In short
The user uses the wallet and trust services Art. 3(5a). Providers issue the user’s wallet, identity data and attestations Art. 2 Art. 3(16)(g). The relying party is the service that relies on them Art. 3(6). Trust service providers, qualified or not, provide signature, seal, time-stamping, archiving services… Art. 3(19). Around them, supervisory bodies, conformity assessment bodies and trusted lists establish trust Art. 46a Art. 3(18) Art. 22.
The map of the ecosystem
eIDAS 2 involves many actors. The diagram shows how they relate to one another; each one is then presented.
The diagram reads from top to bottom. The wallet provider provides the wallet solution Art. 2(1). The user, who controls their wallet unit Art. 2(12), receives in it their person identification data and attestations Art. 2(2) Art. 3(44), then presents them to a registered relying party Art. 5b(1), which authenticates itself to the wallet with an access certificate Art. 2(14). Trust service providers provide trust services Art. 3(19); users and relying parties make use of them Art. 3(5a) Art. 3(6). At the bottom, supervisory bodies, conformity assessment bodies and trusted lists form the supervisory framework, which covers wallet providers as well as trust service providers Art. 46a(3)(a) Art. 46b(3); it is presented on the next page Art. 46a Art. 46b Art. 3(18) Art. 22.
A role is not an organisation. The ARF, the technical reference framework for the wallet (version 3.0.0 in this corpus ARF 3.0.0 ch. 3), makes this clear:
Note that a single entity may combine multiple of the roles depicted in the figure, as
long as that entity complies with all requirements, both legal and technical, for each of
the roles.
In other words, a single entity may hold several roles, provided it meets all the requirements, legal and technical, of each one. The ARF is an informative, non-binding document § 1.3 Purpose, scope and audience.
The user
The user is a natural or legal person, or a natural person representing another person, who uses trust services or electronic identification means provided in accordance with the regulation Art. 3(5a). The user is therefore not only the holder of a wallet: a legal person that uses a trust service, for example to create an electronic seal, is also a user Art. 3(24).
When using a wallet, the user keeps full control of it, together with the data it contains Art. 5a(14). The user’s rights (selective disclosure, pseudonyms, transaction log…) are detailed in step 3.
The wallet provider
The wallet provider is the natural or legal person that provides wallet solutions Art. 2(1). Each Member State provides at least one wallet Art. 5a(1) (the ways of providing it are presented in step 3). The Member State notifies the Commission of the bodies responsible for providing the wallets Art. 5a(18)(b), and a supervisory body checks that these providers comply with the regulation Art. 46a(3)(a).
The provider of person identification data (PID)
Person identification data (PID) enable the identity of a person to be established; they are issued in accordance with Union or national law Art. 3(3). The entity that issues them to the wallet is the provider of person identification data; the ARF calls it the PID Provider § 3.4 Person Identification Data (PID) Providers. Implementing Regulation 2024/2980 defines it as follows:
a natural or legal person responsible for issuing and revoking the person identification
data and ensuring that the person identification data of a user is cryptographically bound
to a wallet unit
The Member State notifies the Commission of the bodies responsible for ensuring that the PID is associated with the wallet Art. 5a(18)(c). The content of the PID and the rules for issuing it are presented in step 3.
Attestation issuers
An electronic attestation of attributes allows attributes to be authenticated: a characteristic, quality, right or permission of a person or an object Art. 3(43) Art. 3(44). Its issuance is a trust service Art. 3(16)(g). The regulation recognises three kinds, which do not come from the same issuers and do not have the same force:
| Kind (common abbreviation) | Who issues it | Legal effect |
|---|---|---|
| Electronic attestation of attributes (EAA) | a trust service provider Art. 3(16)(g) | cannot be denied legal effect or admissibility as evidence solely on the grounds that it is in electronic form or not qualified Art. 45b(1) |
| Qualified attestation (QEAA) | a qualified trust service provider, meeting the requirements of Annex V Art. 3(45) | same legal effect as a lawfully issued attestation in paper form Art. 45b(2) |
| Attestation issued by or on behalf of a public sector body responsible for an authentic source (PuB-EAA) | that public sector body, or a public sector body designated by the Member State to act on its behalf Art. 3(46) | same effect as a paper attestation, and recognised in all Member States Art. 45b(2) Art. 45b(3) |
An authentic source is a repository or system, held under the responsibility of a public sector body or private entity, that is the primary source of information on a person or an object, or that is recognised as authentic by law Art. 3(47). At least for the attributes listed in Annex VI to the regulation, where they rely on authentic sources within the public sector, Member States must enable qualified providers that issue attestations to verify those attributes by electronic means, at the request of the user. They have twenty-four months from the entry into force of the implementing acts on the wallet and its certification to do so Art. 45e(1) Annex VI.
One rule applies to all attestation issuers, qualified or not: they do not combine personal data relating to this service with personal data from other services they or their commercial partners offer Art. 45h(1).
The relying party
The relying party is the natural or legal person that relies on electronic identification, a wallet, another identification means or a trust service Art. 3(6). An example given by the Commission appears in step 3.
A relying party that intends to rely on the wallet is a wallet-relying party Art. 2(3). It must register in the Member State where it is established Art. 5b(1). Two actors, defined by Implementing Regulation 2024/2980, support it:
- the registrar of wallet-relying parties, a body designated by the Member State, establishes and maintains the list of registered wallet-relying parties established in its territory Art. 2(5);
- the provider of wallet-relying party access certificates, mandated by the Member State, issues to registered relying parties the certificate that authenticates them to wallets Art. 2(13) Art. 2(14).
The obligations of relying parties, and the case of intermediaries acting on their behalf, are detailed in step 3.
Trust service providers
A trust service provider is a natural or legal person that provides one or more trust services, either as a qualified or as a non-qualified trust service provider Art. 3(19). Trust services cover the issuance and validation of certificates, the creation and validation of electronic signatures and seals, time-stamping, electronic registered delivery, electronic archiving, recording in an electronic ledger, attestations of attributes, and so on Art. 3(16).
“Qualified” status is not self-proclaimed: it is granted by an authority.
‘qualified trust service provider’ means a trust service provider who provides one or more
qualified trust services and is granted the qualified status by the supervisory body;
The table compares the two categories:
| Qualified provider | Non-qualified provider | |
|---|---|---|
| Before starting | notifies the supervisory body of its intention, together with a conformity assessment report Art. 21(1); starts only once its status is indicated in the trusted list Art. 21(3) | puts in place policies and measures to manage its risks Art. 19a(1)(a) |
| Supervision | ex ante and ex post by the supervisory body Art. 46b(3)(a) | ex post, if the body is informed of a failure to comply Art. 46b(3)(b) |
| Audit | at least every 24 months, at its own expense, by a conformity assessment body Art. 20(1) | — |
| Changes to its services | informs the supervisory body at least one month before any change to its qualified services, three months before ceasing its activities Art. 24(2)(a) | — |
| Incidents | the NIS2 Directive classifies it among essential entities, regardless of its size Art. 3(1)(b); like any trust service provider, it notifies its significant incidents to the CSIRT or the competent authority within 24 hours Art. 23(4) | notifies the supervisory body of any security breach or disruption that has a significant impact, no later than 24 hours after becoming aware of it Art. 19a(1)(b); the NIS2 Directive, which applies to trust service providers regardless of their size, also provides for notification within 24 hours Art. 2(2) Art. 23(4) |
| Visibility | indicated in the trusted list of its State Art. 22(1); may use the EU trust mark Art. 23(1) | — |
A dash indicates that the provisions cited provide for nothing of the kind for the non-qualified provider.
A qualified provider that issues a qualified certificate or a qualified attestation verifies the identity, and where applicable the attributes, of the person concerned Art. 24(1). It may do so in particular by means of the wallet Art. 24(1a). Trust services and what “qualified” changes for each of them are detailed in step 4 of the learning path.
Who supervises, who certifies, who publishes?
Supervisory bodies, conformity assessment bodies, accreditation bodies and trusted lists are presented on the next page: supervision, certification and trusted lists.
Consolidation without official value
This page cites the consolidated versions, published on EUR-Lex, of Regulation 910/2014 and of Implementing Regulation 2024/2980, as well as of Directive (EU) 2022/2555 Regulation (EU) No 910/2014 — consolidated version of 18/10/2024 Implementing Regulation (EU) 2024/2980 — consolidated version of 11/08/2026 Directive (EU) 2022/2555 (NIS2) — consolidated version of 27/12/2022. These consolidations are documentation tools: only the texts published in the Official Journal of the European Union are authentic.
Key points
- The user is any person who uses trust services or electronic identification means, not only the holder of a wallet Art. 3(5a).
- Wallet, PID and attestations come from separate providers, roles that a single entity may combine Art. 2 § 3.1 Introduction { #roles-introduction }.
- Three kinds of attestations: non-qualified, qualified, public; the last two are equivalent to a paper attestation Art. 45b.
- The wallet-relying party registers and authenticates itself with an access certificate Art. 5b(1) Art. 2(14).
- Qualified status is granted by the supervisory body and requires an audit at least every 24 months Art. 3(20) Art. 20(1).
Written by Asphalia.