The EU Digital Identity Wallet, for relying parties

What the wallet is

The EU Digital Identity Wallet is an app each member state provides or recognises. It holds verified credentials (such as a national identity or the single fact of being over 18) and lets the person share only the part that is asked for, with a cryptographic proof that it is genuine and unaltered.

A business that needs one fact about a person can ask for that fact alone. It still has to validate what comes back, but it no longer has to collect or keep the document behind it.

The timeline

The regulation has applied since 20 May 2024, and it states its deadlines as periods rather than dates. Article 5a(1) gives each member state 24 months to provide at least one wallet, and Article 5f(2) gives private relying parties 36 months to accept it, both counted from the implementing acts referred to in Articles 5a(23) and 5c(6). Recital 3 of Implementing Regulation (EU) 2024/2977 names the four acts that fulfil Article 5a(23), and 2024/2981 rests on Article 5c(6). All five entered into force on 24 December 2024, so the two deadlines fall on 24 December 2026 and 24 December 2027.

Using a wallet stays voluntary for citizens, so not every customer will have one when those dates pass. A wallet check therefore belongs beside the method you already use.

Who has to accept it

Article 5f(1) makes member states accept the wallet wherever they require electronic identification for an online public service. Article 5f(2) puts the duty on private relying parties that Union or national law or a contract requires to use strong user authentication for online identification. It names areas such as transport, energy, banking, health and telecommunications. Microenterprises and small enterprises are exempt from it.

Article 5f(3) adds very large online platforms that require their users to authenticate. They have to accept the wallet and support its use for that authentication, limited to the minimum data the service needs. The article gives them no 36 month period. Under Articles 5f(2) and 5f(3) the wallet is used when the user asks. Anyone else may accept it voluntarily, after registering the same way.

A checklist for relying parties

The steps a relying party takes before it can accept the wallet, each with the provision it comes from.

1. Work out whether the duty applies to you

   Public services check Article 5f(1) and very large online platforms Article 5f(3). Everyone else checks Article 5f(2): whether law or a contract requires strong user authentication from you and whether you are larger than a small enterprise. If Article 5f(2) applies, you have until 24 December 2027. Where none of the three applies, accepting the wallet is a choice.

2. Register in the member state where you are established

   Article 5b(2) asks for at least your member state, your name, your registration number where you have one, your contact details and your intended use, including the data you will request. Implementing Regulation (EU) 2025/848, which sets up the national registers from 24 December 2026, asks for more in its Annex I, including whether you rely on an intermediary acting for you. Article 5b(3) then bars asking users for data beyond your registered intended use, and Article 5b(6) obliges you to report changes without delay.

3. Get an access certificate

   Wallets have to be able to authenticate and identify the relying parties that ask them for data (Article 5a(5)(c)), and a wallet relying party access certificate is how a relying party identifies itself. Under Article 7 of Implementing Regulation (EU) 2025/848, every member state authorises at least one certificate authority to issue these certificates, to registered relying parties only. Every member state must also authorise a certificate authority to issue registration certificates listing what you registered for, issued automatically after registration (Article 8(1) of the same regulation, as amended by Implementing Regulation (EU) 2026/1730). Wallets then warn the person when a request goes further.

4. Request only what you registered

   Article 5b(3) holds you to the data in your registration. For age, ask for an age claim where the credential carries one rather than a full birth date. Article 5b(9) also bars refusing a pseudonym where the law does not require the person to be identified.

5. Validate what comes back

   Article 5b(9) makes you responsible for authenticating and validating the identification data and attestations the wallet presents. In practice that means checking the issuer's signature, the device binding and whether the issuer is on a current trusted list.

Checking age before the wallet reaches your users

There are two ways to prove age in the EU wallet ecosystem, and they are not at the same stage. The EU age verification app has its own profile, which puts reader authentication out of scope, so no access certificate is involved. The EU Digital Identity Wallet requires one.

Age checks on the EU age verification app can run today, with no access certificate. Adding the EU Digital Identity Wallet comes after the registration and certificate steps above.

• Start an age check from code: the developer docs
• Every operation, in the API reference
• Or ask your agent, through the MCP server