Every EU state owes a digital ID wallet by December, and two dozen will miss

On December 24, 2026, Article 5a of the eIDAS regulation fires: every EU member state must "provide at least one European Digital Identity Wallet" to its residents, free of charge. That is six weeks from now, and the honest status report is that Denmark is the only member state running a purpose-built production wallet, exactly zero wallets hold EUDI certification, and reporting on national plans puts roughly two dozen of the 27 behind schedule. But the deadline matters less for what governments ship than for the obligation it starts: a login and identity layer that regulated apps will soon be required to accept.

What the wallet actually is

The EUDI Wallet is a government-issued or government-recognized app holding your verified identity attributes, operating at eIDAS's highest assurance level. The mandatory data set is small: family name, given name, birth date, birth place, nationality. Around it the law wraps capabilities that change how identity flows work: selective disclosure, so a user can prove "over 18" without revealing a birth date; a dashboard logging every transaction and every relying party that asked for data; qualified electronic signatures free for personal use; and open-source wallet software as a statutory requirement. Data lives on the user's device, not in a state cloud, by design: "zero tracking or profiling" is in the Commission's own description.

Who must accept it, in three tiers

The acceptance duty is layered, and the dates differ:

The private-sector tier is the one that reaches ordinary product teams. The trigger is not size or sector per se: it is whether EU or national law, or a contract, already obliges you to strongly authenticate users. Banks get there via PSD2's strong customer authentication rules; telecoms, healthcare providers, and transport operators get there by their own regimes. And the obligation is always additive: the wallet rides alongside your existing login, never replaces it, and users cannot be forced or steered toward it.

The shape of integration

If your app lands in scope, the mechanics are defined. Before accepting wallets you register as a relying party with your member state, declaring which attributes you will request; the law then bars you from requesting more than declared, and the registries go public via API on the same December deadline. The wire protocol is OpenID4VP for presenting credentials (SD-JWT VC or ISO mdoc formats), with a relying-party access certificate the wallet validates before it will talk to you. Free for users means free for users only: certificates, verifier infrastructure, and any vendor between you and the wallet are unpriced territory.

The honest rollout picture

The legal deadline and the operational reality are diverging visibly. Denmark's AltID went live June 3, 2026 and is chasing certification; Germany's wallet launches January 2, 2027, nine days late; the Netherlands postponed to late 2027; Estonia announced 2028. Several big user bases are dressed for the part without being it: France Identité has over 5 million users, Italy's IT-Wallet around 8 million monthly, Poland's mObywatel over 13 million, none of them certified EUDI wallets yet. The likely December outcome is formal compliance through provisioned-but-uncertified wallets, with the certification schemes themselves still being stood up. The pilots finished 2025 with a telling verdict: interoperability is achievable but fragile.

What it means for your app

Three concrete consequences. If you are a regulated relying party, "log in with EUDI" becomes a legal requirement on user request by end of 2027, and banks feel it earlier: the AML regulation applies July 10, 2027 and makes eID-based onboarding the preferred rails six months ahead of the eIDAS deadline. If you run KYC, the wallet gives you verified attributes at high assurance but does not replace your AML duties; screening and risk work stay yours. And if you are neither, the wallet is still worth tracking, because selective disclosure is a data-minimization gift: an age check that returns a boolean instead of a birth date shrinks your GDPR surface. For VLOPs, the open question is timing: the acceptance clause has no transition period, so whether Meta or TikTok must accept wallets as soon as certified ones exist is an argument lawyers are having now.

Our position

Watch the deadline, plan for the wave behind it. The December date will slip for the large majority of member states and nobody should build to it; the durable fact is that the EU has legislated a standard, certified identity rail into existence, and regulated apps will have to accept it the way they had to accept PSD2's authentication rules. If your product does onboarding or age verification in Europe, the smart sequencing is to instrument your login flow now, watch your member state's relying-party registry when it opens, and treat OpenID4VP as the format your integration will eventually speak. Do not build a wallet integration against today's docs and call it done, because the specs are still moving. And if you want a preview of the user experience, the Commission already shipped the trick separately: the open-source age-verification mini wallet, built on the same plumbing, is already piloting in six member states.

The takeaway

Regulated-identity plumbing is part of the compliance landscape we build into apps for European clients in our custom software work, alongside the rules in the EU accessibility act post. If your onboarding flow assumes passports and selfies forever, send us the flow.

← the journal