FAQ: eIDAS Implementing Acts

With the European Digital Identity Wallet on the horizon, the EU’s updated eIDAS regulation is entering a critical phase. The newly published draft implementing acts define how digital identification, authentication, and trust services will work, impacting trust service providers and their customers across the digital economy.

What is the background?

The eIDAS Regulation (Electronic Identification, Authentication and Trust Services) was adopted by the European Union in 2014 and became fully applicable in July 2016. It established a legal framework for electronic identification and trust services across the European Union (EU), aiming to enable secure and seamless digital transactions between businesses, citizens, and public authorities.

The European Commission proposed a revision in 2021, leading to a revised version (sometimes, although incorrectly called “eIDAS 2.0”), which was formally adopted in 2024. This updated regulation introduces, amongst other things, the European Digital Identity Wallet, allowing citizens and businesses to store and share official credentials securely on their devices. After the formal adoption, the EU had one year to develop implementing acts, recently published as drafts for consultation.

What are the implementing acts of the EU in general?

Implementing acts are a legal instrument used in the European Union to ensure that EU laws are applied uniformly across all Member States. They are legally binding acts adopted by the European Commission (or, in some cases, the Council) to implement more detailed technical or administrative rules based on an existing EU law, usually a regulation or directive.

The Commission cannot act entirely independently; committees of representatives from Member States assist it through what’s called the "comitology procedure." These committees ensure that Member States retain oversight over the implementation process.

Implementing acts do not change the original law — they only implement it.

Why do we need the implementing acts for eIDAS?

The technical aspects, legal identification, and authentication requirements have been pieced together throughout the EU. Some countries established rather strict standards, while others were a bit laxer. Critics argue that this would have favored providers from less strictly regulated countries. Being registered in a ‘lax country’ would have allowed them to provide their services in a ‘strict country’ anyway, giving them a competitive advantage. One of the goals of the eIDAS implementing acts is to end this practice and establish fair competition throughout the EU with unified standards.

Which aspects of the eIDAS regulation are impacted?

With the current set of implementing acts, the EU focuses on trust services, electronic identification and authentication, and electronic certificates for signatures and seals. New services, such as managing remote qualified electronic signature creation devices, are even specified.

Which companies are affected?

The new regulations will initially primarily affect trust service providers, but will also affect their customers in a second step. Therefore, the evolution of the eIDAS regulation is important for the entire digital economy.

What is the timeline?

Existing trust service providers must comply with the new rules and requirements by May 2026 and successfully undergo the required audits. New providers must meet compliance requirements and complete audits from the outset.

Where can I get additional information?

Download our whitepaper to understand how the new eIDAS rules will impact trust services, digital identity, and cross-border authentication. Get practical guidance on what your organization needs to prepare for compliance and how to turn regulation into opportunity.

State of the 2025 eIDAS Implementing Acts

Do you have any questions? Contact us!

Customer success stories

Customer success stories

FAQ: eIDAS Implementing Acts

What is the background?

What are the implementing acts of the EU in general?

Why do we need the implementing acts for eIDAS?

Which aspects of the eIDAS regulation are impacted?

Which companies are affected?

What is the timeline?

Where can I get additional information?

More trust blog articles

FAQ: eIDAS Implementing Acts

eIDAS business opportunities: EU...

FAQ: Digital Healthcare - Top 5...

What if healthcare in the EU were...