A brIDge to eIDAS 2.0 compliance

The backstory

As with most things these days, it’s about a deadline. Or, in this case, two deadlines.

First, the backstory: the European Union identified some areas that needed updating in its previous regulation to its member nations about digital IDs. The existing regulation dated from 2014. Clearly times, technologies, and threats have changed.¹

That regulation, known as eIDAS, was debated over by the EU, and a newly updated regulation, eIDAS 2.0 – European Digital Identity Regulation (Regulation (EU) 2024/1183) – came into force in May 2024.² 

Its mission is clear: “Digital identification systems offered by governments in the EU before Regulation (EU) 2024/1183 (eIDAS 2.0) had several important shortcomings: they were not available to the whole population, they were often limited to online public services, and did not allow for seamless access cross-border.”³ eIDAS 2.0 provides the pathway to solving those issues with the European Digital Identity Wallet, or EUDIW, for the public and private sector. 

These wallets would be a secure and private means of seamless identification, allowing citizens to prove who they are no matter where they are in the EU, and giving them a place to “safely store, share, and sign important documents.”⁴ Among other use cases, enrollment in universities in other EU member states and opening bank accounts there would be made possible based on presentation of these wallets, without any need for physical documents.

All 27 member states of the EU are now required to make at least one digital identity wallet available to their citizens that will contain that citizen’s personal identification data (PID). The cutoff for that is the end of 2026.⁵ Further, relying parties in sectors identified as being important or critical by the EU – this includes organizations operating in banking, healthcare, education, and telecommunications – must accept these wallets by the end of 2027.⁶

A relying party, or verifier, is an entity that “relies” upon the information within the wallet to identify the user, to provide the service requested. In simple terms, any entity operating within a sector that requires strong customer authentication (SCA) under EU law will be required to accept such a wallet as proof of identification. Keep in mind that there will be at least 27 wallets, and there may well be more, as private entities might also decide to issue a certified EUDIW. That’s a lot of planning and implementation to get through before the deadline hits.

The end of 2027 is closer than you think

This ecosystem has fascinating ramifications for all involved. The potential to get involved at various stages and levels is huge. But all this opportunity comes with a certain level of jeopardy. 

“Be clear what your role is,” stressed Thilo von Bredow, Business Development & Financial Lead, Digital Identities, at G+D. “Are you a relying party, accepting credentials issued by other trusted entities? Are you a credential issuer, planning to monetize verified data by issuing verified credentials (VCs)? Or are you a wallet issuer, and thus the primary interface for your customer’s digital interactions across industries? The strategic role you envision for your organization impacts everything.” 

Once you know your role, you can get on with preparing for this change. Relying parties have a lot to get ready for. Raquel de Horna, Product & Marketing Lead, Digital Identity, at G+D, is clear about the state of preparation across industries. “Banks and other industries that require SCA aren’t really aware of just how much work is involved in preparing for this. That doesn’t include maintenance in case they decide to do it themselves!” 

There is a certain degree of complacence, von Bredow agreed, though he did point to a reason: “The EU is assuming there will be interoperability between all these wallets, if they meet the guidelines laid down in the Architecture and Reference Framework (ARF). But our experience suggests this may not be the case.”

Both de Horna and von Bredow concurred on the scale and immediacy of the issue. A hard deadline – for a large entity, in the regulated industry space, probably with lots of customers and a sizeable IT setup – equals a real headache, with real costs and consequences in case of non-compliance.

Finally, it would be scalable. As de Horna pointed out, EU member states have to issue these wallets, and relying parties have to accept them. But citizens don’t have to adopt them (yet). Usage of these wallets will not be mandated for citizens in many member states. Enrollment might be cumbersome at the beginning, with a resultant lag in adoption. A solution that scales up as usage increases allows relying parties to save on up-front costs.

Clear benefits, including compliance

Compliance is the obvious benefit that such a solution would support. There are other advantages an organization would gain, however. The simplification of a mandatory process is a key operational win, saving costs and man-hours across the board. This also makes the user’s journey more efficient, as the provider can deliver the actual benefits the new EUDIW is designed for.

An interesting implication is cost-savings through shortened know-your-customer (KYC) measures, such as video identification. These measures currently eat up time, create friction, and are expensive. Regulated industry entities subject to anti-money-laundering (AML) requirements must allocate significant resources to KYC currently. If the EUDIWs function as planned, this may well change. 

This only works if the wallets have the best orchestration solutions ready to go. “In the best scenario, there will be less abandonment, and conversion rates will increase because creating an account would be quicker. Relying parties that have these solutions early will stand out from their peers. They’ll attract users. Call it the cool factor,” added de Horna.

The brIDge you need

Tracking down the solution and partner that best suits your needs is crucial. For relying parties, G+D’s brIDge solution meets all the requirements we noted above. It is an orchestration layer available as middleware that is invisible to the user. It is SaaS, and is easily and quickly integrated into an organization’s existing offering. It provides interoperability out-of-the-box with all available certified EUDIWs (and the equivalent ID wallet in Switzerland, known as SWIYU), acting as a registered intermediary service managing the relying party’s necessary registration certificates, enabling successful interaction with the user wallet. And, it is eIDAS 2.0–compliant. 

G+D is an innovation leader and is well known for providing human-centric security technology. We are ideally positioned at the intersection of payment technology, digital security, and identities. Compliance within a hard deadline can be onerously complex. The right partner can help you navigate that complexity.

Published: 25/11/2025