eIDAS is the EU framework for cross-border electronic identification, European Digital Identity Wallets, and trust services used in electronic transactions.
This page helps separate eIDAS-covered services from adjacent login, certificate, document, and identity workflows that may be governed mainly by contract, sector rules, GDPR, or national law.
Structured answer sets in this page tree.
Cited legal and guidance references.
The EU framework covers two linked areas: used for access to online or offline services, and trust services that give legal and technical reliability to electronic transactions. The 2024 European Digital Identity Framework amendments add the , electronic attestations of attributes, electronic archiving, electronic ledgers, and updated trust-service rules. A useful scope review starts with the service being offered or relied on, not with the technology label used by a supplier.
Article 1 sets the basic perimeter: covers recognition of means under notified Member State schemes, provision and recognition of European Digital Identity Wallets, rules for trust services, and the legal framework for specified electronic transaction services.
Article 2 narrows that perimeter. The Regulation applies to schemes notified by a Member State, to European Digital Identity Wallets provided by a Member State, and to providers established in the Union. Trust services used exclusively inside closed systems created by national law or agreements between a defined set of participants are outside trust-service scope. The exclusion is for the provision of those closed-system trust services; it does not automatically exclude an external qualified service merely because a defined participant group uses it.
The original Regulation has applied generally since 1 July 2016. Regulation (EU) 2024/1183 entered into force on 20 May 2024, but its wallet and new trust-service changes use specific implementing-act and transition dates. Scope and readiness therefore need a provision-level date check rather than a single ' 2.0 applies' date.
under is the process of using person identification data in electronic form that uniquely represents a natural or legal person, or a natural person representing another person. An electronic identification means contains that data and is used for authentication to an online or, where appropriate, offline service. The cross-border recognition rules are tied to electronic identification schemes notified by Member States.
A relying party can be a natural or legal person that relies on , EUDI Wallets, other electronic identification means, or a . A normal account login, password reset, or customer identity check is not an electronic-identification flow merely because it identifies a customer; check whether it uses a notified eID scheme, an EUDI Wallet, or an eIDAS trust service.
trust services are electronic services normally provided for remuneration and listed in Article 3. The list covers issuing and validating specified certificates; creating and validating signatures and seals; preservation; remote signature or seal creation-device management; issuing and validating electronic attestations of attributes; creating and validating time stamps; registered delivery and validation of its data and evidence; electronic archiving; and recording data in an electronic ledger.
The qualified status of a is not a marketing description. A qualified trust service must meet the applicable requirements, and a qualified trust service provider must be granted qualified status by the supervisory body. For qualified services, trusted-list status is central to validation and evidence.
Trusted lists are where EU Member States publish information about supervised qualified providers and their qualified trust services. They are essential for checking whether a provider or service had qualified status at the time relevant to a signature, seal, certificate, delivery service, attestation, or other trust-service event.
The European Commission publishes a central List Of Trusted Lists with links to the Member State trusted lists. Systems that validate qualified signatures, seals, website certificates, or other qualified trust services should treat trusted-list retrieval, signature or seal verification, service status, service history, and certificate validity status as evidence, not as a one-time procurement check.
The EUDI Wallet is now part of the framework. The Regulation defines it as an means that lets the user securely store, manage, and validate person identification data and electronic attestations of attributes for presentation to relying parties and other wallet users, and to sign or seal with qualified electronic signatures or seals.
Attribute attestations are also within scope. A qualified electronic attestation of attributes is issued by a qualified provider and must meet Annex V. Attestations issued by or on behalf of a public sector body responsible for an authentic source follow Article 45f and Annex VII instead; they are not called qualified merely because a public body issued them. Implementations should track the attestation type, issuer role, authentic source, revocation status, wallet interface, and whether the presentation request is limited to attributes needed for the use case.
This checklist is relevant when a product, procurement, legal, identity, PKI, or security team needs to decide whether a workflow belongs on the register. The aim is to classify the actual service and preserve the validation material needed later.
Avoid broad labels such as digital identity, e-signing, certificate, wallet, or secure delivery without naming the category and the provider role.
gives electronic signatures the Article 25(1) rule that they cannot be denied legal effect or admissibility solely because they are electronic or not qualified. A signature is qualified only when it is an advanced electronic signature created by a qualified electronic signature creation device and based on a qualified certificate for electronic signatures.
It can. A TLS certificate falls within the definition of a certificate for website authentication when it authenticates a website and links the website to the natural or legal person to whom it is issued. It is qualified only when a qualified provider issues it and it meets Annex IV.
Check the provider, service type, qualified status, and status history in the relevant Member State trusted list, using the Commission List Of Trusted Lists as the EU entry point, and keep the validation evidence with the transaction record.
Use the categories on this page to classify eID schemes, wallet integrations, trust services, QWACs, trusted-list checks, and attribute-attestation flows before assigning legal, product, PKI, and security work.
Ask questions tied to cited sources about eIDAS scope, trust-service categories, wallet integrations, and validation evidence using the cited sources on this page.
Review whether a signature, seal, delivery, certificate, wallet, or attribute-attestation workflow is covered by eIDAS and what evidence should be kept.
"electronic attestations of attributes"
"General Policy Requirements"
"qualified status and the status history"
"Trusted Lists"
"Architecture and Reference Framework"
"European Digital Identity Framework"
"certificate for website authentication"