ENISA Moves EU Digital Wallet Certification from Policy Ambition to Implementation

The European Union Agency for Cybersecurity (ENISA) has now completed a public consultation on the draft candidate EU Digital Wallet certification scheme, with the deadline for responses having passed on April 30. This consultation phase aims to validate the “principles and general organization” of the proposed scheme developed by the Ad Hoc Working Group.

ENISA is now consolidating and analyzing the responses received from Member States, industry vendors, and security experts to assess whether the proposed scheme adequately meets requirements across a broad array of stakeholders. Once finalized, the scheme will prescribe the requirements that proposed wallet implementations must meet to be certified.

Certification acts as a market-access requirement, making this defining phase a critical time for wallet providers, digital identity vendors, trust service providers, and integrators, which will be held to the standards put in place following this review.

The public nature of the consultation is intended to build trust in the EUDI Wallet ecosystem, engaging governments, relying parties, and citizens with the development phase. This transparency and openness to input should build confidence and familiarity with the ecosystem, and serve as a valuable, crowdsourced review to identify potential vulnerabilities or faults.

It also allows development to begin against draft benchmarks for security, privacy protection, and interoperability, which is a critical step if the market is to meet the ambitious deadlines set out for availability.

There are three core challenges for vendors:

• Product Quality: Vendors will need to evidence secure software development, privacy-by-design, vulnerability management, cryptographic controls, and conformity with wallet technical specifications.
• Managing Non-Uniformity: Vendors will need to tackle the complexity of implementing a unified system in a mature, heterogeneous landscape. The accelerated development introduced by the international scheme poses the risk of creating greater fragmentation as Member States come to grips with the new requirements at different paces. However, a unified outcome means that interoperability challenges in the future should only go as far as coping with different maturity levels within the single approach.
• Speed: With demands from the European Parliament and the Council of the European Union to make at least one certified EUDI available to all citizens and residents by late 2026, vendors will need to integrate any product changes necessary following the certification review very quickly. Competing for certification processing availability will add pressure. While current timelines are challenging enough in theory, production deployments always face the risk of unforeseen pragmatic hiccups that can confound planned deadlines. Logistical and organizational strategy will offer just as much advantage to vendors as technical excellence.

Given the maturity of issuance vendors and the long-lived development phase toward EUDI compliance, the challenge in 2027 will be acceptance. The deadline for regulated relying parties to support EUDI Wallets for user authentication is set in late 2027, and this is a landscape rife for those unforeseen pragmatic hiccups. Such entities vary not just by nation, but by region, and the maturity levels are spread even more widely.

There are several key steps that wallet operators will need to undertake to navigate this:

• Review and map draft certification points to product specification and organizational strategies must include consideration of potential conflicts for key customer bases, which should inform tailored messaging on the transition.
• Clarity of scope will be essential in 2027, and customer education may be required to ensure a smooth rollout—vendors will need to be highly specific and accommodate unfamiliarity with the technicalities. For example, many will not appreciate the distinction between a single EUDI Wallet and myriad EUDI Wallet-certified implementations. Quirks of this model will require rigorous acceptance testing to provide a uniform customer experience.

For identity orchestration, credential issuance, authentication, and verification vendors, there is one key priority consideration:

• The key differentiator in this market will be the promise of prolonged simplicity, with the strongest vendors recognizing the challenge of regulation fatigue and repositioning themselves as partners in building digital trust, acting as market enablers, and supporting ongoing operation, rather than pitching point compliance solutions.