Preparing for the Nordic EUDI wallet rollout: crucial compliance timelines and your questions answered

Mandatory acceptance is determined by your industry and your current legal or contractual obligations. Under eIDAS 2.0, there are three main groups required to accept the EUDI wallet:

• Public sector services: Mandatory from the official launch of the wallets in December 2026.
• Very large online platforms: Any online platform with more than 45 million monthly active users in the EU must accept the wallet from December 2026 if they require user authentication.
• Regulated private industries: If you operate in banking, finance, transport, energy, health, telecom, or digital infrastructure, and you are already required by law or contract to use strong customer authentication, you must accept the EUDI wallet as an option by December 2027.

No, and attempting to do so would introduce immense technical complexity and cost. Intermediaries like Signicat exist specifically to solve this problem. By integrating with Signicat’s eID and Wallet Hub, your business gains access to all certified national and commercial wallets across Europe through a single, unified API. Signicat maintains and updates the technical integration, takes care of the verification of the trust relationships on behalf of the Relying Party and helps our customers to register as Relying Party. Each Relying Party needs to be registered in the national register of the Member State their are established in. Such registration includes the intended use of the EUDI Wallet in their procedures. 

The EUDI wallet is designed to operate at the highest level of security (level of assurance high) and is significantly more secure than physical documents or legacy eID systems. Its security does not rely on trying to spot whether a user's face is a deepfake or if their phone is compromised. Instead, trust is anchored in robust cryptographic verification. The wallet utilises secure hardware on the user's device, (Trusted Execution Environments - such as iOS Secure Enclave) to store cryptographic keys, which means credentials cannot be duplicated, copied, or intercepted. If a wallet provider or issuer is compromised, robust revocation protocols are built directly into the framework to instantly cancel and update active credentials. 

The physical application process is a Swedish national implementation choice for Sverige-id, which is linked directly to the national ID card. Other EU member states are free to use different onboarding methods as long as they meet the level of assurance (LoA) high requirements. This means a physical, in-person application to issue PID is not mandated by EU law and does not have to remain the only model in Sweden in the future.

No. While the baseline is harmonised under EU-wide standards (specifically eIDAS 2.0 and the architecture and reference framework), they are not identical in every member state.

Although the revised eIDAS Regulation mandates that all EUDI Wallets must conform to a single, unified technical standard (the Architecture and Reference Framework) so they are globally interoperable, the user experience, implementation models, and functional breadth will vary significantly from country to country.

Because the EU has left key architectural, organisational, and operational decisions to individual Member States, several prominent differences will emerge as wallets roll out.
 

• The common baseline: All member states must issue the EUDI wallet free of charge to their citizens and residents. The wallet must contain the mandatory harmonised person identification data (PID) attributes (like legal name, date of birth, place of birth and nationality).
• National discrepancies: Differences exist in onboarding and eligibility rules (how states verify citizenship or residency), issuance ecosystems (some use a state-developed app, others certify private providers), and supplementary attestations (the availability of digital driving licences, diplomas, etc., varies by country).

Users will not have to select from a list of over 30 different national wallets. For web-based flows, the service can present a single QR code that the user scans with their preferred EUDI wallet to authenticate and present their PID. In a same-device flow, selecting "EUDI wallet" will trigger their preferred wallet app directly. The goal is a wallet-neutral entry point, where the device or wallet discovery mechanism handles the selection under the hood. Signicat’s setup allows you to manage this experience seamlessly.

Signicat will continue supporting established electronic identities like Auðkenni alongside the new EUDI wallets. National eIDs and wallets will coexist, allowing users to transition at their own pace. Nobody will be forced to use the EUDI wallet, meaning domestic identity solutions remain crucial.

EUDI wallets are primarily designed for citizens and residents accessing services within the EU/EEA. For business entities acting as "Relying Parties" (who accept the wallet), they must currently register in the member state where they are established. This means organisations outside the EU/EEA without a European establishment cannot simply register directly as a relying party under the current model.

If your organisation is subject to mandatory acceptance (such as public sector, Very large online platforms, or regulated industries), you must support EUDI wallets regardless of initial adoption levels. The broader EU goal is to create a common identity layer across Europe to allow secure cross-border transactions. Rather than creating friction, it will ultimately reduce it by letting organisations reuse trusted, verified identity data across borders instead of relying on fragmented, country-specific eID onboarding.

• Regulated industries: These include sectors such as banking, finance, health, transport, energy, telecom, and digital infrastructure. EUDI wallet acceptance is mandatory for these private services where strong customer authentication for online identification is already required by law or contractual obligation (effective December 2027).
• Very large online platforms: These are platforms defined under the Digital Services Act (DSA) with more than 45 million monthly active users in the EU. If a VLOP requires user authentication, it must accept the EUDI wallet as an option, effective from the launch of the wallets (December 2026).

The primary focus of the eIDAS 2.0 regulation is on digital use cases and online services. While the wallet will support in-person ("proximity") use cases, such as showing an ID in a shop, the mandatory acceptance rules primarily apply to online authentication, especially for regulated services.

Yes, EUDI authentication supports both online and in-person (onsite/proximity) verification. However, mandatory acceptance rules are focused on digital, online services.

The European Commission has published use case manuals and technical specifications for standard use cases like identity verification, signing, and age verification (available on the EC digital building blocks portal). Beyond these, many more use cases can be supported depending on which verifiable credentials (attestations) are issued. For an attestation to be available, the data owner must choose to make it available in the wallet. 

There will not be a single centralised global database. Instead, registries will be distributed across EU member states and coordinated through a federated EU trust scheme, utilising trust lists and trust anchors.

Security is a fundamental cornerstone of the eIDAS 2.0 regulation. Unlike previous frameworks, EUDI wallets must be certified to meet high security standards (based on ENISA schemes) and will employ state-of-the-art measures like end-to-end encryption and secure hardware. The framework is built with a "security by design" approach, and tested in large-scale pilots.

The EUDI wallet is designed to be significantly more difficult to counterfeit than physical documents. Physical IDs can be visually duplicated or altered. In contrast, digital credentials in the wallet rely on cryptographic security, secure hardware storage on the device, and real-time verification protocols. This means a digital credential’s authenticity is cryptographically verified and cannot be simply copied or visually faked. To support the reliability of the EUDI Wallet, a trust framework is in place where all actors can be verified and authorisation and attestations can be revoked.

EUDI authentication is extremely strong, based on multifactor authentication, operating at level of assurance (LoA) high. It utilises cryptographic verification and secure hardware on the user's device, making it cryptographically tied to the user and virtually impossible to duplicate, which offers a higher degree of real-time security than a static, physical passport.

The EUDI wallet framework includes robust revocation mechanisms for wallet instances, credentials, and certificates. If trust can no longer be guaranteed, affected instances or credentials will be revoked, and users will be immediately informed.

While AI makes attacks like deepfakes and phishing more sophisticated, the EUDI wallet’s security does not rely on trying to detect whether something is AI-generated. Instead, trust is anchored in cryptographic verification of identities, credentials, and trusted parties across multiple security layers, including secure hardware protection of keys.

Under eIDAS 2.0, the wallet must include a mandatory harmonised set of person identification data (PID). This typically includes the holder's full legal name, date of birth, place of birth and nationality.

Not exactly. The PID (person identification data) is a specific standardised, government-signed dataset containing core identity attributes (name, date of birth, nationality). Onboarding to the wallet involves issuing this PID credential into the wallet application, which then acts as your secure eID.

Wallet onboarding is specifically the issuance of a standardised, government-signed verifiable credential, known as the PID, directly into the wallet application. While countries already hold citizen identity data, this process puts that data into the secure, interoperable wallet format.

Member States can choose to inclue the national identification number in the PID they issue; the so called ‘personal administrative number’ is an optional part of the PID. Since some Member States do not allow the use or storage of their ‘personal administrative number’, the concept of ‘pseudonyms’ has been introduced to the EUDI Wallet. The generation of  Relying Party specific pseudonyms should enable wallet users to authenticate themselves without providing Relying Parties with unnecessary information.  

Yes, salaries, income statements, and mortgage-related information can be issued to the wallet as electronic attestations of attributes. While member states have some discretion over which credentials they prioritise in their national ecosystems, certain credentials are governed by separate EU legislation. For example, under the new EU driving licence directive, mobile driving licences must be issued in a format compatible with EUDI wallets, eventually becoming the default format across the EU.

Yes, absolutely. Proving cross-border business identity, representation, and who holds legal power of attorney or procuration is a core commercial use case under eIDAS 2.0. In addition to individuals presenting these proofs, the framework supports business/enterprise wallets specifically designed for organisations.

The EUDI Wallet for organisations is called “European Business Wallet’. Business Wallets can be used by organisations to receive verifications from users (with their natural person EUDI Wallet). A person with a power of attorney to represent an organisation can proof this to the Business Wallet of another organisation.

Yes, and this is exactly the role that intermediaries like Signicat play. Instead of integrating with dozens of national wallet apps and identity sources individually, businesses can use a single integration through Signicat’s eID and Wallet Hub to connect to all certified wallets.

The eIDAS trust framework is still in active development, meaning national wallets are not available, not yet certified and formal trust lists do not exist. However, because Denmark's official app for ID and credentials, AltID (launched in June 2026), is based on the technical standards of the EUDI wallet, Signicat is actively working on making AltID available through the Signicat eID and wallet hub to ensure early readiness.