Proving who you are online in Europe is still surprisingly clumsy. Depending on the country and the service, you might photograph your passport, record a selfie video, log in through a national eID scheme that doesn't work across borders, or wait days for a manual review.
eIDAS 2.0 is the EU's attempt to replace that patchwork with something consistent: a digital identity wallet on your phone that works in every member state, lets you share only the attributes a service actually needs, and is accepted by a defined set of businesses and public bodies.
Some services will have to accept the wallet; others can choose whether to add it. The answer depends on your authentication requirements, business size, and the type of service you run.
From eIDAS to eIDAS 2.0
The original eIDAS Regulation from 2014 created a framework for electronic identification and trust services across the EU. It gave legal standing to electronic signatures, seals, and timestamps, and it set up mutual recognition of national eID schemes so that a citizen of one member state could, in principle, use their national eID to access public services in another.
In practice, adoption was uneven. National schemes varied widely, private-sector uptake was limited, and many citizens had no notified eID at all. Cross-border use stayed mostly theoretical outside a handful of public services.
Regulation (EU) 2024/1183, usually called eIDAS 2.0, amends the original regulation to fix that. It entered into force on 20 May 2024, and its centerpiece is the European Digital Identity Wallet, often shortened to EUDI Wallet.
What the EU Digital Identity Wallet is
The EUDI Wallet is an app, provided or recognized by each member state, that holds verified identity data and other credentials on the user's device. It isn't a single EU-wide app. Each country issues or certifies its own wallet, but all of them follow a shared technical framework so they work across borders.
A wallet holds person identification data, the core verified identity attributes such as name and date of birth, issued by the member state. Alongside that, it can hold electronic attestations of attributes: credentials like a driving license, a university diploma, a professional qualification, or proof of age, issued by public bodies or qualified private providers.
The wallet also lets users create qualified electronic signatures, and member states have to make that free for non-professional use. That alone could change how contracts and forms get signed for consumers.
The features that matter for businesses
Selective disclosure is the headline privacy feature. If a service only needs to know that a user is over 18, the wallet can share exactly that, rather than a full name, birth date, and ID number. That lets a business verify age without storing an identity document.
Users stay in control of every exchange. Each request shows the user which service is asking, what it's asking for, and lets them approve or refuse. The wallet keeps a log of transactions so users can see who requested what, and they can report suspicious requests to their national data protection authority.
Relying parties, which is the regulation's term for services that accept the wallet, have to register with their member state and declare what they intend to request. A wallet will show users the registered identity of whoever is asking, which makes it much harder for a phishing site to impersonate a legitimate service.
Key dates
The regulation is in force now, but the obligations follow the Commission's implementing acts, which set out the technical standards. The first batch was adopted in late 2024, and member states have 24 months from the entry into force of the relevant implementing acts to provide at least one wallet to their citizens, putting the deadline around the end of 2026.
Mandatory acceptance comes later. Private relying parties in scope have to accept the wallet within 36 months of the relevant implementing acts, which puts that obligation in late 2027. Public sector bodies that offer online services requiring electronic identification have to accept it too.
National rollouts are moving at different speeds. Several countries have run large-scale pilots, and the Commission has separately piloted an age verification app built on the same technical framework. Check your own country's progress, since the date a wallet becomes widely held matters more for your users than the legal deadline.
Will your website need to support it?
For most small businesses, no. Acceptance is mandatory for a specific group, not for every website that has a login page.
Article 5f covers private relying parties required by national or EU law, or by contract, to use strong user authentication for online identification, with an explicit exemption for microenterprises and small enterprises under the referenced EU definition. The regulation names sectors where this commonly applies, including banking and financial services, transport, energy, health, social security, postal services, telecommunications, digital infrastructure, education, and drinking water. Sector membership alone is insufficient. Check the strong-authentication trigger, enterprise-size exemption, and applicable deadline before concluding that acceptance is mandatory.
Very large online platforms, as designated under the Digital Services Act, also have a separate acceptance duty when they require authentication, subject to voluntary user request and the minimum data needed for that service. Note that the obligation is to accept the wallet as an option, not to make it the only login method, and users can't be forced to use it.
Everyone else can choose. A typical ecommerce shop, SaaS app, or community site has no obligation, though there may be good reasons to opt in anyway.
Why you might adopt it voluntarily
Age verification is the most obvious reason. If you sell age-restricted products or host content that requires an age check, selective disclosure lets you confirm "over 18" without storing a copy of an ID document. That reduces both friction for users and the amount of sensitive personal data sitting in your database.
KYC and onboarding are another. Any business that verifies identity today, whether it's a marketplace confirming sellers or a platform checking business customers, pays for document scanning services or manual reviews. A cryptographically verified credential from the wallet is faster and more reliable than an uploaded photo.
There's also a GDPR angle. Collecting less data is easier to justify, easier to secure, and easier to delete. Being able to say you verify age or identity without retaining documents is a stronger position than holding a folder of passport scans.
How integration works technically
The wallet ecosystem is built on open standards, which is good news if you run your own infrastructure. The Commission publishes an Architecture and Reference Framework and reference implementations on GitHub.
Credential presentation uses OpenID for Verifiable Presentations, part of the OpenID for Verifiable Credentials family of specifications from the OpenID Foundation. Credentials themselves come in two formats: SD-JWT VC, a JSON-based format supporting selective disclosure, and the ISO/IEC 18013-5 mdoc format originally developed for mobile driving licenses.
In practice, your service acts as a verifier. It creates a presentation request saying which attributes it wants, the user's wallet responds with a signed presentation, and your verifier validates issuer trust, signatures, validity and revocation status where applicable, holder binding, and request binding such as audience and nonce. Use a maintained implementation rather than treating a signature check alone as a complete verification flow. Users can scan a QR code on desktop, or follow a deep link into the wallet app on mobile.
How to prepare as a relying party
First, figure out whether you're obligated. Check whether your sector and your current authentication requirements put you in scope for mandatory acceptance in late 2027. Check the microenterprise and small-enterprise exemption too. If you're unsure, your sector regulator or national eIDAS supervisory body is the place to ask.
Second, identify the attributes you actually need. Selective disclosure only helps if you ask for less, so map each use case to its minimal attribute set: proof of age, country of residence, verified name, or a specific credential.
Third, watch your national registration process. Relying parties have to register with their member state before wallets will accept their requests, and each country is setting up its own procedure. You'll typically receive a relying party access certificate that identifies your service to wallets.
Fourth, choose your integration path. You can build a verifier using the reference libraries, use an open-source identity platform as these add OpenID for Verifiable Credentials support, or buy verification as a service. Self-hosting the verifier keeps identity data off third-party systems, which suits teams already running their own authentication on a VPS under EU jurisdiction.
Finally, test before your users show up. Reference wallets and test environments exist so you can build and validate the flow before national wallets are widely held.
Wrapping up
eIDAS 2.0 gives every EU citizen access to a digital identity wallet by around the end of 2026, with mandatory acceptance for regulated sectors and very large platforms following in late 2027. For most websites, support is optional, but selective disclosure makes it an attractive way to handle age checks and identity verification without storing documents.
If you're in a regulated sector, start mapping your requirements now. If you're not, keep an eye on how quickly your users actually adopt their national wallet, because that's the signal that voluntary support is worth building.
Thanks for reading! If you're planning to run identity verification or authentication on infrastructure you control, QDE offers unmanaged KVM VPS hosting in Amsterdam, with EU-located infrastructure, non-oversold RAM and storage, and full root access for your own stack.
Have questions about your setup? Contact our team and we'll help you find the right fit.
Frequently asked questions about eIDAS 2.0 and the EU Digital Identity Wallet
What is the EU Digital Identity Wallet?
It's an app, provided or recognized by each EU member state, that stores verified identity data and other credentials on a user's phone. Users can share selected attributes with online services, sign documents electronically, and use it across all member states.
When will the EUDI Wallet be available?
Member states have to provide at least one wallet to their citizens within 24 months of the core implementing acts, which puts the deadline around the end of 2026. Actual availability depends on each country's rollout.
Does my website have to accept the EU Digital Identity Wallet?
The private-sector duty generally covers relying parties required by law or contract to use strong user authentication, excluding microenterprises and small enterprises under the EU definition. Very large online platforms have a separate duty. Check the precise implementing-act deadlines and any sector-specific rules; private-sector acceptance is expected in late 2027.
Is the EU Digital Identity Wallet mandatory for citizens?
No. Using the wallet is voluntary, it's free for individuals, and services can't make it the only way to access them where the regulation requires an alternative.
What standards does the wallet use?
Credential presentation uses OpenID for Verifiable Presentations, and credentials come in SD-JWT VC or ISO/IEC 18013-5 mdoc formats. The Commission's Architecture and Reference Framework documents the full technical setup.
Can I use the wallet just for age verification?
Yes. Selective disclosure lets a service request only a proof that the user is over a given age, without receiving their name, birth date, or document number.