Level of Assurance LoA

The three levels of assurance are low, substantial and high. Article 8(2) of the eIDAS Regulation defines each one by two things: the degree of confidence that an electronic identification means gives in the claimed or asserted identity of a person, and what its technical controls are meant to achieve. The table sets the three definitions side by side.

The step from substantial to high is a change of aim. At substantial, the controls reduce the risk that an identity is misused or altered. At high, they are meant to prevent it. A notified scheme must specify which of the levels its means meet (Article 8(1)), so one scheme can issue means at more than one level.

Six elements decide it, and they cover the whole life of the means. Article 8(3) lists them: the procedure to prove and verify the identity of the applicant, the procedure for issuing the means, the authentication mechanism the person uses towards a relying party, the entity that issues the means, any other body involved in the application, and the technical and security specifications of the means itself.

A level is therefore a property of the chain. A well-protected chip does not make a means high if the identity check before issuance was weak. A careful check does not make it high if the login can be passed on to someone else.

The detailed requirements sit below the regulation. Article 8(3) set 18 September 2015 as the deadline for the European Commission to lay down, in implementing acts, minimum technical specifications, standards and procedures for each level. What a level demands in practice is therefore set in implementing acts, not in Article 8 alone.

National labels can differ from the eIDAS ones. The interoperability framework includes a mapping of national assurance levels to the levels under Article 8 (Article 12(4)). A scheme may use its own names at home. For use across borders, the mapped level counts.

eIDAS ties three consequences to the levels. The first is recognition across borders. A public sector body must recognise a notified means from another member state for its online service only where the means is at level substantial or high and at least equal to the level the service requires (Article 6(1)). A means at level low may be recognised. Nobody has to recognise it (Article 6(2)).

The second is the European Digital Identity Wallet. Wallets must be provided under an electronic identification scheme with assurance level high (Article 5a(11)). The wallet itself must meet the level high requirements, in particular for identity proofing and verification (Article 5a(5)).

The third is the qualified certificate behind a qualified electronic signature. A qualified trust service provider may verify the identity of the person it issues a certificate to by means of the wallet, or of a notified electronic identification means that meets level high (Article 24(1a)(a)). A means at level substantial is not enough for that route.

Level substantial or level high. The Anti-Money Laundering Regulation, which applies from 10 July 2027, lets a firm verify a customer's identity through electronic identification means that meet the eIDAS requirements for assurance levels substantial or high and relevant qualified trust services (Article 22(6)(b)). Recital 66 treats qualified trust services as the route for customers who have no such electronic identification. Level low is not named, so it does not fit this route.

The level settles how far the identity can be trusted. It does not settle what data the firm receives. Article 28(1) gave the Anti-Money Laundering Authority until 10 July 2026 to submit draft regulatory technical standards on the attributes that such means and services must feature. Verifying identity is also only one part of customer due diligence. The firm still has to identify the beneficial owner and understand the purpose of the relationship (Article 20(1)).

Not in the eIDAS sense. Article 8 describes electronic identification means in the context of an electronic identification scheme. A passport check that a firm or its software supplier runs for one onboarding issues no electronic identification means. It therefore has no eIDAS level, whatever a product sheet says.

eIDAS uses different words for such checks. Where a qualified trust service provider verifies identity by a method other than the wallet, a notified means, an existing qualified certificate or physical presence, the method must ensure identification with a high level of confidence. A conformity assessment body has to confirm that it does (Article 24(1a)(c)). The bar reads much like level high. The mechanism is different. A level of assurance belongs to an electronic identification means issued under a scheme. A high level of confidence belongs to one provider's method, as confirmed by its auditor.

When a supplier claims a level, a firm can ask which of the two is meant. Is the means on the Commission's list of notified schemes, and at what level? Or has a conformity assessment body confirmed the method, and for which provider?