The EUDI Wallet is built on a handful of open standards, profiled by ETSI and made binding by EU implementing regulations. This page shows which standard does what, which version is current and which version the law refers to.
Checked: · Developer hub · Spec tracker · Glossary
What changed in 2026
Since 11 August 2026, Implementing Regulation (EU) 2026/1731 ties the wallet to concrete technical specifications: credentials in SD-JWT VC and ISO mdoc, issuance with OpenID4VCI, presentation via an OpenID4VC-HAIP profile or an ISO mdoc profile, revocation with the IETF Token Status List. The details are in three ETSI profiles (TS 119 472-1, -2, -3). The W3C Verifiable Credentials Data Model named in the original 2024 regulations no longer appears in the amended annexes.
Two credential formats run side by side. SD-JWT VC is JSON-based and mainly used online; mdoc is CBOR-based and is the only format for in-person presentation. The amended regulation provides for both formats for PID and attestations; relying parties choose what they request.
| Task | SD-JWT VC path | mdoc path |
|---|---|---|
| Issue PID and credentials | OpenID4VCI · HAIP · ETSI TS 119 472-3 | OpenID4VCI · HAIP · ETSI TS 119 472-3 |
| Credential format | SD-JWT VC · SD-JWT · ETSI TS 119 472-1 | ISO/IEC 18013-5 (mdoc) · ETSI TS 119 472-1 |
| Present online (redirect, QR code or browser API) | OpenID4VP · HAIP · ETSI TS 119 472-2 | OpenID4VP · HAIP · ISO/IEC TS 18013-7 · ETSI TS 119 472-2 |
| Present in person (NFC, BLE, QR code) | not applicable | ISO/IEC 18013-5 (mdoc) · ETSI TS 119 472-2 |
| Revocation and status | Token Status List | Token Status List |
| Relying party authentication | ETSI TS 119 411-8 · ETSI TS 119 475 | ETSI TS 119 411-8 · ETSI TS 119 475 |
The ETSI profiles (TS 119 472-x, 119 411-8, 119 475) narrow the general standards down for the EUDI Wallet. Where they and the base standard differ, the profile referenced in the regulation applies.
The version in the regulation is not always the latest one. For implementers, the version referenced in the legal text is binding; newer versions show where the specifications are heading.
| Standard | Publisher | Used for | Status | Latest version | In the regulation |
|---|---|---|---|---|---|
| OpenID4VCI | OpenID Foundation | Issuance | final | 1.0 (16 Sept 2025) | 1.0 |
| OpenID4VP | OpenID Foundation | Presentation | final | 1.0 (9 Jul 2025) | referenced |
| HAIP | OpenID Foundation | Issuance, Presentation | final | 1.0 (24 Dec 2025) | referenced |
| SD-JWT VC | IETF | Format | draft | draft-ietf-oauth-sd-jwt-vc-19 (31 Aug 2026) | referenced |
| SD-JWT | IETF | Format | published | RFC 9901 (Nov 2025) | not referenced |
| ISO/IEC 18013-5 (mdoc) | ISO/IEC | Format, Presentation | published | ISO/IEC 18013-5:2021, 1st ed. (Sept 2021) | 2021 |
| ISO/IEC TS 18013-7 | ISO/IEC | Presentation | published | ISO/IEC TS 18013-7:2025, 2nd ed. (May 2025) | 2025, Annex C |
| Token Status List | IETF | Revocation | draft | draft-ietf-oauth-status-list-21 (21 Jun 2026) | draft-20 |
| ETSI TS 119 472-1 | ETSI | Format | published | V1.2.1 (Feb 2026) | V1.2.1 (2026-02) |
| ETSI TS 119 472-2 | ETSI | Presentation | published | V1.3.1 | V1.2.1 (2026-03) |
| ETSI TS 119 472-3 | ETSI | Issuance | published | V1.1.1 (Mar 2026) | V1.1.1 (2026-03) |
| ETSI TS 119 411-8 | ETSI | Trust | published | V1.1.1 (Oct 2025) | V1.1.1 (2025-10) |
| ETSI TS 119 475 | ETSI | Trust | published | V1.2.1 (Mar 2026) | V1.2.1 (2026-03) |
| ETSI TS 119 602 | ETSI | Trust | published | V1.1.1 (Nov 2025) | not referenced |
| Digital Credentials API | W3C | Presentation | draft | Working Draft (4 Sept 2026) | not referenced |
| VCDM | W3C | Format | published | 2.0, W3C Recommendation (15 May 2025) | not referenced |
| ARF | European Commission | Framework | living document | v3.0.0 (23 Jul 2026) | cited, not binding |
Two specifications in the legal annexes are still drafts: the regulation refers to Token Status List draft 20, while draft 21 is now in the RFC Editor queue, and to SD-JWT VC, which has been submitted to the IESG but is not yet an RFC. ETSI TS 119 472-2 is already at V1.3.1; the regulation refers to V1.2.1. Our spec tracker checks the versions daily at the publishers; last checked : Spec tracker.
OAuth-based protocol through which issuers deliver PID and credentials to the wallet (authorization code or pre-authorized code flow, batch issuance, key proofs).
Protocol with which a relying party requests credentials and the wallet presents them – via redirect on the same device, cross-device via QR code, or via the browser’s Digital Credentials API. Requests use the DCQL query language.
Fixes a selection of OpenID4VCI and OpenID4VP options, together with SD-JWT VC and mdoc, for high-assurance use. The key entry point for EUDI developers: implementing HAIP covers the online path.
JSON-based credential format built on SD-JWT: type (vct), issuer, validity, key binding. Individual claims are selectively disclosable. Mainly used for online flows.
The underlying mechanism of SD-JWT VC: the issuer signs hashes of salted claims; the holder reveals only the chosen claims and proves key possession with a key binding JWT.
Data format (CBOR, mobile security object with a digest per data element) and protocol for in-person presentation via QR code, NFC or Bluetooth Low Energy. Originally for the mobile driving licence; in the EUDI Wallet used for PID and other credentials.
Extends 18013-5 with presentation over the internet. Annex C covers the API-mediated path, such as the browser’s Digital Credentials API.
Compressed bit list in which the issuer publishes the status of many credentials (valid, revoked, suspended). Verifiers fetch the list without revealing to the issuer which credential they are checking.
EU profile for attestations and PID in SD-JWT VC (clause 5) and mdoc (clause 6) format: mandatory fields, signatures, status information.
Two presentation profiles: the “ISO/IEC mdoc profile” (18013-5 in person, 18013-7 Annex C via platform API) and the “OpenID4VC-HAIP profile” (redirect or platform API).
EU profile of OpenID4VCI for issuing PID and attestations, including issuer metadata, the issuer’s registration certificate and embedded disclosure policies.
Certificate policy for the access certificates with which relying parties authenticate to the wallet.
Specifies which relying party information the wallet shows to the user and how the registration certificate is structured.
Data model for lists of trusted entities such as wallet providers, PID providers and certificate providers; complements the classic trusted lists per ETSI TS 119 612. The wallet implementing regulations (2024/2977, 2979, 2980, 2982, 2025/848, 849, 2026/1730, 1731) do not reference it; as of 12 October 2026.
Browser interface (navigator.credentials.get) through which a website requests credentials from a wallet on the device. Both OpenID4VP and 18013-7 Annex C can run over it; the regulation refers generically to “API-mediated” transmission.
General W3C data model for verifiable credentials. The original 2024 implementing regulations named version 1.1; since the amendment by Impl. Reg. (EU) 2026/1731, the EUDI profiles rely on SD-JWT VC and mdoc.
Common technical framework of the Commission and the member states: architecture, roles, flows, requirements. Not legally binding – the implementing regulations based on it are.
This overview simplifies. The legal texts and the specifications themselves are authoritative; this is not legal advice. Versions were checked on the date shown with the publishers (openid.net, IETF Datatracker, ISO, W3C, ETSI, GitHub) and against the text of the implementing regulations. Content may be reused under CC BY 4.0, credit “Eudigo (eudigo.eu)”.