Access certificate: what it is, who issues it and how it is renewed

The access certificate – formally the wallet-relying party access certificate (WRPAC) – is how a business or public body identifies itself to an EUDI Wallet. The wallet checks it with every request and shows the user who is asking for data. It is issued only to registered relying parties (Art. 7(2) of Implementing Regulation (EU) 2025/848), by a provider that each Member State must authorise.

Two points are still open as of 12 October 2026: how long the certificates are valid, and who the authorised providers are in each country. The Commission’s list of access certificate providers has not yet been published. This page is general information, not legal advice.

What the certificate is for

When a user is asked to share data from their wallet with a bank, an online shop or a public authority, the wallet needs to know who is asking. The access certificate is a certificate for electronic seals or signatures that authenticates and validates the relying party (Art. 2(12) of Regulation 2025/848). It allows:

• the wallet to confirm that the requesting organisation is registered,
• the user to see who will receive the data,
• the wallet to refuse a request if the certificate is invalid or revoked.

The certificate contains, among other things, the relying party’s name, identifiers, website and contact details and a reference to the national register in which it is registered (Annex IV point 3(k), as amended by Regulation 2026/1730).

The certificate does not replace registration. It is the technical proof of it. If you are new to the topic, start with What is a relying party?.

Access certificate and registration certificate

The registration certificate lets the wallet check whether a request stays within what the relying party registered and warn the user if it does not (Art. 8(2)(d)). Germany’s official FAQ likewise says organisations receive an “access and registration certificate for the organization and the use case” after identification.

Who issues it

Each Member State must authorise at least one certificate authority to issue access certificates (Art. 7(1)). The provider is a natural or legal person mandated by the Member State (Art. 2(11)); in our reading, that can be a public body or a private trust service provider. The certificate policies are harmonised across the EU and must comply with ETSI TS 119 411-8 (Annex IV point 3, as amended by Regulation 2026/1730), so the certificate should work with every wallet, whichever country issued it.

Member States notify their providers to the Commission, which publishes them in a signed, machine-readable list that can be read without registration (Art. 5(2) and (3) of Implementing Regulation (EU) 2024/2980). The Commission’s eIDAS Dashboard refers to this list, but as of 12 October 2026 it is not yet published. Eudigo checks the list daily and will report when it appears.

Who acts as issuer varies by country, and we have not yet found official designations for most of them. Two examples: in Italy, a decree signed on 31 July 2026 assigns the issuing of access and registration certificates to the state printing works IPZS (Art. 3(3) of the DPCM). Poland’s draft law assumes that qualified trust service providers will issue the certificates on the basis of the register data (impact assessment of 18 February 2026). Germany has chosen a public body in its draft law: under § 10(1) of the draft Digital Identities Act, the Federal Office of Administration (BVA) would be both registrar and certification authority, with the power to issue access and registration certificates. As of 12 October 2026 the act is a cabinet bill; the Bundestag’s second and third reading is scheduled for 15 October 2026.

From registration to certificate

1. Register as a relying party in your Member State of establishment, with all intended uses – see How does a business register as a relying party?
2. The registrar checks your details (Art. 6).
3. An authorised provider issues the access certificate and the registration certificate. Before issuing, the access certificate provider checks that your registration is valid and that the certificate data match the register (Annex IV point 3(c)).
4. You install it in your own integration or with your service provider.

If you use an intermediary, note that the intermediary is itself a relying party and must register (Art. 5b(10) eIDAS). Clarify in the contract whose certificate is used for which requests.

Renewal, revocation and expiry

• Validity and renewal: neither Regulation 2025/848 nor ETSI TS 119 411-8 sets a fixed validity period; it follows from the provider’s certificate policy. The certificate practice statement must describe how certificates are issued, managed, revoked and re-keyed (Annex IV point 2). Without a valid certificate, wallet requests fail.
• Revocation: if a registration is suspended or cancelled – for example because a relying party requested more data than it registered – the certificates must be revoked without undue delay (Art. 9(6)). Providers also monitor the register and revoke certificates whose content no longer matches the registration (Annex IV point 3(e)). They publish the revocation status within 24 hours of a revocation request at the latest (Annex IV point 3(h)).
• Changes: new purposes or data must first be updated in the register (Art. 5b(6) eIDAS).
• Transparency: the public register API returns current and historic access and registration certificates for each relying party (Annex II). Anyone can therefore see when a certificate was replaced.

Common mistakes

• Missing the expiry date: when the certificate expires, every wallet request fails. Record the expiry date and start renewal in good time.
• New purposes without updating the register: the registration certificate only covers the registered intended uses. Register new data requests first.
• Company details changed, certificate forgotten: if your name or contact details change, the access certificate no longer matches the register and may have to be revoked. Report the change and plan for a new certificate.
• Weak key protection: the private key belongs in a secure environment, such as a hardware security module or a trusted service provider.
• Switching providers: if you use an intermediary, agree in advance how certificates and registration data move when you change provider.

What is still open

• validity period and renewal cycle
• fees, which are set nationally
• the authorised issuers in each Member State
• whether service providers may apply for certificates on behalf of their clients

We will update this page when the Commission publishes the provider list and national authorities publish details. Key dates are in the EUDI Wallet deadlines overview; the status of each country is in the EUDI Index.