If you run a website or app that verifies age, identity, or qualifications for people in the EU, a new kind of login is arriving. eIDAS 2.0 (Regulation 2024/1183) requires every member state to offer at least one EU Digital Identity Wallet (EUDI Wallet) to its citizens and residents by the end of 2026.
What the wallet is
It is an app, issued under national schemes but built to common EU rules, where people can store identity data and credentials, such as an ID, a driving licence, or a diploma, and present them to services. It is free and voluntary for users, works across borders, and can also produce qualified electronic signatures.
The big idea: share less
Traditional checks ask for a scan of a passport. The wallet supports selective disclosure: the user chooses which attributes to share. A shop checking age can receive "over 18: yes" and not a date of birth, an address, or a document number. For site owners, that means less sensitive data to store, protect, and leak.
Who must accept it, and when
- End of 2026: member states must offer wallets. Public bodies that require electronic identification must accept them. The exact date varies in sources, from 20 November to 24 December 2026, depending on which legal act sets the 24-month countdown.
- End of 2027: private-sector organizations in regulated areas that must use strong user authentication, including banking, and very large online platforms under the Digital Services Act must accept the wallet when a user asks.
- Everyone else: may accept it voluntarily.
Having the legal deadline does not guarantee finished products in every country on day one. Practical availability depends on implementing acts, national rollouts, and pilots.
How to prepare
- Check whether you must accept it. Sector, size, and the services you offer decide. Ask your legal adviser or national authority.
- Decide the use case. Age check? Customer onboarding? Qualification checks? Pick one service to try first.
- Plan your verifier. The EU's reference framework builds on standards for credential issuance and presentation; look at your country's relying-party guidance and the Commission's technical documentation.
- Register as a relying party where your country requires it, so users can see who is asking for what.
- Ask for the minimum. Request only the attribute you need, and explain why. Data minimization is part of the design, and over-asking can be refused.
- Keep a fallback. Some users will not have a wallet for a while. Offer another route.
Security notes for developers
- Treat wallet responses like any untrusted input: verify signatures and the issuer's trust status before relying on a claim.
- Do not log full credentials. Store only the result you need, such as a pass or fail and a timestamp.
- Test with your national pilot or sandbox, not production data.
- Tell users what they are sharing, in plain language.
Why it matters even outside Europe
Sites based elsewhere that serve EU users may find customers asking for wallet sign-in, especially in finance and online platforms. The same design, prove one fact without handing over your whole identity, is spreading to other regions too.
Sources
- Regulation (EU) 2024/1183 (eIDAS 2.0) on EUR-Lex
- Kennedys: The European Digital Identity Framework
- Arthur Cox: The EU Digital Identity Wallet, what companies need to know
Overview as of November 5, 2026. Deadlines and national rollouts may change. This is not legal advice.