FAQ

Vérifié le 2026-10-29

Disponible uniquement en anglais. Le texte est affiché dans sa langue d'origine.

FAQ

Frequently Asked Questions

Discover the answers to a wide range of questions about EU Digital Identity Wallets.

Search the EU Digital Identity Wallet FAQ

FAQ - The European Digital Identity Framework

These questions are intended for a professional and technical audience from both the private and public sector who are involved with the EU Digital Identity Wallet Ecosystem.

They should provide clarity on the legal and technical requirements required for the successful implementation of the European Digital Identity Wallets and electronic identification means.

These questions and answers serve for informational purposes only and do not constitute legal advice. The definitive interpretation of EU law remains the prerogative of the Court of Justice of the European Union.

European Digital Identity Wallets

  • What is the difference between a wallet solution and a wallet unit?

    Both a wallet solution and a wallet unit are provided by a wallet provider and contain the same basic components; wallet instances, wallet secure cryptographic applications, and wallet secure cryptographic devices.

    The definitions are laid down in Article 2(11) and 2(2) of the Commission Implementing Regulation (EU) 2024/2979.

    A ‘wallet solution’ means a combination of software, hardware, services, settings, and configurations, including wallet instances, one or more wallet secure cryptographic applications and one or more wallet secure cryptographic devices.

    A ‘wallet unit’ means a unique configuration of a wallet solution that includes wallet instances, wallet secure cryptographic applications and wallet secure cryptographic devices provided by a wallet provider to an individual wallet user.

    In simple terms, the wallet solution is the master template, and the wallet unit is the individual version customised for each user.

  • Where can the technical requirements for EU Digital Identity Wallets be found?

    The technical requirements for the EU Digital Identity Wallets can be found in the adopted implementing acts:

    Further, the common technical architecture of the EU Digital Identity Wallets ecosystem is defined in the Architecture and Reference Framework (ARF) document. The ARF has been set-up pursuant to Commission Recommendation (EU) 2021/946 and sets out a set of common standards, and technical specifications for components, protocols, interfaces and data formats governing information exchange between issuers, wallets, and service providers.

    The ARF is published here.

  • Are there libraries/source code available for the EU Digital Identity Wallets?

    The EU Digital Identity Wallet reference implementation enables Member States and stakeholders to develop their own wallets.

    It includes open-source code libraries, modular components, and a fully functional reference application built in line with the ARF.

    The implementation is available on GitHub and includes demo apps for both iOS and Android, allowing users to test key features such as credential issuance and proximity-based verification. Find the reference implementation here.

  • Will wallets be able to prove that a user has delegated mandate powers (i.e., power of attorney or representation rights)?

    Wallets will be used to store any type of electronic attestations of attributes (EAAs). These EAAs can attest to any kind of delegations, such as representation rights or powers of attorney.

    However, it should be noted that the legal meaning and validity of such delegations is not regulated nor standardised in Regulation (EU) No 910/2014.

    Thus, while wallets may be used to store and exchange delegations, like any other electronic attestations of attributes, their creation, interpretation or use will depend on the context in which they are used.

  • What is selective disclosure of attributes?

    Selective disclosure of attributes is a data minimisation feature that enables wallet users to only share the specific information requested by a relying party without revealing additional information. This is one of the ways in which wallets help to comply with the data protection principles enshrined in Regulation (EU) 2016/679 (the ‘GDPR’), in particular the principles of data minimisation and purpose limitation. More generally, this feature allows users to have control over their personal data.

    For example, a user could share their date of birth without revealing their place of birth, allowing for greater privacy while still enabling access to digital services.

  • How will users of the EU Digital Identity Wallets be able to sign electronically?

    The EU Digital Identity Wallets shall enable their users to create qualified electronic signatures.

    To sign electronically using an EU Digital Identity Wallet, the wallet user will be issued a qualified certificate for electronic signatures, which is linked to a qualified electronic signature creation device. That device can be embedded in the wallet or in the mobile device of the user, be external but handled by the user, or be a remote qualified electronic signature creation device.

    The wallet user will have access to a signature creation application which may either be integrated in the wallet instance, be a separate app on the wallet user’s device, or be provided remotely.

  • What is a provider of person identification data?

    The definition is laid down in Article 2(4) of the Commission Implementing Regulation (EU) 2024/2977.

    Providers of person identification data (or PID) are responsible for issuing and revoking the person identification data and ensuring that the person identification data of a user is cryptographically bound to a wallet unit. These can be public sector bodies, e.g. a Ministry or national register, or recognised private entities that are entrusted with the provision of personal information, like a name and date of birth to be used for identification, to the wallet unit.

  • Will end users be charged for person identification data issuance?

    Article 5a(13) of the European Digital Identity Regulation (or ‘Regulation’) explicitly states that the issuance, use, and revocation of the European Digital Identity Wallets (‘wallets’) are to be free of charge for all natural persons. Although the term "wallet issuance" is not explicitly defined in the European Digital Identity Regulation, it can be considered to refer to the creation and provision of the wallet solution by a wallet provider.

    In addition, as an electronic identification means, the wallet shall allow the user to securely store, manage and validate PID further to Article 3(42). The issuance of PID to a user’s wallet can also be considered a necessary precondition that the identification function of the wallet can be used.

    As a result, it can be deducted that the issuance of PID should be free of charge.

  • How are EU Digital Identity Wallets protected against fraud?

    To prevent or minimise fraud, EU Digital Identity Wallets are highly secure as they will:

    • be certified against level of assurance “high” requirements by accredited public or private bodies designated by Member States, ensuring high standards for privacy and security; be private by design - users will always have control over which data they share;
    • implement robust security protocols with assurance level high, strong encryption, and multi-factor authentication;
    • include the wallet secure cryptographic device (WSCD) architecture, ensuring a secure environment and storage for cryptographic assets (such as cryptographic keys for authentication).

  • How is a high standard of privacy for European Digital Identity Wallets ensured in all Member States?

    Personal data protection and privacy are cornerstones of Regulation (EU) No 910/2014 which applies without prejudice to the GDPR. Regulation (EU) No 910/2014 lays down provisions that reinforce the application of the GDPR, such as Article 5a(16) of that Regulation about the technical framework of the EU Digital Identity Wallets. Further, the implementing acts to Regulation (EU) No 910/2014 as regards wallet functionalities also provide technical specifications and privacy enhancing techniques ensuring data protection and privacy.

    To ensure personal data protection by design and by default, the wallets should use available state-of-the-art privacy enhancing techniques. Among others, these features should provide the possibility that wallets can be used without the wallet users being trackable across different wallet-relying parties, if applicable to the usage scenario.

    The EUDI Wallet architecture embodies the principle of privacy by design. This means that the protection of user data is a fundamental pillar of the architecture's design. In this context, the principle of data minimisation guides the collection of personal information, ensuring that relying parties gather only the attributes they need and have registered for. To support the selective disclosure of attributes, the wallets empower users with granular control over what data is presented and to whom. Secure coding practises are mandated, and the architecture itself minimises attack surfaces by compartmentalising sensitive data and access controls. For more information on this topic, please refer to sections 4.2.4 and 4.2.5 of the Architecture and Reference Framework.

  • Which information is required for wallet-relying party registration?

    In a nutshell, each wallet-relying party is required to provide the following information:

    • Identification information: Name, identifiers as stated in the official record together with identification data of the official record (e.g., EORI, registration number in a national business register, VAT, LEI).
    • Address: Physical address of the wallet-relying party
    • URL: An URL belonging to the wallet-relying party.
    • Country code indicator: The country indicator of the Member State where the wallet-relying party is established.
    • Contact details: A valid email address, phone number, and website.
    • Service description: An outline of the services provided and the intended use of wallet user attributes.
    • Attribute usage: A list categorising the attributes to be requested as mandatory or optional.
    • A list of the data, including attestations and attributes that the wallet-relying party intends to request.
    • Intended use: A description of intended use of the data that the wallet-relying party intends to request from wallet units.
    • An indication of whether the wallet-relying party is a public sector body.
    • **Entitlements:**Details of any specific roles in trust services provision, where applicable. This information is submitted to the Member State’s registrar and published to maintain transparency.

    Please refer to Commission Implementing Regulation (EU) 2025/848 for further details and updates on the requirements above.

  • What are pseudonyms, and how are they used?

    In the context of the EU Digital Identity Wallets, pseudonyms are unique, wallet-specific identifiers that can be chosen by the user and used for interactions with a specific relying party. They help preventing user tracking across services while enabling seamless authentication.

    In accordance with the state of the art, pseudonym generation follows WebAuthn standards and is designed to limit data exposure during transactions. Please refer to Article 14 of Commission Implementing Regulation (EU) 2024/2979 for further details.

  • What is wallet certification and who certifies the wallets?

    Wallet certification is the formal process by which EU Digital Identity Wallets are evaluated to ensure they meet functional and cybersecurity standards. This process is further specified by European cybersecurity certification schemes and national certification schemes.

    This process ensures that the security, reliability and interoperability of the wallets are assessed in order to foster trust among users and service providers.

    Wallets are certified by accredited conformity assessment bodies operating under national certification schemes and designated by Member States.

    These bodies are responsible for evaluating wallet solutions against functional and cybersecurity requirements, conducting testing and assessments, and issuing certificates of conformity. They operate under the oversight of national certification scheme owners and ensure alignment with EU standards.

    For further details, please refer to Commission Implementing Regulation (EU) 2024/2981 , and Commission Implementing Regulation (EU) 2025/849.

  • How will security breaches—whether affecting wallets, authentication mechanisms, or electronic identification (eID) schemes— be addressed?

    A severe breach or compromise will result in the immediate withdrawal of all affected wallets, authentication mechanisms or electronic identification (eID) schemes. For further details please refer to Commission Implementing Regulation (EU) 2025/847.

  • What is the difference between “strong customer authentication” (SCA) as referred to in Directive (EU) 2015/2366 (PSD2) and “strong user authentication” as referred to in the European Digital Identity Regulation?

    In the context of Regulation (EU) No 910/2014, the term "strong user authentication" is used instead of "strong customer authentication" (SCA), which is a concept used in Directive (EU) 2015/2366 (PSD2). Since EU Digital Identity Wallets are provided free of charge and do not involve customers in the traditional sense, Regulation (EU) No 910/2014 consistently refers to their holders as "users" instead of “customers”. Although the terms differ, both refer to the same underlying concept, a multi-factor authentication process that ensures secure and reliable user authentication and should therefore be considered as synonyms in this context.

  • Is there an obligation to accept EU Digital Identity Wallets in the area of banking and financial services?

    As per Article 5f(2) of Regulation (EU) No 910/2014, certain private relying parties are required to accept the wallets, upon request of the user, where Strong Customer Authentication (SCA) is required by Union or national law, or by contractual obligation. For example, under the PSD2 Directive, payment service providers are required to apply SCA in specific situations. This obligation to accept the wallets upon request of the user applies 36 months after the entry into force of the implementing acts referred to in Article 5a(23) and Article 5c(6) of Regulation (EU) No 910/2014.

  • How can payment service providers in practice fulfil their obligation to recognise the European Digital Identity Wallets to apply Strong Customer Authentication (SCA)?

    Regulation (EU) No 910/2014 does not prescribe how service providers should fulfil their obligation to recognize the European Digital Identity Wallet to apply Strong Customer Authentication (SCA).

    However, large scale pilots have tested and developed the following way how payment service providers can fulfil their obligations under Art. 5f(2) of Regulation (EU) No 910/2014:

    Payment Service Providers issue a dedicated SCA attestation after carrying out a secure authentication of the user and linking users to their specific payment account and payment instrument.

    In this model, the payment service provider acts as both the issuer of the SCA attestation and the verifier. It should retain full control over the authentication decision, remaining able to authenticate the user independently. The payment service provider should remain fully responsible for validating the attestation and ensuring compliance with applicable regulations.

    The following detailed process has been developed by large-scale pilots in this context:

    • Before the SCA attestation is issued to the user’s wallets, the user completes a registration process under the control of the payment service provider. This process begins when the user requests their wallets to be registered for a specific payment account and payment instrument.
    • The payment service provider authenticates the user through an existing PSD2-compliant method.
    • The wallets generate a cryptographic key pair: the private key is securely stored and used to sign messages, while the corresponding public key is shared with the payment service provider for verification purposes.
    • The payment service provider issues an individual SCA attestation into the user’s wallets. This attestation is device-bound, ensuring usage is linked to the user’s keys on that device, and requires multi-factor authentication to activate the signing key. The resulting cryptographic signatures can then be verified by the payment service provider to securely authenticate transactions.
    • Following this registration, the wallets can be used to present the SCA attestation when SCA is required, together with transaction-specific details for the user to confirm. The confirmation is cryptographically bound to the transaction and allows for dynamic linking, ensuring that authentication is directly tied to the transaction details, such as the specific amount and a specific payee, and that these details are protected from tampering.
    • The SCA attestation and the transaction data can be shared with the payer’s payment service provider, supporting various use cases and allowing additional attributes, such as age verification, to be combined with the payment data.

    A description of this process can be retrieved at the following link: Directive - 2015/2366 - EN - Payment Services Directive - EUR-Lex.

  • Are outsourcing agreements necessary between payment service providers and wallets providers for applying SCA using the wallets? Does the use of the wallets for SCA require the delegation of the authentication?

    Outsourcing agreements between payment service providers and wallets providers are not required under Regulation (EU) No 910/2014 for the implementation of the wallets for SCA.

    Where payment service providers act as both issuer of the SCA attestation and verifier, they should retain full control over the authentication decision and remain fully responsible for validating the attestation and ensuring compliance with applicable regulations.

    In this model, the wallets act as a secure carrier of the attested information. Given that payment service providers are responsible for issuing and relying upon attestations for SCA, a delegation of the authentication to a third party does not take place.

  • Is there a requirement for all wallets to offer SCA (strong customer authentication) to facilitate online payments by the end of 2027?

    Yes, indeed. The objective of the European Digital Identity Regulation is to offer all EU citizens a secure and trustworthy means of identification, authentication and to share digital documents. The Regulation also requires Member States to offer European Digital Identity Wallets to all EU citizens by end 2026 and obliges private service providers to accept the wallet for SCA (strong customer authentication) by end 2027. Consequently, all wallets must be able to offer this possibility.

  • What are the requirements regarding the acceptance of the EU Digital Identity Wallets by Very Large Online Platforms (‘VLOPs’)?

    Article 5f(3) of the Regulation (EU) No 910/2014 requires providers of VLOPs, as referred to in Article 33 of Regulation (EU) 2022/2065 (the ‘DSA’), that require user authentication for accessing their online services, to facilitate and accept the use of EU Digital Identity Wallets.

    Whenever VLOPs require user authentication for access to online services, such as logging in, account creation, or identity verification processes, they shall enable users upon request, to voluntarily use EU Digital Identity Wallets for such authentication purposes. Consequently, providers of VLOPs shall ensure technical compatibility with EU Digital Identity Wallets.

    To support user privacy and strengthen data protection, the EU Digital Identity Wallets will support the WebAuthn standard, acting as passkey providers to enable secure, passwordless authentication and the use of relying party-specific pseudonyms, when interacting with VLOPs.

Electronic Identification Schemes

  • What are the requirements for Member States intending to pre-notify their national electronic identification scheme?

    The objective of Regulation (EU) No 910/2014 is to streamline the peer review procedures for electronic identification schemes, relying on certification in order to foster cooperation among Member States on the security and interoperability of their notified electronic identification schemes.

    Therefore, Article 12a of Regulation (EU) No 910/2014 provides that electronic identification schemes to be notified shall by certified by designated conformity assessment bodies against the cybersecurity requirements set out in Article 8(1) of the Regulation. However, certification against non-cybersecurity requirements is optional. Consequently, the peer-review process shall not apply to electronic identification schemes or parts of such schemes which are certified. However, the parts of the scheme which are not covered by certification must be peer reviewed.

  • What is the legal effect of the notification of an electronic identification scheme?

    All notified electronic identification schemes must be recognised across the Union which means any Member State that, either through administrative practice or by law, relies upon electronic identification for authentication to their electronic services, must also accept the use of a notified electronic identification means issued in another Member State.

    However, in some cases the service a user wishes to access may require further information that is not available through the electronic identification means to complete the identification process.

    To reduce cases where users are asked for additional information, Member States, when acting as relying parties for cross-border services, are obliged to provide identity matching services that ensure a smooth identification process. These services match the information available through the electronic identification means with information already stored either in that Member State, e.g. if a person has received an electronic identification means from that Member State or if they were previously a resident of that Member State.

FAQ - Trust Services

General

  • What is a qualified trust service provider?

    The grant of a qualified status for a trust service provider requires that the trust service provider has successfully undertaken an audit confirming it fulfils the requirements of Regulation (EU) No 910/2014 and the confirmation of this compliance by the competent national supervisory body. While detailed requirements depend on the specific qualified trust service, all qualified trust service providers are subject to ongoing supervision by the competent national supervisory body. Qualified trust service providers may begin to label the trust service they provide as “qualified” only after their qualified status has been indicated in the national trusted list.

  • What is a non-qualified trust service provider?

    A non-qualified trust service provider is a trust service provider that provides one or more trust services without having obtained the qualified status under Regulation (EU) No 910/2014. As a result, the trust services they provide are not listed as qualified in the national trusted list and do not benefit from the specific legal presumptions attached to qualified trust services under the Regulation (EU) No 910/2014.

  • What are certificates for electronic signatures, certificates for electronic seals, certificates for website authentication or certificates for the provision of other trust services?

    Regulation (EU) No 910/2014 creates a legal framework for various types of certificates, each serving a distinct trust purpose.

    A certificate for electronic signature, defined in Article 3(14), is an electronic attestation that links electronic signature validation data to a natural person and confirms their name or pseudonym.

    A certificate for electronic seal, as per Article 3(29), serves a similar function for a legal person, attesting the link between electronic seal validation data and a legal person and confirming the name of the legal person.

    A certificate for website authentication, as defined in Article 3(38), is an electronic attestation that makes it possible to authenticate a website and links the website to the natural or legal person to whom the certificate is issued.

    Certificates for the provision of other trust services support trust service functionalities such as validating electronic time stamps or preservation services.

    The Regulation maintains the distinction between qualified and non-qualified certificates, depending on the trust service provider’s status, the content of the certificate and the assurance level of the attested data. The process for verifying the identity data of the person to whom a qualified certificate is issued and for verifying any additional attribute to be included in the certificate together with that identity data needs to abide by demanding procedures and standard to ensure a high level of confidence in the certified data (cf. Art.24(1)(a)(1b) and CIR (EU) 2025/1566).

    Qualified certificates must furthermore include at least information set out in the respective Annex I, III or IV of the Regulation mainly to ensure it includes information about the issuer and the person to whom the certificate is issued, an indication that the certificate is qualified for a specific purpose, information that allows verification of its authenticity, its validity and of signatures or seals created by the person. The practices used by qualified trust service provider to provide their services, including to manage the life cycle of the qualified certificates they deliver need to meet provisions specified for qualified providers (cf. Art.24(2)(3)(4)) and specific to the issuance of qualified certificates (Art.28/38/45).

  • What supervisory arrangements may Member States put in place for trust services, and what are the limits of national regulatory autonomy in this area?

    Member States must designate at least one supervisory body under Article 46b(1). Designation of more than one body is permissible, provided competences are clearly defined and non-overlapping, and each body is duly notified to the Commission under Article 46b(2).

    The task list in Article 46b(4) is non-exhaustive — Member States may assign additional tasks beyond those expressly enumerated, provided they remain consistent with Union law.

  • How can trust services provided in third countries be recognised under Regulation (EU) No 910/2014?

    Regulation (EU) No 910/2014 makes the process of recognition of trust services provided by trust service providers established in a third country or by an international organisation. In particular, the Regulation allows such recognition to be established either through an international agreement between the Union and the third country or through implementing acts adopted by the Commission. This provides an additional mechanism that may facilitate the recognition process compared to relying solely on international agreements. These mechanisms allow trust services provided outside the Union to be recognised under the eIDAS framework where the conditions set out in the Regulation are fulfilled.

  • What is the Third Countries Trusted List for Advanced Electronic Signatures?

    The Third Countries Trusted List for Advanced Electronic Signatures is developed and maintained by the Commission. It contains information notified by third countries that is assessed by the Commission. The purpose of the Third Countries Trusted List for Advanced Electronic Signatures is to facilitate the technical validation of electronic signatures or seals supported by certificates issued by trust service providers established in third Countries. Although it does not imply legal equivalence within the meaning of Article 14 of Regulation (EU) No 910/2014, the inclusion of a third country in the Third Countries Trusted List for Advanced Electronic Signatures is considered as the first step towards working on recognition of qualified electronic signatures or seals and other qualified trust services.

Trust Services Providers

  • What are the main differences between qualified and non-qualified trust services?

    Due to the more stringent requirements applicable to qualified trust service providers, qualified trust services benefit from specific legal effects and provide a higher assurance with respect to their technical and organisational security than non-qualified trust services.

    By way of example:

    • As per Article 25(2), a qualified electronic signature shall have the equivalent legal effect of a handwritten signature;
    • As per Article 35(2), a qualified electronic seal shall enjoy the presumption of integrity of the data and of correctness of the origin of the data to which the qualified electronic seal is linked;
    • As per Article 45b(2), a qualified electronic attestation of attributes shall have the same legal effect as lawfully issued attestations in paper form.

    The primary distinction lies in the degree of trustworthiness, regulatory requirements and regulatory oversight. Under Article 3(17) of the Regulation (EU) No 910/2014, a qualified trust service is one that meets the applicable requirements laid down in the Regulation and is provided by a qualified trust service provider. This provider is supervised and audited regularly, ex ante and ex post, in accordance with Articles 20 and 21 of the Regulation. By contrast, providers of non-qualified trust services are subject to a lighter supervisory regime, ex post only.

  • If a QTSP received its qualified status before 20 May 2024, by when shall it submit a conformity assessment report (CAR) under Article 24(1), (1a) and (1b)?

    QTSPs having received their qualified status before 20/05/2024 — regardless of how long before that date the status was granted — shall submit a conformity assessment report demonstrating their compliance with the requirements of Article 24(1)(1a)(1b) before 21/05/2026. For this specific report, compliance shall be demonstrated with the requirements of Article 24(1), (1a) and (1b), but it is not mandatory to use the standards referenced in CIR (EU) 2025/1566, since this Implementing Regulation shall only apply as from 19/08/2027.

  • For the initial conformity assessment report that QTSPs must submit as part of their initiation process, do they already need to apply the standards referenced in CIR (EU) 2025/1566?

    Providers that wish to be qualified as a QTSPs must submit a conformity assessment report demonstrating their compliance with the requirements of article 24(1), (1a) and (1b) as part of their initiation process in line with Article 21. For this initial report, compliance shall be demonstrated with the requirements of Article 24(1), (1a) and (1b). However, when the report is provided to the competent supervisory body before 19/08/2027, it is not mandatory to use the standards referenced in CIR (EU) 2025/1566, since this Implementing Regulation shall only apply as from 19/08/2027.

  • From what date must all conformity assessment reports under Article 24 (1), (1a) and (1b) be based on the standards referenced in (EU) 2025/1566?

    All conformity assessment reports related to article 24(1), (1a), and (1b) which are submitted to the competent supervisory body after 19/08/2027 must be based on the standards referenced in (EU) 2025/1566.

  • How is the qualified status maintained?

    Qualified trust service providers shall be audited by an accredited conformity assessment body before initiating their activities, and every two years thereafter. Taking into account the resulting conformity assessment reports, supervisory bodies for trust services verify that the qualified trust service provider and the qualified trust service it provides fulfil the requirements of Regulation (EU) No 910/2014 and, where this is the case, grant or confirm the qualified status, which is included in the national trusted list. This list is the constitutive document confirming that the qualified trust service providers are qualified for a qualified trust service and that they comply with the requirements established in the Regulation.

  • Is there a list of the conformity assessment bodies accredited under Regulation (EU) No 910/2014?

    In practical terms, a conformity assessment body is an entity that is accredited in accordance with Regulation (EC) No 765/2008 as being competent and independent for evaluating whether trust service providers and the services they offer meet the relevant requirements of Regulation (EU) No 910/2014 in order to be granted qualified status and included in the relevant national trusted list.

    Member States are required under Article 20 (1b) of Regulation (EU) No 910/2014 to notify the Commission without undue delay of accredited CABs, including their names, addresses, and accreditation details, along with any subsequent changes.

    This information is shared with all Member States and will remain accessible to the public — eIDAS list of CAB .

  • What happens when a Qualified Trust Service Provider (QTSP) loses its qualified status?

    If the Qualified Trust Service Provider (QTSP) fails to meet the requirements outlined in Regulation (EU) No 910/2014 and does not remedy failures within the specified timeframe after being asked to do so by the competent supervisory body, the qualified status may be withdrawn and the national trusted list updated accordingly.

  • How is the qualified status granted to trust service providers and their trust services?

    When a trust service provider wishes to provide a qualified trust service, it shall first request an assessment from an accredited conformity assessment body (CAB). The CAB shall conduct an assessment and produce a conformity assessment report confirming that the candidate qualified trust service provider and the qualified trust service it intends to provide fulfil the requirements laid down in the Regulation (EU) No 910/2014 and in Article 21 of the NIS2 Directive (EU) 2022/2555. This process is commonly referred to as an ‘initiation audit/assessment.’

    Once the trust service provider obtains such conformity assessment (audit) report, it shall submit a request to the competent supervisory body of the Member State where it is established, together with that report. The supervisory body verifies this claimed compliance, normally within three months in collaboration with the competent NIS2 authorities.

    Once the verification is positively concluded, the supervisory body grants the qualified status. Next, the national trusted list of qualified trust service providers is updated to include the new qualified trust service provider and/or the new qualified trust service and their qualified status. The qualified trust service provider is only allowed to start offering its qualified trust services after the qualified status has been indicated in the national trusted list.

    Once the qualified status has been granted and published in the national trusted list, the qualified trust service provider may also use the EU trust mark for qualified trust services.

  • How are eIDAS laboratories integrated into the EU accreditation framework?

    Regulation (EC) No 765/2008 establishes the exclusive legal framework for accreditation in the Union, under which only conformity assessment bodies accredited by National Accreditation Bodies of EU Member States may perform conformity assessment activities with legal effect under EU law. Accreditation of conformity assessment certificates issued by bodies established in third countries, including those operating under international arrangements such as IAF and ILAC, do not by themselves fulfil the accreditation requirements laid down in Regulation (EC) No 765/2008 for conformity assessment activities with legal effect under Union law.

    In the context of Regulation (EU) No 910/2014, CIR (EU) 2025/1566 allows testing of certain technical measures to be carried out by laboratories accredited under Regulation (EC) No 765/2008 or by national competent authorities appointed for that purpose. These laboratories may be involved in assessing the effectiveness of measures implemented to comply with the applicable requirements (point (5) of the Annex to Implementing Regulation (EU) 2025/1566).

    Where testing or evaluation activities are instead performed within the framework of a cybersecurity certification scheme established under Regulation (EU) 2019/881 (Cybersecurity Act), the applicable rules of that certification scheme apply. In such cases, laboratories operate under the supervision of an accredited cybersecurity certification body and must comply with the requirements of the relevant scheme.

  • What does presumption of compliance mean?

    A presumption of compliance means that when the relevant standards, specifications or procedures referenced in an implementing act are followed, there is no need to demonstrate separately that the requirements in Regulation (EU) No 910/2014 have been met; compliance is presumed.

    Where a qualified trust service provider follows the requirements set out in such an implementing act, supervisory bodies should presume compliance with the corresponding requirements of Regulation (EU) No 910/2014 when assessing conformity or granting or maintaining the qualified status.

    However, trust service providers may also demonstrate compliance by other means. In such cases, they must provide evidence of compliance with Regulation (EU) No 910/2014, which must be assessed by a conformity assessment body and reflected in the conformity assessment report submitted to the supervisory body.

  • What is the value, role, and use of Trusted Lists?

    Trusted Lists are essential in ensuring legal certainty and building trust in trust services. Trusted Lists have a constitutive character to indicate the qualified status of a qualified trust service provider and of the qualified trust service it provides. Trusted Lists foster cross border recognition and acceptability of qualified trust services by facilitating the validation of the legal status of, among others, qualified electronic signatures and qualified electronic seals.

    By consulting the trusted lists, relying parties (citizens, businesses or public administrations) can verify whether a trust service provider and the trust service it provides have a qualified status and can therefore rely on the legal effects attached to qualified trust services.

  • What must Qualified Trust Service Providers (QTSPs) verify before issuing a qualified certificate?

    Article 24(1) of Regulation (EU) 910/2014 requires QTSPs to verify, when issuing a qualified certificate (QC) or a qualified electronic attestation of attributes (QEAA), the identity and, if applicable, any specific attributes of the person to whom the certificate or attestation is to be issued.

    This verification obligation applies to each and any issuance of qualified certificates or attestations, and thus also applies in the case of re‑issuance. While automated processes and reliance on previous verifications may be used, the qualified trust service provider remains responsible for ensuring the correctness and accuracy of the identity and attributes of the person to whom the certificate or attestation is to be issued, at the moment of issuance, as clarified in Recital 74 of Regulation (EU) 2024/1183.

  • Are Qualified Trust Service Providers (QTSP) required to verify the identity of the natural or legal persons using their services?

    Identity verification requirements apply explicitly to the following qualified trust services:

    • the issuance of qualified certificates for electronic signatures;
    • the issuance of qualified certificates for electronic seals;
    • the issuance of qualified certificates for website authentication;
    • the provision of qualified electronic registered delivery services;
    • the qualified service for the management of remote qualified electronic signature creation devices;
    • the qualified service for the management of remote qualified electronic seal creation devices;
    • the provision of qualified electronic archiving services;
    • the issuance of qualified electronic attestations of attributes;
    • the recording of electronic data in a qualified electronic ledger.

    Issuance of qualified certificates and qualified electronic attestations of attributes

    According to Article 24(1) of Regulation (EU) No 910/2014, when issuing a qualified certificate or a qualified electronic attestation of attributes, a QTSP shall verify the identity and any necessary attributes of the person in question.

    The verification of the identity and, where applicable, of the attributes must be performed, by appropriate means, by the qualified trust service provider, either directly or by means of a third party, on the basis of one of the methods indicated in Article 24(1) for identity verification and, where applicable, in Article 24(1b) for attributes verification, or, when needed, on a combination of those methods. Furthermore, those verifications must be performed in accordance with the implementing acts adopted pursuant to Article 24(1c), i.e. with Commission Implementing Regulation (EU) 2025/1566 of 29 July 2025 .

    QTSPs issuing qualified electronic attestations (QEAA/s) of attributes may benefit from the obligation on Member States to enable those QTSPs issuing QEAAs to verify attributes relying on authentic sources within the public sector, by electronic means at the request of the user, in accordance with Union or national law. This is not an obligation for QTSPs but a facility they have for at least those attributes listed in Annex VI of Regulation (EU) No 910/2014.

    Provision of qualified electronic registered delivery service

    To ensure that transfer of data using a qualified electronic registered delivery service is delivered to the correct addressee, qualified electronic registered delivery services shall ensure the identification of the addressees with a very high level of confidence or, where applicable, a high level of confidence with the use of European Digital Identity Wallets, in line with Commission Implementing Regulation (EU) 2025/19344 of 29 September 2025 on set requirements, reference standards and specifications that, where they are met by the QTSP, allow presumption of compliance with the requirements of the Regulation, including in relation to those verifications of identity of the sender and addressee.

    Management of remote qualified electronic signature (or seal) creation devices (remote QSCD)

    QTSPs managing remote QSCD must ensure, with a high level of confidence, that the signatories have sole control over the use of their remote qualified electronic signature creation data, and that the creators of the seal have sole control over the use of their electronic seal creation data. Commission Implementing Regulation (EU) 2025/1567 of 29 July 2025 sets out detailed reference standards and specifications that those QTSPs must meet to ensure that this is the case.

    Qualified electronic archiving services

    As part of the provision of qualified electronic archiving services, QTSPs must allow authorised relying parties to receive a record in an advanced and secure manner that confirms that electronic data archived in the qualified electronic archiving service originates from an identified natural or legal person. QTSPs must ensure throughout the preservation of the qualified electronic archive the presumption of integrity of the data from the beginning of the preservation period to the moment of retrieval.

    The recording of electronic data in a qualified electronic ledger

    In respect of the provision of qualified electronic ledgers, QTSPs must ensure that the origin of data records entered in the ledger can be established. This does not imply that the origin must be linked to an identified natural or legal person, nor that the identity of such a person must be verified.

    General consideration on the use of pseudonyms

    Article 5 of Regulation (EU) No 910/2014 states that, as a general rule that applies also in the context of the provision of qualified trust services, without prejudice to specific rules of Union or national law requiring users to identify themselves or to the legal effect given to pseudonyms under national law, the use of pseudonyms that are chosen by the user shall not be prohibited. The Regulation lays down explicitly the possibility for qualified certificates to be issued to natural persons, where they are identified in the issued certificate by means of a pseudonym. The absence of explicit references to pseudonyms in the provisions governing other qualified trust services does not prevent the application of Article 5 of Regulation (EU) No 910/2014, which allows the use of pseudonyms chosen by users.

    Nevertheless, Article 24(2)(h) requires QTSPs providing QTS to “record and keep accessible for as long as necessary after the activities of the qualified trust service provider have ceased, all relevant information concerning data issued and received by the qualified trust service provider, for the purpose of providing evidence in legal proceedings and for the purpose of ensuring continuity of the service”. This information must be retained for evidentiary purposes, including for use in legal proceedings and for ensuring continuity of the service. This may include, for example, information allowing the link between a pseudonym used in the provision of a qualified trust service and the real identity of the person concerned to be established, where this is necessary to provide evidence in legal proceedings.

  • Does it matter if a Qualified Trust Service is issued by a provider established in another Member State?

    The validity of such service cannot be denied. According to the internal market principle set out in Article 4 and to Article 24d of Regulation (EU) No 910/2014, a qualified trust service provided in one Member State shall be recognised as qualified in all other Member States.

  • What shall the Qualified Trust Service Provider (QTSP) do if it wants to implement any change in the provision of its qualified trust service?

    Pursuant to Article 24(2)(a) of Regulation (EU) No 910/2014, the Qualified Trust Service Provider (QTSP) must inform the supervisory body at least two months before implementing any change in the provision of its qualified trust service, and at least three months in advance in case of the cessation of the service or parts thereof.

    Upon receiving such information, the supervisory body may request additional information and may also request an ad hoc external assessment to confirm that, from the implementation of the intended changes, the QTSP shall continue to meet the applicable requirements of the Regulation. Additional information may include, for example, the provision of updated documentation (e.g. applicable policies and practise statements, terms and conditions, risk analysis, incident response plan).

    The supervisory body may also attach conditions to the permission to implement the intended changes to the qualified trust services. If the verification is not concluded within 3 months of the notification, the supervisory body must inform the QTSP about the delay, the reasons for the delay, and the new verification deadline.

    In case of termination of a qualified trust service, or parts thereof, the supervisory body has the task to verify the compliance of the underlying termination plan to its very first correct application, including how information is kept accessible in accordance with Article 24(2)(h) of the Regulation.

  • Which are the information retention obligations for Qualified Trust Service Providers (QTSPs)?

    Article 24(2)(h) of Regulation (EU) No 910/2014 sets out the obligation for the Qualified Trust Service Provider (QTSP) to record and keep accessible for as long as necessary after the activities of the qualified trust service provider have ceased, all relevant information concerning data issued and received by the qualified trust service provider, for the purpose of providing evidence in legal proceedings and for the purpose of ensuring continuity of the service.

  • Can a Qualified Trust Service Provider outsource parts of its service, or must it do everything in-house?

    Qualified trust service providers can rely on external third parties, e.g. sub-contractors or other qualified trust service providers, to meet the relevant requirements applicable to the provision of their qualified trust services. Regulation (EU) No 910/2014 allows qualified trust service providers to outsource parts of their activities or the services that are components of their qualified trust service, provided that the subcontracted services, and the qualified trust service whose services are part of, comply with the requirements of the Regulation.

    Article 24(2)(k) of the Regulation permits the use of subcontractors who, as regards the provision of the qualified trust service, possess the necessary expertise, reliability, experience, and qualifications and who have received appropriate training regarding security and personal data protection rules and shall apply administrative and management procedures which correspond to European or international standards.

  • What does ETSI EN 319 401 requirement 7.6 mean for PaaS-based trust services?

    Clause 7.6 of ETSI EN 319 401-1 does not per se prohibit the use of cloud-based services as components of a trust service. Where a (qualified or non-qualified) trust service provider (TSP) is considering building a (qualified or non-qualified) trust service relying on cloud-based services (e.g. a full-stack PKI as a service, remote HSMs, customer onboarding), it should ensure that the selected cloud service provider is providing the services components of the trust service in compliance with the applicable requirements of Regulation (EU) 910/2014 and of Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS2). The inclusion of 7.6 in the Annex does not prevent the use of cloud-based services and does not mean that the TSP would be required to host all hardware or to have a direct control on their physical access. Where an external service provider is used by a TSP, the TSP should require the external service provider to ensure that the provided services being component services of the trust service meet the requirements under clause 7.6 (as well as all other applicable requirements, e.g. NIS2) and, where appropriate, are auditable as part of the conformity assessment obligations of the TSP. The TSP should be able to perform necessary checks.    

    Indeed, the requirements from Regulation (EU) No 910/2014 and from NIS2 that apply to the TSP and the trust service it provides apply to the external services used by the TSP where those services form part of the provision of the trust service. In other words, the TSP must be able to demonstrate that the trust service it provides meets the applicable requirements including when using external services for parts or for the entirety of the trust service. Article 3(19) of Regulation (EU) No 910/2014 defines a ‘trust service provider’ as “a natural or a legal person who provides one or more trust services either as a qualified or as a non-qualified trust service provider”. By definition, an entity providing a non-qualified trust service (list in Art. 3(16)) is a (non-qualified) trust service provider and needs to comply with Article 19a requirements (and, where applicable, with NIS2 requirements).  

    The eIDAS dashboard is a tool to facilitate browsing of national trusted lists established following Article 22 of Regulation (EU) No 910/2014. Under Article 22, there is no requirement to include information about non-qualified trust service providers on national trusted lists, the decision to do so remains with Member States.

Electronic Signatures & Seals

  • What are the qualified trust services for the management of remote qualified electronic signature creation devices and for the management of remote qualified electronic seal creation devices?

    Regulation (EU) No 910/2014 defines electronic signature and electronic seal creation devices as configured software or hardware used to create an electronic signature or an electronic seal (Article 3(22) and (31)). Remote qualified electronic signature or seal creation devices (remote QSCD) are defined as qualified electronic signature or seal creation devices managed by a qualified trust service provider in accordance with Regulation (EU) No 910/2014 on behalf of a signatory or a seal creator (Article 3 (23a) and (23b)).

    In practice, remote qualified electronic signature/seal creation devices allow the signatory or seal creation data (private keys) and the qualified certificate data to be managed by qualified trust service providers. Instead of storing the keys and the device in their own hardware, signatories or seal creators can use them remotely through the infrastructure operated by the qualified trust service provider.

    Until 20 May 2024, the management of such remote qualified electronic signature/seal creation devices was not categorised as a distinct trust service. Nevertheless, such devices could already be used to facilitate the creation of qualified electronic signatures or qualified electronic seals, provided that the remote qualified device was operated by a qualified trust service provider. Integrating these services into the legal framework for qualified trust services was therefore necessary to address the legal uncertainty and liability issues resulting from the absence of specific rules in the previous version of the Regulation.

  • Can Member States restrict the type of electronic signature required for a given online service or transaction?

    As a matter of principle, Regulation (EU) No 910/2014 does not fully harmonise national rules on the legal effect of electronic signatures or on form requirements for particular transactions. Recital 63 of Regulation (EU) 2024/1183 confirms that, except where Regulation (EU) No 910/2014 provides otherwise, the legal effect of electronic signatures is for national law to determine. In doing so, Member States should apply the principle of proportionality between the legal value of the document and the level of security and cost of the signature required. This should be based on a proper risk assessment as regards to the type of signatures needed for a given transaction. The use of advanced electronic signatures for day-to-day transactions is to be encouraged where they provide sufficient trust and security.

    Member States may not request an electronic signature at a higher security level than ‘qualified electronic signature’ for cross-border use of online services offered by a public sector body (Article 27(3)).

    As regards the formats of such electronic signatures, where a Member State requires an advanced electronic signature to use an online service offered by, or on behalf of, a public sector body, that Member State shall recognise advanced electronic signatures, advanced electronic signatures based on a qualified certificate for electronic signatures, and qualified electronic signatures in at least the formats and using methods defined in the implementing act adopted pursuant to Article 27(5) of Regulation (EU) No 910/2014.

    Qualified electronic signatures and qualified electronic seals based on a qualified certificate issued in one Member State shall be recognised, respectively, as qualified electronic signatures and qualified electronic seals in all other Member States.

  • Can Member States impose maximum validity periods for qualified certificates, and how does this affect certificates from other Member States?

    National laws may not impose further requirements or limitations on qualified certificates than those established by Regulation (EU) No 910/2014. This is stated clearly for qualified certificates for electronic signatures, electronic seals and website authentication, respectively, by Articles 28(2), 38(2) and 45(1b) of Regulation (EU) No 910/2014, which provide that such certificates shall not be subject to any mandatory requirements exceeding those laid down in Annex I, Annex II and Annex III of the Regulation.

    Furthermore, Article 4a of Regulation (EU) No 910/2014 requires that a qualified certificate issued in one Member State is recognised, respectively, as qualified in all other Member States.

  • What is a remote Qualified Electronic Signature Creation Device (QSCD)? How is it different from a local QSCD?

    Regulation (EU) No 9120/2014 recognises that qualified electronic signatures may be created using a qualified electronic signature creation device. Those devices can be either remote (e.g. a hardware security module managed by a qualified trust service provider remotely on behalf of the user who accesses it via the network) or local (e.g. a smartcard in possession of a user). Qualified electronic signatures are legally the same regardless of which kind of qualified electronic signature creation device was used to create the signature.

    The new category of qualified trust services consisting in the management of remote electronic signature creation devices and of remote electronic seal creation devices is introduced by Regulation (EU) 2024/1183.

  • What are the certification requirements for a remote Qualified electronic Signature Creation Device and for a remote Qualified electronic Seal Creation Device?

    All QSCDs whether they are local or remote shall be certified in accordance with Article 30 of Regulation (EU) No 910/2014 for their compliance with the requirements of Annex II. This certification must be performed either in accordance with the standards listed in CID (EU)2016/650 or in accordance with an alternative certification procedure. Such alternative certification procedures are currently used to remote QSCDs and to certain types of local QSCDs (e.g. Hardware Security Modules mainly used by legal persons as local qualified electronic seal creation devices). These procedures must be notified by the certification body using them to the Commission, which publishes them in a compiled list.

    Furthermore, Member States must notify to the Commission appropriate information on certified QSCD, whenever a QSCD is certified, or its certification is cancelled.

    This information on certified QSCD shall then be included in the list compiled by the Commission in accordance with Article 31(2) of Regulation (EU) No 910/2014. The list is available in the eIDAS Dashboard . Please refer to Commission Implementing Regulation (EU) 2025/1570 of 29 July 2025 , Commission Implementing Regulation (EU) 2025/1567 and CID (EU)2016/650 for further details.

  • Do advanced and qualified electronic signatures need to comply with CID (EU) 2015/1506?

    Articles 27 and 37 of Regulation (EU) No 910/2014 do not impose any obligation for advanced or qualified electronic signatures/seals to comply with the standards listed in Implementing Decision (EU) 2015/1506. Those provisions require Member States to recognise such signatures/seals, in at least the formats or using the methods defined in that Decision, where a public sector body requires the use of an online service. These requirements concern recognition and validation by relying parties, not the creation of the signature/seal. The creation of advanced electronic signatures/seals remains technology-neutral and is subject only to the requirements set out in Article 26/36 of the Regulation.

    Articles 27 and 37 of Regulation (EU) No 910/2014 do not require advanced electronic signatures or qualified electronic signatures to comply with the formats or methods listed in Commission Implementing Decision (EU) 2015/1506.

    Those provisions instead concern the recognition of electronic signatures and seals in the context of online public services. Where a public sector body requires the use of an advanced electronic signature or seal for an online service, Member States must recognise at least the formats or methods defined in Implementing Decision (EU) 2015/1506.

    These provisions therefore regulate the legal recognition of signatures and seals by relying parties, not the creation of the signature or seal itself.

Electronic registered delivery services

  • How does a Qualified Electronic Registered Delivery Service (QERDS) ensure data reaches the right recipient?

    To ensure that data using a qualified electronic registered delivery service is delivered to the correct addressee, qualified electronic registered delivery services should ensure the identification of the addressee with a very high level of confidence (by contrast, only a high level of confidence is required as regards the identification of the sender).

FAQ - Electronic attestation of attributes

EAAs in the Digital Identity Wallets

  • What is an attribute?

    An attribute is a piece of information that characterises an individual, an entity or an object. Attributes can include a wide range of personal or professional data, such as a person’s name, date of birth, nationality, educational qualifications, professional titles, or specific rights and permissions.

    In the context of digital identity, attributes are essential for proving identity or validating specific characteristics within online services. Attributes can be static (e.g., date of birth) or dynamic (e.g., current address), and they may be derived from official registries, personal documents, or certifications issued by trusted authorities.

  • What is an Electronic Attestation of Attributes?

    An Electronic Attestation of Attributes (EAA) is a type of digital document that confirms the accuracy of a specific attribute or set of attributes, such as a place of residence or professional qualification. An EAA can be issued to, stored and presented with the EU Digital Identity Wallets.

  • What are the three categories of EAAs, and what advantages are associated with each category?

    Not all EAAs are the same. They vary in their legal status, assurance levels, and the types of use cases for which they are most suitable.

    • Qualified Electronic Attestations of Attributes (QEAAs): Issued only by Qualified Trust Service Providers under strict identity-verification and anti-fraud checks, QEAAs carry the highest assurance level. Legally equivalent to paper documents and automatically recognised across all Member States.
    • Non-qualified Electronic Attestations of Attributes (EAAs): Skips QTSP requirements, making them faster and cheaper to issue, ideal for private-sector services or pilots, though relying parties must independently assess trust and reliability.
    • Public Electronic Attestations of Attributes (PuB-EAAs): Issued by or on behalf of public sector bodies drawing on official registries, PuB-EAAs match QEAAs in legal quality and EU-wide recognition, without needing to come from a qualified trust service provider. ..Read more

    Qualified Electronic Attestations of Attributes (QEAAs)

    • Stronger security and fraud prevention – As stated in Article 24(1), 24(1a) and 24(1b) of Regulation (EU) No 910/20143, when issuing a qualified EAA, a Qualified Trust Service Provider (QTSP) must verify the attested identity and specific attributes of the person to which it is issued. Moreover, Article 24 prescribes robust scrutiny mechanisms to detect inconsistencies and prevent tampering or misuse.
    • Recognised in all Member States – Under Article 24a(9) of Regulation (EU) No 910/2014, QEAAs shall be recognised across the EU, ensuring smooth cross-border use.
    • Same legal value as an equivalent document in paper form – As per Article 45b(2) of Regulation (EU) 910/2014, a QEAA shall have the same legal effect as lawfully issued attestations in paper form.
    • Secure revocation mechanism - Where a qualified electronic attestation of attributes has been revoked after initial issuance, it shall lose its validity from the moment of its revocation and its status shall not in any circumstances be reverted (Article 45d(4)).

    Non-qualified Electronic Attestations of Attributes

    • More flexible and easier to issue - Non-qualified EAAs do not require the issuers to meet requirements for Qualified Trust Service Providers, making them easier and faster to deploy, especially for private-sector services or pilot projects.
    • Lower compliance and operational burden - They have fewer regulatory requirements than QEAAs, which can significantly reduce costs and administrative overhead for issuers.
    • According to Article 45b(1) of Regulation (EU) 910/2014, an electronic attestation of attributes shall not be denied legal effect or admissibility as evidence in legal proceedings on the sole ground that it is in electronic form or that it does not meet the requirements for qualified electronic attestations of attributes.
    • Compared to QEAA and PubEAA, EAAs do not benefit from a Regulation built-in trust framework and require a higher burden on relying parties to establish the level of reliability and trust, mainly on an attestation scheme basis.
    • Key Legal Difference between qualified and non-qualified EAAs: QEAAs benefit from a harmonised EU trust framework, mandatory recognition across all Member States, and the same legal effect as an equivalent paper attestation, whereas non-qualified EAAs may still have legal effect and evidential value but do not benefit from these specific legal presumptions and recognition guarantees under Regulation (EU) No 910/2014.

    Public Electronic Attestations of Attributes (PuB-EAAs)

    • Public EAAs (PuB-EAAs) can be issued by or on behalf of public sector bodies when the data originates from official registries or government databases. Their legal quality and assurance equals qualified EAAs, even if not issued by qualified trust service providers.
    • These attestations hold legal equivalence to paper-based documents and are particularly relevant for public services. According to Article 45b(2) of Regulation (EU) 910/2014, attestations of attributes issued by, or on behalf of, a public sector body responsible for an authentic source shall have the same legal effect as lawfully issued attestations in paper form. Pub-EAAs are equivalent to official public documents and are recognised in all Member States. Their electronic format makes them easier to use and share in certain situations compared to their non-digital counterparts.
    • Recognised in all Member States: As per Article 45b(3) of Regulation (EU) 910/2014, an attestation of attributes issued by or on behalf of a public sector body responsible for an authentic source in one Member State shall be recognised as an attestation of attributes issued by or on behalf of a public sector body responsible for an authentic source in all Member States.
    • Secure revocation mechanism - Where an electronic attestation of attributes issued by or on behalf of a public sector body responsible for an authentic source has been revoked after initial issuance, it shall lose its validity from the moment of its revocation and its status shall not be reverted (Article 45f(4) of Regulation (EU) 910/2014).

    Read less

How to issue an EEA

  • Who can issue EAAs?

    • Non-qualified EEAs can be issued by anyone who can meet the requirements for the issuance of EAAs (Article 45g and 45h) and for trust service providers (Art. 19a).
    • Public Sector Body can issue Public Electronic Attestations of Attributes (PuB-EAAs) provided they meet the requirements of Regulation (EU) No 910/2024, including Art. 45f. Regulation (EU) 910/2014 does not forbid public sector bodies from becoming (Qualified) Trust Services Providers and issuing EAAs and QEAAs.
    • Private Sector can issue EAAs in the form of qualified or non-qualified EAAs, depending on their intended characteristics and use scenarios, thus becoming a Trust Service Provider. Qualified EAAs can only be issued by Qualified Trust Service Providers.
    • Regulation (EU) 910/2014 does not apply to EU institutions, bodies and agencies (EUIBAs). However, this does not prevent EU institutions, bodies and agencies from providing services equivalent to the trust services defined under Regulation (EU) 910/2014.

  • How to issue Non-Qualified Electronic Attestations of Attributes?

    Under Regulation (EU) 910/2014, anyone who issues electronic attestations of attributes (EAAs), like diplomas, licences, or mandates to act on someone's behalf, is automatically classed as a Trust Service Provider, with no special status required to become one.

    Non-qualified providers still carry real obligations, though: they must manage legal, operational, and security risks, report serious breaches within 24 hours, and meet EAA-specific rules on wallet interoperability and data separation. Unlike qualified services, there's no mandatory upfront audit, supervision happens after the fact, triggered ..Read more by incidents or complaints.

    • In accordance with the definitions provided in Article 3 of Regulation (EU) 910/2014:: ‘electronic attestation of attributes’ means an attestation in electronic form that allows attributes to be authenticated; ‘trust service’ means an electronic service normally provided for remuneration which consists of any of the following: […] (g) the issuance of electronic attestations of attributes; ‘trust service provider’ means a natural or a legal person who provides one or more trust services either as a qualified or as a non-qualified trust service provider.
    • As per recital 55 of Regulation 2024/1183 amending Regulation (EU) No 910/20144 any service provider that issues attested attributes in electronic form such as diplomas, licences, birth certificates or powers and mandates to represent or act on behalf of natural or legal persons should be considered a trust service provider of electronic attestation of attributes.
    • Accordingly, the issuance of Electronic Attestations of Attributes results in the entity being classified as a Trust Service Provider.
    • There are no specific requirements for obtaining the status of a Trust Service Provider.

    Read less

  • Are there any specific obligations for Trust Service Providers issuing non-qualified trust services?

    Requirements for non-qualified trust service providers are specified in Article 19a of Regulation (EU) 910/2014, in Directive (EU) 2022/2555 (NIS 2NIS2) and the Commission Implementing Regulation (EU) 2025/2160 laying down rules as regards reference standards, specifications and procedures for the management of risks to the provision of non-qualified trust services.

    A trust service provider must have suitable policies and measures in place to deal with legal, business, and operational risks, as well as other indirect risks connected to the provision of the non-qualified trust service.

    These measures must cover:

    • registration and onboarding procedures for a trust service;
    • procedural or administrative checks needed to provide trust services;
    • the management and implementation of trust services.

    If there is any security breach or disruption that significantly affects the service or the personal data it holds, the provider must notify as soon as possible and no later than 24 hours after becoming aware of the issue:

    • the supervisory authority;
    • the affected individuals;
    • the public (if it is in the public interest); and
    • any other relevant authorities.

    There are additional specific requirements for TSP issuing EAAs:

    • Providers of EAA shall provide EUDI Wallet users with the possibility to request, obtain, store and manage the EAA irrespective of the Member State where the EUDI Wallet is provided (Art.45g(1)). This means that they need to comply with the formats and applicable requirements set out in the relevant implementing acts.
    • Providers of EAAs shall not combine personal data relating to the provision of those EAAs with personal data from any other services offered by them or their commercial partners (Art.45h(1)). Furthermore, personal data relating to the provision of EAAs shall be kept logically separate from other data held by the provider of EAAs (Art.45h(2)).

    Good to know:

    • Commission Implementing Regulation (EU) 2025/2160 lays down rules for the application of Regulation (EU) No 910/2014 of the European Parliament and of the Council as regards reference standards, specifications and procedures for the management of risks to the provision of non-qualified trust services.
    • No prior auditing is mandated for TSPs issuing EAAs; supervision is conducted ex post and initiated only in response to security incidents or formal complaints.

  • How to issue Qualified Electronic Attestations of Attributes?

    Qualified EAAs (QEAAs) can only be issued by Qualified Trust Service Providers (QTSP), and must meet strict content requirements, including a clear "qualified" marking, issuer details, attested attributes, validity dates, a unique code, and a qualified signature or seal.

    Becoming a QTSP itself is a formal process: providers notify their supervisory body, submit a conformity assessment confirming compliance with both the eIDAS Regulation and NIS2, and only gain qualified status and the right to operate once listed on the national trusted list.

    That status is not permanent: QTSPs face mandatory audits at least every 24 months, and can lose their qualified status if they fail to fix compliance issues or if NIS2 or GDPR authorities flag violations. The sections below go ..Read more into more detail on each step.

    Qualified EAAs are issued exclusively by Qualified Trust Service Providers (QTSPs).

    Qualified EAAs must also meet requirements laid down in Annex V of Regulation (EU) No 910/2014 and include, for example:

    • Indication it is qualified – A clear indication that it is a qualified electronic attestation of attributes.
    • Issuer details – Data identifying the qualified trust service provider that issued it.
    • Entity being attested – Information about the person or organisation the attributes belong to; indicate if a pseudonym is used.
    • Attested attributes
    • Validity period –Start and end dates for the attestation.
    • Unique attestation code – A unique ID from the issuer, and if relevant, the scheme it belongs to.
    • Qualified signature/seal – A qualified electronic signature or seal from the issuing provider.
    • Certificate access – Information on where to find the supporting certificate to verify the qualified signature/seal of the issuer.
    • Validity check – Information or service to verify if the attestation is still valid.

    Other requirements are described in Articles 45d, 45g and 45h of Regulation (EU) 910/2014.

    Where a qualified electronic attestation of attributes has been revoked after initial issuance, it shall lose its validity from the moment of its revocation and its status shall not in any circumstances be reverted (Article 45d(4)).

    List of reference standards and specifications and procedures for qualified electronic attestations of attributes are regulated by Commission Implementing Regulation (EU) 2025/1569.7

    When issuing a QEAA, a QTSP shall verify the identity and, if applicable, any specific attributes of the natural or legal person to whom the QEAA is to be issued (Article 24).

    Providers of electronic attestations of attributes shall provide European Digital Identity Wallet users with the possibility to request, obtain, store and manage the electronic attestation of attributes irrespective of the Member State where the European Digital Identity Wallet is provided (Article 45g(1)).

    Moreover, for the attributes listed in Annex VI, Member States must make it possible for QTSPs to verify the attributes against authentic sources (Article 45e(1)).

    Read less

  • How to become a Qualified Trust Service Provider?

    The initiation of a qualified trust service is described in Article 21 of Regulation (EU) 910/2014

    A trust service provider intending to offer a qualified trust service must:

    Notify the supervisory body, and submit a conformity assessment report issued by a conformity assessment body.

    The report must confirm compliance with:

    • Regulation (EU) 910/2014, and
    • Article 21 of the NIS2 Directive (EU) 2022/2555.

    The supervisory body verifies whether:

    • The provider meets the requirements for qualified trust service providers, and
    • The trust services comply with the requirements of Regulation (EU) 910/2014
    • For NIS2 compliance, the supervisory body must request the competent NIS2 authority to carry out supervisory actions.

    If compliance is confirmed, the supervisory body grants qualified status to the provider and the service.

    • Qualified trust service providers may begin to label the trust service they provide as “qualified” only after their qualified status has been indicated in the national trusted list.
    • The list is the constitutive document confirming that the qualified trust service providers are qualified for a qualified trust service.

  • How is the qualified status maintained? (Article 20)

    The supervision of qualified trust service providers is outlined in Article 20 of Regulation (EU) 910/2014.

    While detailed requirements depend on the specific qualified trust service, all qualified trust service providers are subject to ongoing supervision by the competent national supervisory body.

    • Qualified trust service providers (QTSPs) must be audited at least every 24 months.
    • Audits are carried out at the provider’s own expense by an accredited conformity assessment body (CAB).
    • The audit must confirm compliance with Regulation (EU) 910/2014 & Article 21 of the NIS2 Directive (EU) 2022/2555.
    • QTSPs must notify the supervisory body at least one month before any planned audit.
    • The supervisory body may participate as an observer in the audit if it wishes.
    • If a QTSP fails to meet requirements, the supervisory body may require corrective action within a set deadline. If the issue is not remedied, the supervisory body may withdraw qualified status.

    Qualified status may also be withdrawn when:

    • NIS2 authorities report non-compliance with Article 21 of NIS2.
    • GDPR authorities report non-compliance with GDPR.

  • How to issue Public Electronic Attestation of Attributes?

    Public EAAs (PuB-EAAs) follow a similar logic to QEAAs, requiring a machine-readable indicator of official status, issuer identification, subject details, attested attributes, validity period, unique identifier, and a qualified signature or seal, plus free access to the supporting certificate and a way to check validity.

    But because PuB-EAAs come from public bodies rather than QTSPs, the issuing body must undergo an ex ante conformity assessment, meet reliability standards on par with a QTSP, and be formally notified to the Commission by its Member State before it can issue attestations. The sections below cover these requirements in more detail. ..Read more

    General requirements:

    The requirements for the PuB-EAAs issued by or on behalf of a public body responsible for an authentic source must meet requirements outlined in Annex VII of Regulation (EU) 910/2014, and include:

    • A clear indication (readable by automated systems) that it is an official electronic attestation of attributes issued by or for a public body.
    • Identification of the issuing public body, including at least: the Member State, the name of the body, and where applicable, its official registration number.
    • Identification of the subject to whom the attributes relate; if a pseudonym is used, this must be clearly stated.
    • The attested attribute(s)
    • The validity period, showing when the attestation starts and ends.
    • A unique attestation identifier for the issuing body and, if relevant, the attestation scheme it belongs to.
    • A qualified electronic signature or seal of the issuing body.
    • Free access to the certificate supporting the qualified signature or seal.
    • Information on how to check the attestation’s validity, or where such services can be found.

    Other requirements are described in Article 45f of Regulation (EU) 910/2014, including the need to conduct an ex ante conformity assessment by a conformity assessment body, meet a level of reliability and trustworthiness equivalent to a QTSP (on the basis of the general requirements applicable to all QTSPs) and be notified to the Commission as a PubEAA provider by their Member State.

    Obligations for Member States:

    • Each Member State must make sure that any public-sector body issuing electronic attestations of attributes operates with a level of reliability and trustworthiness comparable to that of a qualified trust service provider - Article 45f(2) of Regulation (EU) 910/2014.
    • Before a public body can be officially recognised for issuing PubEAAs, the Member State must notify the Commission and provide evidence (through a conformity assessment report) that the body meets the necessary requirements – Article 45f(3) of Regulation (EU) 910/2014.

    Read less

  • How can I quickly understand the different types of attestations?

    Type of EAAProvider TypeLegal Effect
    Qualified Electronic Attestations of AttributesQualified Trust Service Provider (QTSP)Equivalent to paper-based documents
    Non-Qualified Electronic Attestations of AttributesTrust Service Provider (TSP)No guaranteed legal equivalence
    Public Electronic Attestations of AttributesPublic Sector Body or Official AuthorityEquivalent to paper-based documents

    Qualified Electronic Attestations of Attributes

    Provider Type

    Qualified Trust Service Provider (QTSP)

    Legal Effect

    Equivalent to paper-based documents

    Non-Qualified Electronic Attestations of Attributes

    Provider Type

    Trust Service Provider (TSP)

    Legal Effect

    No guaranteed legal equivalence

    Public Electronic Attestations of Attributes

    Provider Type

    Public Sector Body or Official Authority

    Legal Effect

    Equivalent to paper-based documents

EAAS based solutions

  • How is cross-border usability of EAAs guaranteed for European Digital Identity Wallet users?

    Providers of EAAs shall provide users of European Digital Identity Wallets with the possibility to request, obtain, store and manage the electronic attestation of attributes irrespective of the Member State where the European Digital Identity Wallet is provided (Art.45g(1)).

  • Is international recognition of EAAs possible?

    Qualified EAAs can be recognised outside the EU according to Article 14 of Regulation (EU) 910/2014. Recognition of trust services is mutual and conditional:

    • The EU and a third country or an international organisation can recognise each other’s trust services if equivalent standards and formal recognition instruments are in place.
    • Non-EU trust services can be legally equivalent to EU qualified services only if: the EU signs an agreement with the country/organisation, or the EU adopts an official implementing act to recognise the service.
    • Before the EU recognises the EAAs, the non-EU provider must meet the same standards and requirements that EU-qualified providers must meet. The third country or organisation must also create and publish a trusted list of recognised trust service providers, just like the EU does.

  • Is there additional legislation that must be considered? Can any Qualified Trust Service Provider issue all types of electronic attestations of attributes?

    The general legal framework for EAAs is set out in Regulation (EU) 910/2014. These rules ensure that a qualified EAA carries the same legal effect as lawfully issued paper-based attestations.

    However, as per recital 55 of Regulation (EU) 2024/11838, those requirements apply without prejudice to Union or national law defining additional sector-specific requirements as regards form with underlying legal effects and, in particular, the cross-border recognition of qualified electronic attestation of attributes, where appropriate.

    Driving Licences Directive is an example of lex specialis defining additional sector-specific requirements. It requires that Member States issue a Mobile Driving Licence (mDL) as EAAs.

    It explicitly mandates:

    • in Article 5(1) that Member States shall issue mobile driving licences based on the Union standard specifications...
    • And in Article 5(2) that […] Mobile driving licences shall be issued to holders to be used with European Digital Identity Wallets as electronic attestations of attributes, in accordance with Regulation (EU) No 910/2014 of the European Parliament and of the Council.

    If a non-authorised QTSP were to issue a QEAA resembling an mDL, but without the authority to issue either a DL or an mDL, Regulation (EU) 910/2014 would not confer upon that QEAA any equivalence to an official, paper-based driving licence.

    Moreover, all Commission services should promote the ‘Wallet by Default Approach’. This means that the EUDIWs should remain a preferred solution for EU citizens. By ensuring that the EUDIWs are widely available and integrated into public and private sector services, the initiative will support cross-border digital interactions, improve administrative efficiency, and strengthen citizen trust.

  • How to issue electronic attestation of attributes to European Digital Identity Wallets?

    • As stated in Article 45h of Regulation (EU) 910/2014, providers of electronic attestations of attributes shall provide European Digital Identity Wallet users with the possibility to request, obtain, store and manage the electronic attestation of attributes irrespective of the Member State where the European Digital Identity Wallet is provided.
    • Moreover, providers of qualified electronic attestations of attributes shall provide an interface with European Digital Identity Wallets.
    • Additional guidance can be found in Commission Implementing Regulation (EU) 2025/2025 on qualified electronic attestations of attributes and electronic attestations of attributes provided by or on behalf of a public sector body responsible for an authentic source.

  • How are electronic attestations of attributes managed within the European Digital Identity Wallets?

    As per Article 5a of Regulation (EU) 910/2014, the specific management of electronic attestations of attributes will largely be up to the different wallet providers. At a minimum, it must be possible to create, read, update and delete those attestations on the European Digital Identity Wallet. Wallet providers are likely to also provide discovery services that would allow wallet users to find relevant attestations that users may request to be issued to them. The wallets must also support the reissuance, suspension and revocation of electronic attestations of attributes.

  • Do public sector bodies issuing Pub-EAAs qualify as providers of qualified trust services or non-qualified trust services under the Regulation?

    Public sector bodies issuing Pub-EAAs are not per se qualified trust service providers. The provision of Pub-EAAs is not a qualified trust service, and their providers are not required to become qualified trust service providers. However, the supervision regime of Pub-EAA providers is similar to that of qualified trust service providers, and Pub-EAAs have the same legal effects as qualified attestations of attributes.

  • How is users’ personal data protected?

    • Providers of qualified and non-qualified electronic attestation of attributes services shall not combine personal data relating to the provision of those services with personal data from any other services offered by them or their commercial partners (Article 45h(1) of Regulation (EU) 910/2014).
    • Personal data relating to the provision of electronic attestation of attributes services shall be kept logically separate from other data held by the provider of electronic attestation of attributes. (Article 45h(2) of Regulation (EU) 910/2014).
    • Providers of qualified electronic attestation of attributes’ services shall implement the provision of such qualified trust services in a manner that is functionally separate from other services provided by them. (Article 45h(3) of Regulation (EU) 910/2014).
    • The technical framework of the European Digital Identity Wallet enables privacy preserving techniques which ensure unlinkability, where the attestation of attributes does not require the identification of the user. (Article 5a(16)(b).
    • Besides these specific rules in Regulation (EU) 910/2014, all other GDPR requirements apply, such as on data protection principles, data subjects' rights, etc. The GDPR is also fully applicable to the processing of your personal data in the EUDIW: among other things, this means that the processing is secure (Article 32), thanks to measures such as encryption and secure storage of data; the wallet was built on the basis of data protection by design and by default. You can exercise your data subject rights (Chapter III GDPR), the amount of personal data processed is limited to what is strictly necessary, and you retain control of what personal data you share with whom.

  • What are the liability rules for the Trust Services Providers?

    • The liability and burden of proof of Trust Service Providers is regulated under Article 13 of Regulation (EU) 910/2014.
    • According to that Article, trust service providers are responsible for any damage caused intentionally or through negligence that results from their failure to meet the obligations set out in the Regulation.
    • Anyone who suffered material or non-material damage because of a trust service provider's infringement of the Regulation has the right to seek compensation under EU and national law.
    • National rules on liability apply.
    • The burden of proving the intention or negligence of a non-qualified trust service provider lies with the natural or legal person claiming the damage.
    • The intention or negligence of a qualified trust service provider is presumed unless that qualified trust service provider proves that the damage occurred without the intention or negligence of that qualified trust service provider.
    • It is important to note that, where trust service providers duly inform their customers in advance of the limitations on the use of the services they provide and where those limitations are recognisable to third parties, trust service providers shall not be liable for damages arising from the use of services exceeding the indicated limitations.

  • Which attributes must be verified against authentic sources?

    As prescribed in Article 24 of Regulation (EU) 910/2014, when issuing a qualified electronic attestation of attributes, a qualified trust service provider shall verify the identity and, if applicable, any specific attributes of the natural or legal person to whom the qualified electronic attestation of attributes is to be issued.

    To facilitate this process, in accordance with Article 45e of Regulation (EU) 910/2014, Member States must ensure that qualified trust service providers of electronic attestations of attributes are able to verify by electronic means at the request of the user the authenticity of the enlisted attributes against the relevant authentic source at national level or via designated intermediaries recognised at national level.

    These attributes relevant to this requirement are listed in Annex VI and represent the minimum required set. The examples include: age, civil status, educational and professional qualifications, public permits and licenses.

    Verification against authentic sources is not the only way of verifying attributes by QTSPs. Other methods are outlined in Article 24(1b) of Regulation (EU) 910/2014.

    The provider must verify attributes using one or more of the following methods:

    • Digital identity methods - through the European Digital Identity Wallet, or a notified eID with a high assurance level (Article 8).
    • Qualified certificates - using a qualified electronic signature or seal certificate issued according to the rules.
    • Qualified electronic attestation of attributes (QEAAs).
    • Other reliable methods - any method that ensures a high level of confidence, confirmed by a conformity assessment body.
    • Physical presence - the person (or authorised representative) appears in person, providing appropriate evidence following national law.

  • What is a catalogue of attributes?

    A catalogue of attributes is a repository of attributes. It is established by the Commission with the assistance of the European Digital Cooperation Group to facilitate the verification of attributes against authentic sources by qualified trust service providers issuing qualified electronic attestations of attributes. It will contain, at least, the attributes listed in Annex VI of Regulation (EU) 910/2014 to enable the verification of those attributes against authentic sources.

    For example: age, address, gender, civil status, family composition, nationality or citizenship, educational and professional qualifications, permits and licences.

    More information about the catalogue can be found in the Commission Implementing Regulation (EU) 2025/1569.11.

  • What is a catalogue of schemes?

    A catalogue of schemes is a repository of schemes for the attestation of attributes. It will be maintained and published online by the Commission. It will contain specifications for common types of electronic attestations of attributes in order to facilitate interoperability and harmonisation of those attestations.

    For example, schemes of attributes may define specifications for the issuance of Digital Travel Credentials (DTCs), mobile driving license (mDL), diplomas and age verification.

    More information about the catalogue can be found in the Commission Implementing Regulation (EU) 2025/1569.12.

  • Can a public sector body also act as a QTSP or even a TSP and issue attestations of attributes?

    Regulation (EU) 910/2014 does not prevent public sector bodies from becoming trust services providers, be they non-qualified or qualified. In this case, public sector bodies providing (qualified) trust services shall also be supervised as such and meet the requirements set out in the Regulation and in the implementing acts.

  • Can attributes listed in Annex VI of eIDAS also be issued in the form of EAA?

    • Annex VI to the Regulation establishes  a minimum catalogue of attributes for which Member States should ensure that measures are taken to allow QTSPs issuing QEAAs to verify by electronic means at the request of the user, the authenticity of those attributes against the relevant authentic source at national level or via designated intermediaries recognised at national level, in accordance with Union or national law and where these attributes rely on authentic sources within the public sector.
    • As stated in Recital 12 of the EAAs Implementing Act 13 , Member States are encouraged to provide any additional optional attributes beyond the mandatory ones to ensure that the set of person identification data is unique. The Regulation does not prevent any public sector body, be they responsible for an authentic source, from issuing any kind of EAA as regards any kind of attribute.
    • Consequently, EAAs may include any attributes, without predefined limitations. Public bodies may issue EAAs independently or by contracting TSPs.
    • Please note that mutual recognition only applies to QTS: thus, only a qualified electronic attestation of attributes and attestations of attributes issued by, or on behalf of, a public sector body responsible for an authentic source shall have the same legal effect as lawfully issued attestations in paper form in all Member States. (see Art. 24a and Art. 45b).

  • How is a QTSP supposed to collect the necessary attribute data for initial issuance of a QEAA?

    There are two processes: collection (gathering the attribute data) and verification (confirming the data is correct).

    Article 24(1b) regulates verification of attributes.

    The Regulation does not mandate how the attributes are initially collected.

    QTSPs issuing QEAAs must, at the moment of the issuance of the QEAA, ensure with complete certainty the correctness and accuracy of the attested attributes of the person and the identification of that person to whom the QEAA is issued.

    But to achieve this, there is no obligation for QTSPs issuing QEAAs to verify the attributes against authentic sources.

    • Art.24(1)(1a)(1b) do not per se entail or automatically provide the QTSP with any consent from the person to whom the identity and attributes will be verified, for the purpose of verifying them against authentic sources in accordance with Art.45e.
    • This consent must be explicitly obtained by the QTSP from that person.
    • There may be different options to obtain such consent based on agreements between the QTSP and the person (e.g. not necessarily requiring an explicit consent to be granted at the time of the request made by the QTSP to the authentic source).

  • Does “lawfully issued attestations in paper form” in Article 45b(2) include administrative documents issued by Member States, such as identity cards?

    The term attestation is not defined in eIDAS, which only regulates EAAs. Under Art. 3(44), an electronic attestation of attributes is a means of electronically authenticating attributes of a person. Considering the broad definitions, almost any attribute or set of attributes could be issued as an EAA as long as any potential additional requirements on the form (e.g. laid down in Union or national law) is met.

  • Is the reference to “paper form” limited to paper documents, or does it also cover other physical formats such as plastic cards?

    Paper form in Art. 45b(2) should be read as referring to the physical counterpart, irrespective of substrate. The point is equivalence between electronic and physical forms, not between paper and plastic.

  • Does Article 45b(2) override EU rules on the format of documents like IDs, passports, and driving licences, or must those rules be changed first for them to be used as PuB-EAAs?

    Article 45b(2) gives PuB-EAAs and QEAAs the same legal effect as their lawfully issued physical counterparts for the attributes they carry. Where there are specific requirements on the form in specific legislation, this should be considered for the issuance of electronic attestations of attributes. For example, the mDL additional requirements were set up for the issuance of mDL that would need to be respected for the issuance of these very specific EAAs.

  • Can Member States offer the verification mechanism in Art. 45e to TSPs?

    • As per Article 45e, Member States must ensure that QTPs can verify attributes against authentic sources, at least for the attributes listed in Annex VI.
    • Recital 61 of Regulation (EU) No 2024/1183 amending Regulation (EU) No 910/2104 states that the purpose of this verification mechanism is to support qualified trust service providers of qualified electronic attestations of attributes in meeting their obligations under Regulation (EU) No 910/2014.
    • Article 45e does not prevent Member States from enabling TSPs to access the verification mechanism.
    • Before granting access to authentic source verification for trust service providers, it might be beneficial to conduct an internal assessment of potential risks. Key considerations could include ensuring GDPR compliance, obtaining user consent, and implementing effective risk mitigation measures.

FAQ - General

General

  • What are EU Digital Identity Wallets?

    EU Digital Identity Wallets are personal digital wallets, in the form of apps allowing citizens to digitally prove who they are, as well as store and manage identity data and official documents in digital form. These may include a driving licence, or educational qualifications.

    Many citizens are already using digital wallets on their mobile phones to store their boarding passes and show them when they travel or to keep their virtual bank cards to proceed with convenient payments. These wallets, often offered by online platforms, allow their users to log in to various online services from shopping to reading news but these logins are not necessarily giving users full control over what data they share to identify themselves while accessing online services. These “social logins” can rarely can be used to access digital government services. With the EU Digital Identity Wallets, all European citizens will be able to prove, across the EU, their identity where necessary to access public and private digital services, to share digital documents, or simply to prove a specific personal attribute, such as age, without revealing their full identity or other personal details. Citizens will at all times have full control of the data they share and with whom.

  • Will I have to pay for EU Digital Identity Wallets?

    For natural persons, the use of the wallets, including electronic signatures for non-professional purposes, will be free of charge. Businesses may have to pay fees to use the wallet services, depending on Member States' choice of business model for the wallet. This may mean in practice for instance that service providers, such as telecom operators or credit card companies may be asked to pay when they rely on identification services the wallets will offer to onboard to new mobile phone contracts or credit cards. Using the wallets for sharing digital documents may also incur costs to the providers of these documents.

  • Will I have to pay to use an EU Digital Identity Wallet?

    No, EU Digital Identity Wallets will be completely free for citizens, including signing private documents electronically with your wallet for non-professional use cases. Some certificates shared through the wallet may require payment to the provider, such as educational certificates, credit statements or business certificates – similar to the situation today where obtaining such certificates in paper form also sometimes comes at a cost.

  • How can I obtain an EU Digital Identity Wallet?

    Member States have the choice to offer the wallets to their citizens and residents at the national level directly themselves, or to mandate another organisation with provision or recognise an independent provider. Everyone will be able to download, install and use EU Digital Identity Wallets on their personal mobile device. Member States can make use of existing national digital eID schemes to facilitate registering citizens for the wallets (with the help of additional security measures where necessary).

  • When will I be able to use EU Digital Identity Wallets?

    Member States should issue EU Digital Identity Wallets 24 months after adoption of the implementing legislation setting out the core functions of the wallet and its certification. Indicatively, this means wallets will be available to citizens in 2026.

  • Where can I download a wallet?

    Wallets are not yet available. In the future, you will be able to find the wallet in major mobile app stores (iOS, Android), clearly labelled as official EU Digital Identity Wallets.

Wallet Usage

  • Could I use EU Digital Identity Wallets to access private services?

    Yes, EU citizens should be able to use their EU Digital Identity Wallets to access digital services all across the Internet, including certain private services. As such, they improve the effectiveness and extend the benefits of secure and convenient digital identity to the private sector. Providers of some private services must accept the wallets at the request of the wallet user, notably where strong user authentication is required. This is for instance the case for making payments, for opening bank accounts and for other use cases such as in the areas of transport, energy, insurance, drinking water, postal services, digital infrastructure, education or telecommunications. A requirement to recognise the EU Digital Identity Wallets for authentication also applies to Very Large Online Platforms.

  • Will public services support and accept digital signatures?

    Yes, public services must accept qualified electronic signatures for cross-border use as equal to paper signatures. There may be some exceptions at national level.

  • Will it be easy for me to create digital signatures with an EU Digital Identity Wallet?

    Everyone who has fully set up their EU Digital Identity Wallet will be able to sign electronically with just a few clicks.

  • Could I use an EU Digital Identity Wallet for banking services?

    Yes, citizens will be able to use EU Digital Identity Wallets to authorise payments, open financial services accounts and other services in full security with personal data protected. In all these cases, the wallets will not replace, but complement solutions offered by banks.

  • How will the systems be interoperable and work across different Member States?

    The Regulation imposes common functional requirements for all EU Digital Identity Wallets issued by Member States.
    The Commission is working closely with Member States to develop common standards, technical specifications and protocols needed to ensure that all wallets meet these requirements, operate in the same way across the EU and offer the same required functionalities, security and data protection features.
    The technical specifications will be made mandatory by means of implementing legislation ensuring that wallets in all Member States are fully interoperable and observe the same standards.

  • I have two nationalities and two identity cards/passports. Can I store them both in the same wallet?

    For now the personal identification data provided by one Member State can only be used within the wallet provided by this Member State. But this does not matter as all national wallets will be completely interoperable and will be useable across the EU with the same functionalities.

  • What will change for Europeans and EU businesses?

    The main novelty offered by the new rules is that all EU citizens, residents and businesses will be offered EU Digital Identity Wallets which are accepted by private and public digital services in all Member States. You can find out more about the benefits of EU Digital Identity Wallets here.

  • My country already has an advanced e-identity system. Why should I use an EU Digital Identity Wallet?

    The EU Digital Identity Wallets will not replace existing national eID schemes but supplement them as an option that (1) will be recognised across borders. (2) enables you to securely present and share a wide range of digital documents (like education diplomas, and train tickets) and (3) allows you to log in to a range of private sector services while preserving your privacy.

  • What are Electronic Attestations of Attributes?

    Electronic Attestations of Attributes, or EAAs, are referred to in the EU Digital Identity Framework Regulation. They are a type of digital document that can be added, stored and presented with the EU Digital Identity Wallet, and contain important information about ourselves. Examples include a university diploma, a boarding pass, or a driver’s license.

    For the sake of simplicity, we refer to EAAs as digital documents throughout this website.

  • What is the difference between digital assets and digital documents (or EAAs)?   

    What we refer to as digital documents throughout our website are also called Electronic Attestations of Attributes in the EU Digital Identity Framework Regulation. These are proofs of an attribute (about either a person or object). They are especially useful for important documents such as your driver’s licence, your diploma, or a travel document like a boarding pass, as these are usually needed to prove something and access services.

    Digital assets on the other hand are digital objects, and can include everything from documents, to songs, to films. They also include Non-Fungible Tokens, or NFTs, which are a special kind of digital asset that represent ownership or the authenticity of something through a token.

    The EU Digital Identity Wallet will store and present personal identification data and digital documents/Electronic Attestation of Attributes but not digital assets. You will be able to store your university diploma in your wallet, but not your favourite song.

  • Will I be able to store NFTs on my wallet?

    NFTs, or Non-Fungible Tokens, are unique digital identifiers used to certify ownership and authenticity. There are no plans or provisions in the regulation for the wallet to store digital assets or NFTs.

    EU Digital Identity Wallets are personal digital wallets allowing citizens to digitally prove who they are, as well as store and manage identity data and official documents in digital form, ex. Driving licences, digital travel credentials, educational qualifications. These digital documents are also referred to as  Electronic Attestations of Attributes in the EU Digital Identity Framework Regulation.

    It is possible to create Qualified/Unqualified Electronic Attestation of Attributes that proves ownership of a specific object and issue it to an EU Digital Identity Wallet.

Governance and Actors

  • Will a unique European Digital Identity replace national digital identities?

    No, replacing national digital identities is not the aim of the revised Regulation. Member States will continue to provide digital identities.

    Instead, the European Digital Identity framework extends the functionalities and usability of national eIDs by means of a personal digital wallet. The obligation on Member States to offer EU Digital Identity Wallets will ensure that every person and business in the EU has access to a means of digital identification.

    Every citizen will have the choice whether to use the European Digital Identity wallet or a national eID system.

  • How will Member States participate in the new European Digital Identity Governance Framework?

    The Regulation sets out a new comprehensive governance framework for both electronic identification and trust services to support the implementation and supervision of the European Digital Identity Framework.
    The new governance framework notably includes a new cooperation and coordination body (European Digital Identity Cooperation Group) to advise the Commission in the preparation of implementing legislation, organise peer reviews, discuss requests for mutual assistance and exchange views, best practices and other information between all parties. In this way, the new set-up will improve the consistency and effectiveness of the current governance system.

  • How is the Commission helping Member States prepare for the EU Digital Identity Wallet?

    Under the Digital Europe Programme , the Commission is in the process of developing a wallet prototype based on the technical specifications. The software is already published on Github for voluntary use by Member States. In addition, under the same programme , the Commission is co-funding Large Scale Pilots , which test the wallets in a diverse range of everyday use cases. Examples of use cases include providing identification to online and offline public and private services, displaying one's mobile driving licence, authorising payments, exchanging diplomas, signing documents electronically, and presenting medical prescriptions. The results of the pilots will make it easier and quicker for Member States to develop and offer the wallet to their citizens and will help avoid bugs.

  • Who will provide the EU Digital Identity Wallet?

    Member States have the choice to offer the wallets to their citizens and residents themselves, mandate another organisation with the provision, or recognise an independent provider. The offer may differ by Member State.

  • What can I do with the new EU Digital Identity Wallets?

    You will be able to use it to identify digitally for public and private online services across the EU wherever this is necessary. You will also be able to sign digital documents (such as an employment or rental contract). In addition you will be able to share digital documents about yourself, such as educational or professional certificates, or hold a digital driving licence or a digital visa (Digital Travel Credential) in your wallet.

    You will be able to download, store and use basic personal data and digital documents or credentials in digital form very much like today in your physical wallet or briefcase.

  • What are the standards and technical requirements for European Digital Wallets?

    The European Commission and Member State experts are together working to create a common toolbox needed to develop the wallet, which includes the Architecture and Reference Framework (Technical Specifications ). All guidelines will follow international standards already in use.

  • Why will the European Digital Identity Wallets be developed under an open-source licence?

    Transparency on the technical set-up of the European Digital Identity Wallets is important for public trust and for building a well functioning and fully secure system. Everybody can scrutinise the technological set-up proposed and provide feedback on the choices made. Security weaknesses, bugs or malfunctions can be better identified and corrected in this way. Member States may limit the disclosure of some parts of the source code for reasons of public security.

FAQ - The European Digital Identity Framework

These questions are intended for a professional and technical audience from both the private and public sector who are involved with the EU Digital Identity Wallet Ecosystem.

They should provide clarity on the legal and technical requirements required for the successful implementation of the European Digital Identity Wallets and electronic identification means.

These questions and answers serve for informational purposes only and do not constitute legal advice. The definitive interpretation of EU law remains the prerogative of the Court of Justice of the European Union.

European Digital Identity Wallets

  • What is the difference between a wallet solution and a wallet unit?

    Both a wallet solution and a wallet unit are provided by a wallet provider and contain the same basic components; wallet instances, wallet secure cryptographic applications, and wallet secure cryptographic devices.

    The definitions are laid down in Article 2(11) and 2(2) of the Commission Implementing Regulation (EU) 2024/2979.

    A ‘wallet solution’ means a combination of software, hardware, services, settings, and configurations, including wallet instances, one or more wallet secure cryptographic applications and one or more wallet secure cryptographic devices.

    A ‘wallet unit’ means a unique configuration of a wallet solution that includes wallet instances, wallet secure cryptographic applications and wallet secure cryptographic devices provided by a wallet provider to an individual wallet user.

    In simple terms, the wallet solution is the master template, and the wallet unit is the individual version customised for each user.

  • Where can the technical requirements for EU Digital Identity Wallets be found?

    The technical requirements for the EU Digital Identity Wallets can be found in the adopted implementing acts:

    Further, the common technical architecture of the EU Digital Identity Wallets ecosystem is defined in the Architecture and Reference Framework (ARF) document. The ARF has been set-up pursuant to Commission Recommendation (EU) 2021/946 and sets out a set of common standards, and technical specifications for components, protocols, interfaces and data formats governing information exchange between issuers, wallets, and service providers.

    The ARF is published here.

  • Are there libraries/source code available for the EU Digital Identity Wallets?

    The EU Digital Identity Wallet reference implementation enables Member States and stakeholders to develop their own wallets.

    It includes open-source code libraries, modular components, and a fully functional reference application built in line with the ARF.

    The implementation is available on GitHub and includes demo apps for both iOS and Android, allowing users to test key features such as credential issuance and proximity-based verification. Find the reference implementation here.

  • Will wallets be able to prove that a user has delegated mandate powers (i.e., power of attorney or representation rights)?

    Wallets will be used to store any type of electronic attestations of attributes (EAAs). These EAAs can attest to any kind of delegations, such as representation rights or powers of attorney.

    However, it should be noted that the legal meaning and validity of such delegations is not regulated nor standardised in Regulation (EU) No 910/2014.

    Thus, while wallets may be used to store and exchange delegations, like any other electronic attestations of attributes, their creation, interpretation or use will depend on the context in which they are used.

  • What is selective disclosure of attributes?

    Selective disclosure of attributes is a data minimisation feature that enables wallet users to only share the specific information requested by a relying party without revealing additional information. This is one of the ways in which wallets help to comply with the data protection principles enshrined in Regulation (EU) 2016/679 (the ‘GDPR’), in particular the principles of data minimisation and purpose limitation. More generally, this feature allows users to have control over their personal data.

    For example, a user could share their date of birth without revealing their place of birth, allowing for greater privacy while still enabling access to digital services.

  • How will users of the EU Digital Identity Wallets be able to sign electronically?

    The EU Digital Identity Wallets shall enable their users to create qualified electronic signatures.

    To sign electronically using an EU Digital Identity Wallet, the wallet user will be issued a qualified certificate for electronic signatures, which is linked to a qualified electronic signature creation device. That device can be embedded in the wallet or in the mobile device of the user, be external but handled by the user, or be a remote qualified electronic signature creation device.

    The wallet user will have access to a signature creation application which may either be integrated in the wallet instance, be a separate app on the wallet user’s device, or be provided remotely.

  • What is a provider of person identification data?

    The definition is laid down in Article 2(4) of the Commission Implementing Regulation (EU) 2024/2977.

    Providers of person identification data (or PID) are responsible for issuing and revoking the person identification data and ensuring that the person identification data of a user is cryptographically bound to a wallet unit. These can be public sector bodies, e.g. a Ministry or national register, or recognised private entities that are entrusted with the provision of personal information, like a name and date of birth to be used for identification, to the wallet unit.

  • Will end users be charged for person identification data issuance?

    Article 5a(13) of the European Digital Identity Regulation (or ‘Regulation’) explicitly states that the issuance, use, and revocation of the European Digital Identity Wallets (‘wallets’) are to be free of charge for all natural persons. Although the term "wallet issuance" is not explicitly defined in the European Digital Identity Regulation, it can be considered to refer to the creation and provision of the wallet solution by a wallet provider.

    In addition, as an electronic identification means, the wallet shall allow the user to securely store, manage and validate PID further to Article 3(42). The issuance of PID to a user’s wallet can also be considered a necessary precondition that the identification function of the wallet can be used.

    As a result, it can be deducted that the issuance of PID should be free of charge.

  • How are EU Digital Identity Wallets protected against fraud?

    To prevent or minimise fraud, EU Digital Identity Wallets are highly secure as they will:

    • be certified against level of assurance “high” requirements by accredited public or private bodies designated by Member States, ensuring high standards for privacy and security; be private by design - users will always have control over which data they share;
    • implement robust security protocols with assurance level high, strong encryption, and multi-factor authentication;
    • include the wallet secure cryptographic device (WSCD) architecture, ensuring a secure environment and storage for cryptographic assets (such as cryptographic keys for authentication).

  • How is a high standard of privacy for European Digital Identity Wallets ensured in all Member States?

    Personal data protection and privacy are cornerstones of Regulation (EU) No 910/2014 which applies without prejudice to the GDPR. Regulation (EU) No 910/2014 lays down provisions that reinforce the application of the GDPR, such as Article 5a(16) of that Regulation about the technical framework of the EU Digital Identity Wallets. Further, the implementing acts to Regulation (EU) No 910/2014 as regards wallet functionalities also provide technical specifications and privacy enhancing techniques ensuring data protection and privacy.

    To ensure personal data protection by design and by default, the wallets should use available state-of-the-art privacy enhancing techniques. Among others, these features should provide the possibility that wallets can be used without the wallet users being trackable across different wallet-relying parties, if applicable to the usage scenario.

    The EUDI Wallet architecture embodies the principle of privacy by design. This means that the protection of user data is a fundamental pillar of the architecture's design. In this context, the principle of data minimisation guides the collection of personal information, ensuring that relying parties gather only the attributes they need and have registered for. To support the selective disclosure of attributes, the wallets empower users with granular control over what data is presented and to whom. Secure coding practises are mandated, and the architecture itself minimises attack surfaces by compartmentalising sensitive data and access controls. For more information on this topic, please refer to sections 4.2.4 and 4.2.5 of the Architecture and Reference Framework.

  • Which information is required for wallet-relying party registration?

    In a nutshell, each wallet-relying party is required to provide the following information:

    • Identification information: Name, identifiers as stated in the official record together with identification data of the official record (e.g., EORI, registration number in a national business register, VAT, LEI).
    • Address: Physical address of the wallet-relying party
    • URL: An URL belonging to the wallet-relying party.
    • Country code indicator: The country indicator of the Member State where the wallet-relying party is established.
    • Contact details: A valid email address, phone number, and website.
    • Service description: An outline of the services provided and the intended use of wallet user attributes.
    • Attribute usage: A list categorising the attributes to be requested as mandatory or optional.
    • A list of the data, including attestations and attributes that the wallet-relying party intends to request.
    • Intended use: A description of intended use of the data that the wallet-relying party intends to request from wallet units.
    • An indication of whether the wallet-relying party is a public sector body.
    • **Entitlements:**Details of any specific roles in trust services provision, where applicable. This information is submitted to the Member State’s registrar and published to maintain transparency.

    Please refer to Commission Implementing Regulation (EU) 2025/848 for further details and updates on the requirements above.

  • What are pseudonyms, and how are they used?

    In the context of the EU Digital Identity Wallets, pseudonyms are unique, wallet-specific identifiers that can be chosen by the user and used for interactions with a specific relying party. They help preventing user tracking across services while enabling seamless authentication.

    In accordance with the state of the art, pseudonym generation follows WebAuthn standards and is designed to limit data exposure during transactions. Please refer to Article 14 of Commission Implementing Regulation (EU) 2024/2979 for further details.

  • What is wallet certification and who certifies the wallets?

    Wallet certification is the formal process by which EU Digital Identity Wallets are evaluated to ensure they meet functional and cybersecurity standards. This process is further specified by European cybersecurity certification schemes and national certification schemes.

    This process ensures that the security, reliability and interoperability of the wallets are assessed in order to foster trust among users and service providers.

    Wallets are certified by accredited conformity assessment bodies operating under national certification schemes and designated by Member States.

    These bodies are responsible for evaluating wallet solutions against functional and cybersecurity requirements, conducting testing and assessments, and issuing certificates of conformity. They operate under the oversight of national certification scheme owners and ensure alignment with EU standards.

    For further details, please refer to Commission Implementing Regulation (EU) 2024/2981 , and Commission Implementing Regulation (EU) 2025/849.

  • How will security breaches—whether affecting wallets, authentication mechanisms, or electronic identification (eID) schemes— be addressed?

    A severe breach or compromise will result in the immediate withdrawal of all affected wallets, authentication mechanisms or electronic identification (eID) schemes. For further details please refer to Commission Implementing Regulation (EU) 2025/847.

  • What is the difference between “strong customer authentication” (SCA) as referred to in Directive (EU) 2015/2366 (PSD2) and “strong user authentication” as referred to in the European Digital Identity Regulation?

    In the context of Regulation (EU) No 910/2014, the term "strong user authentication" is used instead of "strong customer authentication" (SCA), which is a concept used in Directive (EU) 2015/2366 (PSD2). Since EU Digital Identity Wallets are provided free of charge and do not involve customers in the traditional sense, Regulation (EU) No 910/2014 consistently refers to their holders as "users" instead of “customers”. Although the terms differ, both refer to the same underlying concept, a multi-factor authentication process that ensures secure and reliable user authentication and should therefore be considered as synonyms in this context.

  • Is there an obligation to accept EU Digital Identity Wallets in the area of banking and financial services?

    As per Article 5f(2) of Regulation (EU) No 910/2014, certain private relying parties are required to accept the wallets, upon request of the user, where Strong Customer Authentication (SCA) is required by Union or national law, or by contractual obligation. For example, under the PSD2 Directive, payment service providers are required to apply SCA in specific situations. This obligation to accept the wallets upon request of the user applies 36 months after the entry into force of the implementing acts referred to in Article 5a(23) and Article 5c(6) of Regulation (EU) No 910/2014.

  • How can payment service providers in practice fulfil their obligation to recognise the European Digital Identity Wallets to apply Strong Customer Authentication (SCA)?

    Regulation (EU) No 910/2014 does not prescribe how service providers should fulfil their obligation to recognize the European Digital Identity Wallet to apply Strong Customer Authentication (SCA).

    However, large scale pilots have tested and developed the following way how payment service providers can fulfil their obligations under Art. 5f(2) of Regulation (EU) No 910/2014:

    Payment Service Providers issue a dedicated SCA attestation after carrying out a secure authentication of the user and linking users to their specific payment account and payment instrument.

    In this model, the payment service provider acts as both the issuer of the SCA attestation and the verifier. It should retain full control over the authentication decision, remaining able to authenticate the user independently. The payment service provider should remain fully responsible for validating the attestation and ensuring compliance with applicable regulations.

    The following detailed process has been developed by large-scale pilots in this context:

    • Before the SCA attestation is issued to the user’s wallets, the user completes a registration process under the control of the payment service provider. This process begins when the user requests their wallets to be registered for a specific payment account and payment instrument.
    • The payment service provider authenticates the user through an existing PSD2-compliant method.
    • The wallets generate a cryptographic key pair: the private key is securely stored and used to sign messages, while the corresponding public key is shared with the payment service provider for verification purposes.
    • The payment service provider issues an individual SCA attestation into the user’s wallets. This attestation is device-bound, ensuring usage is linked to the user’s keys on that device, and requires multi-factor authentication to activate the signing key. The resulting cryptographic signatures can then be verified by the payment service provider to securely authenticate transactions.
    • Following this registration, the wallets can be used to present the SCA attestation when SCA is required, together with transaction-specific details for the user to confirm. The confirmation is cryptographically bound to the transaction and allows for dynamic linking, ensuring that authentication is directly tied to the transaction details, such as the specific amount and a specific payee, and that these details are protected from tampering.
    • The SCA attestation and the transaction data can be shared with the payer’s payment service provider, supporting various use cases and allowing additional attributes, such as age verification, to be combined with the payment data.

    A description of this process can be retrieved at the following link: Directive - 2015/2366 - EN - Payment Services Directive - EUR-Lex.

  • Are outsourcing agreements necessary between payment service providers and wallets providers for applying SCA using the wallets? Does the use of the wallets for SCA require the delegation of the authentication?

    Outsourcing agreements between payment service providers and wallets providers are not required under Regulation (EU) No 910/2014 for the implementation of the wallets for SCA.

    Where payment service providers act as both issuer of the SCA attestation and verifier, they should retain full control over the authentication decision and remain fully responsible for validating the attestation and ensuring compliance with applicable regulations.

    In this model, the wallets act as a secure carrier of the attested information. Given that payment service providers are responsible for issuing and relying upon attestations for SCA, a delegation of the authentication to a third party does not take place.

  • Is there a requirement for all wallets to offer SCA (strong customer authentication) to facilitate online payments by the end of 2027?

    Yes, indeed. The objective of the European Digital Identity Regulation is to offer all EU citizens a secure and trustworthy means of identification, authentication and to share digital documents. The Regulation also requires Member States to offer European Digital Identity Wallets to all EU citizens by end 2026 and obliges private service providers to accept the wallet for SCA (strong customer authentication) by end 2027. Consequently, all wallets must be able to offer this possibility.

  • What are the requirements regarding the acceptance of the EU Digital Identity Wallets by Very Large Online Platforms (‘VLOPs’)?

    Article 5f(3) of the Regulation (EU) No 910/2014 requires providers of VLOPs, as referred to in Article 33 of Regulation (EU) 2022/2065 (the ‘DSA’), that require user authentication for accessing their online services, to facilitate and accept the use of EU Digital Identity Wallets.

    Whenever VLOPs require user authentication for access to online services, such as logging in, account creation, or identity verification processes, they shall enable users upon request, to voluntarily use EU Digital Identity Wallets for such authentication purposes. Consequently, providers of VLOPs shall ensure technical compatibility with EU Digital Identity Wallets.

    To support user privacy and strengthen data protection, the EU Digital Identity Wallets will support the WebAuthn standard, acting as passkey providers to enable secure, passwordless authentication and the use of relying party-specific pseudonyms, when interacting with VLOPs.

Electronic Identification Schemes

  • What are the requirements for Member States intending to pre-notify their national electronic identification scheme?

    The objective of Regulation (EU) No 910/2014 is to streamline the peer review procedures for electronic identification schemes, relying on certification in order to foster cooperation among Member States on the security and interoperability of their notified electronic identification schemes.

    Therefore, Article 12a of Regulation (EU) No 910/2014 provides that electronic identification schemes to be notified shall by certified by designated conformity assessment bodies against the cybersecurity requirements set out in Article 8(1) of the Regulation. However, certification against non-cybersecurity requirements is optional. Consequently, the peer-review process shall not apply to electronic identification schemes or parts of such schemes which are certified. However, the parts of the scheme which are not covered by certification must be peer reviewed.

  • What is the legal effect of the notification of an electronic identification scheme?

    All notified electronic identification schemes must be recognised across the Union which means any Member State that, either through administrative practice or by law, relies upon electronic identification for authentication to their electronic services, must also accept the use of a notified electronic identification means issued in another Member State.

    However, in some cases the service a user wishes to access may require further information that is not available through the electronic identification means to complete the identification process.

    To reduce cases where users are asked for additional information, Member States, when acting as relying parties for cross-border services, are obliged to provide identity matching services that ensure a smooth identification process. These services match the information available through the electronic identification means with information already stored either in that Member State, e.g. if a person has received an electronic identification means from that Member State or if they were previously a resident of that Member State.

FAQ - Trust Services

FAQ - General

General

  • What is a qualified trust service provider?

    The grant of a qualified status for a trust service provider requires that the trust service provider has successfully undertaken an audit confirming it fulfils the requirements of Regulation (EU) No 910/2014 and the confirmation of this compliance by the competent national supervisory body. While detailed requirements depend on the specific qualified trust service, all qualified trust service providers are subject to ongoing supervision by the competent national supervisory body. Qualified trust service providers may begin to label the trust service they provide as “qualified” only after their qualified status has been indicated in the national trusted list.

  • What is a non-qualified trust service provider?

    A non-qualified trust service provider is a trust service provider that provides one or more trust services without having obtained the qualified status under Regulation (EU) No 910/2014. As a result, the trust services they provide are not listed as qualified in the national trusted list and do not benefit from the specific legal presumptions attached to qualified trust services under the Regulation (EU) No 910/2014.

  • What are certificates for electronic signatures, certificates for electronic seals, certificates for website authentication or certificates for the provision of other trust services?

    Regulation (EU) No 910/2014 creates a legal framework for various types of certificates, each serving a distinct trust purpose.

    A certificate for electronic signature, defined in Article 3(14), is an electronic attestation that links electronic signature validation data to a natural person and confirms their name or pseudonym.

    A certificate for electronic seal, as per Article 3(29), serves a similar function for a legal person, attesting the link between electronic seal validation data and a legal person and confirming the name of the legal person.

    A certificate for website authentication, as defined in Article 3(38), is an electronic attestation that makes it possible to authenticate a website and links the website to the natural or legal person to whom the certificate is issued.

    Certificates for the provision of other trust services support trust service functionalities such as validating electronic time stamps or preservation services.

    The Regulation maintains the distinction between qualified and non-qualified certificates, depending on the trust service provider’s status, the content of the certificate and the assurance level of the attested data. The process for verifying the identity data of the person to whom a qualified certificate is issued and for verifying any additional attribute to be included in the certificate together with that identity data needs to abide by demanding procedures and standard to ensure a high level of confidence in the certified data (cf. Art.24(1)(a)(1b) and CIR (EU) 2025/1566).

    Qualified certificates must furthermore include at least information set out in the respective Annex I, III or IV of the Regulation mainly to ensure it includes information about the issuer and the person to whom the certificate is issued, an indication that the certificate is qualified for a specific purpose, information that allows verification of its authenticity, its validity and of signatures or seals created by the person. The practices used by qualified trust service provider to provide their services, including to manage the life cycle of the qualified certificates they deliver need to meet provisions specified for qualified providers (cf. Art.24(2)(3)(4)) and specific to the issuance of qualified certificates (Art.28/38/45).

  • What supervisory arrangements may Member States put in place for trust services, and what are the limits of national regulatory autonomy in this area?

    Member States must designate at least one supervisory body under Article 46b(1). Designation of more than one body is permissible, provided competences are clearly defined and non-overlapping, and each body is duly notified to the Commission under Article 46b(2).

    The task list in Article 46b(4) is non-exhaustive — Member States may assign additional tasks beyond those expressly enumerated, provided they remain consistent with Union law.

  • How can trust services provided in third countries be recognised under Regulation (EU) No 910/2014?

    Regulation (EU) No 910/2014 makes the process of recognition of trust services provided by trust service providers established in a third country or by an international organisation. In particular, the Regulation allows such recognition to be established either through an international agreement between the Union and the third country or through implementing acts adopted by the Commission. This provides an additional mechanism that may facilitate the recognition process compared to relying solely on international agreements. These mechanisms allow trust services provided outside the Union to be recognised under the eIDAS framework where the conditions set out in the Regulation are fulfilled.

  • What is the Third Countries Trusted List for Advanced Electronic Signatures?

    The Third Countries Trusted List for Advanced Electronic Signatures is developed and maintained by the Commission. It contains information notified by third countries that is assessed by the Commission. The purpose of the Third Countries Trusted List for Advanced Electronic Signatures is to facilitate the technical validation of electronic signatures or seals supported by certificates issued by trust service providers established in third Countries. Although it does not imply legal equivalence within the meaning of Article 14 of Regulation (EU) No 910/2014, the inclusion of a third country in the Third Countries Trusted List for Advanced Electronic Signatures is considered as the first step towards working on recognition of qualified electronic signatures or seals and other qualified trust services.

Trust Services Providers

  • What are the main differences between qualified and non-qualified trust services?

    Due to the more stringent requirements applicable to qualified trust service providers, qualified trust services benefit from specific legal effects and provide a higher assurance with respect to their technical and organisational security than non-qualified trust services.

    By way of example:

    • As per Article 25(2), a qualified electronic signature shall have the equivalent legal effect of a handwritten signature;
    • As per Article 35(2), a qualified electronic seal shall enjoy the presumption of integrity of the data and of correctness of the origin of the data to which the qualified electronic seal is linked;
    • As per Article 45b(2), a qualified electronic attestation of attributes shall have the same legal effect as lawfully issued attestations in paper form.

    The primary distinction lies in the degree of trustworthiness, regulatory requirements and regulatory oversight. Under Article 3(17) of the Regulation (EU) No 910/2014, a qualified trust service is one that meets the applicable requirements laid down in the Regulation and is provided by a qualified trust service provider. This provider is supervised and audited regularly, ex ante and ex post, in accordance with Articles 20 and 21 of the Regulation. By contrast, providers of non-qualified trust services are subject to a lighter supervisory regime, ex post only.

  • If a QTSP received its qualified status before 20 May 2024, by when shall it submit a conformity assessment report (CAR) under Article 24(1), (1a) and (1b)?

    QTSPs having received their qualified status before 20/05/2024 — regardless of how long before that date the status was granted — shall submit a conformity assessment report demonstrating their compliance with the requirements of Article 24(1)(1a)(1b) before 21/05/2026. For this specific report, compliance shall be demonstrated with the requirements of Article 24(1), (1a) and (1b), but it is not mandatory to use the standards referenced in CIR (EU) 2025/1566, since this Implementing Regulation shall only apply as from 19/08/2027.

  • For the initial conformity assessment report that QTSPs must submit as part of their initiation process, do they already need to apply the standards referenced in CIR (EU) 2025/1566?

    Providers that wish to be qualified as a QTSPs must submit a conformity assessment report demonstrating their compliance with the requirements of article 24(1), (1a) and (1b) as part of their initiation process in line with Article 21. For this initial report, compliance shall be demonstrated with the requirements of Article 24(1), (1a) and (1b). However, when the report is provided to the competent supervisory body before 19/08/2027, it is not mandatory to use the standards referenced in CIR (EU) 2025/1566, since this Implementing Regulation shall only apply as from 19/08/2027.

  • From what date must all conformity assessment reports under Article 24 (1), (1a) and (1b) be based on the standards referenced in (EU) 2025/1566?

    All conformity assessment reports related to article 24(1), (1a), and (1b) which are submitted to the competent supervisory body after 19/08/2027 must be based on the standards referenced in (EU) 2025/1566.

  • How is the qualified status maintained?

    Qualified trust service providers shall be audited by an accredited conformity assessment body before initiating their activities, and every two years thereafter. Taking into account the resulting conformity assessment reports, supervisory bodies for trust services verify that the qualified trust service provider and the qualified trust service it provides fulfil the requirements of Regulation (EU) No 910/2014 and, where this is the case, grant or confirm the qualified status, which is included in the national trusted list. This list is the constitutive document confirming that the qualified trust service providers are qualified for a qualified trust service and that they comply with the requirements established in the Regulation.

  • Is there a list of the conformity assessment bodies accredited under Regulation (EU) No 910/2014?

    In practical terms, a conformity assessment body is an entity that is accredited in accordance with Regulation (EC) No 765/2008 as being competent and independent for evaluating whether trust service providers and the services they offer meet the relevant requirements of Regulation (EU) No 910/2014 in order to be granted qualified status and included in the relevant national trusted list.

    Member States are required under Article 20 (1b) of Regulation (EU) No 910/2014 to notify the Commission without undue delay of accredited CABs, including their names, addresses, and accreditation details, along with any subsequent changes.

    This information is shared with all Member States and will remain accessible to the public — eIDAS list of CAB .

  • What happens when a Qualified Trust Service Provider (QTSP) loses its qualified status?

    If the Qualified Trust Service Provider (QTSP) fails to meet the requirements outlined in Regulation (EU) No 910/2014 and does not remedy failures within the specified timeframe after being asked to do so by the competent supervisory body, the qualified status may be withdrawn and the national trusted list updated accordingly.

  • How is the qualified status granted to trust service providers and their trust services?

    When a trust service provider wishes to provide a qualified trust service, it shall first request an assessment from an accredited conformity assessment body (CAB). The CAB shall conduct an assessment and produce a conformity assessment report confirming that the candidate qualified trust service provider and the qualified trust service it intends to provide fulfil the requirements laid down in the Regulation (EU) No 910/2014 and in Article 21 of the NIS2 Directive (EU) 2022/2555. This process is commonly referred to as an ‘initiation audit/assessment.’

    Once the trust service provider obtains such conformity assessment (audit) report, it shall submit a request to the competent supervisory body of the Member State where it is established, together with that report. The supervisory body verifies this claimed compliance, normally within three months in collaboration with the competent NIS2 authorities.

    Once the verification is positively concluded, the supervisory body grants the qualified status. Next, the national trusted list of qualified trust service providers is updated to include the new qualified trust service provider and/or the new qualified trust service and their qualified status. The qualified trust service provider is only allowed to start offering its qualified trust services after the qualified status has been indicated in the national trusted list.

    Once the qualified status has been granted and published in the national trusted list, the qualified trust service provider may also use the EU trust mark for qualified trust services.

  • How are eIDAS laboratories integrated into the EU accreditation framework?

    Regulation (EC) No 765/2008 establishes the exclusive legal framework for accreditation in the Union, under which only conformity assessment bodies accredited by National Accreditation Bodies of EU Member States may perform conformity assessment activities with legal effect under EU law. Accreditation of conformity assessment certificates issued by bodies established in third countries, including those operating under international arrangements such as IAF and ILAC, do not by themselves fulfil the accreditation requirements laid down in Regulation (EC) No 765/2008 for conformity assessment activities with legal effect under Union law.

    In the context of Regulation (EU) No 910/2014, CIR (EU) 2025/1566 allows testing of certain technical measures to be carried out by laboratories accredited under Regulation (EC) No 765/2008 or by national competent authorities appointed for that purpose. These laboratories may be involved in assessing the effectiveness of measures implemented to comply with the applicable requirements (point (5) of the Annex to Implementing Regulation (EU) 2025/1566).

    Where testing or evaluation activities are instead performed within the framework of a cybersecurity certification scheme established under Regulation (EU) 2019/881 (Cybersecurity Act), the applicable rules of that certification scheme apply. In such cases, laboratories operate under the supervision of an accredited cybersecurity certification body and must comply with the requirements of the relevant scheme.

  • What does presumption of compliance mean?

    A presumption of compliance means that when the relevant standards, specifications or procedures referenced in an implementing act are followed, there is no need to demonstrate separately that the requirements in Regulation (EU) No 910/2014 have been met; compliance is presumed.

    Where a qualified trust service provider follows the requirements set out in such an implementing act, supervisory bodies should presume compliance with the corresponding requirements of Regulation (EU) No 910/2014 when assessing conformity or granting or maintaining the qualified status.

    However, trust service providers may also demonstrate compliance by other means. In such cases, they must provide evidence of compliance with Regulation (EU) No 910/2014, which must be assessed by a conformity assessment body and reflected in the conformity assessment report submitted to the supervisory body.

  • What is the value, role, and use of Trusted Lists?

    Trusted Lists are essential in ensuring legal certainty and building trust in trust services. Trusted Lists have a constitutive character to indicate the qualified status of a qualified trust service provider and of the qualified trust service it provides. Trusted Lists foster cross border recognition and acceptability of qualified trust services by facilitating the validation of the legal status of, among others, qualified electronic signatures and qualified electronic seals.

    By consulting the trusted lists, relying parties (citizens, businesses or public administrations) can verify whether a trust service provider and the trust service it provides have a qualified status and can therefore rely on the legal effects attached to qualified trust services.

  • What must Qualified Trust Service Providers (QTSPs) verify before issuing a qualified certificate?

    Article 24(1) of Regulation (EU) 910/2014 requires QTSPs to verify, when issuing a qualified certificate (QC) or a qualified electronic attestation of attributes (QEAA), the identity and, if applicable, any specific attributes of the person to whom the certificate or attestation is to be issued.

    This verification obligation applies to each and any issuance of qualified certificates or attestations, and thus also applies in the case of re‑issuance. While automated processes and reliance on previous verifications may be used, the qualified trust service provider remains responsible for ensuring the correctness and accuracy of the identity and attributes of the person to whom the certificate or attestation is to be issued, at the moment of issuance, as clarified in Recital 74 of Regulation (EU) 2024/1183.

  • Are Qualified Trust Service Providers (QTSP) required to verify the identity of the natural or legal persons using their services?

    Identity verification requirements apply explicitly to the following qualified trust services:

    • the issuance of qualified certificates for electronic signatures;
    • the issuance of qualified certificates for electronic seals;
    • the issuance of qualified certificates for website authentication;
    • the provision of qualified electronic registered delivery services;
    • the qualified service for the management of remote qualified electronic signature creation devices;
    • the qualified service for the management of remote qualified electronic seal creation devices;
    • the provision of qualified electronic archiving services;
    • the issuance of qualified electronic attestations of attributes;
    • the recording of electronic data in a qualified electronic ledger.

    Issuance of qualified certificates and qualified electronic attestations of attributes

    According to Article 24(1) of Regulation (EU) No 910/2014, when issuing a qualified certificate or a qualified electronic attestation of attributes, a QTSP shall verify the identity and any necessary attributes of the person in question.

    The verification of the identity and, where applicable, of the attributes must be performed, by appropriate means, by the qualified trust service provider, either directly or by means of a third party, on the basis of one of the methods indicated in Article 24(1) for identity verification and, where applicable, in Article 24(1b) for attributes verification, or, when needed, on a combination of those methods. Furthermore, those verifications must be performed in accordance with the implementing acts adopted pursuant to Article 24(1c), i.e. with Commission Implementing Regulation (EU) 2025/1566 of 29 July 2025 .

    QTSPs issuing qualified electronic attestations (QEAA/s) of attributes may benefit from the obligation on Member States to enable those QTSPs issuing QEAAs to verify attributes relying on authentic sources within the public sector, by electronic means at the request of the user, in accordance with Union or national law. This is not an obligation for QTSPs but a facility they have for at least those attributes listed in Annex VI of Regulation (EU) No 910/2014.

    Provision of qualified electronic registered delivery service

    To ensure that transfer of data using a qualified electronic registered delivery service is delivered to the correct addressee, qualified electronic registered delivery services shall ensure the identification of the addressees with a very high level of confidence or, where applicable, a high level of confidence with the use of European Digital Identity Wallets, in line with Commission Implementing Regulation (EU) 2025/19344 of 29 September 2025 on set requirements, reference standards and specifications that, where they are met by the QTSP, allow presumption of compliance with the requirements of the Regulation, including in relation to those verifications of identity of the sender and addressee.

    Management of remote qualified electronic signature (or seal) creation devices (remote QSCD)

    QTSPs managing remote QSCD must ensure, with a high level of confidence, that the signatories have sole control over the use of their remote qualified electronic signature creation data, and that the creators of the seal have sole control over the use of their electronic seal creation data. Commission Implementing Regulation (EU) 2025/1567 of 29 July 2025 sets out detailed reference standards and specifications that those QTSPs must meet to ensure that this is the case.

    Qualified electronic archiving services

    As part of the provision of qualified electronic archiving services, QTSPs must allow authorised relying parties to receive a record in an advanced and secure manner that confirms that electronic data archived in the qualified electronic archiving service originates from an identified natural or legal person. QTSPs must ensure throughout the preservation of the qualified electronic archive the presumption of integrity of the data from the beginning of the preservation period to the moment of retrieval.

    The recording of electronic data in a qualified electronic ledger

    In respect of the provision of qualified electronic ledgers, QTSPs must ensure that the origin of data records entered in the ledger can be established. This does not imply that the origin must be linked to an identified natural or legal person, nor that the identity of such a person must be verified.

    General consideration on the use of pseudonyms

    Article 5 of Regulation (EU) No 910/2014 states that, as a general rule that applies also in the context of the provision of qualified trust services, without prejudice to specific rules of Union or national law requiring users to identify themselves or to the legal effect given to pseudonyms under national law, the use of pseudonyms that are chosen by the user shall not be prohibited. The Regulation lays down explicitly the possibility for qualified certificates to be issued to natural persons, where they are identified in the issued certificate by means of a pseudonym. The absence of explicit references to pseudonyms in the provisions governing other qualified trust services does not prevent the application of Article 5 of Regulation (EU) No 910/2014, which allows the use of pseudonyms chosen by users.

    Nevertheless, Article 24(2)(h) requires QTSPs providing QTS to “record and keep accessible for as long as necessary after the activities of the qualified trust service provider have ceased, all relevant information concerning data issued and received by the qualified trust service provider, for the purpose of providing evidence in legal proceedings and for the purpose of ensuring continuity of the service”. This information must be retained for evidentiary purposes, including for use in legal proceedings and for ensuring continuity of the service. This may include, for example, information allowing the link between a pseudonym used in the provision of a qualified trust service and the real identity of the person concerned to be established, where this is necessary to provide evidence in legal proceedings.

  • Does it matter if a Qualified Trust Service is issued by a provider established in another Member State?

    The validity of such service cannot be denied. According to the internal market principle set out in Article 4 and to Article 24d of Regulation (EU) No 910/2014, a qualified trust service provided in one Member State shall be recognised as qualified in all other Member States.

  • What shall the Qualified Trust Service Provider (QTSP) do if it wants to implement any change in the provision of its qualified trust service?

    Pursuant to Article 24(2)(a) of Regulation (EU) No 910/2014, the Qualified Trust Service Provider (QTSP) must inform the supervisory body at least two months before implementing any change in the provision of its qualified trust service, and at least three months in advance in case of the cessation of the service or parts thereof.

    Upon receiving such information, the supervisory body may request additional information and may also request an ad hoc external assessment to confirm that, from the implementation of the intended changes, the QTSP shall continue to meet the applicable requirements of the Regulation. Additional information may include, for example, the provision of updated documentation (e.g. applicable policies and practise statements, terms and conditions, risk analysis, incident response plan).

    The supervisory body may also attach conditions to the permission to implement the intended changes to the qualified trust services. If the verification is not concluded within 3 months of the notification, the supervisory body must inform the QTSP about the delay, the reasons for the delay, and the new verification deadline.

    In case of termination of a qualified trust service, or parts thereof, the supervisory body has the task to verify the compliance of the underlying termination plan to its very first correct application, including how information is kept accessible in accordance with Article 24(2)(h) of the Regulation.

  • Which are the information retention obligations for Qualified Trust Service Providers (QTSPs)?

    Article 24(2)(h) of Regulation (EU) No 910/2014 sets out the obligation for the Qualified Trust Service Provider (QTSP) to record and keep accessible for as long as necessary after the activities of the qualified trust service provider have ceased, all relevant information concerning data issued and received by the qualified trust service provider, for the purpose of providing evidence in legal proceedings and for the purpose of ensuring continuity of the service.

  • Can a Qualified Trust Service Provider outsource parts of its service, or must it do everything in-house?

    Qualified trust service providers can rely on external third parties, e.g. sub-contractors or other qualified trust service providers, to meet the relevant requirements applicable to the provision of their qualified trust services. Regulation (EU) No 910/2014 allows qualified trust service providers to outsource parts of their activities or the services that are components of their qualified trust service, provided that the subcontracted services, and the qualified trust service whose services are part of, comply with the requirements of the Regulation.

    Article 24(2)(k) of the Regulation permits the use of subcontractors who, as regards the provision of the qualified trust service, possess the necessary expertise, reliability, experience, and qualifications and who have received appropriate training regarding security and personal data protection rules and shall apply administrative and management procedures which correspond to European or international standards.

  • What does ETSI EN 319 401 requirement 7.6 mean for PaaS-based trust services?

    Clause 7.6 of ETSI EN 319 401-1 does not per se prohibit the use of cloud-based services as components of a trust service. Where a (qualified or non-qualified) trust service provider (TSP) is considering building a (qualified or non-qualified) trust service relying on cloud-based services (e.g. a full-stack PKI as a service, remote HSMs, customer onboarding), it should ensure that the selected cloud service provider is providing the services components of the trust service in compliance with the applicable requirements of Regulation (EU) 910/2014 and of Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS2). The inclusion of 7.6 in the Annex does not prevent the use of cloud-based services and does not mean that the TSP would be required to host all hardware or to have a direct control on their physical access. Where an external service provider is used by a TSP, the TSP should require the external service provider to ensure that the provided services being component services of the trust service meet the requirements under clause 7.6 (as well as all other applicable requirements, e.g. NIS2) and, where appropriate, are auditable as part of the conformity assessment obligations of the TSP. The TSP should be able to perform necessary checks.    

    Indeed, the requirements from Regulation (EU) No 910/2014 and from NIS2 that apply to the TSP and the trust service it provides apply to the external services used by the TSP where those services form part of the provision of the trust service. In other words, the TSP must be able to demonstrate that the trust service it provides meets the applicable requirements including when using external services for parts or for the entirety of the trust service. Article 3(19) of Regulation (EU) No 910/2014 defines a ‘trust service provider’ as “a natural or a legal person who provides one or more trust services either as a qualified or as a non-qualified trust service provider”. By definition, an entity providing a non-qualified trust service (list in Art. 3(16)) is a (non-qualified) trust service provider and needs to comply with Article 19a requirements (and, where applicable, with NIS2 requirements).  

    The eIDAS dashboard is a tool to facilitate browsing of national trusted lists established following Article 22 of Regulation (EU) No 910/2014. Under Article 22, there is no requirement to include information about non-qualified trust service providers on national trusted lists, the decision to do so remains with Member States.

Electronic Signatures & Seals

  • What are the qualified trust services for the management of remote qualified electronic signature creation devices and for the management of remote qualified electronic seal creation devices?

    Regulation (EU) No 910/2014 defines electronic signature and electronic seal creation devices as configured software or hardware used to create an electronic signature or an electronic seal (Article 3(22) and (31)). Remote qualified electronic signature or seal creation devices (remote QSCD) are defined as qualified electronic signature or seal creation devices managed by a qualified trust service provider in accordance with Regulation (EU) No 910/2014 on behalf of a signatory or a seal creator (Article 3 (23a) and (23b)).

    In practice, remote qualified electronic signature/seal creation devices allow the signatory or seal creation data (private keys) and the qualified certificate data to be managed by qualified trust service providers. Instead of storing the keys and the device in their own hardware, signatories or seal creators can use them remotely through the infrastructure operated by the qualified trust service provider.

    Until 20 May 2024, the management of such remote qualified electronic signature/seal creation devices was not categorised as a distinct trust service. Nevertheless, such devices could already be used to facilitate the creation of qualified electronic signatures or qualified electronic seals, provided that the remote qualified device was operated by a qualified trust service provider. Integrating these services into the legal framework for qualified trust services was therefore necessary to address the legal uncertainty and liability issues resulting from the absence of specific rules in the previous version of the Regulation.

  • Can Member States restrict the type of electronic signature required for a given online service or transaction?

    As a matter of principle, Regulation (EU) No 910/2014 does not fully harmonise national rules on the legal effect of electronic signatures or on form requirements for particular transactions. Recital 63 of Regulation (EU) 2024/1183 confirms that, except where Regulation (EU) No 910/2014 provides otherwise, the legal effect of electronic signatures is for national law to determine. In doing so, Member States should apply the principle of proportionality between the legal value of the document and the level of security and cost of the signature required. This should be based on a proper risk assessment as regards to the type of signatures needed for a given transaction. The use of advanced electronic signatures for day-to-day transactions is to be encouraged where they provide sufficient trust and security.

    Member States may not request an electronic signature at a higher security level than ‘qualified electronic signature’ for cross-border use of online services offered by a public sector body (Article 27(3)).

    As regards the formats of such electronic signatures, where a Member State requires an advanced electronic signature to use an online service offered by, or on behalf of, a public sector body, that Member State shall recognise advanced electronic signatures, advanced electronic signatures based on a qualified certificate for electronic signatures, and qualified electronic signatures in at least the formats and using methods defined in the implementing act adopted pursuant to Article 27(5) of Regulation (EU) No 910/2014.

    Qualified electronic signatures and qualified electronic seals based on a qualified certificate issued in one Member State shall be recognised, respectively, as qualified electronic signatures and qualified electronic seals in all other Member States.

  • Can Member States impose maximum validity periods for qualified certificates, and how does this affect certificates from other Member States?

    National laws may not impose further requirements or limitations on qualified certificates than those established by Regulation (EU) No 910/2014. This is stated clearly for qualified certificates for electronic signatures, electronic seals and website authentication, respectively, by Articles 28(2), 38(2) and 45(1b) of Regulation (EU) No 910/2014, which provide that such certificates shall not be subject to any mandatory requirements exceeding those laid down in Annex I, Annex II and Annex III of the Regulation.

    Furthermore, Article 4a of Regulation (EU) No 910/2014 requires that a qualified certificate issued in one Member State is recognised, respectively, as qualified in all other Member States.

  • What is a remote Qualified Electronic Signature Creation Device (QSCD)? How is it different from a local QSCD?

    Regulation (EU) No 9120/2014 recognises that qualified electronic signatures may be created using a qualified electronic signature creation device. Those devices can be either remote (e.g. a hardware security module managed by a qualified trust service provider remotely on behalf of the user who accesses it via the network) or local (e.g. a smartcard in possession of a user). Qualified electronic signatures are legally the same regardless of which kind of qualified electronic signature creation device was used to create the signature.

    The new category of qualified trust services consisting in the management of remote electronic signature creation devices and of remote electronic seal creation devices is introduced by Regulation (EU) 2024/1183.

  • What are the certification requirements for a remote Qualified electronic Signature Creation Device and for a remote Qualified electronic Seal Creation Device?

    All QSCDs whether they are local or remote shall be certified in accordance with Article 30 of Regulation (EU) No 910/2014 for their compliance with the requirements of Annex II. This certification must be performed either in accordance with the standards listed in CID (EU)2016/650 or in accordance with an alternative certification procedure. Such alternative certification procedures are currently used to remote QSCDs and to certain types of local QSCDs (e.g. Hardware Security Modules mainly used by legal persons as local qualified electronic seal creation devices). These procedures must be notified by the certification body using them to the Commission, which publishes them in a compiled list.

    Furthermore, Member States must notify to the Commission appropriate information on certified QSCD, whenever a QSCD is certified, or its certification is cancelled.

    This information on certified QSCD shall then be included in the list compiled by the Commission in accordance with Article 31(2) of Regulation (EU) No 910/2014. The list is available in the eIDAS Dashboard . Please refer to Commission Implementing Regulation (EU) 2025/1570 of 29 July 2025 , Commission Implementing Regulation (EU) 2025/1567 and CID (EU)2016/650 for further details.

  • Do advanced and qualified electronic signatures need to comply with CID (EU) 2015/1506?

    Articles 27 and 37 of Regulation (EU) No 910/2014 do not impose any obligation for advanced or qualified electronic signatures/seals to comply with the standards listed in Implementing Decision (EU) 2015/1506. Those provisions require Member States to recognise such signatures/seals, in at least the formats or using the methods defined in that Decision, where a public sector body requires the use of an online service. These requirements concern recognition and validation by relying parties, not the creation of the signature/seal. The creation of advanced electronic signatures/seals remains technology-neutral and is subject only to the requirements set out in Article 26/36 of the Regulation.

    Articles 27 and 37 of Regulation (EU) No 910/2014 do not require advanced electronic signatures or qualified electronic signatures to comply with the formats or methods listed in Commission Implementing Decision (EU) 2015/1506.

    Those provisions instead concern the recognition of electronic signatures and seals in the context of online public services. Where a public sector body requires the use of an advanced electronic signature or seal for an online service, Member States must recognise at least the formats or methods defined in Implementing Decision (EU) 2015/1506.

    These provisions therefore regulate the legal recognition of signatures and seals by relying parties, not the creation of the signature or seal itself.

Electronic registered delivery services

  • How does a Qualified Electronic Registered Delivery Service (QERDS) ensure data reaches the right recipient?

    To ensure that data using a qualified electronic registered delivery service is delivered to the correct addressee, qualified electronic registered delivery services should ensure the identification of the addressee with a very high level of confidence (by contrast, only a high level of confidence is required as regards the identification of the sender).

FAQ - Electronic attestation of attributes

FAQ - Electronic attestation of attributes

EAAs in the Digital Identity Wallets

  • What is an attribute?

    An attribute is a piece of information that characterises an individual, an entity or an object. Attributes can include a wide range of personal or professional data, such as a person’s name, date of birth, nationality, educational qualifications, professional titles, or specific rights and permissions.

    In the context of digital identity, attributes are essential for proving identity or validating specific characteristics within online services. Attributes can be static (e.g., date of birth) or dynamic (e.g., current address), and they may be derived from official registries, personal documents, or certifications issued by trusted authorities.

  • What is an Electronic Attestation of Attributes?

    An Electronic Attestation of Attributes (EAA) is a type of digital document that confirms the accuracy of a specific attribute or set of attributes, such as a place of residence or professional qualification. An EAA can be issued to, stored and presented with the EU Digital Identity Wallets.

  • What are the three categories of EAAs, and what advantages are associated with each category?

    Not all EAAs are the same. They vary in their legal status, assurance levels, and the types of use cases for which they are most suitable.

    • Qualified Electronic Attestations of Attributes (QEAAs): Issued only by Qualified Trust Service Providers under strict identity-verification and anti-fraud checks, QEAAs carry the highest assurance level. Legally equivalent to paper documents and automatically recognised across all Member States.
    • Non-qualified Electronic Attestations of Attributes (EAAs): Skips QTSP requirements, making them faster and cheaper to issue, ideal for private-sector services or pilots, though relying parties must independently assess trust and reliability.
    • Public Electronic Attestations of Attributes (PuB-EAAs): Issued by or on behalf of public sector bodies drawing on official registries, PuB-EAAs match QEAAs in legal quality and EU-wide recognition, without needing to come from a qualified trust service provider. ..Read more

    Qualified Electronic Attestations of Attributes (QEAAs)

    • Stronger security and fraud prevention – As stated in Article 24(1), 24(1a) and 24(1b) of Regulation (EU) No 910/20143, when issuing a qualified EAA, a Qualified Trust Service Provider (QTSP) must verify the attested identity and specific attributes of the person to which it is issued. Moreover, Article 24 prescribes robust scrutiny mechanisms to detect inconsistencies and prevent tampering or misuse.
    • Recognised in all Member States – Under Article 24a(9) of Regulation (EU) No 910/2014, QEAAs shall be recognised across the EU, ensuring smooth cross-border use.
    • Same legal value as an equivalent document in paper form – As per Article 45b(2) of Regulation (EU) 910/2014, a QEAA shall have the same legal effect as lawfully issued attestations in paper form.
    • Secure revocation mechanism - Where a qualified electronic attestation of attributes has been revoked after initial issuance, it shall lose its validity from the moment of its revocation and its status shall not in any circumstances be reverted (Article 45d(4)).

    Non-qualified Electronic Attestations of Attributes

    • More flexible and easier to issue - Non-qualified EAAs do not require the issuers to meet requirements for Qualified Trust Service Providers, making them easier and faster to deploy, especially for private-sector services or pilot projects.
    • Lower compliance and operational burden - They have fewer regulatory requirements than QEAAs, which can significantly reduce costs and administrative overhead for issuers.
    • According to Article 45b(1) of Regulation (EU) 910/2014, an electronic attestation of attributes shall not be denied legal effect or admissibility as evidence in legal proceedings on the sole ground that it is in electronic form or that it does not meet the requirements for qualified electronic attestations of attributes.
    • Compared to QEAA and PubEAA, EAAs do not benefit from a Regulation built-in trust framework and require a higher burden on relying parties to establish the level of reliability and trust, mainly on an attestation scheme basis.
    • Key Legal Difference between qualified and non-qualified EAAs: QEAAs benefit from a harmonised EU trust framework, mandatory recognition across all Member States, and the same legal effect as an equivalent paper attestation, whereas non-qualified EAAs may still have legal effect and evidential value but do not benefit from these specific legal presumptions and recognition guarantees under Regulation (EU) No 910/2014.

    Public Electronic Attestations of Attributes (PuB-EAAs)

    • Public EAAs (PuB-EAAs) can be issued by or on behalf of public sector bodies when the data originates from official registries or government databases. Their legal quality and assurance equals qualified EAAs, even if not issued by qualified trust service providers.
    • These attestations hold legal equivalence to paper-based documents and are particularly relevant for public services. According to Article 45b(2) of Regulation (EU) 910/2014, attestations of attributes issued by, or on behalf of, a public sector body responsible for an authentic source shall have the same legal effect as lawfully issued attestations in paper form. Pub-EAAs are equivalent to official public documents and are recognised in all Member States. Their electronic format makes them easier to use and share in certain situations compared to their non-digital counterparts.
    • Recognised in all Member States: As per Article 45b(3) of Regulation (EU) 910/2014, an attestation of attributes issued by or on behalf of a public sector body responsible for an authentic source in one Member State shall be recognised as an attestation of attributes issued by or on behalf of a public sector body responsible for an authentic source in all Member States.
    • Secure revocation mechanism - Where an electronic attestation of attributes issued by or on behalf of a public sector body responsible for an authentic source has been revoked after initial issuance, it shall lose its validity from the moment of its revocation and its status shall not be reverted (Article 45f(4) of Regulation (EU) 910/2014).

    Read less

How to issue an EEA

  • Who can issue EAAs?

    • Non-qualified EEAs can be issued by anyone who can meet the requirements for the issuance of EAAs (Article 45g and 45h) and for trust service providers (Art. 19a).
    • Public Sector Body can issue Public Electronic Attestations of Attributes (PuB-EAAs) provided they meet the requirements of Regulation (EU) No 910/2024, including Art. 45f. Regulation (EU) 910/2014 does not forbid public sector bodies from becoming (Qualified) Trust Services Providers and issuing EAAs and QEAAs.
    • Private Sector can issue EAAs in the form of qualified or non-qualified EAAs, depending on their intended characteristics and use scenarios, thus becoming a Trust Service Provider. Qualified EAAs can only be issued by Qualified Trust Service Providers.
    • Regulation (EU) 910/2014 does not apply to EU institutions, bodies and agencies (EUIBAs). However, this does not prevent EU institutions, bodies and agencies from providing services equivalent to the trust services defined under Regulation (EU) 910/2014.

  • How to issue Non-Qualified Electronic Attestations of Attributes?

    Under Regulation (EU) 910/2014, anyone who issues electronic attestations of attributes (EAAs), like diplomas, licences, or mandates to act on someone's behalf, is automatically classed as a Trust Service Provider, with no special status required to become one.

    Non-qualified providers still carry real obligations, though: they must manage legal, operational, and security risks, report serious breaches within 24 hours, and meet EAA-specific rules on wallet interoperability and data separation. Unlike qualified services, there's no mandatory upfront audit, supervision happens after the fact, triggered ..Read more by incidents or complaints.

    • In accordance with the definitions provided in Article 3 of Regulation (EU) 910/2014:: ‘electronic attestation of attributes’ means an attestation in electronic form that allows attributes to be authenticated; ‘trust service’ means an electronic service normally provided for remuneration which consists of any of the following: […] (g) the issuance of electronic attestations of attributes; ‘trust service provider’ means a natural or a legal person who provides one or more trust services either as a qualified or as a non-qualified trust service provider.
    • As per recital 55 of Regulation 2024/1183 amending Regulation (EU) No 910/20144 any service provider that issues attested attributes in electronic form such as diplomas, licences, birth certificates or powers and mandates to represent or act on behalf of natural or legal persons should be considered a trust service provider of electronic attestation of attributes.
    • Accordingly, the issuance of Electronic Attestations of Attributes results in the entity being classified as a Trust Service Provider.
    • There are no specific requirements for obtaining the status of a Trust Service Provider.

    Read less

  • Are there any specific obligations for Trust Service Providers issuing non-qualified trust services?

    Requirements for non-qualified trust service providers are specified in Article 19a of Regulation (EU) 910/2014, in Directive (EU) 2022/2555 (NIS 2NIS2) and the Commission Implementing Regulation (EU) 2025/2160 laying down rules as regards reference standards, specifications and procedures for the management of risks to the provision of non-qualified trust services.

    A trust service provider must have suitable policies and measures in place to deal with legal, business, and operational risks, as well as other indirect risks connected to the provision of the non-qualified trust service.

    These measures must cover:

    • registration and onboarding procedures for a trust service;
    • procedural or administrative checks needed to provide trust services;
    • the management and implementation of trust services.

    If there is any security breach or disruption that significantly affects the service or the personal data it holds, the provider must notify as soon as possible and no later than 24 hours after becoming aware of the issue:

    • the supervisory authority;
    • the affected individuals;
    • the public (if it is in the public interest); and
    • any other relevant authorities.

    There are additional specific requirements for TSP issuing EAAs:

    • Providers of EAA shall provide EUDI Wallet users with the possibility to request, obtain, store and manage the EAA irrespective of the Member State where the EUDI Wallet is provided (Art.45g(1)). This means that they need to comply with the formats and applicable requirements set out in the relevant implementing acts.
    • Providers of EAAs shall not combine personal data relating to the provision of those EAAs with personal data from any other services offered by them or their commercial partners (Art.45h(1)). Furthermore, personal data relating to the provision of EAAs shall be kept logically separate from other data held by the provider of EAAs (Art.45h(2)).

    Good to know:

    • Commission Implementing Regulation (EU) 2025/2160 lays down rules for the application of Regulation (EU) No 910/2014 of the European Parliament and of the Council as regards reference standards, specifications and procedures for the management of risks to the provision of non-qualified trust services.
    • No prior auditing is mandated for TSPs issuing EAAs; supervision is conducted ex post and initiated only in response to security incidents or formal complaints.

  • How to issue Qualified Electronic Attestations of Attributes?

    Qualified EAAs (QEAAs) can only be issued by Qualified Trust Service Providers (QTSP), and must meet strict content requirements, including a clear "qualified" marking, issuer details, attested attributes, validity dates, a unique code, and a qualified signature or seal.

    Becoming a QTSP itself is a formal process: providers notify their supervisory body, submit a conformity assessment confirming compliance with both the eIDAS Regulation and NIS2, and only gain qualified status and the right to operate once listed on the national trusted list.

    That status is not permanent: QTSPs face mandatory audits at least every 24 months, and can lose their qualified status if they fail to fix compliance issues or if NIS2 or GDPR authorities flag violations. The sections below go ..Read more into more detail on each step.

    Qualified EAAs are issued exclusively by Qualified Trust Service Providers (QTSPs).

    Qualified EAAs must also meet requirements laid down in Annex V of Regulation (EU) No 910/2014 and include, for example:

    • Indication it is qualified – A clear indication that it is a qualified electronic attestation of attributes.
    • Issuer details – Data identifying the qualified trust service provider that issued it.
    • Entity being attested – Information about the person or organisation the attributes belong to; indicate if a pseudonym is used.
    • Attested attributes
    • Validity period –Start and end dates for the attestation.
    • Unique attestation code – A unique ID from the issuer, and if relevant, the scheme it belongs to.
    • Qualified signature/seal – A qualified electronic signature or seal from the issuing provider.
    • Certificate access – Information on where to find the supporting certificate to verify the qualified signature/seal of the issuer.
    • Validity check – Information or service to verify if the attestation is still valid.

    Other requirements are described in Articles 45d, 45g and 45h of Regulation (EU) 910/2014.

    Where a qualified electronic attestation of attributes has been revoked after initial issuance, it shall lose its validity from the moment of its revocation and its status shall not in any circumstances be reverted (Article 45d(4)).

    List of reference standards and specifications and procedures for qualified electronic attestations of attributes are regulated by Commission Implementing Regulation (EU) 2025/1569.7

    When issuing a QEAA, a QTSP shall verify the identity and, if applicable, any specific attributes of the natural or legal person to whom the QEAA is to be issued (Article 24).

    Providers of electronic attestations of attributes shall provide European Digital Identity Wallet users with the possibility to request, obtain, store and manage the electronic attestation of attributes irrespective of the Member State where the European Digital Identity Wallet is provided (Article 45g(1)).

    Moreover, for the attributes listed in Annex VI, Member States must make it possible for QTSPs to verify the attributes against authentic sources (Article 45e(1)).

    Read less

  • How to become a Qualified Trust Service Provider?

    The initiation of a qualified trust service is described in Article 21 of Regulation (EU) 910/2014

    A trust service provider intending to offer a qualified trust service must:

    Notify the supervisory body, and submit a conformity assessment report issued by a conformity assessment body.

    The report must confirm compliance with:

    • Regulation (EU) 910/2014, and
    • Article 21 of the NIS2 Directive (EU) 2022/2555.

    The supervisory body verifies whether:

    • The provider meets the requirements for qualified trust service providers, and
    • The trust services comply with the requirements of Regulation (EU) 910/2014
    • For NIS2 compliance, the supervisory body must request the competent NIS2 authority to carry out supervisory actions.

    If compliance is confirmed, the supervisory body grants qualified status to the provider and the service.

    • Qualified trust service providers may begin to label the trust service they provide as “qualified” only after their qualified status has been indicated in the national trusted list.
    • The list is the constitutive document confirming that the qualified trust service providers are qualified for a qualified trust service.

  • How is the qualified status maintained? (Article 20)

    The supervision of qualified trust service providers is outlined in Article 20 of Regulation (EU) 910/2014.

    While detailed requirements depend on the specific qualified trust service, all qualified trust service providers are subject to ongoing supervision by the competent national supervisory body.

    • Qualified trust service providers (QTSPs) must be audited at least every 24 months.
    • Audits are carried out at the provider’s own expense by an accredited conformity assessment body (CAB).
    • The audit must confirm compliance with Regulation (EU) 910/2014 & Article 21 of the NIS2 Directive (EU) 2022/2555.
    • QTSPs must notify the supervisory body at least one month before any planned audit.
    • The supervisory body may participate as an observer in the audit if it wishes.
    • If a QTSP fails to meet requirements, the supervisory body may require corrective action within a set deadline. If the issue is not remedied, the supervisory body may withdraw qualified status.

    Qualified status may also be withdrawn when:

    • NIS2 authorities report non-compliance with Article 21 of NIS2.
    • GDPR authorities report non-compliance with GDPR.

  • How to issue Public Electronic Attestation of Attributes?

    Public EAAs (PuB-EAAs) follow a similar logic to QEAAs, requiring a machine-readable indicator of official status, issuer identification, subject details, attested attributes, validity period, unique identifier, and a qualified signature or seal, plus free access to the supporting certificate and a way to check validity.

    But because PuB-EAAs come from public bodies rather than QTSPs, the issuing body must undergo an ex ante conformity assessment, meet reliability standards on par with a QTSP, and be formally notified to the Commission by its Member State before it can issue attestations. The sections below cover these requirements in more detail. ..Read more

    General requirements:

    The requirements for the PuB-EAAs issued by or on behalf of a public body responsible for an authentic source must meet requirements outlined in Annex VII of Regulation (EU) 910/2014, and include:

    • A clear indication (readable by automated systems) that it is an official electronic attestation of attributes issued by or for a public body.
    • Identification of the issuing public body, including at least: the Member State, the name of the body, and where applicable, its official registration number.
    • Identification of the subject to whom the attributes relate; if a pseudonym is used, this must be clearly stated.
    • The attested attribute(s)
    • The validity period, showing when the attestation starts and ends.
    • A unique attestation identifier for the issuing body and, if relevant, the attestation scheme it belongs to.
    • A qualified electronic signature or seal of the issuing body.
    • Free access to the certificate supporting the qualified signature or seal.
    • Information on how to check the attestation’s validity, or where such services can be found.

    Other requirements are described in Article 45f of Regulation (EU) 910/2014, including the need to conduct an ex ante conformity assessment by a conformity assessment body, meet a level of reliability and trustworthiness equivalent to a QTSP (on the basis of the general requirements applicable to all QTSPs) and be notified to the Commission as a PubEAA provider by their Member State.

    Obligations for Member States:

    • Each Member State must make sure that any public-sector body issuing electronic attestations of attributes operates with a level of reliability and trustworthiness comparable to that of a qualified trust service provider - Article 45f(2) of Regulation (EU) 910/2014.
    • Before a public body can be officially recognised for issuing PubEAAs, the Member State must notify the Commission and provide evidence (through a conformity assessment report) that the body meets the necessary requirements – Article 45f(3) of Regulation (EU) 910/2014.

    Read less

  • How can I quickly understand the different types of attestations?

    Type of EAAProvider TypeLegal Effect
    Qualified Electronic Attestations of AttributesQualified Trust Service Provider (QTSP)Equivalent to paper-based documents
    Non-Qualified Electronic Attestations of AttributesTrust Service Provider (TSP)No guaranteed legal equivalence
    Public Electronic Attestations of AttributesPublic Sector Body or Official AuthorityEquivalent to paper-based documents

    Qualified Electronic Attestations of Attributes

    Provider Type

    Qualified Trust Service Provider (QTSP)

    Legal Effect

    Equivalent to paper-based documents

    Non-Qualified Electronic Attestations of Attributes

    Provider Type

    Trust Service Provider (TSP)

    Legal Effect

    No guaranteed legal equivalence

    Public Electronic Attestations of Attributes

    Provider Type

    Public Sector Body or Official Authority

    Legal Effect

    Equivalent to paper-based documents

EAAS based solutions

  • How is cross-border usability of EAAs guaranteed for European Digital Identity Wallet users?

    Providers of EAAs shall provide users of European Digital Identity Wallets with the possibility to request, obtain, store and manage the electronic attestation of attributes irrespective of the Member State where the European Digital Identity Wallet is provided (Art.45g(1)).

  • Is international recognition of EAAs possible?

    Qualified EAAs can be recognised outside the EU according to Article 14 of Regulation (EU) 910/2014. Recognition of trust services is mutual and conditional:

    • The EU and a third country or an international organisation can recognise each other’s trust services if equivalent standards and formal recognition instruments are in place.
    • Non-EU trust services can be legally equivalent to EU qualified services only if: the EU signs an agreement with the country/organisation, or the EU adopts an official implementing act to recognise the service.
    • Before the EU recognises the EAAs, the non-EU provider must meet the same standards and requirements that EU-qualified providers must meet. The third country or organisation must also create and publish a trusted list of recognised trust service providers, just like the EU does.

  • Is there additional legislation that must be considered? Can any Qualified Trust Service Provider issue all types of electronic attestations of attributes?

    The general legal framework for EAAs is set out in Regulation (EU) 910/2014. These rules ensure that a qualified EAA carries the same legal effect as lawfully issued paper-based attestations.

    However, as per recital 55 of Regulation (EU) 2024/11838, those requirements apply without prejudice to Union or national law defining additional sector-specific requirements as regards form with underlying legal effects and, in particular, the cross-border recognition of qualified electronic attestation of attributes, where appropriate.

    Driving Licences Directive is an example of lex specialis defining additional sector-specific requirements. It requires that Member States issue a Mobile Driving Licence (mDL) as EAAs.

    It explicitly mandates:

    • in Article 5(1) that Member States shall issue mobile driving licences based on the Union standard specifications...
    • And in Article 5(2) that […] Mobile driving licences shall be issued to holders to be used with European Digital Identity Wallets as electronic attestations of attributes, in accordance with Regulation (EU) No 910/2014 of the European Parliament and of the Council.

    If a non-authorised QTSP were to issue a QEAA resembling an mDL, but without the authority to issue either a DL or an mDL, Regulation (EU) 910/2014 would not confer upon that QEAA any equivalence to an official, paper-based driving licence.

    Moreover, all Commission services should promote the ‘Wallet by Default Approach’. This means that the EUDIWs should remain a preferred solution for EU citizens. By ensuring that the EUDIWs are widely available and integrated into public and private sector services, the initiative will support cross-border digital interactions, improve administrative efficiency, and strengthen citizen trust.

  • How to issue electronic attestation of attributes to European Digital Identity Wallets?

    • As stated in Article 45h of Regulation (EU) 910/2014, providers of electronic attestations of attributes shall provide European Digital Identity Wallet users with the possibility to request, obtain, store and manage the electronic attestation of attributes irrespective of the Member State where the European Digital Identity Wallet is provided.
    • Moreover, providers of qualified electronic attestations of attributes shall provide an interface with European Digital Identity Wallets.
    • Additional guidance can be found in Commission Implementing Regulation (EU) 2025/2025 on qualified electronic attestations of attributes and electronic attestations of attributes provided by or on behalf of a public sector body responsible for an authentic source.

  • How are electronic attestations of attributes managed within the European Digital Identity Wallets?

    As per Article 5a of Regulation (EU) 910/2014, the specific management of electronic attestations of attributes will largely be up to the different wallet providers. At a minimum, it must be possible to create, read, update and delete those attestations on the European Digital Identity Wallet. Wallet providers are likely to also provide discovery services that would allow wallet users to find relevant attestations that users may request to be issued to them. The wallets must also support the reissuance, suspension and revocation of electronic attestations of attributes.

  • Do public sector bodies issuing Pub-EAAs qualify as providers of qualified trust services or non-qualified trust services under the Regulation?

    Public sector bodies issuing Pub-EAAs are not per se qualified trust service providers. The provision of Pub-EAAs is not a qualified trust service, and their providers are not required to become qualified trust service providers. However, the supervision regime of Pub-EAA providers is similar to that of qualified trust service providers, and Pub-EAAs have the same legal effects as qualified attestations of attributes.

  • How is users’ personal data protected?

    • Providers of qualified and non-qualified electronic attestation of attributes services shall not combine personal data relating to the provision of those services with personal data from any other services offered by them or their commercial partners (Article 45h(1) of Regulation (EU) 910/2014).
    • Personal data relating to the provision of electronic attestation of attributes services shall be kept logically separate from other data held by the provider of electronic attestation of attributes. (Article 45h(2) of Regulation (EU) 910/2014).
    • Providers of qualified electronic attestation of attributes’ services shall implement the provision of such qualified trust services in a manner that is functionally separate from other services provided by them. (Article 45h(3) of Regulation (EU) 910/2014).
    • The technical framework of the European Digital Identity Wallet enables privacy preserving techniques which ensure unlinkability, where the attestation of attributes does not require the identification of the user. (Article 5a(16)(b).
    • Besides these specific rules in Regulation (EU) 910/2014, all other GDPR requirements apply, such as on data protection principles, data subjects' rights, etc. The GDPR is also fully applicable to the processing of your personal data in the EUDIW: among other things, this means that the processing is secure (Article 32), thanks to measures such as encryption and secure storage of data; the wallet was built on the basis of data protection by design and by default. You can exercise your data subject rights (Chapter III GDPR), the amount of personal data processed is limited to what is strictly necessary, and you retain control of what personal data you share with whom.

  • What are the liability rules for the Trust Services Providers?

    • The liability and burden of proof of Trust Service Providers is regulated under Article 13 of Regulation (EU) 910/2014.
    • According to that Article, trust service providers are responsible for any damage caused intentionally or through negligence that results from their failure to meet the obligations set out in the Regulation.
    • Anyone who suffered material or non-material damage because of a trust service provider's infringement of the Regulation has the right to seek compensation under EU and national law.
    • National rules on liability apply.
    • The burden of proving the intention or negligence of a non-qualified trust service provider lies with the natural or legal person claiming the damage.
    • The intention or negligence of a qualified trust service provider is presumed unless that qualified trust service provider proves that the damage occurred without the intention or negligence of that qualified trust service provider.
    • It is important to note that, where trust service providers duly inform their customers in advance of the limitations on the use of the services they provide and where those limitations are recognisable to third parties, trust service providers shall not be liable for damages arising from the use of services exceeding the indicated limitations.

  • Which attributes must be verified against authentic sources?

    As prescribed in Article 24 of Regulation (EU) 910/2014, when issuing a qualified electronic attestation of attributes, a qualified trust service provider shall verify the identity and, if applicable, any specific attributes of the natural or legal person to whom the qualified electronic attestation of attributes is to be issued.

    To facilitate this process, in accordance with Article 45e of Regulation (EU) 910/2014, Member States must ensure that qualified trust service providers of electronic attestations of attributes are able to verify by electronic means at the request of the user the authenticity of the enlisted attributes against the relevant authentic source at national level or via designated intermediaries recognised at national level.

    These attributes relevant to this requirement are listed in Annex VI and represent the minimum required set. The examples include: age, civil status, educational and professional qualifications, public permits and licenses.

    Verification against authentic sources is not the only way of verifying attributes by QTSPs. Other methods are outlined in Article 24(1b) of Regulation (EU) 910/2014.

    The provider must verify attributes using one or more of the following methods:

    • Digital identity methods - through the European Digital Identity Wallet, or a notified eID with a high assurance level (Article 8).
    • Qualified certificates - using a qualified electronic signature or seal certificate issued according to the rules.
    • Qualified electronic attestation of attributes (QEAAs).
    • Other reliable methods - any method that ensures a high level of confidence, confirmed by a conformity assessment body.
    • Physical presence - the person (or authorised representative) appears in person, providing appropriate evidence following national law.

  • What is a catalogue of attributes?

    A catalogue of attributes is a repository of attributes. It is established by the Commission with the assistance of the European Digital Cooperation Group to facilitate the verification of attributes against authentic sources by qualified trust service providers issuing qualified electronic attestations of attributes. It will contain, at least, the attributes listed in Annex VI of Regulation (EU) 910/2014 to enable the verification of those attributes against authentic sources.

    For example: age, address, gender, civil status, family composition, nationality or citizenship, educational and professional qualifications, permits and licences.

    More information about the catalogue can be found in the Commission Implementing Regulation (EU) 2025/1569.11.

  • What is a catalogue of schemes?

    A catalogue of schemes is a repository of schemes for the attestation of attributes. It will be maintained and published online by the Commission. It will contain specifications for common types of electronic attestations of attributes in order to facilitate interoperability and harmonisation of those attestations.

    For example, schemes of attributes may define specifications for the issuance of Digital Travel Credentials (DTCs), mobile driving license (mDL), diplomas and age verification.

    More information about the catalogue can be found in the Commission Implementing Regulation (EU) 2025/1569.12.

  • Can a public sector body also act as a QTSP or even a TSP and issue attestations of attributes?

    Regulation (EU) 910/2014 does not prevent public sector bodies from becoming trust services providers, be they non-qualified or qualified. In this case, public sector bodies providing (qualified) trust services shall also be supervised as such and meet the requirements set out in the Regulation and in the implementing acts.

  • Can attributes listed in Annex VI of eIDAS also be issued in the form of EAA?

    • Annex VI to the Regulation establishes  a minimum catalogue of attributes for which Member States should ensure that measures are taken to allow QTSPs issuing QEAAs to verify by electronic means at the request of the user, the authenticity of those attributes against the relevant authentic source at national level or via designated intermediaries recognised at national level, in accordance with Union or national law and where these attributes rely on authentic sources within the public sector.
    • As stated in Recital 12 of the EAAs Implementing Act 13 , Member States are encouraged to provide any additional optional attributes beyond the mandatory ones to ensure that the set of person identification data is unique. The Regulation does not prevent any public sector body, be they responsible for an authentic source, from issuing any kind of EAA as regards any kind of attribute.
    • Consequently, EAAs may include any attributes, without predefined limitations. Public bodies may issue EAAs independently or by contracting TSPs.
    • Please note that mutual recognition only applies to QTS: thus, only a qualified electronic attestation of attributes and attestations of attributes issued by, or on behalf of, a public sector body responsible for an authentic source shall have the same legal effect as lawfully issued attestations in paper form in all Member States. (see Art. 24a and Art. 45b).

  • How is a QTSP supposed to collect the necessary attribute data for initial issuance of a QEAA?

    There are two processes: collection (gathering the attribute data) and verification (confirming the data is correct).

    Article 24(1b) regulates verification of attributes.

    The Regulation does not mandate how the attributes are initially collected.

    QTSPs issuing QEAAs must, at the moment of the issuance of the QEAA, ensure with complete certainty the correctness and accuracy of the attested attributes of the person and the identification of that person to whom the QEAA is issued.

    But to achieve this, there is no obligation for QTSPs issuing QEAAs to verify the attributes against authentic sources.

    • Art.24(1)(1a)(1b) do not per se entail or automatically provide the QTSP with any consent from the person to whom the identity and attributes will be verified, for the purpose of verifying them against authentic sources in accordance with Art.45e.
    • This consent must be explicitly obtained by the QTSP from that person.
    • There may be different options to obtain such consent based on agreements between the QTSP and the person (e.g. not necessarily requiring an explicit consent to be granted at the time of the request made by the QTSP to the authentic source).

  • Does “lawfully issued attestations in paper form” in Article 45b(2) include administrative documents issued by Member States, such as identity cards?

    The term attestation is not defined in eIDAS, which only regulates EAAs. Under Art. 3(44), an electronic attestation of attributes is a means of electronically authenticating attributes of a person. Considering the broad definitions, almost any attribute or set of attributes could be issued as an EAA as long as any potential additional requirements on the form (e.g. laid down in Union or national law) is met.

  • Is the reference to “paper form” limited to paper documents, or does it also cover other physical formats such as plastic cards?

    Paper form in Art. 45b(2) should be read as referring to the physical counterpart, irrespective of substrate. The point is equivalence between electronic and physical forms, not between paper and plastic.

  • Does Article 45b(2) override EU rules on the format of documents like IDs, passports, and driving licences, or must those rules be changed first for them to be used as PuB-EAAs?

    Article 45b(2) gives PuB-EAAs and QEAAs the same legal effect as their lawfully issued physical counterparts for the attributes they carry. Where there are specific requirements on the form in specific legislation, this should be considered for the issuance of electronic attestations of attributes. For example, the mDL additional requirements were set up for the issuance of mDL that would need to be respected for the issuance of these very specific EAAs.

  • Can Member States offer the verification mechanism in Art. 45e to TSPs?

    • As per Article 45e, Member States must ensure that QTPs can verify attributes against authentic sources, at least for the attributes listed in Annex VI.
    • Recital 61 of Regulation (EU) No 2024/1183 amending Regulation (EU) No 910/2104 states that the purpose of this verification mechanism is to support qualified trust service providers of qualified electronic attestations of attributes in meeting their obligations under Regulation (EU) No 910/2014.
    • Article 45e does not prevent Member States from enabling TSPs to access the verification mechanism.
    • Before granting access to authentic source verification for trust service providers, it might be beneficial to conduct an internal assessment of potential risks. Key considerations could include ensuring GDPR compliance, obtaining user consent, and implementing effective risk mitigation measures.

FAQ - General

FAQ - General

General

  • What are EU Digital Identity Wallets?

    EU Digital Identity Wallets are personal digital wallets, in the form of apps allowing citizens to digitally prove who they are, as well as store and manage identity data and official documents in digital form. These may include a driving licence, or educational qualifications.

    Many citizens are already using digital wallets on their mobile phones to store their boarding passes and show them when they travel or to keep their virtual bank cards to proceed with convenient payments. These wallets, often offered by online platforms, allow their users to log in to various online services from shopping to reading news but these logins are not necessarily giving users full control over what data they share to identify themselves while accessing online services. These “social logins” can rarely can be used to access digital government services. With the EU Digital Identity Wallets, all European citizens will be able to prove, across the EU, their identity where necessary to access public and private digital services, to share digital documents, or simply to prove a specific personal attribute, such as age, without revealing their full identity or other personal details. Citizens will at all times have full control of the data they share and with whom.

  • Will I have to pay for EU Digital Identity Wallets?

    For natural persons, the use of the wallets, including electronic signatures for non-professional purposes, will be free of charge. Businesses may have to pay fees to use the wallet services, depending on Member States' choice of business model for the wallet. This may mean in practice for instance that service providers, such as telecom operators or credit card companies may be asked to pay when they rely on identification services the wallets will offer to onboard to new mobile phone contracts or credit cards. Using the wallets for sharing digital documents may also incur costs to the providers of these documents.

  • Will I have to pay to use an EU Digital Identity Wallet?

    No, EU Digital Identity Wallets will be completely free for citizens, including signing private documents electronically with your wallet for non-professional use cases. Some certificates shared through the wallet may require payment to the provider, such as educational certificates, credit statements or business certificates – similar to the situation today where obtaining such certificates in paper form also sometimes comes at a cost.

  • How can I obtain an EU Digital Identity Wallet?

    Member States have the choice to offer the wallets to their citizens and residents at the national level directly themselves, or to mandate another organisation with provision or recognise an independent provider. Everyone will be able to download, install and use EU Digital Identity Wallets on their personal mobile device. Member States can make use of existing national digital eID schemes to facilitate registering citizens for the wallets (with the help of additional security measures where necessary).

  • When will I be able to use EU Digital Identity Wallets?

    Member States should issue EU Digital Identity Wallets 24 months after adoption of the implementing legislation setting out the core functions of the wallet and its certification. Indicatively, this means wallets will be available to citizens in 2026.

  • Where can I download a wallet?

    Wallets are not yet available. In the future, you will be able to find the wallet in major mobile app stores (iOS, Android), clearly labelled as official EU Digital Identity Wallets.

Wallet Usage

  • Could I use EU Digital Identity Wallets to access private services?

    Yes, EU citizens should be able to use their EU Digital Identity Wallets to access digital services all across the Internet, including certain private services. As such, they improve the effectiveness and extend the benefits of secure and convenient digital identity to the private sector. Providers of some private services must accept the wallets at the request of the wallet user, notably where strong user authentication is required. This is for instance the case for making payments, for opening bank accounts and for other use cases such as in the areas of transport, energy, insurance, drinking water, postal services, digital infrastructure, education or telecommunications. A requirement to recognise the EU Digital Identity Wallets for authentication also applies to Very Large Online Platforms.

  • Will public services support and accept digital signatures?

    Yes, public services must accept qualified electronic signatures for cross-border use as equal to paper signatures. There may be some exceptions at national level.

  • Will it be easy for me to create digital signatures with an EU Digital Identity Wallet?

    Everyone who has fully set up their EU Digital Identity Wallet will be able to sign electronically with just a few clicks.

  • Could I use an EU Digital Identity Wallet for banking services?

    Yes, citizens will be able to use EU Digital Identity Wallets to authorise payments, open financial services accounts and other services in full security with personal data protected. In all these cases, the wallets will not replace, but complement solutions offered by banks.

  • How will the systems be interoperable and work across different Member States?

    The Regulation imposes common functional requirements for all EU Digital Identity Wallets issued by Member States.
    The Commission is working closely with Member States to develop common standards, technical specifications and protocols needed to ensure that all wallets meet these requirements, operate in the same way across the EU and offer the same required functionalities, security and data protection features.
    The technical specifications will be made mandatory by means of implementing legislation ensuring that wallets in all Member States are fully interoperable and observe the same standards.

  • I have two nationalities and two identity cards/passports. Can I store them both in the same wallet?

    For now the personal identification data provided by one Member State can only be used within the wallet provided by this Member State. But this does not matter as all national wallets will be completely interoperable and will be useable across the EU with the same functionalities.

  • What will change for Europeans and EU businesses?

    The main novelty offered by the new rules is that all EU citizens, residents and businesses will be offered EU Digital Identity Wallets which are accepted by private and public digital services in all Member States. You can find out more about the benefits of EU Digital Identity Wallets here.

  • My country already has an advanced e-identity system. Why should I use an EU Digital Identity Wallet?

    The EU Digital Identity Wallets will not replace existing national eID schemes but supplement them as an option that (1) will be recognised across borders. (2) enables you to securely present and share a wide range of digital documents (like education diplomas, and train tickets) and (3) allows you to log in to a range of private sector services while preserving your privacy.

  • What are Electronic Attestations of Attributes?

    Electronic Attestations of Attributes, or EAAs, are referred to in the EU Digital Identity Framework Regulation. They are a type of digital document that can be added, stored and presented with the EU Digital Identity Wallet, and contain important information about ourselves. Examples include a university diploma, a boarding pass, or a driver’s license.

    For the sake of simplicity, we refer to EAAs as digital documents throughout this website.

  • What is the difference between digital assets and digital documents (or EAAs)?   

    What we refer to as digital documents throughout our website are also called Electronic Attestations of Attributes in the EU Digital Identity Framework Regulation. These are proofs of an attribute (about either a person or object). They are especially useful for important documents such as your driver’s licence, your diploma, or a travel document like a boarding pass, as these are usually needed to prove something and access services.

    Digital assets on the other hand are digital objects, and can include everything from documents, to songs, to films. They also include Non-Fungible Tokens, or NFTs, which are a special kind of digital asset that represent ownership or the authenticity of something through a token.

    The EU Digital Identity Wallet will store and present personal identification data and digital documents/Electronic Attestation of Attributes but not digital assets. You will be able to store your university diploma in your wallet, but not your favourite song.

  • Will I be able to store NFTs on my wallet?

    NFTs, or Non-Fungible Tokens, are unique digital identifiers used to certify ownership and authenticity. There are no plans or provisions in the regulation for the wallet to store digital assets or NFTs.

    EU Digital Identity Wallets are personal digital wallets allowing citizens to digitally prove who they are, as well as store and manage identity data and official documents in digital form, ex. Driving licences, digital travel credentials, educational qualifications. These digital documents are also referred to as  Electronic Attestations of Attributes in the EU Digital Identity Framework Regulation.

    It is possible to create Qualified/Unqualified Electronic Attestation of Attributes that proves ownership of a specific object and issue it to an EU Digital Identity Wallet.

Governance and Actors

  • Will a unique European Digital Identity replace national digital identities?

    No, replacing national digital identities is not the aim of the revised Regulation. Member States will continue to provide digital identities.

    Instead, the European Digital Identity framework extends the functionalities and usability of national eIDs by means of a personal digital wallet. The obligation on Member States to offer EU Digital Identity Wallets will ensure that every person and business in the EU has access to a means of digital identification.

    Every citizen will have the choice whether to use the European Digital Identity wallet or a national eID system.

  • How will Member States participate in the new European Digital Identity Governance Framework?

    The Regulation sets out a new comprehensive governance framework for both electronic identification and trust services to support the implementation and supervision of the European Digital Identity Framework.
    The new governance framework notably includes a new cooperation and coordination body (European Digital Identity Cooperation Group) to advise the Commission in the preparation of implementing legislation, organise peer reviews, discuss requests for mutual assistance and exchange views, best practices and other information between all parties. In this way, the new set-up will improve the consistency and effectiveness of the current governance system.

  • How is the Commission helping Member States prepare for the EU Digital Identity Wallet?

    Under the Digital Europe Programme , the Commission is in the process of developing a wallet prototype based on the technical specifications. The software is already published on Github for voluntary use by Member States. In addition, under the same programme , the Commission is co-funding Large Scale Pilots , which test the wallets in a diverse range of everyday use cases. Examples of use cases include providing identification to online and offline public and private services, displaying one's mobile driving licence, authorising payments, exchanging diplomas, signing documents electronically, and presenting medical prescriptions. The results of the pilots will make it easier and quicker for Member States to develop and offer the wallet to their citizens and will help avoid bugs.

  • Who will provide the EU Digital Identity Wallet?

    Member States have the choice to offer the wallets to their citizens and residents themselves, mandate another organisation with the provision, or recognise an independent provider. The offer may differ by Member State.

  • What can I do with the new EU Digital Identity Wallets?

    You will be able to use it to identify digitally for public and private online services across the EU wherever this is necessary. You will also be able to sign digital documents (such as an employment or rental contract). In addition you will be able to share digital documents about yourself, such as educational or professional certificates, or hold a digital driving licence or a digital visa (Digital Travel Credential) in your wallet.

    You will be able to download, store and use basic personal data and digital documents or credentials in digital form very much like today in your physical wallet or briefcase.

  • What are the standards and technical requirements for European Digital Wallets?

    The European Commission and Member State experts are together working to create a common toolbox needed to develop the wallet, which includes the Architecture and Reference Framework (Technical Specifications ). All guidelines will follow international standards already in use.

  • Why will the European Digital Identity Wallets be developed under an open-source licence?

    Transparency on the technical set-up of the European Digital Identity Wallets is important for public trust and for building a well functioning and fully secure system. Everybody can scrutinise the technological set-up proposed and provide feedback on the choices made. Security weaknesses, bugs or malfunctions can be better identified and corrected in this way. Member States may limit the disclosure of some parts of the source code for reasons of public security.

Discover the benefits of the Wallet

Store, secure, and share your digital identity — discover the many ways EUDI Wallet will benefit both individuals and organisations.

Discover the benefits of the wallet