Trusted digital statements about identity, rights and attributes
Electronic Attestations of Attributes, or EAAs, are digital statements that allow attributes to be authenticated. Under eIDAS 2, they become a formal building block of the European digital identity and trust-services ecosystem.
An attribute can be a characteristic, quality, right, permission or other piece of information about a person, organisation or thing. Examples include a diploma, professional qualification, licence, residence status, age, company role, mandate, permit or certification.
EAAs are important because digital identity is not only about proving who someone is. In many real-world processes, the more important question is whether someone has a certain attribute, right or authority. Are they qualified? Are they authorised? Are they a resident? Do they represent an organisation? Does a company hold a required permit? EAAs provide a regulated and interoperable way to express such information digitally.
Sources used are listed here.
Why Electronic Attestations of Attributes matter
Many digital services still rely on users uploading documents, certificates or screenshots to prove something about themselves or their organisation. These documents may come from trusted sources, but they are often difficult to verify automatically.A relying party may need to check whether a document is authentic, whether it has been changed, whether the issuer is trusted, and whether the information is still valid. This creates friction for users, businesses and public authorities.
EAAs address this by turning trusted attributes into structured, digitally verifiable attestations. Instead of submitting a scanned certificate or manually entered data, a user or organisation can present an attestation that can be verified by the receiving party.
This supports faster onboarding, better compliance checks, reduced administrative burden and more trustworthy digital services.
Attributes, credentials and attestations
EAAs are closely related to Verifiable Credentials, but the legal terminology under eIDAS is different.A Verifiable Credential is a technical and data-model concept. It refers to a digital credential that can be cryptographically verified.
An Electronic Attestation of Attributes is an eIDAS legal concept. It refers to an attestation in electronic form that allows attributes to be authenticated.
In practice, these concepts can overlap. An EAA may be implemented using credential technologies, wallet protocols and credential formats. But the term EAA is important because it connects the credential to the eIDAS legal framework, trust services and specific legal effects.
The role of the EUDI Wallet
The European Digital Identity Wallet is designed to store, manage and present Person Identification Data and Electronic Attestations of Attributes. This means that users can use the wallet not only to identify themselves, but also to prove specific attributes when interacting with public or private services.For example, a person could use an EUDI Wallet to present a diploma, a driving entitlement, a professional qualification or a residence-related attribute. A business user could present attributes related to an organisation, role or mandate, depending on the use case and the applicable framework.
This makes EAAs one of the most important credential categories in the EUDI Wallet ecosystem. PID answers the question “who is this person?” EAAs answer questions such as “what is true about this person, organisation or object?” and “which rights or qualifications can be trusted?”
Qualified and non-qualified attestations
eIDAS distinguishes between different levels and contexts of electronic attestations.A general EAA is an electronic attestation that allows attributes to be authenticated. Under eIDAS, such attestations cannot be denied legal effect or admissibility as evidence in legal proceedings solely because they are in electronic form.
A Qualified Electronic Attestation of Attributes, or QEAA, is issued by a Qualified Trust Service Provider and must meet the requirements laid down in Annex V of eIDAS. This gives it a higher assurance level and a stronger legal position within the European trust framework.
There is also a specific category for attestations issued by or on behalf of public sector bodies responsible for authentic sources. These are relevant where the attribute comes from an official public register or authoritative source.
Authentic sources
The value of an attestation depends strongly on the source behind it. Some attributes can only be trusted if they are verified against an authentic source.An authentic source is an authoritative data source that is recognised as the origin or reference source for specific information. Examples may include population registers, business registers, professional registers, education registers, permit registers or other official sources.
Under eIDAS 2, authentic sources become especially important because certain attributes must be electronically verifiable. Annex VI identifies categories of attributes that Member States must make electronically verifiable through authentic sources or recognised mechanisms. This includes both personal and professional or organisational attributes, such as address, age, qualifications, permits, powers and mandates, and company data.
This is highly relevant for FIDES because authentic sources are often the natural issuers, or source authorities, behind reusable digital credentials.
Annex V, VI and VII
The annexes to eIDAS are important for understanding how EAAs fit into the legal framework.Annex V defines requirements for Qualified Electronic Attestations of Attributes. These requirements help ensure that a QEAA contains the information needed to identify the issuer, the subject, the attributes, the validity period and other elements relevant for trust and verification.
Annex VI lists categories of attributes that Member States must ensure can be verified electronically against authentic sources. This annex is important because it points to the types of data that are expected to become reusable in wallet-based services.
Annex VII concerns electronic attestations of attributes issued by or on behalf of public sector bodies responsible for authentic sources. This category is important where a public authority or authorised body provides attributes based on official records.
Together, these annexes show that EAAs are not just a technical credential feature. They are part of a legal and organisational framework for trusted data exchange.
Examples of Electronic Attestations of Attributes
EAAs can support many real-world use cases.For individuals, examples include education credentials, proof of age, residence attributes, professional qualifications, driving entitlements, membership credentials or permits.
For organisations, examples include company registration data, roles, mandates, representation rights, licences, tax-related attributes, certifications, compliance status or public authorisations.
For products or assets, similar attestation concepts can be used to express conformity, certification, sustainability or traceability claims, although the exact legal classification may depend on the applicable framework.
The common pattern is that an issuer attests to a specific attribute, the holder manages it, and a relying party verifies it when needed.
Electronic Attestations of Attributes and trust services
eIDAS 2 introduces the issuance of EAAs as a trust service. This is important because attribute attestations are not merely informal credentials; they can be part of a regulated trust-services market.Qualified trust service providers can issue QEAAs if they meet the applicable requirements. Public sector bodies or parties acting on their behalf can issue attestations linked to authentic sources under the relevant eIDAS provisions.
This creates a bridge between existing trust services, public registers, wallet providers and relying parties. It also creates new responsibilities around assurance, supervision, interoperability and acceptance.
For more context, see the FIDES topic on eIDAS 2.
Relationship with Verifiable Credentials
EAAs can be understood as one of the most important legal categories of credentials in the European framework.Verifiable Credentials provide a technical model for trusted digital claims. EAAs provide an eIDAS legal category for digital attestations of attributes. In many wallet ecosystems, the same object may be discussed from both angles: technically as a credential, legally as an attestation.
For example, a professional qualification could be represented as a credential in a wallet. If it is issued under the eIDAS rules as an EAA or QEAA, it may also carry specific legal effects and trust assumptions.
This means that implementers must pay attention to both layers: the credential format and protocol layer, and the legal or governance layer that determines the status of the attestation.
Relationship with the European Business Wallet
EAAs are highly relevant for the European Business Wallet because organisations often need to prove more than their identity.A business wallet may need to hold and present company attributes, registration data, permits, authorisations, certifications, mandates and representation rights. These are all attribute-based claims.
In business processes, the relying party often needs to know whether a person is allowed to act on behalf of a company, whether a company has a required licence, or whether a specific business attribute comes from an authoritative source.
EAAs and QEAAs can therefore become important building blocks for trusted business interactions, compliance reporting, onboarding, procurement, e-invoicing and cross-border services. For more context on organisation-centric wallet use cases, see the FIDES topic on Business Wallets.
Relationship with issuers and relying parties
EAAs only create value if the ecosystem around them works.Issuers must be trusted for the attributes they provide. Wallets must support receiving, storing and presenting attestations. Relying Parties must be able to request, verify and interpret them. Trust registries, schemas, status mechanisms and interoperability profiles are needed to make this work across organisations and borders.
This is especially important because different attributes require different trust assumptions. A diploma should come from an education institution or recognised authority. A company role may need to come from a business register, a mandate register or an authorised organisational source. A certification should come from a recognised certification body.
Without clear discovery and governance, verifiable attestations can still be difficult to reuse.
Credential types and interoperability
An EAA is useful only if the receiving party understands what it means. This requires agreement on credential types, schemas, semantics, assurance levels, status information and presentation rules.For example, two attestations may both describe a professional qualification, but they may use different schemas, different issuer models or different evidence rules. A verifier needs to understand whether these attestations are equivalent, acceptable or relevant for the process.
This is why Credential Types and Interop Profiles are important. They help make attributes reusable across wallets, issuers and relying parties instead of creating isolated implementations for each use case.
Why EAAs are not enough on their own
An EAA can make an attribute digitally verifiable, but it does not automatically solve every trust question.A relying party still needs to understand what the attribute means, who issued it, whether the issuer is trusted, which legal or sector-specific rules apply, and whether the attestation is still valid.
This is why schemas, credential catalogs, authentic-source registries, trusted lists, rulebooks and interoperability profiles remain essential. EAAs are a powerful building block, but they need ecosystem infrastructure around them.
Why this matters
EAAs can make digital services more efficient, trustworthy and user-centric. They allow people and organisations to prove specific facts without repeatedly submitting documents or giving direct access to source systems.For public services, EAAs can reduce administrative burden and support cross-border digital procedures. For businesses, they can support onboarding, compliance, reporting, authorisation and trusted data exchange. For users, they can support more control over which attributes are shared and with whom.
EAAs also help shift digital identity from “login” to “trusted claims”. Instead of only authenticating a user, digital services can verify the attributes that actually matter for a transaction.
The role of FIDES
For the FIDES Community, Electronic Attestations of Attributes are a key concept because they connect wallets, credentials, issuers, authentic sources and relying parties.FIDES can help by making EAA-related credential types, issuers and relying parties discoverable. It can also help clarify which attributes are available, who can issue them, which wallets support them, and in which use cases they are accepted.
This is exactly where the FIDES Ecosystem Explorer, Credential Catalog, Issuer Catalog, Relying Party Catalog and interoperability profiles become relevant. A functioning EAA ecosystem requires more than legal definitions and technical standards. It requires practical visibility into the trusted data flows that organisations can actually use.