Twenty-seven national schemes decide whether Europe's identity wallet is certified.
ENISA's draft closed its public review on 30 April and this desk found nothing saying it has been adopted. Article 5c(3) never waited for it, and the duty it puts in its place runs to no date at all.
Every account of the December deadline says a Member State must have a certified wallet. The article that sets the deadline does not use the word.
Article 5a(1) of the amended eIDAS Regulation says each Member State "shall provide at least one European Digital Identity Wallet" within 24 months of the entry into force of the implementing acts under Article 5a(23) and Article 5c(6). Provide. Joris Feenstra has done that arithmetic on this site and it comes out at 24 December 2026. Nothing in the paragraph makes the duty conditional on a certificate.
The duty to certify is real and it sits one article further on. Article 5c(1): the conformity of wallets and of the electronic identification scheme under which they are provided "shall be certified by conformity assessment bodies designated by Member States". That paragraph carries no date. It takes none from Article 5a(1) either, which counts its 24 months from implementing acts and not from anybody's certificate. Article 5d then builds a list of wallets that have been both provided and certified, and that is where the adjective in everyone's summary comes from.
The sentence in general circulation is ENISA's. Its certification portal says Member States must provide "at least one certified EU Digital Identity Wallet by the end of 2026", on the page announcing a consultation on the scheme that would certify one. The sentence is a fair account of what Brussels wants. It is not a quotation of anything in the regulation.
The fallback was written in before anybody needed it
Article 5c(2) sends the cybersecurity parts of the job to European cybersecurity certification schemes adopted under the Cybersecurity Act. One such scheme exists. It is the EUCC, Implementing Regulation (EU) 2024/482, and it certifies ICT products rather than wallets. ENISA has been drafting a candidate scheme for wallets since the Commission asked it to; version 0.4.614 went out for public review on 2 April 2026 and the survey closed on 30 April. On 10 November, when this desk last looked, ENISA's certification portal's publications index ran to 4 November and its news index to 10 August, and neither carried a later version or an adoption.
So the European scheme is a draft, six weeks before the wallets are due. This turns out to matter less than it should, because Article 5c(3) anticipated it. Where the schemes under paragraph 2 "do not, or only partially" cover the cybersecurity requirements, and for everything that is not a cybersecurity requirement, Member States "shall establish national certification schemes" following the implementing act under Article 5c(6). That act is Implementing Regulation (EU) 2024/2981, adopted on 28 November 2024, and its Chapter II is titled "National certification schemes". Its recital 4 says what it is for in one clause: "In the absence of such schemes, or when they partially cover" the requirements.
Read in that order, the architecture is not broken. It is working exactly as drafted. Twenty-seven Member States write twenty-seven schemes, each assigns a scheme owner, and certificates are issued under those schemes by bodies those Member States designate. The last article of 2024/2981 is headed "Transition to a European cybersecurity certification scheme" and provides that the Regulation "shall be subject to review" when the first one is adopted. The national route is not the contingency. It is the route, and the European scheme is the thing that will eventually be reviewed into it. ENISA signed a two-year contribution agreement with the Commission in February 2026, worth 1.6 million euro, to help Member States build the national schemes. The money went to the route that exists.
The certificate attests a list, and the list is shorter than Article 5a
Article 5c(1) does not say that wallets must comply with Article 5a and be certified for it. It names what is certified: conformity with the requirements in Article 5a(4), Article 5a(5) and Article 5a(8), the logical separation requirement in Article 5a(14), and, where applicable, the standards referred to in Article 5a(24). That is a long and demanding list — the whole functional specification, the protocols, assurance level high, the validation mechanisms — and it is a list.
Three things in the same article are outside it. The source code of a wallet's application software components has to be open-source licensed under Article 5a(3). Issuance, use and revocation have to be free of charge to every natural person under Article 5a(13). The wallet has to be accessible to persons with disabilities, on an equal basis, in accordance with the Accessibility Act, under Article 5a(21). None of the three is named in Article 5c(1), and there are more of them in paragraphs 6 to 22. Data protection is its own case: Article 5c(5) says compliance with the personal-data requirements "may be certified" under the GDPR, which is a verb a compliance officer reads twice.
Article 5a(16), the paragraph that forbids tracking and correlation after an attestation is issued and requires privacy-preserving techniques for unlinkability, binds "the technical framework of the European Digital Identity Wallet". Not the provider, and not the wallet. Who is obliged by a sentence addressed to a framework is not resolved anywhere I have read.
The implementing act is wider than the article it implements. Article 4(1) of 2024/2981 requires national schemes to cover "functional, cybersecurity and data protection requirements", and Article 3(2) makes the object of certification "the provision and operation" of the wallet and its identification scheme — a process, not an app. A national scheme may therefore certify more than Article 5c(1) obliges it to. Which bound applies is a question about that scheme.
One more thing moved this year. The Article 5a(24) standards that Article 5c(1) folds in "where applicable" did not exist until Implementing Regulation (EU) 2026/798 was adopted on 7 April 2026, in force twenty days after publication on 28 April. The scope of the certificate grew eight months before the wallets were due. Because that act is made under Article 5a(24) and not Article 5a(23), it does not touch the clock in Article 5a(1).
Twenty-seven schemes, and nothing obliging them to recognise each other
Article 5f(1) makes Member States accept any wallet "provided in accordance with this Regulation", and from 24 December 2027 Article 5f(2) does the same to private relying parties required to use strong user authentication. A Belgian firm will therefore be accepting wallets certified in twenty-six other states, under schemes written by those states, by bodies those states designated.
On the certificates behind them, 2024/2981 offers a recital and a verb. Recital 27 says Member States "may conclude agreements for the cross-border reuse of certification schemes or parts thereof". May. There is no mutual recognition duty anywhere in the operative text I have read. The wallets are mutually recognised; the evidence that they were properly certified is not.
Nor is it easy to see who issued it. The definition of conformity assessment body inserted into Article 3, point (18), requires accreditation under Regulation (EC) No 765/2008 as competent to certify wallets, and Article 9 of 2024/2981 adds the standard — EN ISO/IEC 17065:2012 — and four competence requirements. That part is nailed down. Then Article 5c(7): Member States communicate the names and addresses of their conformity assessment bodies to the Commission, and the Commission "shall make that information available to all Member States". To Member States. A relying party asked to trust a Latvian certificate is not among the recipients the paragraph names.
Article 5c(8) empowers the Commission to adopt delegated acts setting specific criteria for those bodies. A title search of the Publications Office catalogue on 11 October and again on 10 November returns no delegated act under Regulation 910/2014 at all, of any kind. The criteria for the bodies that issue the certificate the deadline is said to require have not been written, and because 2024/2981 Article 9 covers accreditation and competence, nobody has had to notice.
Not established
Three things this desk could not stand up, and they are the three a board paper would want. Whether the candidate scheme has been adopted since 11 October: that takes a Commission implementing act under the Cybersecurity Act, and none had appeared by 10 November. How many wallets are certified: the only artefact that answers it is the list Article 5d(3) obliges the Commission to publish in the Official Journal, and I found no publication of it. Whether any Member State has a published scheme or a designated body: the drafts go to the Cooperation Group and the names go to Member States, and neither route ends at a page anyone can open.
Elin Sandberg found in October that all six registers the wallet ecosystem runs on were still being prepared. This is the seventh document, and it decides whether the wallets listed on the other six are the thing the regulation means.
The duty that falls on 24 December is to provide a wallet. The duty to have certified it has no date at all, and in most of the Union the scheme it would be certified against has been read by nobody outside the Cooperation Group. Article 5c(3) has said that would be the arrangement since April 2024.
Written from
Primary The document itself. Claims in this piece rest only on these.
- Regulation (EU) 2024/1183 amending Regulation (EU) No 910/2014 as regards establishing the European Digital Identity Framework, OJ L, 30.4.2024, CELEX 32024R1183Read in the English XHTML manifestation served by the Publications Office from the cellar, not through EUR-Lex's web front end, which sits behind a challenge that returns half a document. Read and relied on for: Article 5a(1), including the words 'shall provide at least one European Digital Identity Wallet' and the 24-month clock tied to the acts under Article 5a(23) and Article 5c(6); Article 5a(2), (3), (4), (5), (8), (13), (14), (16), (18), (21), (23) and (24); Article 5c in full, in particular 5c(1) and its enumerated scope, 5c(2), 5c(3), 5c(4), 5c(5), 5c(7) and 5c(8); Article 5d(1) and (3); Article 5e(2); Article 5f(1), (2) and (3); and the definition of conformity assessment body inserted into Article 3, point (18), which carries the accreditation requirement under Regulation (EC) No 765/2008. Recitals 23, 24, 25, 26, 27 and 40 read. The word 'certified' does not appear in Article 5a; that is a search of the article's own text, not an inference.
- Commission Implementing Regulation (EU) 2024/2981 of 28 November 2024 on the certification of European Digital Identity Wallets, OJ L, 4.12.2024, CELEX 32024R2981Opened from the cellar and read through Articles 1 to 22, which is the whole of the operative text. Source for: the subject matter in Article 1; the definitions of wallet solution, scheme owner and object of certification in Article 2; Article 3(1) on scheme owners and 3(2) and (3) on the object of certification being the provision and operation of wallet solutions; Article 4(1) on the use of European cybersecurity certification schemes 'when available and applicable, including the EUCC' and Article 4(1) covering functional, cybersecurity and data protection requirements; Article 8(2) on resistance to attackers with high attack potential; Article 9(1) and (2) on accreditation and competence of certification bodies; Article 18 on the certification lifecycle; and Article 21, headed 'Transition to a European cybersecurity certification scheme', which makes the Regulation subject to review on the adoption of the first such scheme. Recitals 4, 14, 15, 26 and 27 read, including recital 4's 'In the absence of such schemes' and recital 27's statement that Member States 'may conclude agreements for the cross-border reuse of certification schemes or parts thereof'. The nine annexes, including the risk register in Annex I, were not read; nothing in the piece rests on them.
- Commission Implementing Regulation (EU) 2026/798 of 7 April 2026 on reference standards for the remote onboarding of users, OJ L, 8.4.2026, CELEX 32026R0798Opened from the cellar. Header, recitals and Articles 1 and 2 read: it is adopted under Article 5a(24), it sets the reference standards and specifications referred to in that paragraph in its Annex, and it enters into force on the twentieth day after publication, which on a publication date of 8 April 2026 is 28 April 2026 by this desk's count. The Annex was searched rather than read; the piece makes no claim about its contents. The point that this act, being under Article 5a(24) rather than 5a(23), does not feed the Article 5a(1) clock is read off Article 5a(1)'s own list.
- Commission Implementing Regulation (EU) 2026/1731 of 15 July 2026 amending Implementing Regulations (EU) 2024/2977, 2024/2979, 2024/2980 and 2024/2982, OJ L, 22.7.2026, CELEX 32026R1731Opened from the cellar and read for its legal basis, its header and Articles 1 to 4. Relied on for one negative only: it is adopted under Article 5a(23) and it amends the four core acts, and it does not amend Implementing Regulation (EU) 2024/2981. The certification act has not been reopened since December 2024.
- Commission Implementing Regulation (EU) 2025/849 of 6 May 2025 on the submission of information for the list of certified European Digital Identity Wallets, OJ L, 7.5.2025, CELEX 32025R0849Opened from the cellar. Articles 1 to 4 read. It is the Article 5d(7) act and it sets the format and the secure channel by which Member States submit information, including changes to a wallet's certification status, to the Commission and the Cooperation Group. It carries no application date beyond entry into force. Its Annex was not read.
- Commission Implementing Regulation (EU) 2024/482 (the EUCC scheme), CELEX 32024R0482Not opened. Cited for its existence and its title only, which is how the claim in the body is framed: a title search of the Publications Office catalogue for acts whose title contains 'cybersecurity certification scheme' returns the EUCC and nothing else, in the original and in two consolidated versions. Anyone relying on what the EUCC itself requires should open it.
- Publications Office of the European Union, SPARQL catalogueQueried on 11 October 2026, and used both to resolve the cellar identifiers for every instrument above and to establish two negatives. First, a title search for English-language acts whose title contains both 'Delegated' and '910/2014' returns no rows, which is the basis for the statement that no delegated act under Article 5c(8) has been adopted. Second, the 'cybersecurity certification scheme' search described above. The limit of the method should be stated: it matches on titles, so an act that regulates either subject without naming it in its title would be missed. A reader who needs certainty about the delegated act should ask the Commission. Re-queried 10 November 2026: the 'Delegated' and '910/2014' title search still returns no rows, no act whose title names wallets, a certification scheme, 910/2014 or 2019/881 is dated after 12 August 2026, and the only cybersecurity certification scheme in the catalogue is still the EUCC.
- ENISA, 'Public Consultation on the draft candidate EUDIW Certification scheme', and the publication page for Draft candidate EUDIW Scheme v0.4.614Both pages opened on 11 October 2026, together with the portal's news index and its publications index. Source for: the consultation running from 2 April 2026 and closing on 30 April 2026; the webinar of 8 April 2026; the version number v0.4.614 and the companion security requirements at v0.5.614; the statement that the Commission asked ENISA to develop a candidate scheme under the Cybersecurity Act and that ENISA drafted it with an ad hoc working group of industry and Member State representatives; the parallel request for an opinion from the European Cybersecurity Certification Group; and the quoted phrase 'at least one certified EU Digital Identity Wallet by the end of 2026', which appears in ENISA's own words. The news index on that date ran to 10 August 2026 and the publications index to 24 September 2026, and neither carried any EUDIW item later than April 2026 or any version later than v0.4.614. The €1.6 million two-year contribution agreement signed in February 2026 to support national certification schemes is from ENISA's news item of 3 April 2026 on enisa.europa.eu. Re-checked 10 November 2026: the v0.4.614 page still reads '31 March 2026 (Last updated on: 7 April 2026)' and calls the document a draft for public review; no later version is listed. The portal's news index still ends at 10 August 2026; its publications index now ends at 4 November 2026 with EUCC guidance on secure elements, which does not concern wallets.
- Draft candidate EUDIW Scheme v0.4.614 (133 pages)Downloaded and not read. The PDF's fonts are subset-encoded and the text could not be extracted on this desk's tooling; no claim in this piece rests on the draft's contents, only on its existence, its version and its status as stated on the pages that publish it.
- Whether the candidate scheme has been adopted since 11 October 2026Open question, and the piece says so in the body with the date attached. Adoption would take a Commission implementing act under Regulation (EU) 2019/881, which would appear in the Official Journal. Nothing of the kind had appeared when this desk looked. This is the one observational finding in the piece and it must be re-checked in the week it publishes. Re-checked 10 November 2026, the day after publication: no implementing act in the Official Journal, no new scheme version, no ECCG opinion published, and no Article 5d(3) list of certified wallets in the OJ C series.
- How many European Digital Identity Wallets are certifiedDeliberately unanswered. The artefact that answers it is the list Article 5d(3) obliges the Commission to publish in the Official Journal and maintain in machine-readable form. This desk found no such publication. A null result on a search is not proof of absence, so the body prints no number in either direction.
- Whether any Member State has published a national certification scheme, or designated and notified its conformity assessment bodiesNot established for any Member State. Article 5c(3) requires draft national schemes to go to the Cooperation Group, whose papers this desk has not seen, and Article 5c(7) directs the names of the bodies to the Commission and then to Member States rather than to the public. No national scheme is named in the body and no country is ranked.
Lead Pointed us at the story. Nothing here is cited as authority.
- Reports that no wallet has been deployed or certified, and that the Commission doubts every Member State will launch in timePointed this desk at the subject and is not cited for anything. The sources found were trade blogs and vendor posts whose accounts of national status contradicted one another, and no primary document behind the Commission's reported doubt was located. The body prints neither the deployment count nor the Commission's view.