EUDI Wallet: what it is and how EU integration lands in 2027

AI-generated, human-reviewed

17/07/2026 · eudi-wallet

By the end of 2027, millions of people across the EU will carry a state-recognised digital wallet on their phone — and organisations that check identity or credentials will have to accept it. The EUDI Wallet is not just another login option among many; it is the European framework for digital identity mandated by eIDAS 2.0. This article explains what the EUDI Wallet actually is, which deadlines apply through 2027, and what its integration means for your existing identity architecture.

The subject is the European Digital Identity Wallet (EUDI Wallet) — an app that lets citizens and businesses hold officially attested identity data and other credentials on their own device and present them selectively. For technical decision-makers, the question is less whether this is coming than when, and at what integration cost.

What the EUDI Wallet is

The EUDI Wallet is an app provided or recognised by each member state. It holds two kinds of credentials: Person Identification Data (PID) — state-backed core attributes such as name and date of birth — and electronic attestations of attributes ((Q)EAA), for example a driving licence, a study record, or a professional qualification. These credentials are issued by accredited parties, cryptographically signed, and stored on the device.

The key conceptual difference from classic identity flows is selective disclosure. Users do not reveal a full data set; they reveal only the attribute requested — “over 18,” say, instead of the full date of birth. Data minimisation is not an afterthought filter but built into the protocol. Control over which attribute goes to whom stays with the person, not with the verifying party.

The regulatory frame: eIDAS 2.0

The legal basis is Regulation (EU) 2024/1183, which amends the original 2014 eIDAS regulation and establishes the framework for European digital identity. It entered into force in May 2024 and is commonly called eIDAS 2.0. The text is publicly available on EUR-Lex.

Two obligations matter most for integrators. First, every member state must provide at least one EUDI Wallet. Second, certain sectors must accept the wallet as proof of identity — including regulated industries such as banking, health, telecoms, energy, and transport, as well as very large online platforms. If you already verify identity online today, treat the wallet not as optional but as a foreseeable requirement.

The regulation does not pin down the technical detail itself; it delegates that to implementing acts and to the Architecture and Reference Framework (ARF) — the ecosystem’s continuously maintained technical reference (public on GitHub). The ARF is the authoritative source for every integration decision and evolves under version control.

The timeline through 2027

The overview below summarises the milestones. Some dates are announced or planned and may shift — the direction, however, is binding.

For the German rollout, the announced launch of a state-driven wallet in early 2027 is the relevant fixed point; opening the market to private providers is planned for the period after. That makes 2027 the year regulation turns into lived integration — and, for operators in Germany, the sensible planning horizon.

How the integration works technically

The ecosystem has three roles. An issuer issues credentials — the state issues the PID, accredited bodies issue attestations. The wallet holds them on the device. A relying party requests and verifies credentials — the role most organisations will take on.

For that role, the ARF standardises concrete protocols rather than proprietary interfaces:

• OpenID for Verifiable Credential Issuance (OpenID4VCI) for issuing credentials into the wallet.
• OpenID for Verifiable Presentations (OpenID4VP) for requesting and presenting credentials in the online case — the core building block for relying parties.
• ISO/IEC 18013-5 for in-person, proximity verification, for example at an on-site check.

On credential formats, relying parties must handle two worlds: SD-JWT VC (JSON-based, common for attribute attestations) and the ISO mdoc format (familiar from the mobile driving licence). If you want to accept every credential in the ecosystem, you cannot avoid supporting both.

Then there is the trust layer. A relying party must register and identify itself — the wallet checks who is actually requesting data and shows it to the person. Trusted issuers and verifiers are published through trusted lists. This mutual authentication is not a nicety; it prevents arbitrary third parties from harvesting identity data under false pretences.

What it means for your identity architecture

The EUDI Wallet does not replace your existing identity and access management — it sits alongside it. In most architectures the wallet becomes an additional, especially high-assurance source of verified attributes, while your own system keeps managing sessions, roles, and permissions.

In practice, that means adding a relying-party component that speaks OpenID4VP and verifies the presented credentials. If you already run a central identity system, for example based on OpenID Connect, you can wire the wallet in as another trusted source rather than building a second, parallel login path. For what such a central identity layer looks like when run in-house, see Single Sign-on with Keycloak.

The harder decisions rarely sit in the protocol but in the architecture: which credentials you genuinely need, how you enforce data minimisation, where you verify and discard attributes instead of storing them, and how the solution stays maintainable while the ARF keeps evolving. These are exactly the questions we treat as software and systems architecture — as a sequence of documented decisions, not a one-off integration project.

Takeaways

• The EUDI Wallet is the European framework for digital identity mandated by eIDAS 2.0 (Regulation (EU) 2024/1183) — with selective disclosure as a built-in principle.
• Member states must provide wallets by the end of 2026; Germany has announced a state-driven launch for early 2027, with mandatory acceptance expected to follow by late 2027.
• Integration turns on concrete standards: OpenID4VP as a relying party, the SD-JWT VC and ISO mdoc formats, and a solid trust layer with registration and trusted lists.
• The wallet does not replace your identity management but adds a verified attribute source — the architectural work sits in data minimisation, verification logic, and maintainability.

If you are evaluating EUDI integration for 2027 and want to fit it cleanly into an existing, self-hosted identity landscape, the right starting point is the architecture work: software and systems architecture — from technical assessment to implementation support.