevant where businesses currently request identity documents, certificates, or proof of authorization and then verify them manually. In the future, verifiable digital credentials can be used in these processes. This can simplify workflows while also allowing businesses to request only the information actually needed for a specific purpose.

Where can the EUDI Wallet support business processes?

Potential use cases can be found wherever businesses need to reliably verify identities, attributes, or authorizations. Examples include:

• Customer onboarding: Required identity data can be provided and verified digitally. Depending on the use case, individual attributes may be sufficient instead of complete documents.
• Age and authorization verification: Businesses can verify whether a person meets specific requirements without requesting additional personal data that is not necessary for the transaction.
• Qualification credentials: Educational degrees, professional qualifications, and other credentials can be presented digitally and verified for validity.
• B2B processes: In business transactions, a person’s identity may not be the only relevant factor. It can also be important to know what role the person is acting in and whether the person is authorized to represent a company. Appropriate credentials can provide electronic proof of this authority.
• Digital contract processes: Identity credentials and electronic trust services can work together to support digital processes from identification through electronic signature.

The real value therefore goes beyond a new form of digital identification. The EUDI Wallet becomes particularly relevant where businesses currently handle credentials across different systems, documents, and verification steps.

This raises a practical question for businesses: At which points in our processes do people currently need to prove their identity, specific attributes, or authorizations, and how could these steps be handled digitally in the future?

EUDI Wallet: Where businesses need to take action

The EUDI Wallet not only creates new opportunities for digital business processes.
Under certain conditions, eIDAS 2.0 will also require private service providers to accept the EUDI Wallet for online identification.

The industry alone does not determine whether this requirement applies. A key factor is whether a business provides an online service for which strong user authentication is required by law or by contract. Microenterprises and small enterprises are exempt from this requirement.

The sectors listed in Article 5f of the eIDAS Regulation include transportation, energy, banking, financial services, social security, healthcare, drinking water, postal services, digital infrastructure, education, and telecommunications.

Does my business have to accept the EUDI Wallet?

Businesses should consider three questions:

1. Is strong user authentication required by law or contract for the online service?
2. Does the specific online service fall under the mandatory EUDI Wallet acceptance requirements of eIDAS 2.0?
3. What technical and organizational changes are required to integrate the EUDI Wallet into the identification process?

If an online service is subject to the mandatory acceptance requirements, the business must accept the EUDI Wallet for the relevant online identification process when voluntarily requested by the user. Separate requirements apply to very large online platforms.

What eIDAS 2.0 deadlines should businesses keep in mind?

The EUDI Wallet is being introduced in stages. Businesses should keep four key milestones in mind:

• Since May 20, 2024: The revised eIDAS Regulation has been in force.
• 2025: Implementing acts specify the technical and organizational requirements for the EUDI Wallet and the European wallet ecosystem.
• By the end of 2026: EU Member States must provide at least one EUDI Wallet that meets the common European requirements.
• 36 months after the relevant implementing acts enter into force: The mandatory acceptance requirements take effect for certain private service providers. One of the conditions is that strong user authentication is required by law or contract for the respective online service.

Businesses therefore do not need to wait until the EUDI Wallet becomes widely established in everyday use. Organizations that may be subject to the mandatory acceptance requirements can already review their identification processes: Where is strong user authentication currently used? What identity or authorization credentials are required? And which systems would need to interact with an EUDI Wallet in the future?

Businesses that are not subject to mandatory acceptance requirements can also benefit from reviewing their existing processes. Regardless of regulatory obligations, the EUDI Wallet may be relevant wherever identities, attributes, and authorizations are currently verified using documents or separate processes.

Note: This article is intended for general informational purposes only and does not constitute legal advice. Whether and to what extent specific eIDAS 2.0 requirements apply to a business depends on the individual use case.