We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

FAQEU

EUDI Wallet relying parties under eIDAS

A relying party is the public or private service provider that asks a user to present identity data or attestations from a European Digital Identity Wallet.

Register in the Member State of establishment, declare the purpose and data list, identify the service to users, validate wallet data, and retain evidence that requests stayed within the registered scope.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Jul 25, 2026
Questions
4

Structured answer sets in this page tree.

Primary sources
5

Cited legal and guidance references.

Publication metadata
Sorena AI
Published May 9, 2026
Updated Jul 25, 2026
Overview

Under the amended eIDAS framework, an intends to rely on European Digital Identity Wallets for a public or private service delivered through digital interaction. Article 5b sets the role's registration, data-request, identification, validation, and change-notification duties. Commission Implementing Regulation (EU) 2025/848, as amended by Commission Implementing Regulation (EU) 2026/1730, supplies the harmonised registration mechanics, but they do not apply until 24 December 2026.

Search this module

Find a question or answer quickly

4 of 4 questions
Question 1

Who is an EUDI Wallet relying party under eIDAS?

A relying party is the service provider side of a wallet interaction: a public or private organisation that requests data from a user's EU Digital Identity Wallet before granting access to a service, verifying a customer, enrolling a student, checking a professional mandate, or receiving a digital document.

For Article 5b, the trigger is the intention to rely on the wallet for public or private services by means of digital interaction. Once that trigger is present, the relying party must register in the Member State where it is established. Because the harmonised national-register rules apply from 24 December 2026, a team preparing earlier must verify whether its Member State has already opened a registration route instead of assuming that an EU-wide registration portal exists.

  • Treat the role as triggered by wallet reliance, not by the organisation's sector label.
  • Map each wallet use case to the service being provided, the establishment Member State, and the specific wallet data needed.
  • Distinguish a relying party from wallet providers, PID providers, and attestation providers; the relying party is the service side requesting and receiving presented data.
  • If an intermediary acts on behalf of the relying party, Article 5b treats the intermediary as a relying party and restricts it from storing transaction-content data.

What is an under the EU eIDAS Regulation?

It is the public or private service provider that intends to rely on a European Digital Identity Wallet for a digital service interaction. In practice, that means the party asks the user to present , an , or other wallet-held data so the service can authenticate the user, verify an attribute, or process a digital document.

Citations
Question 2

What must be registered before requesting wallet data?

Article 5b requires the relying party to register in the Member State where it is established. The registration must include information needed for the party to authenticate to EUDI Wallets, contact details, and the intended wallet use, including the data the relying party will request from users.

From 24 December 2026, Commission Implementing Regulation (EU) 2025/848 harmonises the registration process. It requires national registers and policies, accurate registration data, prompt updates, verification against supporting documents or authentic sources, and cancellation when the relying party stops relying on wallets under that registration.

Article 5b limits the live request: relying parties must not ask users for data beyond what they indicated during registration. The registered purpose and attribute list therefore form a control boundary for product, legal, privacy, and engineering teams.

  • Registration jurisdiction: the Member State where the relying party is established.
  • Identity material: information needed to authenticate the relying party to wallets, including name and official registration details where applicable.
  • Contact details: the public contact record associated with the wallet relying-party registration.
  • Purpose and data list: the intended use of the wallet and the user data or attributes to be requested.
  • Change control: notify the Member State without delay when registration information changes.

Does an need authorisation before requesting wallet data?

The cited rule is registration, not a general EU-level pre-authorisation approval. Article 5b requires registration in the Member State of establishment and says the process must be cost-effective and proportionate to risk. Recital 17 adds that registration should not entail a pre-authorisation process, while leaving other Union or national service-specific laws unaffected.

Can an ask for attributes that were not listed during registration?

No. Article 5b says relying parties must not request user data other than the data indicated in the registered intended-use information. A new attribute, new purpose, or changed service should therefore reopen the registration and privacy review before it appears in the wallet request.

When do the harmonised EUDI Wallet relying-party registration rules apply?

Commission Implementing Regulation (EU) 2025/848 applies from 24 December 2026. Article 5b already establishes the registration duty, but before the harmonised rules apply, a relying party should verify the relevant Member State's register, policy, availability, and onboarding route rather than assume that the same process is live across the EU.

Citations
Question 3

How should the wallet interaction work for users?

The relying party should authenticate and identify itself to the user, request only the registered data needed for the service, and let the wallet present the specific requested data before the user confirms. Article 5b also makes the relying party responsible for authenticating and validating the and electronic attestations of attributes it requests from wallets.

The ARF adds a useful technical control point: the wallet can use relying-party registration information or certificates to help verify whether a request fits the registered attributes and warn the user if it does not. That technical model supports the legal purpose, data-minimisation, and transparency checks, but the binding obligation remains in eIDAS and applicable data-protection law.

  • Show the relying-party identity before requesting wallet data.
  • Display the specific PID fields, attestations, or attributes being requested for the transaction.
  • Allow the user to confirm or refuse the presentation through the wallet flow.
  • Validate the authenticity and validity of received PID or EAA data before relying on it.
  • Accept pseudonyms where Union or national law does not require identification of the user.

What should an show the user before receiving wallet data?

The relying party should identify itself and request only the specific data needed for the registered purpose. The Commission service-provider flow describes the wallet displaying the requested data to the user before confirmation, and Article 5b requires relying parties intending to rely on wallets to identify themselves to the user.

Who validates and electronic attestations received from an EUDI Wallet?

Article 5b places that responsibility on the relying party. The relying party must carry out the procedure for authenticating and validating the PID and electronic attestations of attributes it requested from the wallet, rather than treating the wallet presentation alone as a complete business approval.

Citations
Question 4

What evidence should a relying party keep?

A useful relying-party evidence record should prove that the live wallet request matches the registered purpose and data list. It should also show that the user saw who was requesting the data, what data was requested, and which validation procedure the service applied to the wallet response.

Avoid storing more wallet transaction content than the service needs. The ARF highlights relying-party linkability risks from unique fixed attestation elements, and Article 5b specifically says intermediaries acting for relying parties must not store data about transaction content.

  • Member State registration record, relying-party name, official registration details where applicable, and contact details.
  • Registered intended use, requested PID fields or attestation attributes, and the product/service feature that uses each item.
  • Wallet request configuration, relying-party authentication material, and, under the harmonised rules applying from 24 December 2026, wallet-relying-party access and registration certificates.
  • Validation procedure for PID and electronic attestations of attributes, including what is checked before granting service access.
  • Change log showing when a new service, purpose, data field, intermediary, or establishment fact triggered registration review.
  • Data-retention note explaining which transaction elements are discarded when no longer needed to reduce linkability and over-collection risk.
  • Do not misstate the harmonised registrar's 10-year recordkeeping duty as a blanket relying-party retention period. Commission Implementing Regulation (EU) 2025/848 requires registrars to keep registration, certificate-issuance, and change records for 10 years; the relying party still needs a separate legal and operational basis for retaining transaction content.

What evidence should an keep under eIDAS?

Keep the registration record, declared wallet purpose, requested data list, contact details, wallet request configuration, user-facing identification evidence, validation procedure for PID and electronic attestations, and change notifications. From 24 December 2026, also retain the access certificates and automatically issued registration certificates produced by the applicable national process. The record should let a reviewer compare the registered scope with the actual wallet request.

What records help prove a wallet request stayed within the registered scope?

Keep the registration record, the data list declared for the wallet use case, the user-facing request details, and the change log for any later scope updates. That combination shows whether the live request matched the registered intended use and helps explain any later review or update.

What happens if an EUDI Wallet relying-party registration is suspended or cancelled?

Under the harmonised rules applying from 24 December 2026, the registrar may suspend or cancel a registration for specified non-compliance, security, legality, fraud, or cessation grounds. The registrar must notify the affected relying party and relevant certificate providers without undue delay and no later than 24 hours after the action; the providers must then revoke the related access and registration certificates without undue delay where applicable. The service should stop making wallet requests under the affected registration until the status and any required remediation are resolved.

Citations
Recommended next step

Turn relying-party registration duties into wallet request evidence

Sorena can help map EUDI Wallet use cases to registered purposes, requested attributes, user-facing disclosures, validation checks, and change-control evidence.

Research workflow
Open Research Copilot for eIDAS

Ask questions tied to cited sources about EUDI Wallet relying-party scope, registration, requested data, and evidence using the cited sources on this page.

Explore next step
Talk to Sorena
Talk through implementation

Review your wallet request flow, registered data list, validation evidence, and unsupported national-registration questions with Sorena.

Explore next step
Primary sources

References and citations

EUDI Wallet Architecture and Reference Framework
eu-digital-identity-wallet.github.io
Referenced sections
  • The ARF grounds evidence for registered attributes, user approval, and retention controls that reduce relying-party linkability risk.
"Relying Parties will discard the unique fixed elements"
European Commission - Wallet for service providers
ec.europa.eu
Referenced sections
  • The Commission service-provider flow describes wallet display of requested data and user confirmation before service access or document presentation.
"wallet displays the specific data requested"
Related guides

Explore more topics

eIDAS 2 deadlines and compliance calendar for EUDI Wallet and trust services
eIDAS 2 calendar separating binding EUDI Wallet, reporting, and trust-service dates from implementation milestones and technical programme updates.
eIDAS 2.0 vs eIDAS: EUDI Wallet and trust-service changes
Compare the original eIDAS electronic identification and trust-service framework with the eIDAS 2.0 amendments for EUDI Wallets, relying parties, attestations, QWACs, and supervision.
eIDAS Certificates and Authentication: qualified certificates, QWACs, and validation checks
Official source guide to eIDAS qualified certificates, website authentication certificates, trusted lists, relying-party checks, and validation evidence.
eIDAS checklist and evidence pack for trust services, signatures, and EUDI Wallet relying parties
Build an eIDAS evidence pack for qualified trust services, electronic signatures, trusted-list checks, certificate validation, supervisory records, and EUDI Wallet relying-party controls.
eIDAS compliance guide for trust services, QTSPs, signatures, and EUDI Wallet relying parties
Official source eIDAS compliance guide for trust-service classification, QTSP supervision evidence, qualified signatures, seals, time stamps, certificates, trusted-list validation, and EUDI Wallet relying-party records.
eIDAS electronic signatures: SES, AES, QES legal effect and evidence
An official source guide to eIDAS electronic-signature legal effect: SES, AES, QES, qualified certificates, QTSP trusted-list checks, validation, recognition, and evidence records.
eIDAS penalties and fines for trust service providers
Guide to eIDAS Article 16 fine floors, national penalty rules, supervisory action, qualified-status withdrawal, and trusted-list evidence.
eIDAS QES validation checks for relying parties
How to validate a qualified electronic signature under eIDAS: certificate, QTSP, trusted-list, QSCD, integrity, validation result, and evidence records.
eIDAS Qualified Trust Services: QTSP Selection
How to select an EU eIDAS qualified trust service provider: identify the qualified service type, verify trusted-list status, review supervision evidence, and retain certificate-policy records.
eIDAS remote signature and cloud HSM controls for QTSPs
Source-grounded guide to eIDAS remote signature controls: remote QSCD scope, server-side signing, QTSP evidence, signer authentication, certificate validation, and trusted-list checks.
eIDAS signature legal effect selector: SES, AES, AES-QC, or QES
Compare eIDAS signature levels by legal effect, governing form rules, qualified certificate status, QTSP evidence, QSCD use, validation, and public-service recognition.
eIDAS trust service role scoping workflow: TSP, QTSP, validator, relying party, or QTSP customer
Classify an eIDAS role by evidence: trust service provider, qualified trust service provider, signature or seal validator, EUDI Wallet relying party, relying party, or customer of a QTSP.
eIDAS trusted list validation: LOTL, QTSP status, and evidence
How to validate EU eIDAS trusted-list evidence: start from the Commission LOTL, confirm QTSP and qualified-service status, check certificate path and revocation data, and retain validation reports.
eIDAS vs ESIGN and UETA: EU qualified signatures vs U.S. e-signature laws
Compare eIDAS with ESIGN and UETA for electronic signatures, qualified certificates, trust services, cross-border recognition, validation evidence, and source gaps.
eIDAS vs ETSI EN 319 401: legal supervision and TSP policy requirements
Compare eIDAS and ETSI EN 319 401 for trust services: legal scope, QTSP supervision, conformity assessment, audits, incident evidence, and operational controls.
eIDAS vs GDPR for identity data: wallet, trust-service, and privacy obligations
Compare eIDAS identity, trust-service, and EUDI Wallet rules with GDPR duties for personal-data processing, minimisation, lawful basis, evidence, security, and user rights.
eIDAS vs NIS2 for trust service providers: QTSP and cybersecurity obligations
Compare eIDAS trust-service and QTSP duties with NIS2 cybersecurity risk-management, incident reporting, supervision, and evidence duties for trust service providers.
Electronic Attestations of Attributes under EU eIDAS: EAA, QEAA, issuers, wallets, and validation
Official source guide to electronic attestations of attributes under amended EU eIDAS: EAA, QEAA, public-sector authentic-source attestations, wallet use, issuer checks, relying-party validation, revocation, and legal effect.
EU eIDAS Applicability Test for Trust Services, Wallets, and Certificates
An official source eIDAS scope test for QTSPs, trust services, electronic signatures, seals, timestamps, QWACs, EUDI Wallet relying parties, and cross-border recognition evidence.
EU eIDAS attribute attestations: EAA, QEAA, wallet, and relying party checks
What electronic attestations of attributes mean under eIDAS, how QEAAs differ from public-sector and non-qualified attestations, and what issuers, wallets, and relying parties should verify.
EU eIDAS checklist for signatures, trust services, and wallets
Checklist for eIDAS trust-service and EUDI Wallet controls: qualified status, trusted lists, certificates, signatures, seals, timestamps, validation evidence, and relying-party records.
EU eIDAS FAQ: signatures, QTSPs, trusted lists, QWACs, wallets, and validation
FAQ on eIDAS trust services and the European Digital Identity framework, covering advanced and qualified electronic signatures, QTSP status, trusted lists, QWACs, EUDI Wallet relying parties, attestations of attributes, and validation evidence.
EU eIDAS QTSP authorization and supervision guide
How qualified trust service providers obtain and keep qualified status under eIDAS, including conformity assessment reports, supervision, trusted lists, incidents, and evidence.
EU eIDAS QTSP Due Diligence Workflow for Trusted Lists, Certificates, and Evidence
Check a qualified trust service provider under eIDAS by validating trusted-list status, qualified service scope, certificates, policies, supervision, audits, and retained evidence.
EU eIDAS Requirements for Trust Services, Signatures, Seals, Wallets, and Evidence
Official source guide to core eIDAS requirements for trust service providers, qualified trust services, electronic signatures, seals, time stamps, trusted lists, and EUDI Wallet relying parties.
EU eIDAS Trusted Lists FAQ: LOTL, QTSP status, and validation evidence
How EU eIDAS Trusted Lists and the Commission LOTL support QTSP and qualified trust-service validation, with practical evidence checks for relying parties.
EUDI Wallet readiness for service providers under eIDAS
Readiness guide for organisations preparing to request or verify data from European Digital Identity Wallets: roles, registration, ARF alignment, selective disclosure, implementing acts, and evidence.
EUDI Wallet Relying Party Onboarding Workflow under eIDAS
Prepare an eIDAS wallet-relying-party registration, intended-use record, access-certificate controls, attribute request, validation evidence, and intermediary safeguards.
EUDI Wallet Relying Party Registration Under eIDAS
What eIDAS Article 5b and the EUDI Wallet ARF say about wallet relying party registration, intended uses, attribute requests, certificates, evidence, and Member State gaps.
EUDI Wallet Technical Architecture Guide under eIDAS
Technical guide to the EUDI Wallet architecture: ARF roles, wallet units, PID and attestations, relying parties, trust model, certificates, protocols, privacy, and security controls.
QES vs AdES under EU eIDAS: legal effect, certificates, QTSPs, and validation evidence
Compare qualified electronic signatures (QES) and advanced electronic signatures (AdES) under EU eIDAS, including legal effect, qualified certificates, QTSP status, QSCDs, and validation evidence.
QWACs under eIDAS: website authentication certificates
A source-grounded guide to qualified website authentication certificates under eIDAS, covering Annex IV data, trusted lists, browser recognition, validation evidence, and QTSP checks.
What eIDAS Covers: eID, Trust Services, EUDI Wallet, and QWACs
A source-grounded guide to the systems and services covered by EU eIDAS: notified electronic identification, trust services, signatures, seals, time stamps, registered delivery, website authentication, trusted lists, the EUDI Wallet, and attribute attestations.
What is a qualified trust service provider under eIDAS?
How to verify QTSP status under eIDAS using the qualified service, supervisory body decision, trusted list entry, conformity assessment evidence, and service-specific records.
What is a QWAC under the EU eIDAS Regulation?
Plain-language FAQ on qualified website authentication certificates under eIDAS, including website identity, QTSP trusted-list checks, browser recognition, and validation evidence.