theseeus.eu Cyber

eIDAS 2

← All instruments
in forceadjacent
Type
regulation
Layer
adjacent
Status
in force
In force
2024-05-20
CELEX
32024R1183
Last verified
2026-07-16
Official text
EUR-Lex / official source

eIDAS 2 — securing identity and the trust layer

Regulation (EU) 2024/1183 amends the 2014 eIDAS Regulation to create the European Digital Identity (EUDI) Wallet and modernise trust services. Its cybersecurity relevance is twofold: it secures the identity/trust layer many other services rely on, and its providers are simultaneously a NIS2 sector.

What it introduces

  • EU Digital Identity Wallet — every Member State must offer citizens and businesses a wallet to store and present identity attributes and credentials (e.g. diplomas, licences, payment credentials), usable across borders and accepted by large platforms and the public sector.
  • Modernised trust services — e-signatures, e-seals, timestamps, registered delivery, website authentication certificates, plus new services (e.g. electronic archiving, ledgers, remote signature-creation-device management).

Security-relevant obligations

  • High-assurance security for the wallet: certification against defined standards, strong authentication, and privacy-by-design (selective disclosure, user control, no unnecessary tracking).
  • Trust service providers — especially qualified ones — must meet strict security requirements, undergo conformity assessment/audit, and notify security breaches to the supervisory body (and affected parties) within tight deadlines.
  • Implementing acts specify the technical architecture (the “Architecture and Reference Framework”).

Interplay with cyber law

  • NIS2: trust service providers are a NIS2 Annex I sector; qualified TSPs are in scope regardless of size. Their eIDAS security duties and NIS2 duties coexist.
  • Digital Omnibus: eIDAS incident/breach notifications are slated to join the Single Entry Point.
  • CSA2 proposal: would extend NIS2-style obligations to wallet providers.
  • GDPR: the wallet is a large personal-data system; data-protection-by-design is central to its design.

Status

In force since 20 May 2024; the operational rollout depends on implementing acts and national wallet deployment. Member States are expected to make wallets available roughly 24 months after the key implementing acts. ⚠️ VERIFY current wallet-availability date.

Sources