Which businesses must accept the EUDI Wallet, and from when?

Under the eIDAS Regulation, private businesses must accept the EUDI Wallet when they are required to use strong user authentication for online identification, whether by Union law, national law or contract. The regulation names transport, energy, banking, financial services, social security, health, drinking water, postal services, digital infrastructure, education and telecommunications. The obligation applies no later than 24 December 2027 (calculated). Micro and small enterprises are exempt. Very large online platforms must also accept the wallet where they require users to log in.

This applies in all 27 member states, because eIDAS is an EU regulation and directly applicable. Member states may add national rules on top.

The legal basis: Article 5f eIDAS

The acceptance obligation is set out in Article 5f of the eIDAS Regulation, as amended by Regulation (EU) 2024/1183. It has three tiers:

How the 2027 date is calculated

Article 5f(2) sets the deadline at “no later than 36 months from the date of entry into force of the implementing acts referred to in Article 5a(23) and Article 5c(6)”. These implementing regulations, (EU) 2024/2977, 2024/2979, 2024/2980, 2024/2981 and 2024/2982, were adopted on 28 November 2024, published in the Official Journal on 4 December 2024 and entered into force on the twentieth day after publication, i.e. 24 December 2024. Adding 36 months gives 24 December 2027. This date is our calculation, not a date stated in the regulation. See all EUDI Wallet deadlines.

Which sectors are named

The English text of Article 5f(2) lists: “transport, energy, banking, financial services, social security, health, drinking water, postal services, digital infrastructure, education or telecommunications”. The list is introduced with “including”, so it is not exhaustive.

The decisive test is not the sector alone but whether strong user authentication for online identification is required, by Union or national law or by contractual obligation. Typical examples (our assessment, unverified):

• opening an account or logging in to online banking (strong customer authentication under payment services law)
• signing a mobile phone contract that involves an identity check
• customer portals of energy suppliers or health insurers that require proof of identity

Whether a particular process is covered depends on the individual case and may differ between member states. Eudigo does not provide legal advice.

Who is exempt

Article 5f(2) exempts “microenterprises and small enterprises as defined in Article 2 of the Annex to Commission Recommendation 2003/361/EC”. Roughly, this means fewer than 50 staff and an annual turnover or balance sheet total of no more than EUR 10 million. Medium-sized enterprises are not exempt. Thresholds and group rules are explained in Does the obligation apply to small businesses?.

The exemption concerns the obligation only. Small businesses may still offer the wallet voluntarily, but then have to register like any other relying party.

What “accept” means

• Only at the user’s request: Using the wallet is voluntary (Article 5a(15)), and it must remain possible to access services by other existing means. Businesses add the wallet as an option; existing methods such as video identification or national eID schemes can stay.
• Register first: A business that wants to rely on the wallet, including on a voluntary basis, and request data from a wallet must register as a relying party in the member state where it is established (Article 5b(1)). The registration states which data it intends to request and for what purpose. See how relying party registration works.
• Request only registered data: Relying parties must not ask users for data beyond what they have registered (Article 5b(3)).
• Access certificate: Towards the wallet, the business identifies itself with an access certificate, which is issued only to registered relying parties (Article 7 of Implementing Regulation (EU) 2025/848).

Which wallets exist in each country is shown in EUDI Wallets in the EU and the EUDI index.

National rules: domestic cases

Article 5f is headed “Cross-border reliance on European Digital Identity Wallets”. Member states can extend the obligation to purely domestic situations or link the wallet to existing national eID rules.

Example Germany: the draft Digital Identities Act (DIdG), section 15(1), provides that Article 5f(1) to (3) applies accordingly to purely domestic cases. Where a German law requires the national online ID, the wallet is also to be accepted as proof of identity, unless specific provisions say otherwise (section 15(2)). The DIdG is still a government bill (Bundestag printed paper 21/7408); the second and third reading in the Bundestag is scheduled for 15 October 2026, after which the Bundesrat must consent. Its content may still change (as of 12 October 2026). Whether other member states have similar plans has not yet been researched unverified.

Businesses operating in several countries should therefore check the national implementing law in each member state where they are established or serve customers.

What businesses should do now

1. Check whether you are affected: Which of your online processes require strong authentication or an identity check today?
2. Check your size: Are you below the thresholds for micro and small enterprises, including linked and partner enterprises?
3. Prepare registration: The rules for national relying party registers (Implementing Regulation (EU) 2025/848, Article 11) apply from 24 December 2026.
4. Plan the technical integration: build it yourself or use a service provider (intermediary); test in the available sandboxes.
5. Watch the deadlines: our deadline overview is updated regularly. For background, see What is the EUDI Wallet?.