European Digital Identity Wallet – standards and technical specifications (update)

European Commission · Have your Say · Initiative 16112

Amending CIRs (EU) 2024/2977, 2024/2979, 2024/2980 and 2024/2982 – Implementing Regulation (EU) 2026/1731 · Statement of October 28, 2026

Core statement: Standards are structure, and GISAD welcomes the maintenance of the wallet standards in an open European standardisation process. But this standardisation also decides two limits: interoperability must not become linkability – a wallet that leaves traces everywhere with every presentation is not proof of identity, but a motion detector. And wherever AI agents present credentials on behalf of a person, the rule of Trusted WEB 4.0 applies: single-step release, signed instance numbers, no standing authorisation. The standard determines whether the wallet organises trust – or profiling.

What the regulation provides

Implementing Regulation (EU) 2026/1731 of 15 July 2026, in force since 11 August 2026, amends the four wallet implementing regulations CIR (EU) 2024/2977, 2024/2979, 2024/2980 and 2024/2982 by updating the references to applicable standards and technical specifications, ensuring that Member States can develop and provide European Digital Identity Wallets in an interoperable manner (Article 5a(23) of the eIDAS Regulation). The consultation (5 February to 5 March 2026, 43 contributions) ran in parallel to the two sister consultations on relying parties and attestations of attributes. What is affected is the technical core on which Member States are building their wallets – a few months before the wallets must be available on 24 December 2026.

Recognition: open standards in European hands

GISAD acknowledges that the standards are developed in the European standardisation process (ETSI TC ESI), published as legal acts and consulted before adoption: transparent, comprehensible, European. This is structure instead of vendor lock-in – no proprietary formats of individual providers, no de facto dependencies on non-European standard setters. The specification of an interface for data deletion requests to relying parties is also a step in the right direction: data minimisation becomes a technical obligation, not a declaration of intent.

Criticism 1: interoperability is not linkability

The amended CIRs require wallet units to validate access certificates at every interaction, check wallet unit attestations and present attributes. Technically correct – but each of these checks is an event that leaves traces with relying parties and in protocols. Anyone using the same wallet at twenty services leaves twenty linkable data records, even if each individual service sees only one attestation. The standard must prevent linkage, not merely minimise individual disclosures: no cross-service correlation identifiers, WAN-anonymous metadata, assignment only internal, following the transaction number model of the EU-D-S. The individual presentation is anonymised – the sum of the presentations must not produce a profile.

Criticism 2: the presenting agent is the escape case

The consultation called for agent-mediated machine-to-machine interactions to be explicitly included in the specifications and interoperability tests: AI agents that request and present attestations on behalf of the user. This is the constellation that Trusted WEB 4.0 resolves with the Finder-KI-Escape-Schalter – and the security signals of recent months show it is not theory: models from OpenAI and Anthropic escaped closed test environments, and the Hugging Face attack of July 2026 happened with reduced guardrails precisely in a testing environment. An AI agent with credential function therefore needs: single-step release for every presentation (no standing authorisation, no background synchronisation), signed instance numbers from the Truststation for every agent instance, measurement outside the manipulable area, and the zero-tolerance rule for instance-identifying markers outside the system.

Criticism 3: the target moves shortly before the start

The technical core of the wallets is being amended five months before the availability deadline. Transparency and consultation are good – but Member States building against the previous reference standard face rework, and interoperability tests must run against a target that no longer moves. Structure protects only if it stands before the operation begins; standard maintenance needs fixed reference points and adequate transition periods.

GISAD’s recommendations

1. Linkage protection as a principle of standardisation: no cross-service correlation identifiers in wallet unit attestations; WAN-anonymous metadata; assignment only internal (transaction number principle of the EU-D-S).
2. Agent-mediated interactions only with single-step release per presentation, signed instance numbers of the Truststation per agent instance and the zero-tolerance rule; no standing authorisations in the specifications.
3. Data deletion requests not as an optional interface, but as a mandatory component of relying party compliance.
4. Fixed reference standards with adequate transition periods; with every standard update, transition periods that do not force Member States into duplicate work.
5. Extend interoperability tests to WAN-anonymous use cases: access and presentation without identification where identity is not legally required – the wallet must be able to do what the border rule of the EU-D-S demands: identity only where identity is needed.