European Digital Identity Wallet EUDI Wallet

The European Digital Identity Wallet is an electronic identification means, defined in Article 3(42) of the eIDAS Regulation. The definition gives it three jobs. The user can securely store, manage and validate person identification data and electronic attestations of attributes. The user can provide them to relying parties and to other wallet users. The user can sign with qualified electronic signatures or seal with qualified electronic seals.

Two of those terms need a short explanation. Person identification data is the set of data, issued under Union or national law, that establishes who a person is (Article 3(3)). An electronic attestation of attributes is an attestation in electronic form that allows attributes to be authenticated, and an attribute is a characteristic, quality, right or permission of a person or of an object (Article 3(43) and (44)).

The wallet came into the regulation through Regulation (EU) 2024/1183, the amendment often called eIDAS 2.0. Each wallet must be provided under an electronic identification scheme with assurance level high, the highest of the three levels in the regulation (Article 5a(11)).

There is no single EU wallet. A wallet can be provided directly by a member state, under a mandate from a member state, or independently of a member state but recognised by it (Article 5a(2)).

Each member state must provide at least one. Article 5a(1) sets the deadline by reference to other acts, not as a calendar date. The wallet is due within 24 months of the date of entry into force of the implementing acts referred to in Article 5a(23) and Article 5c(6). Those are Commission acts that set the standards and procedures for what the wallet does and for how it is certified. The regulation set 21 November 2024 as the deadline for the Commission to establish them. Commission Implementing Regulations (EU) 2024/2979 and (EU) 2024/2981 entered into force on 24 December 2024, which puts the member states' deadline at 24 December 2026.

The duty lies on the state. The wallet is meant for all natural and legal persons in the Union, so companies are covered as well as individuals. For individuals, issuance, use and revocation are free of charge (Article 5a(13)). Nobody is obliged to have one (Article 5a(15)).

Article 5a(4) lists the functions every wallet must give its user. Most of them fall into two groups.

The first is identification. The user must be able to request, obtain, select, combine, store, delete, share and present identity data and attestations, under their sole control. They use these to authenticate to relying parties online and, where appropriate, in offline mode. Selective disclosure must be possible, so a user can show one item without showing the rest.

The second is control. The wallet must generate pseudonyms and store them encrypted and locally within the wallet. It must give access to a log of all transactions through a dashboard, where the user can see which relying parties they have connected with and what data was exchanged. From there they can ask a relying party to erase personal data under Article 17 of the GDPR, or report it to the national data protection authority.

Signing has its own rule. The wallet must let the user sign with qualified electronic signatures, and it must offer all natural persons the ability to do so by default and free of charge (Article 5a(5)(g)). Member states may take proportionate measures to limit the free signature to non-professional purposes. A partner who signs engagement letters for a firm may therefore fall outside the free offer, depending on the member state.

The definition of a qualified electronic signature has not changed. It still needs a qualified certificate, and only a qualified trust service provider can issue one (Article 3(12) and (15)). The wallet is a new way to reach a qualified signature. A provider still stands behind the certificate.

Article 5f names three groups that must accept a wallet provided under the regulation.

The first is the public sector. Where a member state requires electronic identification and authentication for an online service of a public sector body, it must also accept wallets.

The second is private relying parties that are required to use strong user authentication for online identification, by Union law, by national law or by contract. Microenterprises and small enterprises, as defined in a Commission recommendation of 2003, are excepted. The third group is the very large online platforms within the meaning of the Digital Services Act, where they require user authentication for access.

For both private groups the duty arises only upon the voluntary request of the user. The firm cannot insist on the wallet. It has to take it when the user offers it.

Only the second group has a period of its own: no later than 36 months from the entry into force of the same implementing acts that start the member states' 24 months (Article 5f(2)). That puts the deadline at 24 December 2027. Article 5f(1) and (3) state no separate period.

A firm that is a micro or small enterprise, or that is under no duty to use strong user authentication, falls outside the mandatory group. Nothing stops such a firm from accepting wallets by choice.

It must register. Under Article 5b(1), a relying party that intends to rely on wallets registers in the member state where it is established. The registration gives at least the firm's name, its member state, its registration number where it has one, its contact details and the intended use of the wallet. The intended use includes an indication of the data the firm will request from users (Article 5b(2)). Member states publish the registered information online.

The registration sets a limit. A relying party may not ask users for any data other than what it indicated (Article 5b(3)). A firm that registered to receive a name with a date of birth cannot later ask for an address without updating its registration.

Three further duties apply at the moment of use. The relying party must identify itself to the user (Article 5b(8)). It is responsible for authenticating and validating the identity data and attestations it receives. It may not refuse a pseudonym where no Union or national law requires the user to be identified (Article 5b(9)).

For firms with anti-money laundering duties a second regulation matters. Article 22(6) of the Anti-Money Laundering Regulation, which applies from 10 July 2027, lets an obliged entity verify a customer's identity through electronic identification means at assurance level substantial or high and relevant qualified trust services. A wallet is an electronic identification means provided at level high, so it appears to fit that route. The firm still has to complete the other parts of customer due diligence itself.

The regulation starts from user control and then restricts everyone else. Article 5a(14) says users must have full control of the use of their wallet and of the data in it. The provider may not collect information about use that is not necessary to provide the wallet. It may not combine identity data or other wallet data with personal data from its other services or from third-party services, unless the user has expressly requested otherwise. Personal data relating to the wallet must be kept logically separate from any other data the provider holds.

Article 5a(15) protects people who do not want a wallet. Use is voluntary. Access to public and private services, to the labour market and to the freedom to conduct business may not be restricted or made disadvantageous for those who do not use one.

Article 5a(16) deals with tracking. The technical framework must not allow the providers of attestations, or any other party, to obtain data after issuance that lets transactions or user behaviour be tracked, linked or correlated, unless the user explicitly authorises it. It must also enable privacy-preserving techniques that keep separate uses from being linked to each other, where the attestation does not require the user to be identified. A related rule stops the wallet from telling the issuer of an attestation anything about how that attestation is used (Article 5a(5)(b)).

A wallet is certified by a conformity assessment body that a member state has designated. Article 5c(1) requires certification of the wallet, with the identification scheme under which it is provided, against the functional requirements of Article 5a and the rule on logical separation of data.

A certificate is valid for up to five years, provided that a vulnerability assessment is carried out every two years. Where a vulnerability is found and not remedied in a timely manner, the certification is cancelled (Article 5c(4)). Member states report certified wallets to the Commission, which publishes a list of them in the Official Journal and keeps it in machine-readable form (Article 5d).

A breach has fixed consequences. Where a wallet, its validation mechanisms or its identification scheme is breached or partly compromised in a way that affects reliability, the member state must suspend the provision and use of the wallet without undue delay. If the breach is not remedied within three months of the suspension, the member state must withdraw the wallet and revoke its validity. Where the severity of the breach justifies it, withdrawal follows without undue delay (Article 5e). Affected users and relying parties must be told at each step.