Regulationsby GlypheIDAS 2 / EU Digital Identity Wallet
Enacted European Union · In force May 20, 2024 · next deadline Dec 24, 2026 (in 58 days)
Deadlines
Coming up
Member States must provide EU Digital Identity WalletsEach Member State must provide at least one wallet within 24 months of the entry into force of the implementing acts under Arts 5a(23) and 5c(6) (Art 5a(1)).
Private relying parties must accept walletsPrivate relying parties required by law or contract to use strong user authentication must accept wallets on user request within 36 months of the implementing acts' entry into force (Art 5f(2)).
Already passed
Legacy qualified trust service providers conformity reportQTSPs qualified before 20 May 2024 had to submit a conformity assessment report proving compliance with Art 24(1), (1a) and (1b) by 21 May 2026.
First wallet implementing acts enter into forceCommission Implementing Regulations (EU) 2024/2977, 2024/2979, 2024/2980, 2024/2981 and 2024/2982 (adopted 28 Nov 2024, published 4 Dec 2024) enter into force. This starts the wallet deadline clocks in Arts 5a and 5f.
eIDAS 2 enters into forceRegulation (EU) 2024/1183 entered into force on the twentieth day after publication on 30 Apr 2024 (Art 2).
Summaries for reference, not legal advice. Check the official text.
What it does
Requires every Member State to offer at least one European Digital Identity Wallet so people can identify themselves and share verified attributes with selective disclosure. It adds new qualified trust services such as electronic attestations of attributes and electronic ledgers. Private relying parties that must use strong authentication, and very large online platforms, have to accept the wallet when the user asks.
- Who it applies to
- Member States (wallet issuance); qualified and non-qualified trust service providers; relying parties relying on wallets, incl. private relying parties legally or contractually required to use strong user authentication (transport, energy, banking, financial services, health, telecoms and similar) and VLOPs under the DSA.
- Penalties
- Trust service providers: maximum of at least EUR 5M, or for legal persons EUR 5M or 1% of worldwide annual turnover, whichever is higher (Art 16 as amended). Other penalties set by Member States.
- Enforced by
- National supervisory bodies for trust services and wallets; European Commission
- Official name
- Regulation (EU) 2024/1183 amending Regulation (EU) No 910/2014 as regards establishing the European Digital Identity Framework (eIDAS 2)
- Citation
- OJ L, 2024/1183, 30.4.2024
- Topics
- Privacy, Data access and sharing, Biometrics
Verified 2026-09-22 eur-lex.europa.eu
Research notes
The 2026-12-24 and 2027-12-24 dates are computed as 24 and 36 months after the 24 Dec 2024 entry into force of the Art 5a(23)/5c(6) implementing acts (20th day after 4 Dec 2024 publication). The Commission often says 'by end of 2026' for wallets. Further implementing acts adopted in 2025 may affect specific features.
Related
Cyber Resilience ActSets mandatory cybersecurity requirements for hardware and software products with digital elements sold in the EU: secure by design, vulnerability handling, security updates for the support period, SBOMs, and CE marking after conformity assessment. Manufacturers must report actively exploited vulnerabilities and severe incidents to CSIRTs and ENISA from 11 Sep 2026.Next: Dec 11, 2027 CRA fully applies · in 13 monthsDORAHarmonised ICT risk-management, major ICT-incident reporting, digital operational resilience testing (including threat-led penetration testing) and ICT third-party risk rules for EU financial entities. Financial entities must keep a register of all ICT third-party contracts. Critical ICT third-party providers (cloud, data centres and similar) come under direct EU oversight.In effect since Jan 16, 2023Data Governance ActSets conditions for re-use of protected public-sector data (personal data, trade secrets, IP) and creates a notification and neutrality regime for data intermediation services. It also sets up voluntary registration of 'recognised data altruism organisations'. Data intermediaries must stay neutral, separate the intermediation service from other services and notify a competent authority.In effect since Jun 23, 2022Digital Markets ActImposes ex-ante do's and don'ts on designated gatekeepers. Examples: no combining personal data across services without consent, no self-preferencing, interoperability, data portability, and business-user data access. Gatekeepers must notify all acquisitions and submit an audited description of consumer profiling techniques.In effect since Nov 1, 2022Digital Omnibus (data/GDPR)Commission proposal to simplify EU digital rules. It would amend the GDPR (personal data definition, processing for AI, a new cookie/terminal-equipment consent regime in Art 88a/88b, breach notification only for high-risk breaches within 96 hours) and the ePrivacy Directive, NIS2, CER Directive and Data Act. A single-entry point would handle incident reporting, and the Data Governance Act, Free Flow Regulation, Platform-to-Business Regulation and Open Data Directive would be repealed and merged into the Data Act. The AI Act part was split out and adopted separately as Regulation (EU) 2026/1744.No date setDigital Services ActLayered obligations for intermediary services: notice-and-action for illegal content, statements of reasons, complaint handling, transparency reporting, and ad and recommender transparency. Profiling-based ads to minors and ads based on sensitive data are banned. Very large online platforms and search engines (45M+ EU users) must also run annual systemic-risk assessments and audits and give researchers data access.Next: Feb 18, 2027 DSA SME impact report · in 4 monthsEU AI ActA risk-based product-safety regime for AI. It bans certain AI practices, imposes strict requirements on high-risk AI systems (risk management, data governance, documentation, human oversight, conformity assessment), sets transparency duties for chatbots, deepfakes and AI-generated content, and sets obligations for general-purpose AI model providers. The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force 27 July 2026) pushed the high-risk dates back to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). It also softened the AI literacy duty and added bans on non-consensual sexual deepfakes and child sexual abuse material (CSAM) generation.Next: Dec 2 New bans on sexual deepfakes and CSAM generation; Art 50(2) grace period ends · in 36 daysEU CSAM Interim RegulationLets providers of number-independent interpersonal communications services, such as messaging and email, voluntarily scan for and report online child sexual abuse despite ePrivacy confidentiality rules, under strict conditions. It replaces Regulation (EU) 2021/1232, which expired on 2026-04-03. The permanent CSA Regulation proposed in 2022 is still not adopted.Next: Feb 1, 2028 Commission implementation report · in 15 months
Questions about eIDAS 2 / EU Digital Identity Wallet
- What are the eIDAS 2 / EU Digital Identity Wallet compliance deadlines?
- May 20, 2024: eIDAS 2 enters into force. Dec 24, 2024: First wallet implementing acts enter into force. May 21, 2026: Legacy qualified trust service providers conformity report. Dec 24, 2026: Member States must provide EU Digital Identity Wallets. Dec 24, 2027: Private relying parties must accept wallets.
- When does eIDAS 2 / EU Digital Identity Wallet take effect?
- eIDAS 2 / EU Digital Identity Wallet took effect on May 20, 2024. The next milestone is Dec 24, 2026: Member States must provide EU Digital Identity Wallets.
- Who does eIDAS 2 / EU Digital Identity Wallet apply to?
- Member States (wallet issuance); qualified and non-qualified trust service providers; relying parties relying on wallets, incl. private relying parties legally or contractually required to use strong user authentication (transport, energy, banking, financial services, health, telecoms and similar) and VLOPs under the DSA.
- What are the penalties under eIDAS 2 / EU Digital Identity Wallet?
- Trust service providers: maximum of at least EUR 5M, or for legal persons EUR 5M or 1% of worldwide annual turnover, whichever is higher (Art 16 as amended). Other penalties set by Member States.