Digital identity is how a person proves who they are to an online service, and it is the front door to almost every digital public service. Before a council, a tax office or a university can show someone their own records or accept an application, it needs enough confidence that the person is who they claim to be. In the European Union (EU), the rules for that confidence, and for using a national electronic identification (eID) in another country, come from the eIDAS Regulation on electronic identification and trust services and its 2024 revision, which creates the European Digital Identity Wallet.
Why identity comes before everything else
Most joined-up services depend on knowing reliably which record belongs to which person. Reusing data that another agency already holds, as the once-only principle asks, is only safe if the person asking has been properly identified. The same goes for life-event services that bring several agencies together around a birth or a bereavement.
The design problem is to match the strength of the check to the risk. Looking up bin collection days needs no identity at all, while changing the bank account for a pension payment needs a great deal. Identity schemes therefore grade their checks, and each service chooses the grade it needs. Weak checks invite fraud; checks that are stronger than necessary shut people out.
What the 2014 eIDAS Regulation set up
Regulation (EU) No 910/2014, adopted on 23 July 2014, covers electronic identification and trust services such as electronic signatures.1 It did not create a European identity card. Instead, a Member State can notify its own eID scheme to the European Commission, describing the scheme, its assurance levels and who issues the credentials, so that other Member States can recognise it.1
| Level | Confidence in the claimed identity | Purpose of the technical controls |
|---|---|---|
| Low | A limited degree of confidence | Decrease the risk of misuse or alteration of the identity |
| Substantial | A substantial degree of confidence | Decrease substantially the risk of misuse or alteration |
| High | A higher degree of confidence than substantial | Prevent misuse or alteration of the identity |
The core cross-border rule is mutual recognition. Where a public sector body requires eID at level substantial or high for an online service, it must recognise a notified eID from another Member State at an equal or higher level.1 The Commission states that all online public services requiring substantial or high assurance had to be able to accept other countries' notified schemes by 29 September 2018.4 Technically, each country runs an eIDAS-Node, and the connected nodes form the eIDAS Network that carries authentication between countries.4
The obligation covered services provided by public sector bodies, not private ones.1 National schemes also differ widely: the Commission notes that they use varying security mechanisms and are based on different philosophies.4 The 2024 revision adds a common tool on top of them.
The 2024 revision and the European Digital Identity Wallet
Regulation (EU) 2024/1183 of 11 April 2024 amends eIDAS to establish the European Digital Identity Framework.2 It was published in the Official Journal on 30 April 2024 and entered into force on the twentieth day after publication, 20 May 2024.2
Each Member State must provide at least one European Digital Identity Wallet within 24 months of the entry into force of the implementing acts on the wallet's technical specifications and certification.2 The Commission adopted five of those implementing regulations on 28 November 2024 and described the goal as Member States releasing wallets by the end of 2026.3 A wallet can be provided by a Member State, under its mandate or recognised by it; its application source code must be open source; and it must be issued under an eID scheme at assurance level high.2
Two rules protect people who do not want one. Issuing, using and revoking a wallet must be free for natural persons, and use is voluntary: people who do not use a wallet must not be restricted or disadvantaged in reaching public or private services, which must stay available through other means.2
What the wallet holds and who must accept it
A wallet holds two kinds of data: person identification data, which establishes who the user is, and electronic attestations of attributes, which vouch for something about them. The regulation gives diplomas, licences, birth certificates and powers to act for another person as examples of attested attributes.2 Annex VI lists attributes that Member States must make verifiable against public authentic sources at the user's request, including address, age, nationality, educational and professional qualifications, public permits and licences, and company data.2 The wallet must also let natural persons sign with a qualified electronic signature, free of charge by default.2
Acceptance is what makes it useful. Where a Member State requires electronic identification for an online public service, that service must also accept the wallets.2 Private relying parties that must use strong user authentication by law or contract, in sectors such as banking, energy, health, transport and telecommunications, must accept them at the user's request within 36 months of the implementing acts entering into force; micro and small enterprises are exempt.2 Attestations are only as good as the records behind them, so the wallet depends on well-run base registries.
Privacy features in the design
The regulation tries to stop the wallet becoming a tracking tool. Users must be able to disclose data selectively, presenting only what a service needs rather than a whole credential.2 The wallet can generate pseudonyms, and issuers of attestations must not receive information about how those attestations are used.2
Relying parties must register and be authenticated, so the wallet can show the user who is asking. A dashboard logs every transaction, lets the user ask a relying party to erase their data and lets them report a suspicious request to their data protection authority.2 Providers must keep wallet data logically separate from their other data and must not combine it with other services unless the user expressly asks.2
Example
A graduate applies for a postgraduate course in another Member State that needs proof of age and a degree. Under the wallet's design, she presents a degree attestation from her university and confirms she is over 18 from her identity data, without revealing her date of birth or address. The course provider checks the issuers' signatures and sees only what it asked for, and the exchange appears in her dashboard.
The UK approach
The United Kingdom (UK), outside the EU, has taken its own route with two strands. For central government, GOV.UK One Login lets people sign in and prove their identity, and is intended ultimately to let them reach any government service with one set of sign-in details, proving their identity only once.5 It is available to central government departments and agencies, uses identity checks that comply with the government's identity-checking guidance, known as GPG 45, and GOV.UK Wallet is designed to let people store government-issued documents, such as a driving licence, on their phones.5
For the wider market, the UK digital verification services trust framework sets the rules and standards for what a good digital identity looks like, and providers can be independently certified against it.6 Version 1.0 is published under section 28 of the Data (Use and Access) Act 2025 and comes into force when the first conformity assessment body is accredited to certify against it, which GOV.UK says will be no earlier than 1 September 2026.6 The framework governs services from many certified providers rather than a single state-issued wallet.
In practice: Digital identity and eIDAS
What it fixes
- One strong identity check can be reused across many services instead of each service running its own.
- People from other Member States can use their own national eID or wallet to reach public services online.
- Services can ask for a single fact, such as being over 18, without collecting a full identity document.
- Signed attestations let a service check a qualification or licence with the issuer's signature rather than a paper copy.
What gets in the way
- A service that asks for a higher level of assurance than its risk justifies shuts out people who cannot pass the checks.
- Attestations are only as reliable as the registers and issuers behind them.
- Older service back ends were built around their own login systems and are slow to change.
- People without smartphones or official documents still need another way in, and the EU rules require one.
Where to start: List the online services you run, the identity checks each one actually needs, and which of them could accept a notified eID or, once available, the EU wallet. Start with one high-volume service where a shared login would remove a separate account.
Sources
- Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC, EUR-Lex. Accessed 17 October 2026.
- Regulation (EU) 2024/1183 of the European Parliament and of the Council of 11 April 2024 amending Regulation (EU) No 910/2014 as regards establishing the European Digital Identity Framework, EUR-Lex. Accessed 17 October 2026.
- Commission adopts technical standards for cross-border European Digital Identity Wallets, European Commission. Accessed 17 October 2026.
- What is eID, European Commission (Digital Building Blocks). Accessed 17 October 2026.
- About GOV.UK One Login, Government Digital Service. Accessed 17 October 2026.
- UK digital verification services trust framework (1.0), Office for Digital Identities and Attributes and Department for Science, Innovation and Technology (GOV.UK). Accessed 17 October 2026.