EUDI-Waet: The regulatory roadmap for digital identity

The original eIDAS regulation from 2014 created uniform rules for electronic identification and trust services in the internal market, but did not oblige member states to provide their own digital identity systems. After a decade, only a few states had developed usable national eID solutions; interoperability was technically error-prone and hardly accepted. Ultimately, the private sector was largely left out.

The amendment – ​​in force since May 20, 2024 and briefly called eIDAS 2.0 – fundamentally corrects this. The core is Article 5a, according to which 27 member states must provide at least one EUDI waet (European Digital Identity Waet) within 24 months of the entry into force of the first technical implementing acts (the first package came into force in November 2024, the second in May 2025). The member states then have 24 months to prepare at least one EUDI waet. The start date of January 2, 2027 communicated by Germany is based on the fact that the obligation to provide at least one EUDI waet exists from December 31, 2026 at the latest and that mandatory acceptance by public sources begins from January 1, 2027.

What is new about the EUDI-Waet compared to the previous eID? For the first time, it combines three functional areas in one app: electronic identification at a “high” security level, qualified electronic signatures (QES) and seals, and Electronic Attestations of Attributes (EAA), i.e. verified evidence such as driving licenses, university certificates or insurance cards. The user selectively decides which attributes to pass on to whom. However, the need-to-know principle as a technical design requirement – i.e. only as much data is shared as is needed for the respective purpose – is under pressure at the EU level due to current regulatory proposals.

That was the excerpt from our -Plus article “EUDI-Waet: The regulatory roadmap for digital identity”. You can read the entire article with a Plus subscription.