The EU Digital Identity Wallet Arrives in December

My Medium friends can read this over on Medium.

On December 24 this year, every one of us in the EU gets a new right. I am in Germany. I can walk up to my own government and ask for a digital identity wallet. An app that holds my ID, proves who I am online, and costs nothing.

Every member state has to offer one by that date. It's in the regulation, with a number and a paragraph.

Germany starts on January 2.

The right

The law is Regulation (EU) 2024/1183, in force since May 2024. It rewrites the old eIDAS rules and adds Article 5a, which says each member state has to make at least one European Digital Identity Wallet available within 24 months of the technical implementing acts. Those were adopted at the end of November 2024, which puts the deadline on December 24, 2026.

What you get is a right, not an obligation. Nobody has to install anything. But if you want one, your state has to hand it over, and issuing it, using it and revoking it are free for private individuals.

The idea is one app for the things you currently prove with plastic or a scan of plastic. Your ID. Later your driver's license, diplomas, insurance cards. You show a single attribute instead of the whole document, so a shop that needs to know you are over 18 learns that you are over 18 and nothing else.

That last part is the version on the slides.

Nine days

Germany's start date is January 2, 2027. The digital ministry has announced it, and the number itself tells the story: it's the first working day after the deadline runs out.

Then there is the wording the ministry uses on its own page. Every member state should have a wallet "bis Anfang 2027", by early 2027. The regulation says December 24, 2026. Move the deadline into the following year and your own launch is suddenly on time.

Nine days late, announced in advance, and worded so it doesn't look late.

Nine days is nothing. The German wallet is being built by SPRIND, the federal agency for disruptive innovation, together with the BSI, the Bundesdruckerei, Fraunhofer AISEC and others, and there was a pilot running in Dresden this summer with the local Dresden-Pass and the Saxon volunteer card, according to netzpolitik.org. Something is being built.

It's the wording that gets me. Not the delay.

The first version

First comes the identity part. Your personal identification data, so you can prove that you are you to an authority or a company. The ministry lists the rest as later stages: attestations of attributes, driver's license, passport, qualified signatures, payments.

So on day one this is a digital ID card in an app. Not a wallet full of documents.

Which is fine, and also worth knowing before anyone promises you your driver's license on your phone in January. I want that too, though.

December 2027

The date that will matter more to most of us is a year after the first one.

From December 24, 2027, a long list of companies has to accept the wallet wherever the law already forces them to identify you with strong authentication. Banks and payment providers. Telecoms, energy, transport, health, postal services. Plus the very large online platforms designated under the Digital Services Act.

So in theory this is NOT a government app nobody uses. It will be heavily used. If your bank has to take it, you will end up with one eventually.

Downsides, of course

The credentials in the wallet are cryptographically signed. That makes them hard to forge, which is the whole point, and it also makes them kind of worth stealing.

A signed proof that this address belongs to this person is a different kind of data than a screenshot of an ID. The German federal data protection commissioner and security researchers have warned that signed attributes are valuable for identity theft and for the data trade, and netzpolitik.org has the details.

Then the pseudonymity. You are supposed to be able to use the wallet without handing over your name every time. That right exists, and national or EU law can restrict it.

And zero-knowledge proofs, the cryptography that would let you prove you're over 18 without revealing anything else, show up in the recitals of the regulation.

Also, this is one app that holds the documents that prove who you are, built by the state, on a phone made (or at least run with software) by Apple or Google… which is kind of the opposite of the whole EU sovereignty idea.

A European system that identifies people reliably will be looked at by everyone who has ever wanted to know who is behind an account. The EU has spent this year arguing about scanning our messages. These two files are not connected, but I would not bet on them staying unconnected forever.

The Bottom Line

Europe is building something useful here, I think. The way it did with its own version of the CLOUD Act. A free identity you can request from your own state, built to one standard across 27 countries.

Then it lands nine days late in the biggest member state, with the deadline restated as early 2027.

I'll ask for mine in January. Then we'll see what it can do.

If you're not already, follow me on Medium.