eIDAS 2.0 Timeline: The Dates That Matter for Digital Identity in Europe

eIDAS 2.0 is not one deadline. It is a sequence of dates spread across several regulations. Each one lands on a different group: member states, trust service providers, banks, health systems and online platforms. Missing how they connect is a common planning error.

This page puts the key dates in one table, then explains what each phase means. Dates were checked in October 2026. Some depend on acts still to be adopted. We flag those.

The Timeline at a Glance

Key Terms Used in This Timeline

• EUDI Wallet. The European Digital Identity Wallet, an app or set of apps provided under the authority of a member state, that lets people store and share identity data and attestations.
• PID. Person identification data. The core credential that says who the wallet holder is, issued by the member state.
• Attestation of attributes. A signed statement about the holder, such as a driving licence or a diploma. When issued by a qualified trust service provider, it is a qualified electronic attestation of attributes, or QEAA.
• Relying party. Any organisation that requests data from a wallet: a bank, a public service, a platform. Relying parties must register and declare what they will ask for.
• Level of assurance. eIDAS defines three levels: low, substantial and high. Most regulated uses require substantial or high.
• Implementing acts. Detailed rules adopted by the Commission under eIDAS 2.0. They turn the regulation’s principles into technical and procedural requirements.
• QTSP. Qualified trust service provider. A company supervised under eIDAS that offers qualified signatures, seals, timestamps or attestations.
• ARF. The Architecture and Reference Framework, the technical blueprint that wallets and relying parties build on.

Phase 1: Legal Foundations (2024 to 2025)

eIDAS 2.0 entered into force on 20 May 2024. On its own, it set principles. The details sit in implementing acts that define how wallets work, how they are certified and how relying parties register.

The publication of the first acts on 4 December 2024 started the clock. They entered into force on 24 December 2024, which explains the two December deadlines that follow.

Phase 2: Wallet Launch (2026 to early 2027)

Every member state must offer at least one wallet by 24 December 2026. The obligation covers availability, not adoption. In September 2026, Italy, France and Finland were furthest along. Germany targets 2 January 2027 and Romania 14 January 2027. Sweden does not expect a release before 2028.

Two related deadlines matter for providers. Relying parties must register before they can request data. Those rules apply from 24 December 2026. Qualified trust service providers that verify identity remotely must complete biometric testing for presentation attacks, injection attacks and matching performance by the end of 2026.

Phase 3: Sector Rules (2027)

2027 is when the wallet meets sector law.

• Health. Commission Implementing Regulation (EU) 2026/2099, adopted on 21 September 2026, links MyHealth@EU to national eIDs and the wallet. It starts on 26 March 2027 and phases in until 2032. Patients will need substantial assurance at first, moving to high assurance from March 2030.
• Anti-money laundering. The AML Regulation applies from 10 July 2027. AMLA’s final draft standards, sent to the Commission on 1 October 2026, treat electronic identification at substantial or high assurance, including the wallet, as a default way to verify customers. The Commission still has to adopt them.
• Artificial intelligence. The Digital Omnibus moved high-risk obligations for stand-alone systems, which include some biometric uses, to 2 December 2027.

Phase 4: Mandatory Acceptance (December 2027)

By 24 December 2027, private relying parties that must use strong user authentication by law or contract have to accept the wallet when a user asks to use it. This covers banking and financial services, payments, telecoms, energy, transport, health, social security, education, postal services and digital infrastructure. Very large online platforms must also accept it for user authentication.

Banks face a second layer. The Payment Services Regulation, agreed politically on 27 November 2025, will replace large parts of PSD2. In autumn 2026 its publication in the Official Journal was still expected, with compliance projected for around 2028. Check its status before planning.

What December 2027 Means Sector by Sector

The acceptance obligation is written in general terms. Its effect depends on how each sector authenticates customers today.

• Banking and payments. Banks already use strong customer authentication under PSD2, so they are clearly in scope. The wallet must be accepted as a way to log in and approve operations when a customer asks. Account opening is covered by the AML rules described above.
• Telecoms. Many member states require identity checks to register SIM cards or sign contracts. Operators that authenticate customers strongly online will need to accept the wallet. SIM registration was one of the use cases tested in the early large-scale pilots.
• Energy and utilities. Energy suppliers authenticate customers for contracts, supplier switching and access to consumption data. Researchers in Germany are also exploring digital identities for energy installations and certificates of origin, which could extend the wallet beyond people to devices and organisations.
• Transport. Rail, air and public transport operators that require strong authentication for accounts or passes fall within scope. Digital travel credentials are a parallel track, driven by border and aviation rules.
• Education. Universities and schools that require strong authentication for student services must accept the wallet. They are also natural issuers of diplomas and enrolment attestations.
• Health and social security. Both appear in the list of sectors. In health, the MyHealth@EU rules add a separate, phased path for cross-border access.
• Very large online platforms. Platforms designated under the Digital Services Act must accept the wallet for user authentication when the user asks. This is where many people may first use the wallet outside government services.

Across all sectors, the obligation applies when the user requests it. A company can keep its existing login methods. It cannot refuse the wallet.

Phase 5: Deepening (2028 to 2032)

After 2027, the work shifts to depth. The obligations stop being about whether a wallet exists or is accepted and start being about how much it can do. That is where most of the long-term value sits and also where most of the remaining design questions are.

The pace of this phase will depend on issuers as much as on regulators. Every diploma, licence or qualification that becomes available as an attestation gives people a new reason to open the wallet. Every relying party that accepts those attestations gives issuers a reason to produce more. Countries that build this cycle early will see faster adoption. More attestations go into the wallet, such as healthcare attributes from March 2029. Assurance levels rise in health. Wallet use grows across borders as more countries connect.

Which Dates Are Fixed and Which Could Move

Not every date in the table carries the same weight.

• Fixed by law. 24 December 2026 for wallet availability, 10 July 2027 for the AML Regulation and 24 December 2027 for mandatory acceptance are written into regulations already in force. Changing them would require new legislation. Plan around them.
• Fixed, but delivery may lag. National launches can slip even when the legal deadline does not. Sweden has said publicly that its wallet will not arrive before 2028. Germany will launch a few days after the deadline. Expect more announcements of this kind in the last weeks of 2026.
• Dependent on adoption. AMLA’s standards still need Commission adoption. The text may change. The Payment Services Regulation was not yet published in the Official Journal in October 2026. Treat their content as likely, not certain. Check again in early 2027.
• Phased by design. The MyHealth@EU rules spread obligations over five years on purpose. Early phases set the direction. Later phases raise the bar.

This distinction helps when you set budgets. Work tied to fixed legal dates belongs in the core plan. Work tied to dependent dates belongs in a reserve that you release once the text is final. Review that reserve every quarter, because several of these texts could be finalised during 2027.

Portugal on the Timeline

Portugal starts with advantages. Its two main credentials, the Chave Móvel Digital and the Cartão de Cidadão, are already notified at high assurance. The gov.pt app already holds 51 types of documents. Banks and public services already integrate Autenticação.gov.

What Portugal had not published by October 2026 was a name or launch date for its EUDI Wallet. For Portuguese relying parties, that means the 24 December 2026 date is less informative than the December 2027 acceptance obligation, which applies regardless of when the national wallet arrives. Wallets from other member states will also reach Portuguese services through cross-border use.

How to Use This Timeline

• Public sector. Focus on 24 December 2026 and the first months after it. Usage data from early 2027 will shape funding and political support.
• Banks and fintechs. Treat 10 July 2027 and 24 December 2027 as one programme. The same wallet integration serves both due diligence and authentication.
• Health systems. Start with 26 March 2027. The attribute deadlines in 2028 and 2029 need data governance work now.
• Technology providers. Certification and testing cycles are long. The ETSI deadline at the end of 2026 is already close.
• Civil society and researchers. The first months after launch are the right time to test privacy promises in practice. Independent reviews of how wallets handle tracking, recovery and data requests will shape public trust more than any official statement. Publishing findings before the December 2027 obligation gives regulators time to act on them.

A Quarter-by-Quarter Checklist for 2027

• First quarter. Confirm relying-party registration. Test with the first national wallets that launch. Review AMLA’s standards once the Commission adopts them. Health organisations should be preparing for 26 March.
• Second quarter. Finalise due diligence procedures for 10 July. Decide the scope of wallet acceptance: onboarding, login, signature or payments. Gather evidence from early adopters at spring conferences, including LisbonID on 25 and 26 May.
• Third quarter. Apply the AML Regulation from 10 July. Build wallet acceptance into production systems. Update customer communication and staff training.
• Fourth quarter. Run end-to-end tests with as many national wallets as possible. Prepare for the AI Act’s high-risk obligations on 2 December. Go live with wallet acceptance before 24 December.

Each quarter should end with a short review: what was delivered, which dates moved and which assumptions changed. In a year with this many moving parts, the review matters as much as the plan.

A team that follows this sequence reaches December 2027 with one integrated programme instead of three separate projects running in parallel.

Frequently Asked Questions