eIDAS 2.0

eIDAS 2.0 is an amending act. Regulation (EU) 2024/1183 of 11 April 2024 did not repeal the 2014 regulation. It rewrote some articles and inserted new ones. The law to read is still Regulation (EU) No 910/2014, in its consolidated version. Inserted articles carry a letter, such as Article 5a on the wallet. Older ones keep their numbers, such as Article 25 on the legal effect of signatures.

The amending act calls its subject the European Digital Identity Framework. "eIDAS 2.0" is an informal label.

eIDAS 2.0 entered into force on 20 May 2024, and its obligations arrive in stages. Most dates are printed in the text. The two wallet dates are counted from the entry into force of the Commission's wallet implementing regulations.

The two December dates are derived. The wallet implementing regulations entered into force on 24 December 2024, the twentieth day after their publication. Adding 24 months puts the deadline for member states at 24 December 2026. Adding 36 months puts the deadline for private firms at 24 December 2027.

The wallet is an electronic identification means that lets a person store identity data and electronic attestations of attributes, present them to others, and sign with a qualified electronic signature (Article 3(42)). It is provided at assurance level high (Article 5a(11)).

Three design rules matter to anyone who will receive wallet data. A relying party must register in the member state where it is established and declare which data it intends to request (Article 5b). It may not ask for anything beyond that. The user gets a dashboard showing every relying party they have shared data with, from which they can request erasure or report a suspicious request (Article 5a(4)).

Acceptance is compulsory for some. Public bodies that require electronic identification for an online service must accept the wallet. Private firms that must use strong user authentication have to accept it when the user asks, unless they are micro or small enterprises. Very large online platforms that require users to authenticate must accept it when the user asks (Article 5f).

eIDAS 2.0 adds four trust services to the original list (Article 3(16)): electronic attestations of attributes, electronic archiving, electronic ledgers and the management of remote signature creation devices. The legal effect of each qualified form is set out with the other trust services of the eIDAS Regulation.

Electronic attestations of attributes are verified statements about a person or a company. Annex VI lists attributes that member states must let qualified providers verify against public sources. They include professional qualifications, company data and powers to represent a person or a company.

The management of remote signature creation devices, where the signer's key is held on the provider's servers, is a qualified service in its own right (Article 29a). Article 51(3) allowed qualified providers that already managed such devices to continue without that separate status until 21 May 2026.

For signing itself, very little. Article 25(2) is unchanged: a qualified electronic signature has the equivalent legal effect of a handwritten signature. Documents already signed are unaffected.

The changes sit around the signature. Providers face stricter supervision. Their audits now also cover Article 21 of the NIS2 Directive (Article 20(1)). The 24-hour duty to report significant security breaches is not new. For qualified providers it now sits in Article 24(2)(fb) and also covers disruptions of the service. A firm's part is to confirm that its provider still appears as qualified in the EU Trusted List browser.

Identity checks gain a route. The wallet is one of the listed ways to verify a person before a qualified certificate is issued. Other methods confirmed by a conformity assessment body remain available (Article 24(1a)).

Client evidence may change in time. An attestation of attributes could let a client prove a professional licence or a power to represent a company electronically. A firm that wants to receive wallet data will have to register as a relying party first.