Wallet acceptance is law on 24 December 2027.
eIDAS 2.0 (Regulation 2024/1183) makes the European Digital Identity Wallet real, and it puts a duty on covered companies to accept it. Venvera is eIDAS 2.0 compliance software that turns the regulation into a scoped, trackable programme: who is in scope, what a relying party must do, and how to be ready for the wallet-acceptance deadline instead of scrambling after it.
What is eIDAS 2.0, and are you in scope?
eIDAS 2.0 amended the original electronic-identity regulation and entered into force on 20 May 2024. It introduces the EU Digital Identity Wallet and modernises trust services (signatures, seals, timestamps, registered delivery, archiving, ledgers). Scope follows the role you perform, not just your sector: the common private-sector trigger is Article 5f, under which non-micro and non-small companies that must use strong user authentication for online identification, by EU law, national law or contract, must accept the wallet. Article 5f names banking, financial services, transport, energy, healthcare, telecommunications, postal, digital infrastructure, education, drinking water and social security. Covered relying parties have until 24 December 2027; trust service providers carry ongoing duties including reassessment every 24 months. Venvera runs all of this as eIDAS 2.0 compliance software: it maps the duties to controls, scores your wallet readiness, and reuses the evidence you already hold for DORA, NIS2 and ISO 27001 so you are not starting from a blank page.
Know if eIDAS 2.0 applies, entity by entity.
Scope is a role test, not a sector guess, and it is easy to get wrong. Venvera walks you through it: which legal entities and customer-facing services are relying parties under Article 5f, whether the micro or small exemption applies once group and partner structure is counted, and whether you also hold trust-service or wallet-provider duties. The determination is documented, dated and re-runnable when your services or the implementing acts change.
- Article 5f relying-party applicability per entity and service
- Micro and small enterprise exemption test with group structure
- Trust service provider and wallet provider role detection
- A documented, dated scope you can show a supervisor
Be able to accept the wallet before the deadline.
The core relying-party duty is capability: where strong user identification is required, you must accept the EU Digital Identity Wallet by 24 December 2027. Venvera tracks the readiness controls that get you there: registration in the right member states, self-identification to users, an inventory of the services that trigger the duty, validation of the credentials and attestations you receive, and a non-discrimination fallback so wallet users are never disadvantaged.
- Relying-party registration and declared-data discipline
- Strong-authentication service inventory (the trigger list)
- Wallet attestation validation: authenticity, integrity, revocation
- Non-discrimination and alternative-means fallback
Ask for the minimum. Prove you did.
eIDAS 2.0 is strict about identity data: you may request only the attributes you declared at registration, use them only for the declared purpose, and you must not combine them across services or use them to track people. Venvera holds these as controls with evidence, so data minimisation, purpose limitation and transaction records are demonstrable, not just asserted. This is also where your existing GDPR work carries over.
- Declared-data discipline enforced against your request templates
- Purpose limitation and no cross-service tracking
- Identity transaction records sufficient to evidence compliance
- Reuses your GDPR data-protection evidence via the crosswalk
The work you did for DORA and NIS2 counts here too.
Most eIDAS controls are not new work. Strong authentication, incident reporting, certificate lifecycle, supplier obligations and security of the identity stack all overlap controls you already evidence for DORA, NIS2 and ISO 27001. Venvera maps them, so the moment you prove one it satisfies its eIDAS equivalent. Evidence Autopilot then chases only the genuinely eIDAS-specific gaps, from the right domain contacts, and re-asks when evidence expires.
- Overlapping controls auto-satisfied from DORA, NIS2 and ISO 27001
- eIDAS-specific duties (registration, wallet acceptance) never auto-claimed
- Evidence Autopilot collects the deltas with no-login requests
- Incident clocks and supplier registers shared, not rebuilt
For providers: the 24-month clock, handled.
If you are a trust service provider, eIDAS 2.0 keeps you on a cycle: notify your services and represent their status accurately, report significant security breaches within 24 hours, keep a funded termination plan, and undergo conformity reassessment by an accredited body at least every 24 months. Venvera treats reassessment as evidence with an expiry date, so the clock is visible and the renewal is requested before it lapses, and the incident duty runs on the same engine as your other regulatory clocks.
- Qualified and non-qualified status representation
- 24-hour trust-service incident reporting on the clock engine
- Conformity reassessment tracked as expiring evidence (every 24 months)
- Termination plan and certificate-lifecycle controls
Know exactly where you stand in five minutes.
A gap assessment scores your organisation across every eIDAS 2.0 area, scope and governance, wallet readiness, data protection, trust services, security and incidents, and the conditional TSP duties, and hands back a prioritised remediation plan with owners and effort. Track progress from first assessment to full readiness instead of guessing whether you will make the 2027 date.
- Assessment across all eIDAS 2.0 areas, TSP duties scoped conditionally
- Prioritised remediation roadmap with owners and effort
- Progress tracked against the 24 December 2027 deadline
- Board-ready readiness summary in one click
The spreadsheet or Venvera.
eIDAS 2.0, answered.
Know where you stand on eIDAS 2.0 well before 2027.
Start with a free gap report across every eIDAS 2.0 area - 10 minutes, no email to start.
✓ Every paid plan: audit-ready in 90 days, or your money back
10 minutes · no email to start · no credit card · yours to keep