eIDAS 2.0 implementing acts: where we stand and what changes for businesses

Over 30 implementing acts adopted, the three July 2026 updates already in force and just over two months to the first major deadline. The eIDAS 2.0 regulatory framework is now well defined: here is what it means in practice for businesses

The eIDAS 2.0 implementing acts are the Commission regulations that turn the principles of Regulation (EU) 2024/1183 into binding technical specifications and procedures for the European Digital Identity Wallet (EUDI Wallet) and for qualified trust services.

At a glance

Regulation (EU) 2024/1183 (eIDAS 2.0) has been in force since 20 May 2024 and becomes operational through over 30 implementing acts, covering the EUDI Wallet architecture and the new trust services framework.
The three update acts, open for consultation until 5 March 2026, were adopted on 15 July 2026 (Implementing Regulations (EU) 2026/1730, 2026/1731 and 2026/1735) and have been in force since 11 August 2026.
24 December 2026: every Member State must make at least one wallet available to its citizens.
10 July 2027 (AMLR fully applicable), 19 August 2027 (new identity proofing standards, ETSI TS 119 461 V2.1.1) and 24 December 2027 (obligation for regulated entities to accept the EUDI Wallet) are the next deadlines.
In Italy, the IT-Wallet has two implementing decrees published in the Gazzetta Ufficiale (Italy’s Official Gazette) on 23 July and 3 August 2026, with deadlines on 3 August 2027 for public administrations and 3 February 2028 for the Istituto Poligrafico e Zecca dello Stato (IPZS, Italy’s mint and state printing institute).
For businesses, three key actions: register as a relying party, assess the role of attribute issuer, and update signature, verification and onboarding systems.

In this article you will discover:

What the implementing acts are and why they matter

The eIDAS 2.0 regulation, formally Regulation (EU) 2024/1183 amending Regulation 910/2014, entered into force on 20 May 2024. But a regulation that sets out principles and objectives becomes operational only when implementing acts translate its requirements into concrete technical specifications. This is what has been happening since December 2024, when the first five wallet implementing acts entered into force (24 December 2024).

As of October 2026, over 30 implementing acts have been adopted, covering the entire architecture of the European Digital Identity Wallet (EUDI Wallet) and the new framework for trust service providers. The process is essentially complete: the three update acts that were still being adopted were adopted in July 2026, and the foundations are solid and binding. Alignment will culminate by 2026: the implementing acts define the technical rules and operating procedures needed to ensure the compliance of EUDI Wallets and related services.

The adopted acts

The implementing acts fall along two main axes: those concerning the wallet and those concerning trust services.

On the EUDI Wallet side, the adopted regulations define the technical standards for the wallet’s integrity and core functionalities, the protocols and interfaces for data exchange between wallet and relying parties, the conformity certification system for wallets, the rules for registering relying parties in national registers, the procedures for cross-border identity matching and the handling of security breaches. One specific act, Regulation 2026/798 (of 7 April 2026), also sets the standards for remote user onboarding, defining the technical requirements for remote identity proofing processes.

On the trust service provider side, the framework now includes entirely new categories of services compared with eIDAS 1.0. Regulation 2025/1569 governs the verification of electronic attestations of attributes (QEAA/EAA): the mechanism through which the wallet carries certified information about who we are and what role we hold. Regulation 2025/1567 sets the standards for the remote management of qualified signature and seal creation devices (RQSCD), a key element for those providing qualified signature as a service. Regulation 2025/2532 covers qualified electronic archiving; Regulation 2025/2531 covers qualified electronic ledgers, with certified requirements for integrity, chronology and immutability.

Acts have also been adopted on qualified certificates for website authentication (QWAC), validation of qualified and advanced signatures, electronic time stamps, qualified electronic registered delivery services, requirements for QTSPs, accreditation of conformity assessment bodies, and formats for advanced signatures and seals.

The full list and the status of each act are available in the European Commission’s official overview of the implementing acts.

The three July 2026 updates

After the public consultation closed on 5 March 2026, the Commission adopted the three acts updating parts of the framework on 15 July 2026. Published in the Official Journal of the European Union on 22 July 2026, they have been in force since 11 August 2026:

Implementing Regulation (EU) 2026/1731 updates the references to standards and technical specifications in Regulations 2024/2977 (person identification data and attestations), 2024/2979 (integrity and core functionalities), 2024/2980 (trust framework) and 2024/2982 (protocols and interfaces), to ensure interoperability between Member States’ wallets;
Implementing Regulation (EU) 2026/1735 updates the standards and specifications of Regulation 2025/1569 on electronic attestations of attributes, including the rules on revocation and verification;
Implementing Regulation (EU) 2026/1730 updates Regulation 2025/848 on the registration of relying parties in national registers.

These updates do not signal regulatory instability, but the natural technical maturation of a complex infrastructure. They do not change the calendar deadlines. For businesses, the lesson is simple: monitoring the framework is not a one-off snapshot, it requires continuous attention.

Key deadlines

24 December 2026. All Member States must make at least one wallet available to their citizens. With just over two months to go, national paths are progressing at different speeds. Italy has already started with the IT Wallet on the IO app, covering driving licence, health card and disability card, in progressive alignment with the European framework. From the same date, the rules of Regulation 2025/848 on the registration of relying parties in national registers apply.

10 July 2027. The European AML Regulation (AMLR), in force since 2024, becomes fully applicable and introduces a unified framework for customer due diligence across Europe, eliminating differences between national KYC rules. The convergence with the eIDAS deadlines is no coincidence: the two regulations reinforce each other, and those who act on both fronts in a coordinated way gain a significant advantage.

19 August 2027. Regulation (EU) 2025/1566 becomes fully applicable, setting the ETSI TS 119 461 V2.1.1 technical standard for identifying applicants for qualified certificates (QES, QSeal, QWAC) and qualified electronic attestations of attributes (QEAA). From this date, identity proofing processes (especially remote ones) that do not rely on the EUDI Wallet or on a notified eID at level High must be certified by an independent accreditation body. For providers of qualified signatures, this means reviewing the entire identification chain; for users, it means checking that their QTSP partners have already obtained certification.

24 December 2027. Businesses required by law, large online platforms, banks, telecom operators and other entities in regulated sectors will have to accept EUDI Wallet identification for access to their services, in addition to existing mechanisms.

The Italian context: IT-Wallet and national deadlines

In Italy, the implementation framework of the IT-Wallet, the national digital wallet provided for by Article 64-quater of the Codice dell’amministrazione digitale (CAD, Italy’s Digital Administration Code), took shape in summer 2026 with two decrees published in the Gazzetta Ufficiale: the decree of 17 June 2026, approving the IT-Wallet System Guidelines and the pilot rules (GU No. 169 of 23 July 2026), and the decree of 19 March 2026, regulating the IT-Wallet System and its services (GU No. 178 of 3 August 2026).

There are two operational deadlines. By 3 August 2027, public administrations, public service operators and publicly controlled companies must join the system as authentic source holders, making their data available as electronic attestations. By 3 February 2028, the Istituto Poligrafico e Zecca dello Stato (IPZS) will be able to issue electronic attestations of personal identification data also after verifying the user’s identity through the Carta d’Identità Elettronica (CIE, Italy’s electronic identity card).

The decree provides that data presented through the IT-Wallet are exempt from administrative checks and that authentication with the IT-Wallet is equivalent to authentication with SPID and CIE (Article 6). Basic services remain free for citizens; for businesses and private entities, chargeable services are envisaged, with fees to be defined in a later measure. Since 3 August 2026, private entities can also register with the system.

The new scope of trust services

eIDAS 2.0 does not merely update the existing framework: it expands it substantially. The consolidated regulation now defines qualified trust services far more broadly than eIDAS 1.0, including the issuance and validation of electronic attestations of attributes, the remote management of qualified signature and seal creation devices, the recording of data in qualified electronic ledgers and qualified electronic archiving.

For providers already active in the trust ecosystem, this expansion is a direct opportunity: those offering qualified signatures, preservation or digital identity can extend their service portfolio by leveraging existing accreditations and infrastructure, without starting from scratch.

What businesses should do today

Register as a relying party. Registration in national registers is the enabling step for integrating the EUDI Wallet into business processes: customer onboarding, supplier verification, employee authentication. Registers are becoming operational: latecomers risk not being ready for 2027. The European rules on national registers (Regulation 2025/848, updated by Regulation 2026/1730) apply from 24 December 2026.

Assess the role of attribute issuer. Organisations holding certified data, such as professional associations, chambers of commerce, financial institutions and social security bodies, can become authoritative sources of attestations in the wallet. It is not just compliance: it is a strategic position in the European digital ecosystem.

Update signature, verification and onboarding systems. The new technical standards, in particular alignment with the recently updated ETSI standards and norms referenced by the implementing acts, require a review of existing platforms. The investment can be planned today, with clear specifications.

Opportunities for businesses

Integrating EUDI Wallets into business processes will bring benefits in many areas, including:

Customer onboarding: simpler identification processes, with immediate service activation.
Supplier onboarding: quick verification of documents and certifications to enable new collaborations.
Employee onboarding: immediate access to company systems and personalised benefits.
Access to premises and company systems: secure authentication for staff and visitors.

Businesses will also be able to contribute to the wallet ecosystem by enriching the available information with their own data, creating new synergies and business models.

Intesa: inside the ecosystem

Intesa does not watch this process from the outside. As a Qualified Trust Service Provider (QTSP) under eIDAS and an accredited operator for preservation, signature, identification and certificates, Intesa is already inside the operational perimeter that the implementing acts are building.

Our platforms, Intesa Sign for electronic signature, Intesa ID for digital identification and Intesa CMS for certificate management, evolve in line with the new standards. We follow the progress of every implementing act, take part in European technical working groups and turn regulatory developments into concrete solutions for our customers. When the framework changes, we are already ready. Intesa (Havant Group) was also admitted on 9 July 2026 to the IT-Wallet System pilot as an Electronic Attestation Verifier.

Glossary

Implementing act: a regulation adopted by the European Commission to translate the provisions of a basic regulation, in this case eIDAS 2.0, into technical specifications and procedures.
EUDI Wallet: the European Digital Identity Wallet, the European digital wallet through which citizens, residents and businesses securely manage and share identity and attestations.
Relying party: a public or private entity that requests data or attestations from the user’s wallet to provide a service and that must be registered in the national register.
QTSP: Qualified Trust Service Provider, a provider of qualified trust services under eIDAS.
QEAA/EAA: electronic attestations of attributes, either qualified (QEAA) or issued by public bodies responsible for an authentic source (EAA), which the wallet carries to certify information about a person or organisation.
Authentic source: a public register or database holding official data that can issue attestations of it.
RQSCD: a remote qualified signature or seal creation device, managed by the QTSP.
Identity proofing: the process of verifying a person’s identity before issuing a certificate or attestation, including remotely.
ETSI TS 119 461: the technical standard defining identity verification requirements, made binding by Regulation (EU) 2025/1566 from 19 August 2027.
IT-Wallet: the Italian digital wallet system provided for by Article 64-quater of the CAD, managed by the designated public companies and accessible through the IO app.

Conclusions

The regulatory evolution introduced by eIDAS 2.0 marks a turning point for digital identity in Europe. Adopting EUDI Wallets is not just a compliance exercise, but a strategic opportunity for businesses, which will be able to redesign their processes with an unprecedented level of security and reliability.

In this scenario, the role of qualified technology partners will be essential to support businesses in integrating the new digital tools. With its experience in digital identity and trust services, Intesa positions itself as a point of reference for organisations that want to make the most of what eIDAS 2.0 offers, supporting businesses in adopting compliant, secure and innovative solutions.