What changes with eIDAS 2.0?
The eIDAS revision introduces a European Digital Identity Wallet (EUDI), tighter rules for qualified trust service providers (QTSP) and more interoperability between member states. Organisations providing or consuming identity, signatures or trust services must reassess contracts, architecture and compliance.
eIDAS 2.0 does not replace ISO 27001 or NIS2 — it regulates digital identity and trust services. Security and privacy teams still need to collaborate: PKI, logging, incident response and data minimisation touch both worlds.
Who is affected?
Government and public services offering or accepting eID.
Financial sector — alongside DORA, strong identity and signature processes matter for onboarding and contracts.
SaaS and trust service providers delivering QES, timestamps, seals or wallet integrations.
Practical first steps
Inventory where you use eID, signatures or QTSP services today. Map vendors, contracts and data flows. Record overlap with GDPR, ISMS and any NIS2/DORA in one register — not parallel spreadsheets.
Checklist
- Inventory eID, QES and QTSP use
- Map vendors and trust list status
- Link to ISMS, GDPR and risk register
- Plan DPIA where wallet or identity data
- Test fallback and incident scenarios
Practical next step
For eIDAS 2.0, ISO Ready links identity, trust and security measures in one ISMS — with actions, evidence and vendors toward audit. Run the readiness scan on iso-ready.nl.