Identity only where identity is needed: the onboarding regulation completes an identity-centred web

The implementing regulation on the remote onboarding of users to the European Digital Identity Wallets was presented as a draft on 2 December 2025 (feedback until 30 December 2025) and adopted as Implementing Regulation (EU) 2026/798 of 7 April 2026. It permits onboarding via electronic identification means at assurance level „substantial“, reinforced by additional remote procedures so that the combination meets assurance level „high“; identity proofing already performed at level „high“ does not have to be repeated. The context: Member States must make at least one EUDI Wallet available by 24 December 2026; banks, regulated sectors and large platforms must accept it from 24 December 2027; and from 10 July 2027 the Anti-Money-Laundering Regulation recognises it for customer identification.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation, the standards institute of the Trusted WEB 4.0 concept – acknowledges the regulation and the underlying wallet architecture: decentralised storage on the user’s own device, selective disclosure instead of all-round data surrender, a dashboard of one’s own transactions, free e-signatures for non-professional use. These are genuine advances over central account databases and identity platforms. Yet the regulation also completes a misguided development: it makes identity the currency of everyday digital life.

1. Selective disclosure is half freedom

The wallet decides how much identity a service receives – but the decisive question is whether a service needs identity at all. Buying an e-book, reading a news item, searching for information: none of this requires a personal identity. The personality protection concept of Trusted WEB 4.0 shows the alternative: WAN anonymity, no cookies, no privacy settings – assignment only via trust station key sets where it is genuinely needed. GISAD recommends placing an equivalent anonymous path alongside the wallet. The border rule of the European Digital System (EU-D-S) shows how anonymous entry into digital spaces works: through generic user names and transaction numbers that can only be assigned within the system.

2. The Article 5f acceptance obligation must not become compulsory identification at gatekeepers

From the end of 2027, banks and large platforms must accept the wallet – including those US corporations whose business model rests on the exploitation of personal data. A European identity instrument that normatively channels identifiable registration to non-European platforms delivers precisely what the wallet is meant to prevent: personal data flows to gatekeepers. The regulation should make clear that anonymous use remains equally permissible wherever no legal identification requirement exists.

3. Simplicity decides success – and simplicity means participation

The adoption gap is official: only 5 % of Germans can explain what the wallet is; national predecessors remained below 5 % usage. An identity infrastructure that requires explanation fails its own aspiration. getmySense with 2,500 written languages shows the principle: participation instead of barriers – also for older people, for whom every identity procedure is a risk of exclusion. Onboarding procedures should therefore work without prior digital experience; multilingual design is not a courtesy but a prerequisite for access.

4. The wallet is a honeypot – the onboarding regulation must not enlarge it

A device bundling all personal data, the driving licence, certificates and means of payment is the most attractive target in the digital space; its loss is total identity compromise. The regulation is on the right path where it makes repeated identity proofing superfluous through the leverage of existing „high“ eID means. It should additionally minimise the data trail of onboarding itself: no central storage of identity verification records, WAN-anonymous storage of metadata, and biometrics only as a voluntary option – never as the standard.

Not every cloud makes you sovereign: the Digital Decade targets must measure independence, not just adoption

The Digital Decade Policy Programme 2030, adopted in 2022, sets measurable targets for Europe’s digital transformation in four areas: digital skills, secure and sustainable digital infrastructures, the digitalisation of businesses and the digitalisation of public services. More than €288 billion have been mobilised through national roadmaps with over 1,900 measures. The programme review was due by 30 June 2026; the Commission has announced a further review of the 2030 targets for 2027.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation, the standards institute of the Trusted WEB 4.0 concept – welcomes the review and the choice of its four target areas. Yet the 2026 State of the Digital Decade report confirms a structural problem: the programme measures adoption, not sovereignty. The EU misses its targets precisely where sovereignty is at stake – 9 % instead of 20 % of the global semiconductor market, and significant dependence on non-European providers in cloud services, cybersecurity and other strategic technologies.

1. Make the cloud, AI and big data target for businesses measurable by origin

If 75 % of EU companies adopt cloud and AI services that sit with US hyperscalers – CLOUD Act included – the target is met and sovereignty is lost all the same. GISAD recommends supplementing the adoption targets with a target figure for structural independence – for example, the share of critical infrastructures running on systems without US dependence in their core infrastructure. The European Digital System (EU-D-S), with one trustee per discipline, shows that European providers can carry this alternative: every Digital Decade target can be achieved with European technology.

2. Digital skills are a question of participation, not of training

55.6 % instead of 80 % of adults with basic digital skills – this gap is not closed by courses, but by structures that do not demand proficiency in the ways of a profiling economy. getmySense transfers the principle of participation instead of social welfare into the digital world with 2,500 written languages: those who take part in their own language and in clear categories need no algorithm literacy. Participation lowers the barrier – especially for older people, whose exclusion from digital life is a measurable health risk. The skills target remains important, but it must be complemented by a participation target.

3. Bandwidth is not resilience

Gigabit and 5G measure speed, not survivability. The CrowdStrike outage, the Charité incident, the Baltic cable sabotage and the Starshield throttling show: the bottleneck is not throughput, but central dependence. The review should anchor resilience as a target dimension of its own – decentralised networking that keeps functioning when central infrastructures fail. Decentralised digitalisation does not replace a single cable – but it takes the catastrophic effect out of every cable break.

4. Public services WAN-anonymous instead of state-centred

Today, the digitalisation of public administration means central data pools and a digital identity for everything. The EU-D-S shows the third way: citizens use public services WAN-anonymously, with assignment solely via the trust station – powerful administration without an all-round profile. And the review’s aim of strengthening structured channels for regions, cities and local actors finds its model in the EU-D-S: trust stations as points of contact in disputes are local, citizen-facing structures.

A 2030 horizon that only measures the adoption of the existing network will make Europe more digital – but not more sovereign.