Does the EUDI Wallet acceptance obligation apply to small businesses?

No. Micro and small enterprises are exempt from the obligation to accept the EUDI Wallet. Article 5f(2) of the eIDAS Regulation says so expressly and refers to the EU SME definition in Commission Recommendation 2003/361/EC. In short: businesses with fewer than 50 staff and an annual turnover or balance sheet total of no more than EUR 10 million are exempt. They may still offer the wallet voluntarily.

The exemption is part of the EU regulation and therefore applies in all member states. Member states may add national rules, so businesses should also check the law of the country where they are established.

The thresholds

The Annex to Recommendation 2003/361/EC (Article 2) defines:

The staff ceiling must always be met; for the financial ceilings, meeting one of the two is enough (“and/or”). Medium-sized enterprises are not exempt.

Groups and shareholdings

The EU definition looks beyond the individual legal entity (Annex, Articles 3 and 6):

• Linked enterprises (for example a majority of voting rights or the right to appoint the management) are added in full.
• Partner enterprises (a holding of 25 % or more, without control) are added in proportion to the holding.
• Public ownership: an enterprise is generally not an SME if 25 % or more of its capital or voting rights are controlled by one or more public bodies (Article 3(4); exceptions include small autonomous local authorities under Article 3(2)).

A small subsidiary of a large energy supplier or bank is therefore usually not a small enterprise. By our reading, the same can apply to small publicly owned utilities or transport companies unverified. Article 5f(2) refers only to Article 2 of the Annex; that the calculation rules in Articles 3 to 6 also apply is the natural reading but has not been officially confirmed for eIDAS unverified. Businesses close to the thresholds should have their status assessed.

When the exemption does not matter

• Public sector bodies are covered by Article 5f(1); that paragraph contains no size exemption.
• Very large online platforms under the Digital Services Act are covered by Article 5f(3), which likewise contains no exemption for small enterprises.
• Medium-sized and large enterprises in the areas named in Article 5f(2) are covered. See Which businesses must accept the EUDI Wallet?.

Why the wallet may still be worth it for small businesses

The exemption is not a ban. For some small businesses the wallet can be useful:

• age verification in online retail without copies of ID documents
• customer identification with verified data instead of forms and photos
• storing less data: only the registered attributes are requested

A business that uses the wallet voluntarily becomes a relying party and must register first in its member state. It also needs an access certificate. Whether the effort pays off depends on the case. As one example, Germany’s draft Digital Identities Act estimates around 40 hours for a first registration and around 32 hours for later ones, which it expects to be mostly smaller businesses; figures for other countries may differ.

A simpler route can be a service provider acting as an intermediary. Intermediaries are themselves treated as relying parties and must not store data about the content of transactions (Article 5b(10)).

Quick check: is my business exempt?

1. Count staff: the headcount is measured in annual work units (full-time equivalents); part-time and seasonal work counts as fractions. Apprentices in vocational training are not counted (Annex, Article 5).
2. Check financial figures: turnover (excluding VAT) or balance sheet total for the latest approved accounting period (Annex, Article 4).
3. Include linked and partner enterprises and check public ownership, as described above.
4. Result: fewer than 50 staff and turnover or balance sheet total of no more than EUR 10 million: exempt. Above that: covered, if a process in one of the named areas requires strong user authentication for online identification.

Status does not flip after a single year: an enterprise only gains or loses its status if it exceeds or falls below the ceilings over two consecutive accounting periods (Annex, Article 4(2)).

What growing businesses should consider

A business that is small today but growing may become subject to the obligation. Since the obligation applies no later than 24 December 2027 (calculated, see EUDI Wallet deadlines), early planning makes sense. Integration via a service provider is usually faster than building it in-house, and registration takes time.

National rules for domestic cases

Some member states may extend Article 5f to purely domestic situations. Example Germany: the draft Digital Identities Act would apply Article 5f(1) to (3) accordingly to domestic cases (section 15(1)). As the reference covers the whole of paragraph 2, including the exemption, the exemption would likely apply there too (our assessment, unverified). The DIdG is still a government bill (Bundestag printed paper 21/7408); the second and third reading in the Bundestag is scheduled for 15 October 2026, after which the Bundesrat must consent (as of 12 October 2026).

Background: What is the EUDI Wallet? and the country-by-country EUDI index. Eudigo does not provide legal advice.