Ga naar inhoud

eIDAS 2.0 implementation checklist

eIDAS 2.0 implementation checklist: practical guide on eIDAS 2.0, trust services and compliance — for IT, privacy and leadership.

Book an informal conversation

ISO Ready helps you align policy, risk, and evidence — without endless document churn.

Run the ISO 27001 readiness scan

Preparation

This checklist structures eIDAS 2.0 readiness before wallet, QES or QTSP programmes. Use alongside ISO 27001 gap analysis — not as legal advice replacement.

Technology and processes

Check: vendor trust list, certificate lifecycle, logging on signing events, fallback processes, API security for wallet integration, and incident playbooks for identity abuse.

Organisation

Assign owner (CISO/DPO/product), update SoA and processing record, plan vendor review and management review decision on residual risk for new trust services.

Checklist

  • Scope: wallet, QES, QTSP or customer?
  • Trust list and contracts checked
  • SoA + processing record updated
  • Logging and key lifecycle documented
  • Management review on residual risk

Practical next step

For eIDAS 2.0 implementation, ISO Ready links identity, trust and security measures in one ISMS — with actions, evidence and vendors toward audit. Run the readiness scan on iso-ready.nl.

More on eIDAS 2.0

Key takeaways

  • Inventory trust services and wallet use before major projects.
  • Link eIDAS to ISMS, GDPR and vendor register — one trail.
  • Test fallback and logging; QES outage is a business continuity scenario.

Veelgestelde vragen

When does eIDAS 2.0 apply to eIDAS 2.0 implementation checklist?
When you offer or consume digital identity, wallet attributes, QES or qualified trust services in the EU — alongside national implementation timelines.
Does eIDAS replace ISO 27001?
No. eIDAS regulates trust services; ISO 27001 helps the ISMS and evidence for security controls around PKI, logging and vendors.
How does this relate to national eID schemes?
National schemes remain; eIDAS 2.0 adds the EUDI wallet and EU-wide interoperability. Plan transition and fallback.
What role does GDPR play?
Identity and attribute data are personal data. DPIA, records and minimisation remain leading.
How do we start with eIDAS 2.0 implementation checklist?
Inventory current trust services, map vendors and link to ISMS and privacy records before rolling out new wallet or QES processes.

Run the ISO 27001 readiness scan

See where you stand before investing in documents or consultants.

Start the readiness scan