Electronic Identification, Authentication & Trust Services Regulation

You operate an online service that authenticates users or requests attributes from the EU Digital Identity Wallet. If your users log in with the wallet, share an age attestation, or sign a document through your platform, you're a relying party — and eIDAS 2.0 has some very specific opinions about how you do that.

Ihre Pflichten

• Register as a relying party with the Member State where you are established (Art. 5b) — unregistered parties cannot lawfully request wallet attributes
• Declare the intended use of each attribute request and what legal basis you rely on (Art. 5b(2)) — no fishing expeditions
• Apply data minimisation: only request attributes strictly necessary for the service (Art. 5b(2)(b)) — 'date of birth' should not mean 'full address plus tax ID'
• Do not combine attributes from the wallet with data from other sources to profile users (Art. 5b(3)) — cross-referencing is explicitly prohibited
• If you operate in an obligated sector (Art. 6a), accept the EUDI Wallet free of charge for user authentication once implementing acts are in force
• Display a clear, recognisable trust-mark when requesting wallet attributes (Art. 5b(5)) — users must know they are interacting with a registered party
• Log and retain the minimum information needed to prove your registration and legal basis (Art. 5b(4)) — audit trails, but with data minimisation

Wichtige Artikel

You build or operate a European Digital Identity Wallet on behalf of a Member State (or under notification from one). That's a short list — typically national eID authorities or designated public/private providers — but the obligations are intense, because you're operating the single most sensitive piece of identity infrastructure in the EU.

Ihre Pflichten

• Meet the functional requirements of Art. 5a — secure storage of attributes, selective disclosure, pseudonymous authentication, zero-knowledge proofs where applicable
• Obtain formal certification against the EUDI Toolbox ARF (Architecture and Reference Framework) — EU Commission Implementing Regulation 2024/2977 et seq.
• Ensure interoperability with wallets from other Member States (Art. 5a(5)) — your users must be able to authenticate cross-border
• Provide the wallet free of charge to all natural persons and, where appropriate, legal persons (Art. 5a(2))
• Do not retain transactional data or profile users (Art. 5a(4)) — the wallet provider must not see which relying parties a user interacts with
• Publish trust-marks, logos, and cryptographic verification data so relying parties can verify wallet presentations (Art. 5a(8))
• Report security incidents and fraud attempts to the supervisory authority (Art. 5e) — notification timelines set by implementing acts

Wichtige Artikel

You provide qualified or non-qualified trust services under eIDAS — electronic signatures, electronic seals, time stamps, electronic registered delivery, website authentication certificates, or electronic attestations of attributes. Qualified TSPs are on the EU Trusted List and their services carry a legal presumption of validity across the EU.

Ihre Pflichten

• Obtain and maintain qualified status via an annual conformity assessment by an accredited conformity assessment body (Art. 20–21)
• Implement technical and organisational measures proportionate to the risks (Art. 24.2) — including secure cryptographic key management
• Report security breaches and loss of integrity to the supervisory authority within 24 hours (Art. 19.2) — tighter than GDPR
• Maintain a recoverable record of issued certificates and their validity status (Art. 24.2(h)) — lifetime retention for qualified signatures
• Ensure certificates meet the technical standards in Annex I (signatures), III (seals), IV (website auth), V (attestations of attributes)
• Be listed on the national Trusted List of your Member State (Art. 22) — unlisted TSPs cannot claim qualified status
• Offer cross-border interoperable services — qualified signatures issued in one Member State are valid in all (Art. 25.3)

Wichtige Artikel

You're an EU citizen, resident, or legal person entitled to a free European Digital Identity Wallet. You can use it to log in to public and private online services, prove attributes about yourself (age, profession, driving licence), store official documents, and sign electronically — all with strong privacy guarantees.

Your Rights

• You have the right to a free EUDI Wallet issued by your Member State (Art. 5a(2))
• You control which attributes you share with each relying party — the wallet enforces selective disclosure (Art. 5a(4))
• You have the right to use the wallet to authenticate with any mandatory-acceptance service (Art. 6a) — banks, telcos, healthcare, etc.
• You have the right to pseudonymous authentication where the service does not legally require a real identity (Art. 5a(4)(h))
• Your wallet provider and relying parties cannot profile or track you (Art. 5a(4), Art. 5b(3))
• You can download your data and transfer to another wallet (interoperability, Art. 5a(5))
• You can lodge a complaint with your national supervisory authority if a relying party over-collects or a wallet misbehaves

Wichtige Artikel

Verfügbare Tools

• Relying party registration tracker — record your Art. 5b registration, attributes requested, and legal basis per flow
• Mandatory acceptance checker (Art. 6a) — sector classifier + deadline calculator based on implementing acts
• Attribute minimisation matrix — per-flow justification of each attribute request
• Wallet integration readiness — checklist covering ARF conformance, trust-mark placement, selective disclosure
• QTSP register — track your qualified trust services, conformity assessments, and Trusted List status
• Electronic signature policy templates — advanced vs qualified signatures (Art. 26 / 46 matrix)
• Breach notification playbook — 24-hour TSP notification flow (Art. 19.2), shorter than GDPR

KI-gestützte Funktionen

• AI Relying Party Assessment — 6-step wizard covering Art. 5b compliance, attribute minimisation, Art. 6a sector, and Art. 5b(3) no-combination policy
• AI Trust Service Provider Assessment — 5-step wizard covering Art. 19/24 obligations and Art. 26/46 signature gap analysis
• AI Attribute Minimisation Review — reviews your actual wallet requests and flags over-collection
• Semantic search across eIDAS 2.0 articles and implementing acts