Electronic Identification eID

Electronic identification is the process of using person identification data in electronic form that uniquely represents a natural person, a legal person, or a natural person who represents someone else (Article 3(1) of the eIDAS Regulation). It is a way to show who you are online with an identity that somebody has already checked.

The regulation builds the term from three others. Person identification data is a set of data, issued under Union or national law, that enables the identity of a person to be established (Article 3(3)). An electronic identification means is the material or immaterial unit that contains this data and is used for authentication for an online service or, where appropriate, an offline one (Article 3(2)). An electronic identification scheme is the system under which such means are issued (Article 3(4)).

So the scheme is the national system, the means is what the person holds, and the data is what the means carries. A means can be a physical object, such as an identity card with a chip. It can also be immaterial, such as an app on a phone. The state does not have to issue it. Article 7 also accepts means issued under a mandate from the state, or independently of it where the state recognises them.

No. The three are links in one chain. Verification comes first. Before a means is issued, somebody has to establish that the applicant is who they claim to be. Article 7(d) makes the notifying member state responsible for ensuring that the identification data is attributed to the right person at the time the means is issued. Remote identity verification is how such a check is done without a meeting.

Authentication comes last, and it happens at every use. eIDAS defines it as an electronic process that enables the confirmation of the electronic identification of a person (Article 3(5)). Take a person who opens a national identity app and enters a PIN to log in to a tax portal. The PIN step is authentication.

Electronic identification is the whole act of using that data to represent oneself. A firm that examines a client's passport has verified an identity. It has not used electronic identification, because no scheme has issued the client a means that can be used again. With electronic identification, one check can be relied on many times by many services.

A member state notifies a scheme to the European Commission once the scheme meets the conditions in Article 7. The means must give access to at least one public sector service in the notifying state. The scheme must meet at least one of the eIDAS assurance levels. The state must make authentication available online to relying parties in other member states. The procedure then runs in a fixed order.

1. At least six months before notification, the member state gives the other member states a description of the scheme (Article 7(g)).
2. The other member states carry out a peer review of the scheme (Article 12(5)). Schemes, or parts of schemes, that a conformity assessment body has certified are exempt from it (Article 12a(5)).
3. The member state notifies the Commission. It describes the scheme, its assurance levels, its issuers and the supervisory regime (Article 9(1)).
4. The Commission publishes the list of notified schemes in the Official Journal of the European Union (Article 9(2)).
5. Public sector bodies in the other member states recognise the means no later than 12 months after that publication (Article 6(1)).

It must be accepted by public sector bodies for their online services, on three conditions set by Article 6(1). The means comes from a scheme on the Commission's list. Its assurance level is substantial or high, and at least equal to the level the service requires. The public body itself uses level substantial or high for access to that service. A means at level low may be recognised, but no body is obliged to do so (Article 6(2)).

The duty stops at the public sector. Article 6 does not require a private company to accept a notified means. For relying parties other than public sector bodies, the notifying state may define the terms of access to authentication (Article 7(f)). A law firm cannot assume that it may connect to another country's scheme.

The 2024 amendment goes further for the European Digital Identity Wallet, which is itself an electronic identification means (Article 3(42)). Member states that require electronic identification for a public online service must also accept the wallet (Article 5f(1)). Certain private relying parties must accept it as well, when the user asks (Article 5f(2)). Who they are, and by when, is set out under European Digital Identity Wallet.

Yes. The Anti-Money Laundering Regulation, which applies from 10 July 2027, names electronic identification as one of two means of verifying a customer's identity. Article 22(6)(b) covers the use of electronic identification means that meet the eIDAS requirements for assurance levels substantial or high and relevant qualified trust services. Recital 66 treats qualified trust services as the route for customers who have no such electronic identification. The other means is an identity document, passport or equivalent.

An electronic identity helps a firm only if it delivers the data the firm has to collect. Article 28(1) gave the Anti-Money Laundering Authority until 10 July 2026 to submit draft regulatory technical standards. Under that article the standards specify, among other things, the list of attributes that electronic identification means and relevant qualified trust services must feature.