The European Digital Identity Wallet

In short

The European Digital Identity Wallet (EUDI Wallet) is an application for keeping one’s identity data and attestations, and then showing them to a service while sharing only what is necessary Art. 3(42) Art. 5a(4)(a). Each Member State must provide at least one Art. 5a(1). It is free of charge for natural persons Art. 5a(13) and its use is voluntary Art. 5a(15). Services that intend to rely on it must register Art. 5b(1), and some will be required to accept it Art. 5f.

What is the wallet?

The eIDAS regulation defines the wallet as follows:

Three terms recur throughout what follows:

• the user is the person, natural or legal, who uses the wallet Art. 3(5a);
• the relying party is the one that relies on the wallet or on another electronic identification means Art. 3(6). The Commission gives the example of a car rental company that asks for the driving licence stored in its customer’s wallet Working together to create the EU Digital Identity Wallet ecosystem;
• offline mode means a face-to-face presentation, using proximity technology, without the wallet needing network access Art. 3(57).

In practice, what the user has “in hand” is called a wallet unit. It brings together the application installed on their device (the wallet instance), a wallet secure cryptographic application and a wallet secure cryptographic device Art. 2(2) Art. 2(6). The device is a tamper-resistant component that protects the wallet’s “critical assets”; the secure application manages these assets by using the functions of the device Art. 2(7) Art. 2(8). The ARF, the Architecture and Reference Framework of the wallet (version 3.0.0, a document that presents itself as informative § 1.3 Purpose, scope and audience), abbreviates them as WSCA (wallet secure cryptographic application) and WSCD (wallet secure cryptographic device) A.3 Definitions from the adopted Commission Implementing Regulations. The wallet provider is the one that provides this solution Art. 2(9).

The diagram reads from left to right. The PID provider (the user’s identity data, detailed below) and the attestation providers issue data to the wallet unit Art. 3(1) Art. 4. The user, who controls the unit Art. 2(1), chooses what to present to a relying party, which must be registered Art. 5a(4)(a) Art. 5b(1).

What it contains: PID and attestations

The wallet contains two broad families of data.

Person identification data (PID) enable the identity of a person to be established. They are issued in accordance with Union or national law Art. 3(3), under an electronic identification scheme, that is, the national system under which electronic identification means are issued to persons Art. 3(4) Art. 3(1).

Electronic attestations of attributes (EAA) prove an attribute, that is, a characteristic, quality, right or permission Art. 3(43) Art. 3(44). Among the documents the wallet will be able to hold, the Commission cites the driving licence and diplomas General. The regulation distinguishes three kinds of attestations; the table compares them with PID:

An authentic source is a register considered to be the primary source of a piece of information, or recognised as authentic by law Art. 3(47).

The PID of a natural person

Implementing Regulation 2024/2977 sets out the content of the PID Annex. Six data items are mandatory: family name(s), given name(s), date of birth, place of birth, nationality(ies) and portrait. Others are optional: address, sex, email address, mobile telephone number, personal administrative number… For the portrait, the annex states that it is applicable from 11 August 2028 and that Member States may allow the user to opt out of its inclusion Annex.

Four rules complete this content:

• the PID issued to a user is unique for the Member State Art. 3(4);
• it is cryptographically bound to the wallet unit that receives it Art. 3(5);
• the user is enrolled in accordance with the requirements of assurance level high, and the provider verifies their identity before issuing the PID Art. 3(7). The regulation recognises three assurance levels (low, substantial, high); level high corresponds to the highest degree of confidence in the claimed identity Art. 8(2)(c);
• the PID is issued in accordance with the standards of two technical formats, SD-JWT VC and ISO/IEC-mdoc Annex. The first is based on a draft specification of the IETF (the Internet standards body), the second on the structures of the ISO/IEC 18013-5 standard for the mobile driving licence ETSI TS 119 472-1 V1.2.1, § 1 Scope § 2. Objet et champ d'application (résumé officiel ISO, traduit).

Attestations follow at least one of the standards in Annex II to Implementing Regulation 2024/2979 Art. 4(1); the PID also refers to that annex for its two formats Annex. That list refers to specification ETSI TS 119 472-1 Annex II ETSI TS 119 472-1 V1.2.1, which itself relies, for the mdoc format, on the ISO/IEC 18013-5 standard ETSI TS 119 472-1 V1.2.1, § 6.1 General requirements ISO/IEC 18013-5:2021.

What it lets you do

The regulation lists what the wallet allows the user to do, in a manner that is user-friendly, transparent and traceable by the user Art. 5a(4):

• identify oneself and present data: request, obtain, store, combine and present one’s PID and attestations, online and, where appropriate, offline, with the possibility of disclosing only some data (“selective disclosure”) Art. 5a(4)(a);
• use pseudonyms, generated and stored encrypted within the wallet Art. 5a(4)(b). The wallet can generate a pseudonym specific to each relying party Art. 14(2), and a relying party may not refuse a pseudonym where identification of the user is not required by law Art. 5b(9);
• interact with another person’s wallet, after authenticating it Art. 5a(4)(c);
• view a log of all their transactions, through a dashboard that also allows them to request a relying party to erase their data, or to report it to the data protection authority when it receives a data request that seems unlawful or suspicious Art. 5a(4)(d). The log records in particular the date, the relying party and the types of data exchanged, and can be exported Art. 9(2) Art. 9(7);
• sign with a qualified electronic signature, or seal with a qualified electronic seal Art. 5a(4)(e). Every natural person must be able to sign in this way free of charge; Member States may limit this free use to non-professional purposes Art. 5a(5)(g) Art. 11(3);
• retrieve their data and change wallet: download their data and exercise their right to data portability Art. 5a(4)(f) Art. 5a(4)(g), in order to migrate to another wallet solution Art. 13.

Who provides it, and on what terms?

Each Member State provides at least one wallet Art. 5a(1). It may do so directly, under a mandate, or by recognising a wallet provided independently of it Art. 5a(2). The source code of the application software components is licensed under an open-source licence. Member States may, however, provide that, for duly justified reasons, the source code of specific components other than those installed on the user’s device is not disclosed Art. 5a(3).

Being free of charge is written into the text:

The wallet is not mandatory for citizens:

Not using it must not put anyone at a disadvantage: other identification means remain possible Art. 5a(15). The user may also request the revocation of their wallet Art. 5a(9)(a), and the provider must offer them technical support Art. 5a(10).

Privacy: what the framework guarantees

The principle is laid down from the outset: the user has full control of their wallet and of their data Art. 5a(14). The text turns this into concrete safeguards.

No tracking. The technical framework of the wallet shall:

Likewise, the wallet does not provide trust service providers that issue attestations with any information about the use of those attestations Art. 5a(5)(b).

Unlinkability. Where the attestation does not require the identification of the user, the framework enables privacy-preserving techniques that ensure unlinkability Art. 5a(16)(b). PID providers must implement such techniques Art. 5(8).

Selective disclosure. The user shows only what is requested and what they agree to show Art. 5a(4)(a). For the PID, the annex to 2024/2977 applies this item by item:

The portrait is given enhanced protection: the wallet warns the user that it is biometric data and asks for explicit confirmation, and the relying party does not, in principle, retain it Art. 3a.

Limited and separate data. The wallet provider collects only the information necessary for its service, does not combine it with information from its other services without the user’s express request, and keeps it separate from its other data Art. 5a(14). Where personal data are processed by or on behalf of Member States to provide the wallet, the compliance of that processing with the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) must be demonstrated Art. 5a(17) Art. 2(1)(2).

Security and certification

The wallet is provided under an electronic identification scheme of assurance level high Art. 5a(11) and ensures security by design Art. 5a(12).

Its conformity is certified by conformity assessment bodies designated by Member States Art. 5c(1). For cybersecurity, certification follows the European schemes adopted under Regulation 2019/881 Art. 5c(2); for the rest, or as long as those schemes do not cover everything, Member States establish national schemes Art. 5c(3). Implementing Regulation 2024/2981 establishes the framework for this certification Art. 1, and each national scheme has as its subject matter the provision and operation of wallet solutions Art. 3(2).

Certified wallets appear on a list published by the Commission in the Official Journal Art. 5d(3), fed by the information that Member States submit in accordance with Implementing Regulation 2025/849 Art. 1. Wallet units display the EU Digital Identity Wallet Trust Mark, which indicates in a verifiable manner that a wallet has been provided in accordance with the regulation Art. 3(50) Art. 14a(1). In the event of a breach of its security, the Member State suspends the wallet, or even withdraws it Art. 5e(1).

Relying parties: registering and limiting themselves

A service that intends to use the wallet must meet several obligations:

An intermediary acting on behalf of a relying party is itself deemed to be a relying party, and it does not store data about the content of the transaction Art. 5b(10).

Implementing Regulation 2025/848 organises this registration. Each Member State keeps a national register of relying parties, accessible online Art. 3(1) Art. 3(4). Only a registered relying party can obtain an access certificate, which authenticates it to wallets Art. 2(12) Art. 7(2), and a registration certificate, which describes the intended use and the data it may request Art. 8(2)(a) Art. 8(2)(b) Art. 8(2)(c). If it requests more, the wallet informs the user Art. 8(2)(d).

Who will have to accept it?

Online public services, first:

Next, private companies required, by law or by contract, to use strong user authentication (transport, energy, banking, health, telecommunications…). They will have to accept the wallet, upon the voluntary request of the user, no later than 36 months after the entry into force of the implementing acts referred to. Micro and small enterprises are exempt Art. 5f(2).

Finally, very large online platforms that require authentication must accept the wallet, strictly upon the voluntary request of the user and only for the minimum data necessary Art. 5f(3).

Timeline, ARF and specifications

The deadlines and the technical framework (ARF, standards, specifications) are presented on the next page: the wallet, timeline and specifications.

In Belgium

Key points

• The wallet is an application that keeps the user’s PID and attestations and allows the user to present them, to sign and to seal Art. 3(42) § 1.1 EUDI Wallet ecosystem.
• Each Member State provides at least one; it is free of charge for natural persons and optional Art. 5a(1) Art. 5a(13) Art. 5a(15).
• The user stays in control: selective disclosure, pseudonyms, transaction log, no tracking Art. 5a(4) Art. 5a(16).
• The wallet is certified, for up to five years Art. 5c(4).
• A relying party registers and requests only the data it has declared Art. 5b(1) Art. 5b(3).
• Online public services, companies required to use strong authentication and very large platforms will have to accept it Art. 5f.

Written by Asphalia.