eIDAS 2.0 explained: what it means for your business

By the end of 2026, EU member states must provide citizens and businesses with access to a digital identity wallet. Organisations that issue or verify identity-related documents (from chambers of commerce to banks, insurers, and procurement platforms) will increasingly work with verifiable credentials instead of PDFs and email.

Early adopters gain a structural advantage: faster onboarding, lower fraud risk, automated compliance checks, and readiness for mandatory regulations before they take effect. Organisations that wait will face a compressed transition timeline with higher cost and disruption.

The first eIDAS regulation, Regulation (EU) No 910/2014, did two things. It made national electronic identity schemes recognisable across borders, so a login issued in one member state could open a public service in another. It also gave trust services such as electronic signatures, seals and time stamps a legal footing that held everywhere in the Union.

In practice the first half never really arrived. Notifying a national scheme was voluntary, so by the early 2020s a large share of Europeans had no notified electronic identity at all, and the schemes that did exist rarely worked outside their own country. Nothing obliged private organisations to accept them either, which left banks, telecom operators and platforms building identity checks of their own.

eIDAS 2.0, Regulation (EU) 2024/1183, keeps the trust services and rebuilds the identity half around the holder. Every member state must now offer a wallet rather than merely being allowed to notify a scheme, a defined group of private organisations must accept it, and verified facts about a person or a company become a trust service in their own right. The holder decides what is shared in each transaction, which is the shift that makes the rest work.

For a business the practical difference is the direction of travel. Under the old framework you chose whether to support electronic identity, and usually concluded it was not worth the effort. Under the new one the infrastructure arrives regardless, your counterparties get it for free, and the question becomes how quickly you can put it to use.

eIDAS 2.0 applies at two levels. Member states must build and operate the European Digital Identity Wallet infrastructure and make it available to citizens and businesses. Organisations that issue or verify identity-related documents, including chambers of commerce, banks, insurers, government agencies, and procurement platforms, need to be able to issue credentials into that wallet or accept credentials presented from it.

The rollout follows a fixed timeline. By the end of 2026, every EU member state must provide citizens and businesses with access to a digital identity wallet. Ahead of that date, organisations that issue or verify credentials are expected to have the technical capability to work with wallet-based credentials, since the demand from wallet holders arrives the moment the wallet itself becomes available.

In practice, preparing means three things: aligning credential formats with the standards the wallet is built on (W3C Verifiable Credentials, mdoc, OpenID4VC), connecting to a trust registry so issued credentials can be verified without contacting the issuer directly, and adopting a privacy-by-design architecture that keeps credentials in the holder's own wallet rather than in a shared register, and shares only the attributes a verifier needs. Organisations that start early avoid the compressed transition timeline, higher cost, and disruption that come with waiting until the deadline is close.

The headline obligation is the wallet itself. By 24 December 2026 every member state must offer at least one European Digital Identity Wallet, free of charge for natural persons, and make sure it works for citizens, residents and businesses. Public administrations must accept it from the same date, in their own country and for holders from any other member state.

Behind the wallet sits machinery that matters just as much to a business and attracts far less attention. Member states have to make sure person identification data can be issued into the wallet, and that authentic sources such as company registers, education registries and professional bodies can supply their data electronically. They also have to certify wallet solutions and publish which ones are approved.

Two of these deliverables are what a relying party depends on day to day. There has to be a way to check, free of charge, that a wallet presenting a credential is genuine and still valid. And there has to be a national register of relying parties, which is where your own organisation signs up before it may ask a wallet for anything at all.

Progress is uneven, so watch your own member state rather than the European average. The date is the same everywhere, but which authority runs the relying party register, how long registration takes, and which authentic sources are connected first are national decisions. Those are what determine when you can actually start.

Trust services are the part of eIDAS that most businesses already touch without naming it. They are what makes an electronic document or message carry legal weight: signing, sealing, time stamping, registered delivery, and now attesting to facts about a person or an organisation.

The word that matters is qualified. A qualified service comes from a provider that is supervised and published on a national trusted list, and it carries a legal presumption in every member state. A court starts from the assumption that the signature, seal or time stamp is what it claims to be, and whoever disputes it carries the burden of proof. A service that is not qualified can still be perfectly good evidence, but you have to prove it.

Trust services and the wallet are two halves of the same picture. The wallet is how a credential reaches the other party and how the holder chooses what to reveal, while the trust services are what make the contents hold up afterwards. Most organisations end up using several at once: a seal on what they issue, an attestation for the facts they can vouch for, and a signature wherever a person has to commit.

From 24 December 2027, accepting the European Digital Identity Wallet stops being optional for a large part of the private sector. The obligation follows the requirement to use strong user authentication, so it is the way you identify people that decides it, not the label on your industry.

The rule is easiest to read through examples. A bank already runs a strong check when someone opens an account or confirms a payment, so the wallet has to become one of the ways that check can be satisfied. A telecom operator verifying an identity before activating a subscription, an energy supplier switching a contract, and a health insurer registering a new member are all in the same position.

The same applies well beyond the obvious regulated names. A university enrolling students, a transport operator issuing a staff pass, a social security body paying benefits and a very large online platform signing users in all fall inside the obligation once they authenticate someone. If you already send people through a formal identity check online, assume you are in scope and work from there.

Two limits are worth keeping in mind. The obligation is triggered by the user, who asks to use their wallet rather than having it imposed on them, and it covers the identification step rather than the whole relationship. It is also not a licence to ask for more: you may only request the data your relying party registration covers, which in most cases is less than a scanned document would have given you.

Public administrations come first. Once wallets are available, which must happen by 24 December 2026, they must accept them wherever they already ask for electronic identification, in their own country and for citizens of other member states.

Micro and small enterprises are exempt from the acceptance obligation. Very large online platforms designated under the Digital Services Act are inside it wherever they authenticate users, although the regulation sets them no separate date.

If your organisation is on neither list, the practical question does not change. Every identity check you run today is a candidate for a credential presented from a wallet in seconds, with less fraud risk, no document handling, and no data you have to store and protect yourself.

The European Digital Identity Wallet is built around a person. That is the right shape for proving who is in front of you, and the wrong shape for most business to business processes, which turn on the organisation instead: which legal entity you are dealing with, who may act for it, and how far that authority goes.

eIDAS 2.0 already lets an organisation hold credentials and receive attestations about itself, so company data can move through a wallet today. What it does not settle is the administrative layer around that: mandates, powers of representation, filings, and the document exchange between companies and public bodies that still runs on portals and email.

On 19 November 2025 the European Commission proposed a separate regulation for the European Business Wallet to cover exactly that layer. It is still going through the legislative process, so there is no date to plan against yet, and nobody should be waiting for one before acting.

The useful preparation is not technical. Decide now who in your organisation owns company credentials and who may bind the company, because that is what any wallet will be asked to express. It usually takes longer to agree internally than the integration takes to build.

eIDAS 2.0 is supervised, not self-declared. Each member state designates a body that oversees qualified trust service providers and can withdraw qualified status, and a body that supervises the wallet providers operating in its territory. Data protection authorities keep their own role wherever personal data is involved, which on this subject is nearly everywhere.

Relying party registration is the part that touches ordinary businesses most directly. Because your registration states what you are allowed to ask a wallet for, asking for more is visible, reportable and something a supervisory body can act on. Member states must lay down penalties for breaches of the regulation and make them effective, proportionate and dissuasive, and the amounts are set nationally.

For most organisations, though, the first cost of being late is not a fine. It is a customer who can prove something in seconds being asked to upload a scan instead, a competitor onboarding that customer the same afternoon, and a procurement question you cannot answer well.

The second cost is timing. Everything on the checklist below has a lead time measured in months rather than weeks, and it all has to happen in the same window as everyone else. Starting early is mostly about not competing for scarce attention later.

Credenco's Business Wallet is designed from the ground up to meet eIDAS 2.0 requirements. It implements W3C Verifiable Credentials, OpenID4VC for credential issuance and presentation, and validates issuer trust against the EU's eIDAS trusted lists, ensuring every credential issued through Credenco carries the standards-based trust that the regulation demands.

Credentials are kept in each organisation's own wallet, not in a shared register, and holders disclose only the attributes a verifier needs. This privacy-by-design architecture is not a retrofit: it is a core design principle that aligns directly with both GDPR and the eIDAS 2.0 wallet requirements.