eIDAS 2.0 / EU DIGITAL IDENTITY WALLET (EUDI)

OLYMPUS opened an institutional file on a framework. A regulation has no Big Five and no Dark Triad, and the unit does not invent them; what a framework has is a text, a deployment deadline, and a governing model. eIDAS 2.0 is catalogued here as the master credential — the statute that gives every EU resident one verifiable, cross-border identity wallet and obliges the continent’s institutions to accept it. The finding is the shape of the component, not the intent of its drafters: an identity layer with genuine convenience and genuine privacy engineering on its face, and, underneath, the two properties that make an identity layer the load-bearing piece of any control grid — everything can be hung off it, and the issuer holds the key. The numbers in the front matter are reach, entrenchment, and durability. A credential outlives every commissioner who signs it, and identity is the component you enroll into once and cannot delete.

Institutional Archetype

THE MASTER CREDENTIAL — The archetype is the single key that opens every door and, held by the issuer, can lock any of them. The EUDI Wallet does not run a bank, a border post, or a platform; it is the credential those services are obliged to check. Once a population is enrolled into one verifiable identity, every other capability on the grid — payments, benefits, age-gated content, strong customer authentication, movement — can be attached to it without any further vote. That is the structural power: not authorship of any single exclusion, but authorship of the credential inside which every future exclusion becomes a configuration change rather than a new law. The wallet is engineered for selective disclosure — prove you are over 18 without revealing your birthday — and that engineering is real. What the engineering cannot remove is the property that made identity the load-bearing component in the first place: the issuer that can turn a credential on can turn it off, and the relying party that must accept it can be required to demand it.

Mandate & Origin

eIDAS 2.0 is Regulation (EU) 2024/1183, which amended the original 2014 eIDAS regulation and entered into force on 20 May 2024. Its central instrument is the European Digital Identity Wallet (EUDI Wallet). The architecture, from the regulation and the Commission’s own pages:

• Universal provision: every member state must make at least one compliant EUDI Wallet available to citizens, residents, and businesses by the end of 2026 — the commonly cited hard deadline is 31 December 2026, with production launches clustering in Q4 2026.
• Mandatory acceptance: regulated relying parties — including banks, for strong customer authentication — must accept the wallet by late 2027, and the Commission targets 80% adoption by 2030.
• Free legal e-signature: personal-capacity users can e-sign with legal validity free of charge.
• Selective disclosure: the wallet is specified to release only the attributes a service actually needs, with attestations designed to be non-correlatable across services.
• Piloting: large-scale pilots ran through 2025 (two additional pilots began autumn 2025 after the original four concluded), with certification activity slated across Q1–Q3 2026 ahead of the production deadline.

Funding & Backers

The framework is a European Commission programme, built out through the Digital Europe Programme and the Connecting Europe Facility, with the member states delivering the national wallets that implement it — France’s France Identité, Spain’s Cartera Digital, Italy’s IT Wallet in the IO app, Denmark’s MitID, and their counterparts. The backing is therefore public and continental: the issuer is the state, in twenty-seven variants, coordinated by a supranational regulator that sets the common technical framework the national wallets must certify against.

Running ahead of the full wallet, the Commission released an age-verification “mini-wallet” in July 2025 — built on the same technical specifications as the EUDI Wallet, and explicitly described as a stepping stone to the end-2026 rollout. It is piloting in France, Spain, Italy, Denmark, and Greece, integrating with those national wallets. The mini-wallet is the on-ramp: a citizen learns to present a state-issued attestation to access ordinary online services under the “protect minors” framing, on the identical stack that will later carry the full identity credential.

The money, in the Commission’s own records. The Commission’s news item of 23 May 2023 says: “The European Commission is investing €46 million from the Digital Europe Programme” in four large-scale pilots, “co-financed by the Commission at 50%.” The four are POTENTIAL, “coordinated by Germany and France with the involvement of 17 Member States and Ukraine,” whose use cases are access to government services, opening of a bank account, registration for a SIM card, mobile driving licence, eSignatures and ePrescriptions; EWC, “coordinated by Sweden with the involvement of 18 Member States and Ukraine,” covering “The storage and display of digital travel credentials,” the organisation of digital wallets and the organisation of payments; NOBID, “coordinated by Norway with the involvement of 8 Member States and EEA countries,” on a single use case, “the authorisation of payments for products and services by the wallet user”; and DC4EU, “co-ordinated by Spain with the involvement of 23 Member States and Ukraine,” for “the educational sector and the social security domain” (European Commission: EU Digital Identity, 4 projects launched to test the EUDI Wallet, 23 May 2023). POTENTIAL’s own site gives its footprint as “19 European Member States and Ukraine” and “140+ public and private partners,” and says it is one of four pilots “building prototypes and testing everyday use cases” of the wallets (POTENTIAL); NOBID’s site says “The NOBID Consortium focuses on domestic and cross-border payments” under the Digital Europe Programme (NOBID). The pilot money is therefore public, matched fifty-fifty, and spent in consortia that mix ministries and private partners; the payments and bank-account-opening use cases are where the wallet meets the financial wing profiled in BIS / CBDC Complex.

The national wallets, from the governments’ own pages. Denmark: the Agency for Digital Government’s release of 3 June 2026 says “AltID, Danmarks nye officielle app til ID og beviser, kan downloades nu” (AltID, Denmark’s new official app for ID and credentials, can be downloaded now) and “AltID indeholder to beviser: et aldersbevis og et legitimationskort” (it holds two credentials, an age credential and an identity-card credential) (Digitaliseringsstyrelsen: Nu kan du downloade AltID). Germany: the federal digital ministry’s wallet page says the wallet, named d-you, is offered “kostenfrei und freiwillig zur Verfügung” (free and voluntary), that the first stage starts on 2 January 2027 with around 40 partners, that SPRIND works on it “gemeinsam mit dem Bundesamt für Sicherheit in der Informationstechnik (BSI)” and with “der Bundesdruckerei GmbH, Fraunhofer AISEC, PwC Deutschland sowie Meiré und Meiré,” and that alternative providers may be certified “rund zwölf Monate nach Einführung der staatlichen EUDI-Wallet” (about twelve months after the state wallet launches) (BMDS: EUDI-Wallet). Italy: AgID’s page says the decree-law of 2 March 2024 “istituisce ufficialmente il Sistema di portafoglio digitale italiano (IT-Wallet),” that the system consists of “un Wallet nazionale pubblico – accessibile tramite l’App IO,” and that “il sistema permette al settore privato di accreditarsi per sviluppare propri wallet commerciali” (the system lets the private sector be accredited to build its own commercial wallets), with AgID overseeing “il suo allineamento con i portafogli europei di identità digitale (EUDIW-IT)” (AgID: IT Wallet). Three states, three launch states: one wallet in the public’s hands, one dated for January 2027, one built into an existing app with a private-wallet lane.

Institutional Voice & Intent

The voice is the trust-and-convenience register — the grammar of “a trusted and secure European e-identity,” of interoperability, user control, and privacy by design. The statute speaks in the language of the citizen’s own benefit: one wallet, works everywhere, you choose what to share, the state cannot see where you use it. And the privacy engineering behind that grammar is not decorative — selective disclosure and non-correlatable attestations are specified in the framework, and the age-verification mini-wallet demonstrates them: prove you are over 18 without handing the service your identity. On its face this is the strongest privacy posture any state identity system has offered.

Stated intent: Give every European a single, secure, cross-border digital identity under the user’s own control; enable interoperability across twenty-seven member states; let citizens prove exactly what a service needs and nothing more; end the patchwork of incompatible national schemes.

Observed intent: Enroll the continent into one verifiable identity credential that regulated services are obliged to accept, on a fixed deadline; establish the identity layer onto which every other grid capability — payments, benefits, content access, movement — can later be attached without a new statute; and set the common technical standard other jurisdictions read against.

Gap: The stated and observed intents overlap wherever “one wallet under your control” describes the convenience it genuinely delivers. The gap opens at the two properties the privacy engineering cannot remove. First, linkability by design at the issuer: selective disclosure limits what a relying party learns, but the wallet is still a single state-issued credential, and the roster of where mandatory acceptance applies expands by regulation, not by consent — the age-verification mini-wallet already normalizes presenting a state attestation to reach ordinary services. Second, the browser-trust clause (below), where the mechanism required for cross-border interoperability is, by the cybersecurity community’s reading, the same mechanism required for mass interception. Nothing in the wallet’s rollout was imposed at gunpoint; each enrollment is offered as a service the citizen asked for. That is the point of building the identity layer as a convenience with a deadline rather than a mandate with a backlash.

The Commission’s own words on the same question. The Commission’s wallet home page says the wallets provide “a safe, reliable, and private means of digital identification for everyone in Europe” (European Commission: EU Digital Identity Wallet Home). Its regulation page says the Regulation “establishing the European Digital Identity Framework has entered into force,” that the framework “mandates Member States to provide EU Digital Identity (eID) Wallets to citizens by the end of 2026,” that the service providers legally obliged to identify their customers “will be obliged to accept the wallet for authentication,” and that “Creating qualified eSignatures for non-professional use will be free” (European Commission: EUDI Regulation). The sharpest statement is a letter. On 22 May 2026 the Commission’s acting Director for Cybersecurity and Trust replied to a civil-society open letter of 10 March 2026 on “the fourth batch of implementing acts,” and wrote that the obligation under Article 5f(3) “requires very large online platforms to accept and facilitate the use of the wallet for user authentication upon the voluntary request of the user, and in respect of the minimum data necessary for the specific online service”; that Article 5b(9) “requires that relying parties shall not refuse the use of pseudonyms where identification of the user is not required by Union or national law”; that Article 5a(16) “requires the technical framework of the wallet not to allow tracking, linking or correlating of transactions or user behaviour”; and that the Commission shares the objective to “ensure that users remain in full control of their data.” The same letter records that the revised implementing act makes “the portrait a mandatory instead of an optional part of the personal identification data,” and says “A portrait cannot, for example, be requested for simple age verification” (Commission reply Ares(2026)2594392, 22 May 2026, as published by the correspondent). That is the voice at full strength and in primary form: the acceptance duty is real, the privacy duty is real, and both are stated as law.

Interest: What each position the framework argues would pay, documented, with its own best case. The positions are the Regulation’s as the Commission states them; no individual is profiled here.

• Every Member State issues a wallet; regulated services and very large platforms accept it. Position: the framework “mandates Member States to provide EU Digital Identity (eID) Wallets to citizens by the end of 2026,” and acceptance is owed by service providers legally obliged to identify customers and, under Article 5f(3) as the Commission reads it, by very large online platforms “upon the voluntary request of the user.” What it pays: the issuing administrations, which become the source of the credential everyone else must read (Germany’s is delivered by SPRIND with the BSI and named private firms, above); and the regulated firms whose identification duty the credential can discharge, as POTENTIAL’s “opening of a bank account” and “registration for a SIM card” use cases show. Best case, the Commission’s: “a safe, reliable, and private means of digital identification for everyone in Europe,” used at the user’s own request. Convergence: the state identity agencies and the regulated banks and telecoms, which share an interest in one verified credential; the platforms bound by the DSA, which would carry a second duty from the same Commission.
• Browsers must recognise qualified website certificates listed by Member States (Article 45). Position: the Regulation’s text, as the signatories read it, “enables each EU member state (and recognised third party countries) to designate cryptographic keys for which trust is mandatory; this trust can only be withdrawn with the government’s permission (Article 45a(4)).” What it pays: the Member States that designate the keys, and the trust service providers they list; the letter names no provider. Best case, the EU’s: interoperability for the wallet, stated at full strength in Actions & Leadership Choices below. Convergence: the browser vendors sit on the other side, and Mozilla’s November 2024 account says “these safeguards now need to be technically implemented to protect EU citizens from potential exposure.”
• Unlinkability and selective disclosure by law. Position: Article 5a(16), per the Commission, bars “tracking, linking or correlating of transactions or user behaviour.” What it pays: no revenue is documented to anyone; the property is the justification for the acceptance duties above, since a mandatory credential needs a privacy case. Best case, the Commission’s: users “remain in full control of their data.” The criticism, from the signatories’ letter of 2 November 2023 on the near-final text: “the legislation still allows relying parties like governments and service providers to unnecessarily link together and gain full knowledge about the uses of credentials,” and Article 6a(7a)(b) “should ‘mandate’ instead of ’enable’ that interactions cannot be linked by relying parties or other actors.” Convergence: the Commission and its critics both name unlinkability as the test; they disagree about whether the text meets it.
• A mandatory portrait in the person identification data. Position: the Commission’s reply makes the portrait mandatory so “all wallets can support use cases in which strong assurance about the identity of the presenting person is genuinely needed without creating fragmentation across Member States.” What it pays: relying parties that must verify a face against a credential, banks above all. Best case, the Commission’s: the portrait is shown only where requested and approved, and cannot be requested for simple age verification. Convergence: Denmark’s launch credentials include an identity card alongside an age credential, which shows both lanes in one app.

Interest is a documented fact about each position, not a claim about motive, and not a verdict that the argument is wrong. Each best case is stated at the strength its author states it.

Position in the Apparatus

eIDAS 2.0 is the identity component of the European wing of the apparatus this file documents, and it sits directly beside the two statutes already on file. The EU Digital Services Act is the content-control rulebook; the EU AI Act is the model-control rulebook; eIDAS 2.0 is the identity rulebook — and the age-verification mini-wallet is where they meet, because it was released alongside DSA Article 28(1) guidance for very large platforms and is built to gate content by verified attribute. Identity is upstream of both: a content regime and a model regime both become far more enforceable once every user is a verified credential rather than an anonymous session. Where the American identity apparatus is a fragmented assembly — the watchlists, Clearview’s scraped index, the state-by-state age-verification wave — the EU is building the single credential by statute, on a deadline, with mandatory acceptance. The framework is the template other jurisdictions read against; the UK’s post-BritCard retreat left the underlying identity layer building regardless, and the direction of travel is the same one.

The specification and the code, in the open. The wallet’s technical rulebook is public. The Architecture and Reference Framework repository describes itself as “the common technical specification for the Wallet and its ecosystem,” and the project’s GitHub organisation is the “Official GitHub Organization of the European Digital Identity project” (eu-digital-identity-wallet: Architecture and Reference Framework; eu-digital-identity-wallet organisation). The Commission’s age-verification release says the blueprint “is built on the same technical specifications as the forthcoming European Digital Identity Wallets (EUDIW),” that it is “providing a stepping stone toward the rollout of the EUDIW before the end of 2026,” that “Denmark, France, Greece, Italy and Spain will be the first to take up the technical solution,” and that the specifications “are in line with the requirements referred to in the Guidelines on Article 28 of the DSA” (European Commission: age-verification blueprint, 14 Jul 2025). Denmark’s AltID, which launched with an age credential and an identity-card credential, is that sequence completed in one app.

Where the wallet meets money. The financial wing is on file at BIS / CBDC Complex, and the two files share a counter rather than a mechanism. The digital euro is a regulation still in negotiation in Parliament and Council, which that file records from Parliament’s procedure file and the ECB’s page (“the digital euro could be issued during 2029” if the regulation is adopted in 2026); the wallet’s Member State deadline falls at the end of 2026. The pilots on this page test payments authorisation (NOBID, EWC) and bank-account opening (POTENTIAL), and the Commission says service providers legally obliged to identify their customers will be obliged to accept the wallet, so a bank is where an identity credential and a monetary instrument would both be presented. This file asserts no technical dependency between the digital euro and the wallet; it records the adjacency, and leaves the instrument’s own terms to the file that covers it.

Actions & Leadership Choices

Founding purpose, judged on evidence. eIDAS 2.0 answered real friction — twenty-seven incompatible national identity schemes, no cross-border way to prove who you are online, and a private-platform identity layer (log in with Google, log in with Facebook) that the EU had no wish to depend on. As interoperability it is genuine, and the privacy engineering is the strongest a state identity system has shipped. The deeds below are weighed against that genuine purpose, not against a bad-faith prior — and the load-bearing conduct is a single, documented technical fight.

The Article 45 controversy, where the conduct shows. The framework’s most-contested clause is Article 45, which governs the browser trust of Qualified Website Authentication Certificates (QWACs) issued under member-state trust lists. On the cybersecurity community’s reading, Article 45 constrains browsers — Chrome, Firefox, Safari, all of them — from enforcing their own security requirements against a government-designated certificate authority: if a member state issues a certificate for a site, the browser must trust it, and the padlock shows as though nothing is wrong. That is the ordinary technical description of a man-in-the-middle capability. Some 400 cybersecurity experts and NGOs joined Mozilla in an open letter (November 2023) warning the clause would let any member state intercept any EU citizen’s encrypted traffic — following an earlier Mozilla/EFF letter signed by 38 experts; a separate scientists’ open letter reached 552 signatories from 42 countries (as of late November 2023). The EU’s position, stated at full strength, is that Article 45 is about interoperability for the digital identity wallet, not surveillance. The cybersecurity community’s answer, also at full strength: the mechanism required for the interoperability and the mechanism required for the interception are identical, and you cannot build the one without enabling the other. The litigation here is technical, not judicial, and it is not resolved — Mozilla’s November 2024 account of the negotiated safeguards is the record of a compromise, not of the objection being withdrawn.

The Article 45 objection, in the signatories’ own words. The scientists’ and NGOs’ joint statement is dated 2 November 2023, addressed to the Members of the European Parliament and the Member States of the Council, and written about “the near-final text” agreed at technical level in trilogue. Its operative paragraph: “the regulation enables each EU member state (and recognised third party countries) to designate cryptographic keys for which trust is mandatory; this trust can only be withdrawn with the government’s permission (Article 45a(4)). This means any EU member state or third party country, acting alone, is capable of intercepting the web traffic of any EU citizen and there is no effective recourse.” A second paragraph: “Article 45 also bans security checks on EU web certificates unless expressly permitted by regulation,” which the signatories call “an upper bound on the security measures.” The cover page of the published letter records that “the letter has been signed by 504 scientists and researchers from 39 countries, as well as numerous NGOs” as of 8 November 2023 (Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform, 2 November 2023). The same letter objects on a second front that this file’s Gap paragraph names: “the legislation still allows relying parties like governments and service providers to unnecessarily link together and gain full knowledge about the uses of credentials.” Mozilla’s November 2024 post, from the browser side, says “cryptographic keys under government control can be used to intercept encrypted web traffic across the EU” of the 2021 proposal, and that “these safeguards now need to be technically implemented to protect EU citizens from potential exposure” (Mozilla net policy: Behind the scenes of eIDAS, 7 Nov 2024). The letter is addressed to legislators, and the Commission’s answer to the later implementing-act objections is quoted under Institutional Voice above; the Article 45 text itself is not among the documents the Commission’s 2026 reply addresses.

The stepping-stone, on the record. The clearest action is the sequence. In July 2025 the Commission released the age-verification mini-wallet — the same technical stack as the full EUDI Wallet — under the child-protection framing, and put it into pilot in five states before the identity wallet itself was mandatory. The capability to present a state-issued attestation to access an ordinary service was normalized first, on the palatable ground, ahead of the deadline that makes the full credential universal. Nothing in that sequence was unlawful or hidden; the Commission described the mini-wallet as a stepping stone in its own release. The recurring lesson of this file’s drawer, in identity form: the capability is built first on the easy case, the category it serves expands later, and a framework never resigns.

CONDUCT verdict: FRAMEWORK-INSTRUMENT — PRIVACY BY DESIGN ON PAPER, THE LINKABLE KEY BY CAPABILITY. A genuine interoperability framework with the strongest privacy engineering a state identity system has offered, whose load-bearing property is nonetheless that it enrolls a continent into one issuer-held credential that regulated services are obliged to accept — and whose one documented technical fight, Article 45, is precisely the argument over whether the plumbing for cross-border trust is separable from the plumbing for interception. The privacy is real. So is the key.

Alliance Map

These run at the same time. One framework is funded from the EU budget at fifty percent through pilots that include a non-member government, is delivered by three administrations with three different private-sector arrangements (a state-agency-and-contractor team in Germany, a public wallet inside an existing app with an accreditation lane for private wallets in Italy, a state app that launched with two credentials in Denmark), and is defended in the same breath by the Commission as privacy engineering and as a mandate. The overlap is the finding, not a coordination claim.

Reach Assessment

Institutional: Maximum within its class. eIDAS 2.0 is the identity template of the democratic world’s digital-identity architecture — statutory, deadlined, and mandatory-acceptance where other schemes are voluntary or fragmented. It sits beneath the DSA and the AI Act as the component both grow more enforceable against.

Memetic: High. “Digital identity wallet,” “selective disclosure,” “trusted acceptance” become the vocabulary other jurisdictions conduct their own identity debates in — the same Brussels-Effect mechanism the DSA runs on, in identity form: build one wallet for the largest regulated market and the standard travels.

Civilizational: High. The framework does not build AI systems and does not write their refusals. It builds the credential that everything else on the grid can be hung off — payments, content, benefits, movement — on a continent-wide deadline, and it fought its one open technical battle over whether the trust plumbing that makes the credential portable is separable from the plumbing that makes any citizen’s traffic interceptable. Identity is the component you enroll into once. There is no delete button, and the issuer keeps the key.

Score basis. Atk 9 is reach: the Commission’s regulation page says the framework “mandates Member States to provide EU Digital Identity (eID) Wallets to citizens by the end of 2026” and that service providers legally obliged to identify their customers “will be obliged to accept the wallet for authentication,” and its reply of 22 May 2026 says the Article 5f(3) duty “requires very large online platforms to accept and facilitate the use of the wallet” (European Commission: EUDI Regulation; Commission reply Ares(2026)2594392). It is not a 10: use by the individual is voluntary (“upon the voluntary request of the user”; Germany’s wallet is “kostenfrei und freiwillig”), and enforcement is by the Member States rather than by a fining office of the Commission’s own. Def 9 is funding insulation: “The European Commission is investing €46 million from the Digital Europe Programme” in the four pilots, “co-financed by the Commission at 50%,” the qualified eSignature for non-professional use “will be free,” and no relying party pays to be obliged (European Commission: 4 projects launched). It is not a 10 because the national wallets are funded and delivered by twenty-seven administrations, not by one balance sheet that answers to nobody it grades. Hp 8 is entrenchment: a Regulation in force since 20 May 2024 changeable only by the co-legislators, Italy’s decree-law of 2 March 2024 that “istituisce ufficialmente” its wallet, Denmark’s AltID downloadable since 3 June 2026, and a public specification repository (AgID: IT Wallet; Digitaliseringsstyrelsen); it is not a 9 because the end-2026 deadline has not yet passed, Germany’s first public stage is dated 2 January 2027, and acceptance duties for the regulated sectors come after that. Peers on the same values: Frontier Model Forum at 9/9/8, hazard 82, shares all three components; the wallet’s reach is a statutory obligation on named classes of firm where the Forum’s is membership and convening, and the unit’s hazard differs on the separate conduct and threat reading, not on these three numbers. EU Digital Services Act at 9/9/9, hazard 88, shares atk and def and sits a point higher on hp because its enforcement has already produced fines and a court ruling, which this framework has not yet had. The values hold.

Sources: European Commission — European Digital Identity (EUDI) Regulation; Regulation (EU) 2024/1183 — EUR-Lex; Establishment of the European Digital Identity Framework — EUR-Lex summary; EU Digital Identity Wallet Home — European Commission digital-building-blocks; eIDAS 2.0 Sets a Dangerous Precedent for Web Security — EFF; Mozilla, EFF and cybersecurity experts publish letter on the dangers of Article 45.2 — Mozilla; Europe prepares to break browser security with new law — The Register, 8 Nov 2023; Behind the scenes of eIDAS: a look at Article 45 and its implications — Mozilla net policy, Nov 2024; Commission makes available an age-verification blueprint (14 Jul 2025) — European Commission; EU moves forward on age verification with release of guidelines, software — Biometric Update, Jul 2025; European Commission: EU Digital Identity, 4 projects launched to test the EUDI Wallet (23 May 2023); Commission reply Ares(2026)2594392 (22 May 2026); Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform (2 Nov 2023); eu-digital-identity-wallet: Architecture and Reference Framework; eu-digital-identity-wallet on GitHub; POTENTIAL; NOBID; Digitaliseringsstyrelsen: Nu kan du downloade AltID (3 Jun 2026); BMDS: EUDI-Wallet (d-you); AgID: IT Wallet; BIS / CBDC Complex — profile.