European Compliance Suite

eIDAS 2.0 — Regulation (EU) 2024/1183 — entered into force on 20 May 2024. It amends rather than replaces the original 2014 eIDAS framework, retaining the three-tier electronic signature structure while adding the European Digital Identity Wallet, two new qualified trust service categories — electronic registers and electronic archiving — and mandatory acceptance obligations for large platforms and regulated sector organisations. The original eIDAS created cross-border legal recognition for qualified signatures. eIDAS 2.0 makes the infrastructure to deliver them available to every EU citizen and requires a defined category of organisations to accept it.

The European Digital Identity Wallet is a government-issued application allowing EU citizens and residents to store identity credentials, Electronic Attestations of Attributes, and qualified electronic signatures in a standardised format accepted across the Union. Every EU member state must make a EUDI Wallet available to citizens by December 2026. Large online platforms, banks, telecoms providers, and healthcare organisations must accept the wallet for authentication from late 2027 — approximately one year after wallet availability.

Yes, where those companies serve EU users and fall within the mandatory acceptance categories. A US identity verification platform serving EU banks, an Indian e-signature provider offering services to EU enterprises, or a UK KYC platform onboarding EU customers faces the same EUDI Wallet acceptance obligations as an EU-established entity in the same category. The regulation follows where your service is consumed, not where your company is incorporated.

Electronic Attestations of Attributes are verifiable credentials issued by qualified providers confirming specific facts — professional qualifications, regulatory licences, age, account status. They are stored in the EUDI Wallet and can be presented to relying parties without disclosing unnecessary additional data. AI systems that make decisions based on professional credentials, age verification, or licence status will increasingly encounter EAAs in user authentication and KYC workflows. How AI systems process and act on EAAs creates both GDPR Article 22 automated decision-making questions and EU AI Act high-risk classification considerations where the decisions are consequential.

Simple electronic signatures include any electronic data attached to or logically associated with a document — a typed name, a checkbox, a click. Advanced electronic signatures are uniquely linked to the signatory, capable of identifying them, and linked to data in a way that detects subsequent changes. Qualified electronic signatures are advanced signatures created with a qualified electronic signature creation device and based on a qualified certificate — they have the legal equivalent of a handwritten signature in all EU member states. The tier that applies to your use case depends on the legal requirements of the underlying transaction and the jurisdiction in which it has effect.

AI systems used in identity verification, biometric authentication, and access control decisions are subject to EU AI Act obligations — including high-risk classification under Annex III for biometric identification systems — alongside eIDAS 2.0’s trust service and wallet acceptance requirements. A biometric AI system used to verify identity against a EUDI Wallet credential sits under both regimes simultaneously. A cross-framework assessment maps where the obligations overlap and where they impose distinct requirements on the same product.

Identity data — credentials, attributes, biometric data used for verification — is personal data subject to GDPR. eIDAS 2.0 processing typically relies on legal obligation or legitimate interests as the lawful basis where identity verification is required by regulation. However, GDPR’s data minimisation, retention, and data subject rights obligations still apply — including the right of access and the right to erasure, which interact with eIDAS 2.0’s record-keeping requirements in ways that must be specifically mapped. Where AI systems make automated decisions based on EAA processing, GDPR Article 22 obligations apply alongside eIDAS 2.0’s requirements.

Penalties for non-compliance with eIDAS 2.0 are determined by member states as part of their implementation frameworks. The regulation introduces specific financial penalties — up to 4% of global turnover — for national supervisory authorities that wrongly refuse recognition of qualified signatures or trust services issued in other member states. For organisations failing to accept the EUDI Wallet after the mandatory acceptance deadline, member state enforcement mechanisms apply, with penalty levels varying by jurisdiction.

Mandatory acceptance applies to very large online platforms within the scope of the Digital Services Act, to organisations in regulated sectors — banking under PSD3, telecoms, healthcare — and to public service providers. The threshold determination is not always straightforward, particularly for AI platforms that straddle sector categories or operate at scale without meeting VLOP designation. The compliance assessment establishes whether mandatory acceptance applies to your specific product and from what date.

First, determine your role — relying party, trust service provider, qualified trust service provider, or a combination across different product functions.

Second, assess whether your platform falls within the mandatory EUDI Wallet acceptance categories and establish the timeline that applies to you.

Third, map how your product currently handles electronic signatures and trust services against eIDAS 2.0’s updated tier requirements.

Fourth, assess how Electronic Attestations of Attributes interact with your AI system’s decision-making workflows and what GDPR and EU AI Act obligations that triggers. A lawyer-built assessment covers all four steps and delivers a documented compliance position specific to your product — mapped against your EU AI Act, GDPR, and DORA position where all apply.