eIDAS 2.0 Explained: The EUDI Wallet, Its Deadlines and What Changes for E-Signatures

eIDAS 2.0 is the informal name for Regulation (EU) 2024/1183, which amends the EU's eIDAS regulation (No 910/2014) and creates the European Digital Identity Wallet (EUDI Wallet). It entered into force on 20 May 2024. Every Member State must offer a wallet by 24 December 2026. Private services that must use strong user authentication, apart from micro and small enterprises, have to accept it at the user's request by 24 December 2027. The SES, AES and QES signature levels don't change.

The amending regulation was adopted on 11 April 2024 and published in the Official Journal on 30 April 2024 (full text on EUR-Lex). It doesn't replace the 2014 law. The text that applies is Regulation 910/2014 as amended, and "eIDAS 2.0" is shorthand that stuck, not the regulation's own title.

Under the 2014 rules, Member States could notify a national eID scheme on a voluntary basis, and private services had no duty to accept any of it. Regulation 2024/1183 adds five things:

1. 1.
   A wallet in every Member State (Article 5a).
2. 2.
   A duty to accept it, covering public online services, private services required to use strong user authentication, and very large online platforms (Article 5f).
3. 3.
   Four new trust services, from electronic attestations of attributes to electronic ledgers (Article 3(16)).
4. 4.
   The wallet as a way to prove your identity when you apply for a qualified certificate.
5. 5.
   Qualified website certificates that web browsers must recognize.

One thing stays untouched. Article 2(3) says the regulation "does not affect Union or national law related to the conclusion and validity of contracts" or other rules on form.

The EUDI Wallet is an app that holds your verified identity data and credentials such as a driver's license or a diploma. The regulation keeps that data "under the sole control of the user" and requires selective disclosure, so you can share one attribute, like being over 18, instead of your whole ID record.

It doesn't have to be a government app. A Member State can provide the wallet itself, have someone provide it under a mandate, or recognize one built independently. Whichever route it takes, the app's source code must be open-source licensed, with narrow exceptions.

Getting, using and revoking a wallet is free for individuals, and using one is voluntary. Nobody who skips it may be disadvantaged, and services must stay reachable by other means.

The wallet also signs. Every wallet must let its user create a qualified electronic signature, free of charge by default for natural persons, though Member States may limit the free QES to non-professional use. A freelancer planning to sign client contracts this way should check local rules first.

The Commission's implementation page says four large-scale pilots launched in April 2023 with more than 350 organizations from 26 Member States, Norway, Iceland and Ukraine. Signing contracts online is one of the 11 areas they explore.

The regulation counts its main deadlines from the entry into force of the implementing acts named in Articles 5a(23) and 5c(6). Five such acts were adopted on 28 November 2024 and entered into force on 24 December 2024. From that day:

• Member States get 24 months to provide a wallet (Article 5a(1)), which lands on 24 December 2026.
• Private relying parties in scope get no more than 36 months (Article 5f(2)), which lands on 24 December 2027.

Further packages followed, including one on 6 May 2025 for wallets and relying-party registration and one on 29 July 2025 for trust services.

Less than the name suggests. What a signature is worth hasn't changed:

• An electronic signature can't be denied legal effect or refused as evidence just because it's electronic or not qualified (Article 25(1)).
• A QES has the equivalent legal effect of a handwritten signature (Article 25(2)).
• An AES is still uniquely linked to the signer, identifies them, is created with data under their sole control, and shows any later change to the signed data (Article 26).

For when each level is worth the effort, see QES requirements.

What moves is the route to a qualified certificate. A qualified trust service provider may now check your identity through an EUDI Wallet, among other methods. The reference standards for that check, in Implementing Regulation 2025/1566, apply from 19 August 2027.

The wallet can also produce a QES itself, free by default for individuals. On AES, the Commission had until 21 May 2026 to assess whether reference standards are needed.

Four services on the amended list in Article 3(16) are new, and each can be offered as a qualified service.

Remote signing device management

Remote signing keeps your signing key on a provider's device instead of a card you hold. Managing those devices is now a trust service, and Implementing Regulation 2025/1567 sets the qualified rules from 19 August 2027.

Electronic attestations of attributes

An attestation is an electronic proof of a fact about a person, such as a degree or a license. It can't be refused legal effect for being electronic, and a qualified one has the same legal effect as a lawfully issued paper attestation.

Electronic archiving

A qualified archive is run by a qualified trust service provider. It keeps files durable and legible beyond their technological validity, for at least the legal or contractual retention period.

Electronic ledgers

Any electronic ledger keeps basic legal standing: it can't be refused legal effect just for not being qualified. Only a qualified ledger, run by qualified trust service providers, gets the presumption that its records are unchanged and in the right order.

Separately, web browsers have to recognize qualified website certificates and show the certified identity to users.

To confirm that a provider really holds qualified status, see how to check a provider on the EU Trusted List. Seals, the company-level counterpart to signatures, are covered in electronic seals under eIDAS.

Article 5f names three groups. Public services come first: where a Member State requires electronic identification for a public-sector online service, the wallet must be accepted too.

Private relying parties are next, and the test is authentication, not industry. You're in scope if a law or a contract requires you to use strong user authentication, meaning at least two independent factors from different categories, for online identification. Transport, energy, banking, financial services, social security, health, drinking water, postal services, digital infrastructure, education and telecommunications appear only as examples. Micro and small enterprises are exempt. The deadline is 24 December 2027, and acceptance is owed only when the user asks for it.

Very large online platforms form the third group: those designated under Article 33 of the Digital Services Act, with at least 45 million average monthly active users in the EU, a figure the DSA equates to 10% of the EU population. If they require users to authenticate, they must accept the wallet on request, for the minimum data necessary. No separate date applies.

A relying party that wants to use wallets must first register in the Member State where it's established. Under Implementing Regulation 2025/848, only registered parties get the access certificates that wallets check.

The scope clause doesn't mention companies outside the EU: the regulation applies to eID schemes and wallets provided by Member States and to trust service providers established in the EU (Article 2(1)). It isn't a blanket exemption: the duty on very large online platforms (Article 5f(3)) follows the Digital Services Act, which applies wherever the provider is established. If you work with EU customers or partners, four more points matter:

1. 1.
   Accepting the wallet means registering "in the Member State where it is established". The text doesn't say how that works without an EU establishment, so ask counsel before you build a wallet login.
2. 2.
   A QES issued in one Member State counts as a QES in all of them (Article 24a(1)).
3. 3.
   Trust services from outside the EU equal EU qualified ones only when an implementing act or an agreement under Article 218 TFEU recognizes them (Article 14(1)). Check rather than assume.
4. 4.
   Contract form isn't set here. Article 2(3) leaves it to Union and national law, so the law governing the deal decides whether a simple e-signature is enough.

You can confirm an EU provider's qualified status on the EU Trusted List yourself.

1. 1.
   Test yourself against Article 5f(2). Does a law or a contract require strong user authentication for online identification? Are you a micro or small enterprise? If the first answer is no or the second is yes, accepting the wallet is your choice.
2. 2.
   If you're in scope, put 24 December 2027 in the plan and allow time to register as a relying party in the Member State where you're established.
3. 3.
   Find out where national law asks for a particular signature. eIDAS 2.0 doesn't change form rules, so the answer sits in the law governing each contract.
4. 4.
   Where a document does need a QES, look the provider up on the EU Trusted List. A badge on its website isn't proof.
5. 5.
   Add the wallet as one more way in, not the only one. People who don't use a wallet may not be disadvantaged (Article 5a(15)).

If step 1 puts you out of scope, write down why, so the answer is on file when a customer asks.

Chaindoc is where you create a contract, send it for signature and collect payment. Each signed PDF carries a PAdES-BES signature tied to a per-user certificate from Chaindoc's own certificate authority, which Chaindoc's security documentation describes as an advanced electronic signature under Article 26. After the last signature, the final PDF's hash is written to SKALE Calypso, and anyone can re-hash the file and compare it with free online PDF verification.

Identity verification (KYC) runs inside the signing flow, and the result lands in the audit trail: one check a month on Personal, five on Team, ten on Business, none on Free. See KYC inside the signing flow and identity verification before signing.

Two limits. Chaindoc isn't a trust service provider and doesn't issue qualified certificates. Its blockchain record isn't a qualified electronic ledger. Article 45k(1) says a ledger can't be denied legal effect for that reason alone, but the presumption of integrity and order belongs to qualified ledgers.

You can try Chaindoc's signing workflow on the Free plan: €0, permanently, no card, 5 signatures a month. The digital signature compliance guide sets eIDAS beside GDPR and NIST, and the Chaindoc pricing page lists the paid plans.

Three eIDAS 2.0 dates carry most of the weight: 24 December 2026 for a wallet in every Member State, 19 August 2027 for the new identity-proofing standards, and 24 December 2027 for private services under strong user authentication, micro and small enterprises excepted.

Your signatures keep the legal effect they had. Worth checking now: whether a law or a contract puts you under strong user authentication, where national law asks for a QES, and whether your providers are on the EU Trusted List. For eIDAS, GDPR and NIST side by side, read our digital signature compliance guide.