Short answer
The European Digital Identity Framework does not place every loss on one “wallet provider”. Regulation (EU) No 910/2014 (eIDAS), as amended by Regulation (EU) 2024/1183, divides responsibility by function.
Member States must provide or recognise at least one certified European Digital Identity Wallet, maintain validation mechanisms and suspend or withdraw compromised wallets. A private provider operating under a mandate or recognition has its own security, privacy, support and record-keeping duties. Article 11's fault-based liability rules apply to wallets mutatis mutandis, but the precise mapping and recoverable loss remain subject to the actors' roles and national liability law.
The issuer of an electronic attestation remains responsible for issuing and revoking it; storing it in a wallet does not make the wallet provider the source of its truth. Qualified trust service providers face Article 13 liability, with intention or negligence presumed unless they prove otherwise. A relying party must authenticate and validate wallet data before acting.
The framework is also phased. It entered into force on 20 May 2024, but Member States' wallet deadline is 24 December 2026. Some private acceptance duties begin only on 24 December 2027.
When must EU Digital Identity Wallets be available?
Regulation 2024/1183 amended eIDAS and entered into force on 20 May 2024. It did not make operational wallets available everywhere immediately. Article 5a(1) gives Member States 24 months from the entry into force of the implementing acts specified there and in Article 5c(6) to provide at least one wallet.
The four Article 5a(23) implementing regulations—2024/2977, 2024/2979, 2024/2980 and 2024/2982—and certification Regulation 2024/2981 were published on 4 December 2024 and entered into force on 24 December. The wallet deadline is therefore 24 December 2026.
Public bodies requiring electronic identification for an online service must accept compliant wallets once provided. Very large online platforms must accept them for authentication, at the user's voluntary request, where authentication is required. A separate rule for specified private relying parties using strong user authentication applies on 24 December 2027. These are different duties.
The Regulation is directly applicable in EU Member States. It is marked as EEA-relevant, but application in Iceland, Norway and Liechtenstein depends on EEA incorporation and adaptations; it should not be assumed from the EU dates alone.
What do Member States and wallet providers each control?
A wallet may be provided directly by a Member State, under its mandate, or independently and recognised by it. The State provides the framework, free validation mechanisms and revocation, and designates conformity assessment bodies.
Certification covers core functionality, high-assurance identification, data separation and cybersecurity. A certificate lasts up to five years, subject to a vulnerability assessment every two years; an unremedied vulnerability requires cancellation. Article 5e requires prompt suspension after a reliability-affecting breach, immediate withdrawal where severity justifies it, and withdrawal if the problem remains after three months.
now makes that incident process more concrete. The Member State assesses whether reliability is affected. If it suspends a wallet solution, it must ensure that no wallet units are provided, used or activated under that solution, consider revoking wallet-unit attestations and take those measures without undue delay and no later than 24 hours after suspension. It must also provide specified information to affected users, registered relying parties, the Commission and national single points of contact within the same 24-hour period. Those public-law response duties do not, by themselves, decide who must compensate a particular claimant.
Providers carry the operational layer. Wallets must be security-by-design and assurance-level high. Providers must offer technical support, protect critical assets, authenticate relying-party requests, keep wallet personal data logically separate and avoid unnecessary tracking or combining of data. Article 5a(20) also applies specified qualified-provider duties—identity checking, trustworthy systems, security against forgery or theft, record retention and termination planning—to wallet providers mutatis mutandis.
Certification does not guarantee against every attack, and State oversight does not erase a provider's fault.
Who is liable for a compromised wallet?
Article 5a(19) applies eIDAS Article 11 to wallets mutatis mutandis. Article 11 assigns fault-based liability in cross-border identification to the notifying Member State, the party issuing the identification means and the party operating authentication for failures within their respective duties. Claims remain governed by national liability rules, including causation, recoverable damage and procedure.
Because an ecosystem can separate the State, provider, identity-data issuer and authenticator, this is not automatic State compensation or broad strict liability for the app supplier. A claimant must identify the failed function, actor, duty, fault and causal loss. GDPR compensation may apply independently to unlawful personal-data processing.
Who is responsible for attestations and signatures?
An electronic attestation of attributes can state a characteristic, right or permission—for example, a qualification. Its issuer remains responsible for issuance, validity information and revocation. A qualified attestation is issued by a qualified trust service provider and must meet Annex V. A public authentic-source attestation has separate Article 45f controls: the Member State must ensure that the issuing public body has reliability and trustworthiness equivalent to a qualified provider and supports its notification with a conformity assessment.
For qualified and authentic-source attestations, Article 45b(2) says they:
“shall have the same legal effect as lawfully issued attestations in paper form.” —
That paper-equivalent effect is not a truth warranty. The relying party must still check authenticity, validity, scope and revocation.
Wallets must allow natural persons to create qualified electronic signatures by default and free of charge, subject to a possible non-professional-use limit. The qualified certificate, qualified signature-creation device and any remote management are trust-service functions. Under Article 13, a trust service provider is liable for damage intentionally or negligently caused by non-compliance. For a non-qualified provider, the claimant proves intention or negligence. For a qualified provider, intention or negligence is presumed unless rebutted. Properly disclosed, third-party-recognisable usage limitations can exclude liability for use beyond those limits under Article 13(2).
What must a relying party do before relying?
Wallet relying parties must register their identity, intended use and requested data. They may not request data beyond that declaration and must identify themselves to the user. adds national registers, registration policies and certificate rules. It requires relying parties to keep registered information accurate and update it without undue delay; registrars verify applications and can suspend or cancel defective or unlawful registrations. Most importantly:
“Relying parties shall be responsible for carrying out the procedure for authenticating and validating person identification data and electronic attestation of attributes requested from European Digital Identity Wallets.” —
A relying party should verify the wallet, issuer, signature or attestation, status, expiry, revocation and purpose before acting. It must also comply with the GDPR and sectoral duties. eIDAS has no universal reimbursement rule for careless acceptance; national law may decide that part of a loss.
A qualified signature also does not make a document incontestable. In V.B. Trade, Case C-466/22, the Court of Justice held that Article 25(2) equates a qualified electronic signature's legal effect with a handwritten signature. National law may still provide the same procedure for contesting both. Legal effect is not a guarantee of the underlying transaction or immunity from evidence rules.
covers the specific case where assurance-level-substantial identification is combined with remote onboarding to meet assurance level high. Its requirements fall on the person-identification-data provider or an identity-proofing service acting for it—not automatically on every later wallet participant.
A practical incident-allocation checklist
- Identify the failed object: wallet, person-identification data, attestation, certificate, signature or relying-party decision.
- Map the actor performing each function, including State, private wallet provider, identity-data issuer, trust provider and authenticator.
- Check certification, vulnerability, suspension, revocation and validity records at the incident time.
- Determine whether the relying party performed required authentication and validation and requested only registered data.
- Connect the breach to a specific eIDAS, implementing-act, GDPR, contract or national-law duty.
- Preserve logs, notices, validation results, terms and disclosed limitations needed to prove fault and causation.
- Apply the correct burden: ordinary proof for non-qualified providers; rebuttable presumed fault for qualified trust service providers.
Conclusion
The EUDI framework allocates responsibility by function, not by branding. Member States provide, certify and police wallet security; providers operate wallets under detailed technical and privacy duties; attestation and signature providers answer for their own trust services; and relying parties must authenticate and validate before acting. Article 11 and Article 13 provide fault-based routes to compensation, but national law still controls important questions of causation, procedure and recoverable loss. The relevant duty must also be checked against the phased dates: EU rules are in force, wallets are due by 24 December 2026, and the delayed private acceptance duty follows on 24 December 2027.
Sources
- Commission Implementing Regulations , , , and
- Commission Implementing Regulations and
This article provides general legal information, not advice for a specific matter. Laws, facts and procedural deadlines may change the result. Follow the linked primary sources and obtain local advice before acting.