Mandatory EUDI Wallet: What Citizens, Public Authorities and Businesses Need to Know (II)

Having explored what the EUDI Wallet, or European Digital Identity Wallet, is, how it will work and what it means for citizens, public authorities and businesses in our previous article, the next step is to understand how this transformation can be put into practice in real-world services. The adoption of European digital identity will depend not only on the availability of a digital wallet, but also on the ability to integrate it securely, interoperably and effectively into public-sector procedures, business processes and data spaces. Initiatives such as TrustED are essential to facilitating this transition towards a more trustworthy and sovereign European digital ecosystem, aligned with eIDAS2, the GDPR and emerging approaches to identity management and verifiable credentials.

Obligations for Public Authorities (2026)

As Member States roll out EUDI Wallets, with a deadline at the end of 2026, public authorities will need to be ready to accept them whenever electronic identification and authentication are required to access online public services.

Immediate use cases:

• Social security access: Consulting medical records or applying for the European Health Insurance Card.
• Tax procedures: Filing tax returns and accessing official notifications.
• Education: Enrolling at universities in other EU countries through instant verification of academic qualifications stored in the wallet.
• Municipal services: Registering as a resident or applying for building permits entirely online.

For public authorities, the central challenge in adopting the EUDI Wallet is not simply to “issue” or “have” a wallet, but to accept it and integrate it operationally into real-world services while ensuring interoperability. This entails adapting portals and back-end systems to support the common protocols and interfaces through which wallets enable identification and the presentation of citizens’ electronic attestations of attributes. Authorities must also ensure that validation and audit processes work in cross-border scenarios.

From a security and compliance perspective, processes must be aligned with the required level of assurance and with support, revocation and incident-management mechanisms. Organisationally, identity, cybersecurity, legal and data-protection teams must coordinate to ensure that acceptance of the European wallet is robust, measurable and sustainable. This is particularly relevant because, where a public service requires electronic identification or authentication for an online service, the regulatory framework establishes an obligation to accept compliant wallets.entificación/autenticación electrónica para un servicio online, el marco establece la obligación de aceptar wallets conformes.

Obligations for Large Businesses (2027)

Although businesses subject to mandatory wallet acceptance have until December 2027, most are already beginning preparations. The obligation will primarily affect:

• Critical sectors: Banking and financial services (KYC/AML compliance), transport (flights and vehicle hire), energy, healthcare and telecommunications.
• Very Large Online Platforms (VLOPs): Social networks and e-commerce platforms covered by Article 33 of the Digital Services Act that require user authentication.

This implementation also offers business benefits, as the EUDI Wallet can act as a catalyst for efficiency. It can substantially reduce customer onboarding costs by automating identity verification, lower the risk of fraud and identity theft, and simplify cross-border contract signing without paperwork.

Nevertheless, EUDI Wallet adoption also presents several challenges: the private sector must combine regulatory compliance, technical integration and fraud prevention. The acceptance obligation applies to relevant regulated private relying parties, such as banks, where strong user authentication is legally or contractually required in certain areas, no later than 36 months after the relevant implementing acts enter into force.

Although acceptance applies “only at the user’s request”, in practice this requires businesses to prepare integrations with IAM/KYC systems to verify identities and attributes in a standardised way, strengthen security and anti-fraud controls, and redesign onboarding processes to benefit from automated verification without retaining more data than necessary.

At organisational level, it also requires coordination between departments such as business, risk, security and legal to define policies for acceptance, traceability, support and user experience. The real impact is not merely technical: it also affects processes and operational responsibility.

TrustED and Gradiant: Facilitating the Transition

TrustED is a European initiative aimed at enabling trustworthy and scalable services in data spaces through a combination of self-sovereign identity (SSI) management and privacy-enhancing technologies (PETs). In practice, TrustED develops components and methods that help organisations integrate identification and attributes interoperably, with stronger safeguards. Its explicit aim is to design solutions that go beyond benchmark requirements associated with the GDPR, eIDAS2 and the EUDI Wallet ecosystem.

How Does It Work?

TrustED combines two principal technological approaches within the emerging European digital identity frameworks, focusing on the relationship between the EUDI Wallet ecosystem and data spaces: two key pillars of secure, interoperable and sovereign information management.

First, the initiative is developing an EUDI Wallet-based system for issuing and verifying electronic attestations of attributes in line with applicable standards. The solution includes capabilities that could in future be undertaken by Person Identification Data (PID) providers, such as AI-assisted document and biometric verification for remote onboarding, alongside capabilities applicable to all types of issuers, including selective disclosure mechanisms (with approaches based on zero-knowledge proofs, or ZKPs) and dynamic credential revocation.

Second, TrustED seeks to align the European Business Wallet (EBW) initiative with leading data-space initiatives. This approach goes beyond individual identity in the EUDI ecosystem: TrustED envisages the EBW incorporating the Decentralized Claims Protocol (DCP), enabling the management of the identities of organisations operating within data spaces.

In this way, TrustED connects digital identity and data spaces within a single technological framework, facilitating secure and trustworthy interactions for both individuals and organisations within complex digital ecosystems.

Use Cases

TrustED is validating its components through two use cases that bring the technology into real-world settings. The first uses the EUDI Wallet to manage verifiable citizen identity credentials, including Person Identification Data (PID), a biometric credential designed to strengthen the link between the person presenting a credential and its legitimate holder, and a volunteering credential: an electronic attestation of attributes that enables volunteers to verify their identity and volunteering status to any organisation.

The second use case focuses on the identities of organisations themselves and their authentication within a data space. Pilot phases and user involvement make it possible to test issuance, verification, selective disclosure and revocation in practice.

This project has received funding from the European Union’s Horizon Europe research and innovation programme under grant agreement No. 101168467