What has been decided

Commission Implementing Regulation (EU) 2026/1735 of 15 July 2026 amends Implementing Regulation (EU) 2025/1569, which lays down the rules for qualified electronic attestations of attributes (QEAAs) and for attestations issued by or on behalf of public sector bodies responsible for authentic sources. The reason: the Architecture and Reference Framework for the European Digital Identity Wallet has evolved significantly, and the regulation is being aligned with the new standards and specifications. The draft was published on 5 February 2026 with a feedback period until 5 March 2026; the European Data Protection Supervisor delivered his opinion on 17 April 2026. The regulation was published in the Official Journal on 22 July 2026 and entered into force on 11 August 2026; Article 1(3) applies only from 1 January 2027.

• Article 3(2): attestations must comply with the schemes for the attestation of attributes, where applicable.
• Article 4: updated rules on the circumstances of revocation and on the use of privacy-preserving techniques.
• Article 9: specifications for verification mechanisms and requirements for the signing and sealing of verification results against authentic sources.
• Annexes I–IV: updated reference standards, including ETSI TS 119 471 and ETSI TS 119 478.

The regulation is one of three framework updates adopted on 15 July 2026 – alongside Implementing Regulation (EU) 2026/1730 on the registration of relying parties and Implementing Regulation (EU) 2026/1731 on the four core wallet regulations. Articles 6 to 9 of Regulation 2025/1569 have been applicable since 19 August 2026: the list of public sector bodies issuing attestations, the European catalogue of attributes and the catalogue of attestation schemes. The deadline for Member States to provide the wallets remains 24 December 2026.

GISAD’s assessment

1. Attestations are a step in the right direction. Proving „over 18“ or „diploma held“ without handing over an identity document corresponds to the border rule of the EU-D-S: identity only where identity is necessary. Selective disclosure and data minimisation are bindingly anchored here. GISAD expressly welcomes this.

2. Verification must not become a movement profile. Revocation checks and verification against authentic sources create central touchpoints: who queries which status, and when? Article 4 points the right way with privacy-preserving techniques – but this must be made measurable. Revocation status must be obtainable without identifying the holder (Truststation key sets), verification queries must remain WAN-anonymous, and no central movement profiles may be created. A verification confirms a characteristic – it must not survey the holder.

3. Signed verification results – an opportunity with a flip side. Signing and sealing verification results makes the check itself traceable – close to the GISAD principle that measurement must take place outside the manipulable area. But a signed verification result is also a linkable artefact. Transaction numbers that can only be assigned internally are needed, so that proof does not become a correlation feature between providers. Interoperability is not linkability.

4. Open European standards are positive – but the reference base keeps moving. ETSI openness stands for structure instead of vendor lock-in. However, with Article 1(3) applying only from 1 January 2027, parts of the reference standard move beyond the wallet launch date of 24 December 2026. Transitional rules must ensure that no backward-compatibility trap arises.

5. Three acts on one day, one ecosystem. The updates to the registers, wallet core regulations and attestations were amended in parallel. Consistency between them is not a formality: interoperability testing must also cover WAN-anonymous use cases.

6. The attribute catalogue must not become a gatekeeper. The catalogue of attributes and schemes maintained by the Commission is practical – but schemes must remain open and reviewable for independent providers, including small European verifiers. No allowlist thinking.