The EUDI Wallet, or European Digital Identity Wallet, is the app people and businesses will use to identify themselves, share only the data they choose and sign with services across the EU. Regulation (EU) 2024/1183 (eIDAS 2) requires every Member State to provide one within 24 months of the entry into force of the implementing acts, which puts the deadline at December 24, 2026. Private companies required by law or contract to use strong user authentication online, except micro and small enterprises, must accept it at the user's request within 36 months, that is, by December 24, 2027, after registering as a relying party.
eIDAS 2 amends Regulation (EU) No 910/2014, which already governed electronic identification and trust services. For a business it adds three things: a wallet your customers will carry on their phones, a duty to accept it in certain sectors, and a regime for issuing credentials with legal effect.
Status as of October 31, 2026
- The Regulation is in force. Regulation 2024/1183 was published on April 30, 2024 and entered into force twenty days later.
- First batch of implementing acts. Five regulations dated November 28, 2024 (2024/2977, 2024/2979, 2024/2980, 2024/2981 and 2024/2982), in force since December 24, 2024. The 24-month and 36-month deadlines run from that date.
- Second batch, May 6, 2025: 2025/846, 2025/847, 2025/848 (registration of relying parties, applicable from December 24, 2026) and 2025/849. Regulation 2025/1569, dated July 29, 2025, covers qualified attestations of attributes.
- July 2026 update. Regulations 2026/1730, 2026/1731 and 2026/1735, dated July 15, align the earlier acts with the current architecture and reference framework (ARF). Regulation 2026/1731, in force since August 11, 2026, sets the formats and protocols.
- Spain. Spain's Ministry for Digital Transformation held a public hearing from October 2 to 13, 2026 on the draft royal decree governing the European wallet ecosystem in Spain, fast-tracked by the Council of Ministers on September 29. The State Agency for Digital Administration is in charge. That is the latest official step we have verified: until it is approved and published in the Official State Gazette (BOE), it remains a draft.
What the European Digital Identity Wallet is and what data it holds
The Regulation defines it as an electronic identification means that lets the user "securely store, manage and validate" identification data and attestations of attributes in order to present them to relying parties (Art. 3(42)). It can be provided by the Member State, under its mandate, or independently but recognized by it (Art. 5a(2)). Under Article 5a(4), it will let users:
- share data selectively, online and, where appropriate, offline;
- generate pseudonyms stored encrypted in the wallet;
- sign with qualified electronic signatures or seal with qualified electronic seals;
- see which relying parties they have shared data with, ask them to erase it and report them to the data protection authority.
For natural persons it is free of charge (Art. 5a(13)) and using it is voluntary: not using it cannot restrict access to any service (Art. 5a(15)).
Person identification data (PID)
This is the core of the wallet. Implementing Regulation 2024/2977 sets five mandatory attributes for a natural person: family name, given name, date of birth, place of birth and nationality. Address and other data are optional. The portrait can only become mandatory from August 11, 2028 (2026/1731).
Electronic attestations of attributes (EAA)
Everything else travels as an electronic attestation of attributes, defined broadly as "an attestation in electronic form that allows attributes to be authenticated" (Art. 3(44)). The Commission gives mobile driving licenses and education credentials as examples.
Who must accept it, and by when
The duty falls on the service provider, not on the user: the wallet is accepted as one more option and "only upon the voluntary request of the user" (Art. 5f(2)).
| Who | What they must do | Deadline | Legal basis |
|---|---|---|---|
| Member States | Provide at least one wallet | 24 months from 12/24/2024: December 24, 2026 | Art. 5a(1) |
| Public sector bodies that require electronic identification for an online service | Also accept the wallet | The article sets no separate deadline | Art. 5f(1) |
| Private companies required by law or contract to use strong user authentication for online identification, including in transport, energy, banking, financial services, social security, health, drinking water, postal services, digital infrastructure, education or telecommunications | Accept the wallet at the user's request | 36 months from 12/24/2024: December 24, 2027 | Art. 5f(2) |
| Micro and small enterprises | Exempt from the duty above; may accept it voluntarily | — | Art. 5f(2) |
| Very large online platforms that require authentication | Accept and facilitate the wallet, limited to the minimum data needed | The article sets no separate deadline | Art. 5f(3) |
| Any relying party that wants to use the wallet | Register in the Member State where it is established | National registers apply from December 24, 2026 (2025/848) | Art. 5b |
| Providers of qualified attestations of attributes | Provide an interface with the wallets | — | Art. 45g(2) |
Two caveats. The list of sectors is open-ended ("including"): what matters is whether your service already requires strong user authentication by law or contract. And the 2026 and 2027 dates come from adding the Regulation's months to the date the implementing acts entered into force; the text gives no calendar dates.
How a business integrates as a relying party
1. Register in your Member State
Before requesting a single attribute, the relying party registers in the Member State where it is established (Art. 5b(1)). At a minimum it provides its name and official registration number, its contact details and the intended use, including the data it will request (Art. 5b(2)). After that it may not request anything else (Art. 5b(3)). Each Member State publishes its register in human-readable and machine-readable form through a common API (2025/848, Art. 3). Intermediaries acting for a relying party count as relying parties and may not store data about the content of the transaction (Art. 5b(10)).
2. Access and registration certificates
Once registered, the company obtains a wallet-relying party access certificate, issued only to registered parties (2025/848, Art. 7), which it uses to identify itself to the wallet. Each Member State must also authorize at least one certificate authority to issue registration certificates automatically after registration, spelling out each intended use (2025/848, Art. 8, as amended by 2026/1730, in force since August 11, 2026). Wallets must authenticate and validate them from August 11, 2028 (2024/2982, as amended by 2026/1731).
3. Formats and protocols
- Formats: SD-JWT VC and ISO/IEC mdoc. Person identification data is issued under clauses 5 (SD-JWT VC) and 6 (ISO/IEC-mdoc) of Annex II to Implementing Regulation 2024/2979. The W3C VCDM format, common in education, will be supported once its new profiles are available.
- Presentation: two profiles. ISO/IEC-mdoc (ISO/IEC 18013-5 for non-API-mediated transmission and Annex C of ISO/IEC 18013-7 for API-mediated transmission) and OpenID4VC-HAIP, which profiles OpenID4VP, for redirects and API-mediated transmission.
- Verifier identification. In OpenID4VP, the relying party identifies itself with its access certificate (ETSI TS 119 475), and the registration certificate travels in the verifier_info parameter.
- Issuance. Annex I to 2024/2982 refers to the ETSI TS 119 472-3 specification, which builds on OpenID4VC-HAIP, a profile of OpenID for Verifiable Credential Issuance 1.0 (OID4VCI); the wallet instance attestation also follows Appendix E of OID4VCI.
A warning if you read the 2024 acts: the original text of 2024/2977 required PID in ISO/IEC 18013-5 and in the W3C Verifiable Credentials Data Model 1.1. The July 2026 amendment replaced that with SD-JWT VC and mdoc, so a verifier designed against the first reading needs a review.
4. Validate and minimize
Authenticating and validating what it receives is the relying party's responsibility, and it may not refuse pseudonyms where the law does not require the user to be identified (Art. 5b(9)). Users will also see what data they gave you and can ask you to erase it (Art. 5a(4)).
What we review in an integration
- Which services already require strong user authentication, so your legal advisers can confirm whether they fall under the 2027 deadline.
- Which attributes you need for each use: that is what you will declare in the register.
- The verifier: OpenID4VC-HAIP for remote flows, mdoc for proximity, and checks on certificates, trusted lists and revocation.
- How it fits your customer onboarding (KYC, signatures) and the GDPR.
Issuing your own credentials: attestations of attributes and blockchain
A company can also issue attestations of attributes for customers, employees or suppliers to keep in their wallets. Issuing electronic attestations of attributes is one of the trust services defined in the Regulation (Art. 3(16)): a non-qualified provider must manage its risks and notify security breaches with a significant impact to the supervisory body no later than 24 hours after becoming aware of them (Art. 19a). It must let users request and manage them whatever Member State provides the wallet (Art. 45g(1)), and may not combine that data with data from its other services (Art. 45h).
| Type | Who issues it | Legal effect |
|---|---|---|
| Electronic attestation of attributes (EAA) | A non-qualified provider | Cannot be denied legal effect or admissibility as evidence solely because it is electronic or not qualified (Art. 45b(1)) |
| Qualified attestation (QEAA) | A qualified trust service provider meeting Annex V (Art. 45d) | The same legal effect as lawfully issued paper attestations (Art. 45b(2)) |
| Attestation from a public sector body responsible for an authentic source | That body or someone on its behalf | The same as paper, and recognition in every Member State (Art. 45b(2) and (3)) |
The rules for qualified and public-sector attestations are in Implementing Regulation 2025/1569, as amended by 2026/1735.
No rule requires blockchain
A recital of the Regulation (recital 68) calls for "technological neutrality" for the electronic ledger trust service, neither favoring nor discriminating against any technology used to implement it. Trust in the wallet rests on certificates and on the lists of providers that Member States notify and the Commission publishes, not on a blockchain. An electronic ledger is defined as "a sequence of electronic data records, ensuring the integrity of those records and the accuracy of the chronological ordering of those records" (Art. 3(52)); if it is qualified, its records enjoy a presumption of integrity and accurate chronological ordering (Art. 45k), with reference standards in Implementing Regulation 2025/2531.
Where blockchain helps, and where it does not
- It helps with trusted issuer registries: who is accredited to issue what, with a history no one can rewrite. EBSI runs an Issuers Registry, and Spain's blockchain services infrastructure (ISBE) offers a Trusted Issuer Registry (TIR) to publish accreditations and chains of trust.
- It helps with organizational identity: a decentralized identifier for the issuer, anchored to a qualified certificate.
- It helps as evidence: the hash of an issuance recorded on-chain proves it did not change later. It does not guarantee the data is true, only that it was not altered after it was recorded.
- It does not help for storing personal data: the wallet is designed so users control what they share (Art. 5a(14)). On-chain, at most, go organization identifiers, public keys and hashes.
- It does not replace qualification: a credential is not qualified because it sits on a blockchain, but because a qualified provider issues it.
The ISBE example
Spain's blockchain services infrastructure (ISBE) lets each organization register its own decentralized identifier (DID), did:isbe, linked to a qualified eIDAS certificate after a KYB check. On that basis, a LEAR credential is issued, a W3C verifiable credential that works as a digital power of legal representation and that ISBE describes as compatible with the European wallet reference framework. Its wallet requires issuers to implement OID4VCI 1.0 and verifiers to send OID4VP requests with DCQL. Interoperability with EBSI is planned, not finished.
ISBE fits when you need a public-permissioned registry of issuers, verified organizational identity or integrity evidence. You do not need it to accept the European wallet. More in building on Spain's blockchain services infrastructure and ISBE, Alastria and EBSI compared.
How Unknown Gravity approaches it
At Unknown Gravity we design integration as a relying party (flow inventory, registration, verifier and testing) and the issuance of your own credentials, with blockchain only where it adds value. Unknown Gravity is a member of Alastria; it is not a trust service provider, so the qualified part comes from a qualified provider. See our blockchain digital identity management service and our blockchain consulting.
Frequently asked questions
Do citizens have to use the EUDI Wallet?
No. It is voluntary, and not using it cannot restrict access to public or private services (Art. 5a(15)). For natural persons, issuance, use and revocation are free of charge (Art. 5a(13)).
Does my small business have to accept it?
Micro and small enterprises, as defined in Recommendation 2003/361/EC, are outside the duty. A medium-sized or large company that requires strong user authentication online by law or contract must accept the wallet at the user's request by December 24, 2027. Anyone can accept it voluntarily by registering as a relying party.
When will Spain have its wallet?
The EU deadline is December 24, 2026. As of October 31, 2026, the latest official step is the public hearing on the draft royal decree (October 2 to 13). Do not confuse it with the mobile ID card: Royal Decree 255/2025 governs the digital version of Spain's DNI, but does not present it as the European wallet.
Do I need blockchain to issue credentials to the wallet?
No. The formats (SD-JWT VC and mdoc) and the issuance protocol (OID4VCI) do not depend on a blockchain. Blockchain can help with issuer registries, organizational identity or as evidence, but no rule requires it.
What happens if I request more data than I registered?
Article 5b(3) prohibits it. Users can report the request directly from the wallet (Art. 5a(4)), and Implementing Regulation 2025/848 covers suspension and cancellation of a relying party's registration.
Sources
- Regulation (EU) 2024/1183 (eIDAS 2)
- Implementing Regulation (EU) 2024/2977
- Implementing Regulation (EU) 2024/2979
- Implementing Regulation (EU) 2024/2982
- Implementing Regulation (EU) 2025/848: registration of relying parties
- Implementing Regulation (EU) 2025/1569: qualified attestations of attributes
- Implementing Regulation (EU) 2026/1731: standards and specifications
- Implementing Regulation (EU) 2025/2531: qualified electronic ledgers
- European Commission: implementing acts of the Regulation
- European Commission: European Digital Identity Wallet
- Spain's Ministry for Digital Transformation: public hearing on the draft royal decree (in Spanish)
- Royal Decree 255/2025 on the DNI (in Spanish)
- ISBE: identity, did:isbe and TIR (in Spanish)
- ISBE: wallet, OID4VCI and OID4VP (in Spanish)
- ISBE: the LEAR credential, 8/27/2026 (in Spanish)
- ISBE FAQ on EBSI (in Spanish)
- EBSI developer documentation
Status verified as of October 31, 2026. This article is for information only and is not legal advice. Whether your company is covered, and from when, depends on your sector, your size and each Member State's rules; always check the official texts on EUR-Lex.
Need to accept the EUDI Wallet or issue credentials to it? Start with our digital identity management service or our blockchain consulting.