Would you trust one app with all your digital identity?

Brussels wants to streamline and simplify personal administrative tasks. By the end of the year, the EU will launch the EU Digital Identity Wallet (EUDI Wallet). It’s a private digital space where citizens, residents and businesses can store and share personal documents, access private and public services, and sign documents digitally.

The Digital Identity Wallet is a free app that users can download on their mobile devices. It reduces reliance on major tech companies’ storage solutions, like Apple and Google Wallet, and on national systems, while giving users more control over their personal data.

There won’t be a single digital wallet app for the entire EU. Instead, each member state has to create its own. These apps will share the same technical standards, allowing users to access their wallets and service providers to deliver services anywhere in the EU at any time.

What is the EUDI Wallet?

The EUDI Wallet is part of the eIDAS 2.0 Regulation, which aims to create a single digital market for electronic identification. It’s a digital identity app for citizens, residents, and businesses in the EU that simplifies document storage, streamlines digital identification, and makes it more secure and reliable.

Instead of carrying printed copies of personal documents or using multiple mobile storage apps, the Wallet lets users keep all their important documents in one private digital space. These can include official credentials such as national IDs or birth certificates. Medical prescriptions, university diplomas, mobile versions of driving licences, gym memberships and boarding passes can be included too.

Through the Wallet, users can share documents with private and public authorities, both online and offline, across the EU. For example, when applying for a job in Germany, users can show employers a Spanish university certificate without submitting paperwork from scratch. When renting a flat in Stockholm, users can show their rental history from Milan directly from the Wallet, without using a national app.

Users can access national or cross-border public services, including health insurance or social security portals, or apply for a passport or file taxes. They also have direct access to private services, including applying for a bank loan or opening an online bank account.

When applying for services, users must identify themselves, but remain in control of their digital identity throughout the process.

“People should have the right to say no, to not share any of your information or only selectively share information. For example, if someone asks for your student ID, you could give them your university name and maybe the subject you study, but not your student ID”, said Thomas Lohninger, Executive Director of the digital rights NGO epicenter.

Built-in features, such as “selective disclosure” and “zero-knowledge proof”, will let users share only the required information, without revealing other identifying details. This ensures that service providers collect only the minimum data needed to provide a service. Through a privacy dashboard, users will track who has access to their data, while digital document issuers must not track or profile users.

Users can sign documents directly from the Wallet using a free e-signature that has the same legal validity as a handwritten one across member states.

Security and privacy

Since the Wallet consolidates a wide range of vital credentials into one digital system, centralising so much sensitive information creates a single point of failure.

“If you put all eggs in one basket, then that basket hopefully never fails,” said Lohninger. A hack, technical failure or outage could potentially affect access to everything from public transport and government services to digital accounts and identity documents.

If a user’s phone is compromised or stolen, the thief could gain immediate access to a citizen’s entire legal, medical, and professional information.

Second come the technical risks. Even though the legal framework forbids member states from tracking wallet usage, the application still has to communicate with government servers to check if a credential is valid. If a state implements a centralised verification system, it creates a digital trail. This would allow a government or collaborating private corporations to cross-reference timestamps and keys, tracking exactly where and when a citizen authenticates.

There is also growing concern about what privacy advocates call “over identification.” Lohninger argues that the Wallet could make verified identification so easy and inexpensive that organisations begin requesting it even where it was previously unnecessary. “Things that we can do pseudonymously or anonymously right now might soon become more and more under real name obligation,” he said.

The risks will vary depending on how each member state decides to store the data. The option that guarantees the most privacy is decentralised architecture, where all credentials live exclusively on the smartphone’s physical secure hardware chip. But if a country prefers cloud-based backups or central servers, it creates a massive target for cybercriminals and insider threats, significantly weakening data security.

Some of the privacy protections envisioned for the Wallet also depend on cryptographic technology that is still being developed. Lohninger pointed to zero knowledge proofs, which could, for example, allow someone to prove they are over 18 without revealing their date of birth.

But he cautioned that parts of the required technical framework remain unfinished and described some of the privacy preserving technology as “the frontier of cryptographic science.” In practice, he said, developers are balancing a difficult triangle of privacy, security and usability.

Who is behind EUDI?

Three actors work together to make the system work. Wallet providers are private companies that build the wallet apps, make them available for users to download, and provide technical support. Issuers are trusted public or private organisations that issue digital documents, such as education certificates, residence permits and driving licences. Service providers are private or public entities that use the information in the wallet and request user authentication before offering their service, such as pharmacies or universities.

Six large-scale pilots (LSPs) combine public and private-sector expertise to test and improve the Wallet’s functionality across a range of real-life scenarios, such as ticket purchase and travel check-in, ahead of its rollout. 550 private companies and public authorities across the EU, Norway, Iceland and Ukraine are involved in the current LSPs and test more than 11 everyday use cases.

Two LSPs are currently active, while four started in 2023 and have now completed their work. APTITUDE, is testing the Wallet for applications like the Digital Travel Credentials (DTC), a secure digital version of the passport for faster, smoother border checks. WE BUILD Consortium focuses on streamlining payment interactions between businesses, between businesses and governments, and between businesses and consumers.

Member states will have their own national wallet app. The Commission has set up a common EU-wide toolbox that wallet providers must implement. This includes technical specifications, such as agreed standards, protocols, and formats.

National situation

EU countries are racing against a deadline, as they need to provide citizens with a fully functional EUDI wallet by the end of 2026. But Lohninger expects the rollout to be uneven. “Very few member states will be able to hold this deadline,” he said, as some countries may launch systems that resemble the Wallet without being fully functional or interoperable from the start. The frontrunners are Italy, France, Finland, and Bulgaria.

Their strategy was to leverage pre-existing digital services and widely adopted apps, updating them to fit EUDI. They already have open testing environments where developers and third-party credential verifiers can integrate with the upcoming wallet infrastructure.

Italy’s government integrated the EUDI framework directly into its popular public services app, IO, via the IT-Wallet initiative. Italian citizens can already load digital health cards and driving licences into a live test environment.

Meanwhile, France launched the EUDIW Unfold Playground through its pre-existing France Identité ecosystem. It’s a specialised sandbox that allows external technology tools to issue and verify digital credentials within the French environment.

Another country racing ahead is Croatia, which is re-coding its pre-existing Certilia Wallet app to align with the EU’s strict Architecture Reference Framework. This allows it to turn an already-trusted domestic app into a legally compliant European wallet well ahead of the deadline, saving time and development resources.

Other member states struggle with technical delivery, government bottlenecks, commercial motivations, and security issues. Many countries lack the local cybersecurity framework to certify apps to this standard quickly.

Sweden and Germany haven’t yet figured out practical delivery, with Sweden publishing a roadmap that sets a 2028 or 2029 EUDI Wallet release date. Germany hasn’t moved from the prototype phase to a cohesive national rollout; It’s slowed by complex procurement and debate over whether the wallet should be fully public or a public-private hybrid.

All this while Greece, Slovakia, and others remain stuck in private testing phases. Unlike Italy or France, they do not have an open public sandbox or external APIs for developers to test against. Romania was in this group until a private partnership with Mastercard helped it fast-track a hybrid model.