European legal framework for digital identity and trust services
eIDAS is the European legal framework for electronic identification and trust services. Its full name is Regulation (EU) No 910/2014 on electronic identification and trust services for electronic transactions in the internal market. The purpose of eIDAS is to create trust in digital interactions across the EU, so that citizens, businesses and public authorities can use electronic identification and trust services across borders.
What is often called “eIDAS 2” is not a completely separate regulation. It is the 2024 amendment of the original eIDAS Regulation. Regulation (EU) 2024/1183 amended Regulation (EU) No 910/2014 to establish the European Digital Identity Framework, including the European Digital Identity Wallet. Sources: Regulation (EU) 2024/1183 and European Digital Identity Regulation implementation overview.
Why eIDAS matters
Digital services increasingly depend on trust. A person may need to prove their identity online, a company may need to sign a contract digitally, a public authority may need to send an official notification, or a service provider may need to verify a credential.Without a shared legal and technical framework, these interactions become fragmented. Different countries, sectors and service providers may use different identification systems, signature solutions or verification processes. This makes cross-border digital services more difficult and often leads to repeated checks, manual document handling and legal uncertainty.
eIDAS provides a common European trust framework. It defines when electronic identification means can be recognised across borders and when trust services such as electronic signatures, seals, timestamps, registered delivery services and website authentication certificates can have legal effect.
eIDAS 1: electronic identification and trust services
The original eIDAS Regulation, adopted in 2014, focused on two main pillars: electronic identification and trust services.The first pillar is electronic identification. Member States can notify national electronic identification schemes, which can then be recognised by other Member States for access to public services. This created a basis for cross-border recognition of national eID systems.
The second pillar is trust services. These are regulated digital services that help ensure authenticity, integrity, legal certainty and evidential value in electronic transactions. Examples include electronic signatures, electronic seals, electronic timestamps, electronic registered delivery services and website authentication certificates.
This framework was especially important for qualified trust services. A qualified electronic signature, for example, has the equivalent legal effect of a handwritten signature under eIDAS.
Why eIDAS needed an update
Although eIDAS 1 created an important legal foundation, its practical impact on digital identity remained limited. Not every Member State had a widely adopted eID scheme, cross-border use was often complex, and many private-sector services continued to rely on large platform-based login solutions or repeated identity checks.The update was introduced to create a more widely available, user-controlled and interoperable form of digital identity. The European Digital Identity Regulation aims to expand the functionality and usability of national eIDs and ensure mutual recognition of national wallets across Member States. Source: European Commission, European Digital Identity Regulation.
eIDAS 2 and the European Digital Identity Wallet
The most visible change introduced by eIDAS 2 is the European Digital Identity Wallet, often called the EUDI Wallet. The wallet should allow EU citizens and residents to identify themselves, store and present identity data and attributes, and access public and private services online and offline across the EU. Sources: European Commission, European Digital Identity and EU Digital Identity Wallet Home.The wallet is not just a login tool. It can contain Person Identification Data, or PID, and Electronic Attestations of Attributes. These attestations can represent verified information such as diplomas, driving licences, professional qualifications, permits, age attributes or other trusted claims.
A key principle is user control. The user should be able to decide what to share, with whom and for what purpose. The wallet should also support privacy-enhancing mechanisms such as selective disclosure, so that users do not need to reveal more data than necessary.
Trust services under eIDAS
Trust services remain a central part of the eIDAS framework. They provide the legal and technical assurance needed for digital transactions.Important trust services include electronic signatures, electronic seals, electronic timestamps, electronic registered delivery services, certificates for website authentication and electronic attestations of attributes. Some of these services can be qualified, meaning that they meet stricter requirements and are provided by a Qualified Trust Service Provider.
The distinction between ordinary and qualified trust services is important. Qualified trust services benefit from a higher level of legal recognition and assurance. For example, a qualified electronic signature has the equivalent legal effect of a handwritten signature.
Annexes and concrete requirements
eIDAS also includes seven annexes that translate the legal framework into concrete requirements for qualified trust services, certificates, attestations and authentic sources.Annex I sets out the requirements for qualified certificates for electronic signatures, which are used when a natural person signs electronically.
Annex II sets out the requirements for qualified electronic signature creation devices, which protect the keys and signing process behind a qualified electronic signature.
Annex III sets out the requirements for qualified certificates for electronic seals, which are used by legal persons such as companies or public sector bodies.
Annex IV sets out the requirements for qualified certificates for website authentication, which help prove the identity of the organisation behind a website.
Annex V sets out the requirements for Qualified Electronic Attestations of Attributes, making it an important bridge between trust services and wallet-based credentials.
Annex VI lists the categories of attributes that Member States must make electronically verifiable through authentic sources, including address, age, nationality, qualifications, powers and mandates, permits and company data. Source: Annex VI overview.
Annex VII sets out the requirements for electronic attestations of attributes issued by or on behalf of public sector bodies responsible for authentic sources.
This matters because eIDAS is not only a high-level legal framework. The annexes define the practical trust building blocks that make electronic signatures, seals, certificates, attestations and authentic-source data usable across Europe.
Annex VI is especially relevant for the wallet ecosystem because it identifies the types of attributes that should become electronically verifiable across the EU. This includes personal attributes, such as address, age and nationality, but also professional and organisational attributes, such as qualifications, public permits, powers and mandates, and financial and company data for legal persons. In practice, this annex helps connect EUDI Wallets, authentic sources, Qualified Trust Service Providers and future business wallet use cases.
Electronic signatures and seals
Electronic signatures are used by natural persons. They can be used when a person signs a document or transaction digitally.Electronic seals are used by legal persons, such as companies or public sector bodies. A seal can help prove that a document or data originated from a specific organisation and has not been altered.
This distinction is relevant for the wider wallet ecosystem. The EUDI Wallet is primarily person-centric, while the European Business Wallet focuses on organisations, mandates, business identity and formal business communication.
Electronic Attestations of Attributes
One of the most important additions in the updated framework is the stronger role of Electronic Attestations of Attributes. These are electronic statements that allow attributes of a person or object to be authenticated.In practice, attestations are the building blocks that make wallets useful beyond identity. A wallet can be used not only to prove who someone is, but also to prove specific attributes, rights, qualifications, roles or entitlements.
Some attestations may be qualified, such as Qualified Electronic Attestations of Attributes. Others may be issued by or on behalf of public sector bodies responsible for authentic sources. This creates a bridge between official registers, trust service providers, wallet providers and relying parties.
Relying parties and acceptance
A relying party is an organisation or service that requests and verifies data from a wallet. This may be a public authority, a bank, a university, an employer, a telecom provider, a mobility service or another digital service provider.For the EUDI Wallet to become useful, relying parties need to accept wallet-based identification and attestations in real services. eIDAS 2 therefore does not only define wallets and trust services; it also introduces a broader ecosystem in which wallet providers, issuers, relying parties, supervisory bodies and trust service providers need to work together.
Certification, supervision and implementing acts
The EUDI Wallet ecosystem is regulated. Wallets are not ordinary apps. They must meet requirements for security, privacy, certification, interoperability and incident handling.The European Commission publishes implementation materials and implementing acts for topics such as wallet certification, lists of certified wallets, security breaches, qualified trust service applications, qualified certificates, qualified electronic registered delivery services and validation procedures for electronic signatures and seals. Source: European Digital Identity Regulation implementation overview.
This is important because the regulation sets the legal framework, but many operational details are defined through implementing acts, standards, technical specifications and the Architecture and Reference Framework.
Architecture and Reference Framework
The EUDI Wallet ARF, or Architecture and Reference Framework, describes the technical and organisational model for the EUDI Wallet ecosystem. It explains the roles, components, protocols and interactions needed for interoperable wallet implementations.The ARF is not the regulation itself. It supports implementation by describing how the ecosystem can work in practice. For FIDES, the ARF is important because it connects legal requirements to technical choices such as credential formats, issuance protocols, presentation protocols, wallet units, relying party registration and trust mechanisms.
Relationship with the European Business Wallet
The European Digital Identity Wallet and the European Business Wallet are closely related, but they are not the same.The EUDI Wallet is primarily person-centric. It is designed for citizens and residents who need to manage their own identity data and attestations. The European Business Wallet is organisation-centric. It focuses on companies, public sector bodies, organisational identity, mandates, business credentials and legally valid communication.
In practice, the two may work together. A person may use their EUDI Wallet to prove who they are, while a Business Wallet may be used to prove that the person is authorised to act on behalf of an organisation.
Why this matters
eIDAS 2 is a major step in the development of European digital trust infrastructure. It moves the EU from a framework mainly focused on national eID schemes and trust services towards a broader wallet ecosystem for identity, credentials, attestations and trusted digital interactions.For citizens and residents, this may make it easier to access services and share verified information. For public authorities, it can support more efficient digital public services. For businesses and relying parties, it creates new possibilities for trusted onboarding, compliance, verification and cross-border digital services.
The impact will depend on adoption. Regulation alone is not enough. Wallets need to be usable, credentials need to be available, relying parties need to accept them, and technical implementations need to be interoperable.
The role of FIDES
For FIDES, eIDAS and eIDAS 2 are important foundations for the wider digital trust ecosystem. They provide the legal and regulatory context in which wallets, verifiable credentials, issuers, relying parties and trust services can operate.FIDES focuses on the practical side of adoption: making wallets, issuers, credential types, relying parties and interoperability profiles easier to discover, test and reuse.
A successful eIDAS ecosystem requires more than legislation. It requires shared understanding, reusable credentials, testable implementations, trusted sources and clear connections between the legal framework and real-world use cases. That is where FIDES aims to contribute.