directly by a Member State;

under a mandate from a Member State;

independently of a Member State but recognised by that Member State.

securely request, obtain, select, combine, store, delete, share and present, under the sole control of the user, person identification data and, where applicable, in combination with electronic attestations of attributes, to authenticate to relying parties online and, where appropriate, in offline mode, in order to access public and private services, while ensuring that selective disclosure of data is possible;

generate pseudonyms and store them encrypted and locally within the European Digital Identity Wallet;

securely authenticate another person’s European Digital Identity Wallet, and receive and share person identification data and electronic attestations of attributes in a secured way between the two European Digital Identity Wallets;

access a log of all transactions carried out through the European Digital Identity Wallet via a common dashboard enabling the user to:

sign by means of qualified electronic signatures or seal by means of qualified electronic seals;

download, to the extent technically feasible, the user’s data, electronic attestation of attributes and configurations;

exercise the user’s rights to data portability.

support common protocols and interfaces:

not provide any information to trust service providers of electronic attestations of attributes about the use of those electronic attestations;

ensure that the relying parties can be authenticated and identified by implementing authentication mechanisms in accordance with Article 5b;

meet the requirements set out in Article 8 with regard to assurance level high, in particular as applied to the requirements for identity proofing and verification, and electronic identification means management and authentication;

in the case of the electronic attestation of attributes with embedded disclosure policies, implement the appropriate mechanism to inform the user that the relying party or the user of the European Digital Identity Wallet requesting that electronic attestation of attributes has the permission to access such attestation;

ensure that the person identification data, which is available from the electronic identification scheme under which the European Digital Identity Wallet is provided, uniquely represents the natural person, legal person or the natural person representing the natural or legal person, and is associated with that European Digital Identity Wallet;

offer all natural persons the ability to sign by means of qualified electronic signatures by default and free of charge.

ensure that the authenticity and validity of European Digital Identity Wallets can be verified;

allow users to verify the authenticity and validity of the identity of relying parties registered in accordance with Article 5b.

upon the explicit request of the user;

where the security of the European Digital Identity Wallet has been compromised;

upon the death of the user or cease of activity of the legal person.

not allow providers of electronic attestations of attributes or any other party, after the issuance of the attestation of attributes, to obtain data that allows transactions or user behaviour to be tracked, linked or correlated, or knowledge of transactions or user behaviour to be otherwise obtained, unless explicitly authorised by the user;

enable privacy preserving techniques which ensure unlikeability, where the attestation of attributes does not require the identification of the user.

the body responsible for establishing and maintaining the list of registered relying parties that rely on European Digital Identity Wallets in accordance with Article 5b(5) and the location of that list;

the bodies responsible for the provision of European Digital Identity Wallets in accordance with Article 5a(1);

the bodies responsible for ensuring that the person identification data is associated with the European Digital Identity Wallet in accordance with Article 5a(5), point (f);

the mechanism allowing for the validation of the person identification data referred to in Article 5a(5), point (f), and of the identity of the relying parties;

the mechanism by which to validate the authenticity and validity of European Digital Identity Wallets.

the information necessary to authenticate to European Digital Identity Wallets, which as a minimum includes:

the contact details of the relying party;

the intended use of European Digital Identity Wallets, including an indication of the data to be requested by the relying party from users.

the certificate and certification assessment report of the certified European Digital Identity Wallet;

a description of the electronic identification scheme under which the European Digital Identity Wallet is provided;

the applicable supervisory regime and information on the liability regime with respect to the party providing the European Digital Identity Wallet;

the authority or authorities responsible for the electronic identification scheme;

arrangements for suspension or revocation of the electronic identification scheme or authentication or of the compromised parts concerned.

the electronic identification means is issued under an electronic identification scheme that is included in the list published by the Commission pursuant to Article 9;

the assurance level of the electronic identification means corresponds to an assurance level equal to or higher than the assurance level required by the relevant public sector body to access that service online in the first Member State, provided that the assurance level of that electronic identification means corresponds to the assurance level substantial or high;

the relevant public sector body uses the assurance level substantial or high in relation to accessing that service online.

assurance level low shall refer to an electronic identification means in the context of an electronic identification scheme, which provides a limited degree of confidence in the claimed or asserted identity of a person, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to decrease the risk of misuse or alteration of the identity;

assurance level substantial shall refer to an electronic identification means in the context of an electronic identification scheme, which provides a substantial degree of confidence in the claimed or asserted identity of a person, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to decrease substantially the risk of misuse or alteration of the identity;

assurance level high shall refer to an electronic identification means in the context of an electronic identification scheme, which provides a higher degree of confidence in the claimed or asserted identity of a person than electronic identification means with the assurance level substantial, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to prevent misuse or alteration of the identity.

a description of the electronic identification scheme, including its assurance levels and the issuer or issuers of electronic identification means under the scheme;

the applicable supervisory regime and information on the liability regime with respect to the following:

the authority or authorities responsible for the electronic identification scheme;

information on the entity or entities which manage the registration of the unique person identification data;

a description of how the requirements set out in the implementing acts referred to in Article 12(8) are met;

a description of the authentication referred to in point (f) of Article 7;

arrangements for suspension or revocation of either the notified electronic identification scheme or authentication or the compromised parts concerned.

it aims to be technology neutral and does not discriminate between any specific national technical solutions for electronic identification within a Member State;

it follows European and international standards, where possible;

it facilitates the implementation of privacy and security by design.

a reference to minimum technical requirements related to the assurance levels under Article 8;

a mapping of national assurance levels of notified electronic identification schemes to the assurance levels under Article 8;

a reference to minimum technical requirements for interoperability;

a reference to a minimum set of person identification data necessary to uniquely represent a natural or legal person, or a natural person representing another natural person or a legal person, which is available from electronic identification schemes;

rules of procedure;

arrangements for dispute resolution; and

common operational security standards.

EUR 5 000 000 where the trust service provider is a natural person; or

where the trust service provider is a legal person, EUR 5 000 000 or 1 % of the total worldwide annual turnover of the undertaking to which the trust service provider belonged in the financial year preceding the year in which the infringement occurred, whichever is higher.

further specify the measures referred to in paragraph 1; and

define the formats and procedures, including deadlines, applicable for the purpose of paragraph 2.

have appropriate policies and take corresponding measures to manage legal, business, operational and other direct or indirect risks to the provision of the non-qualified trust service, which shall, notwithstanding Article 21 of Directive (EU) 2022/2555, include at least measures relating to:

notifying the supervisory body, the identifiable affected individuals, the public if it is of public interest and, where applicable, other relevant competent authorities, of any security breaches or disruptions in the provision of the service or the implementation of the measures referred to in point (a) (i), (ii) or (iii), that have a significant impact on the trust service provided or on the personal data maintained therein, without undue delay and in any case no later than 24 hours of having become aware of any security breaches or disruptions.

the accreditation of the conformity assessment bodies and for the conformity assessment report referred to in paragraph 1;

the auditing requirements for the conformity assessment bodies to carry out their conformity assessment, including composite assessment, of the qualified trust service providers as referred to in paragraph 1;

the conformity assessment schemes for carrying out the conformity assessment of the qualified trust service providers by the conformity assessment bodies and for the provision of the report referred to in paragraph 1.

by means of the European Digital Identity Wallet or a notified electronic identification means which meets the requirements set out in Article 8 with regard to assurance level high;

by means of a certificate of a qualified electronic signature or of a qualified electronic seal, issued in compliance with point (a), (c) or (d);

by using other identification methods which ensure the identification of the person with a high level of confidence, the conformity of which shall be confirmed by a conformity assessment body;

through the physical presence of the natural person or of an authorised representative of the legal person, by means of appropriate evidence and procedures, in accordance with national law.

by means of the European Digital Identity Wallet or a notified electronic identification means which meets the requirements set out in Article 8 with regard to assurance level high;

by means of a certificate of a qualified electronic signature or of a qualified electronic seal, issued in accordance with paragraph 1a, point (a), (c) or (d);

by means of a qualified electronic attestation of attributes;

by using other methods, which ensure the verification of the attributes with a high level of confidence, the conformity of which shall be confirmed by a conformity assessment body;

by means of the physical presence of the natural person or of an authorised representative of the legal person, by means of appropriate evidence and procedures, in accordance with national law.

inform the supervisory body at least one month before implementing any change in the provision of its qualified trust services or at least three months in case of an intention to cease those activities;

employ staff and, if applicable, subcontractors who possess the necessary expertise, reliability, experience, and qualifications and who have received appropriate training regarding security and personal data protection rules and shall apply administrative and management procedures which correspond to European or international standards;

with regard to the risk of liability for damages in accordance with Article 13, maintain sufficient financial resources and/or obtain appropriate liability insurance, in accordance with national law;

before entering into a contractual relationship, inform, in a clear, comprehensive and easily accessible manner, in a publicly accessible space and individually any person seeking to use a qualified trust service of the precise terms and conditions regarding the use of that service, including any limitations on its use;

use trustworthy systems and products that are protected against modification and ensure the technical security and reliability of the processes supported by them, including using suitable cryptographic techniques;

use trustworthy systems to store data provided to it, in a verifiable form so that:

notwithstanding Article 21 of Directive (EU) 2022/2555, have appropriate policies and take corresponding measures to manage legal, business, operational and other direct or indirect risks to the provision of the qualified trust service, including at least measures related to the following:

notify the supervisory body, the identifiable affected individuals, other relevant competent bodies where applicable and, at the request of the supervisory body, the public if it is of public interest, of any security breaches or disruptions in the provision of the service or the implementation of the measures referred to in point (fa)(i), (ii) or (iii) that have a significant impact on the trust service provided or on the personal data maintained therein, without undue delay and in any event within 24 hours of the incident;

take appropriate measures against forgery, theft or misappropriation of data or, without right, deleting, altering or rendering data inaccessible;

record and keep accessible for as long as necessary after the activities of the qualified trust service provider have ceased, all relevant information concerning data issued and received by the qualified trust service provider, for the purpose of providing evidence in legal proceedings and for the purpose of ensuring continuity of the service. Such recording may be done electronically;

have an up-to-date termination plan to ensure the continuity of service in accordance with provisions that are verified by the supervisory body pursuant to Article 46b(4), point (i);

in case of qualified trust service providers issuing qualified certificates, establish and keep updated a certificate database.

if a qualified certificate for electronic signature has been temporarily suspended that certificate shall lose its validity for the period of suspension;

the period of suspension shall be clearly indicated in the certificate database and the suspension status shall be visible, during the period of suspension, from the service providing information on the status of the certificate.

generates or manages electronic signature creation data on behalf of the signatory;

notwithstanding point (1)(d) of Annex II, duplicates the electronic signature creation data for back-up purposes only, provided that the following requirements are met:

complies with any requirements identified in the certification report of the specific remote qualified electronic signature creation device issued pursuant to Article 30.

a security evaluation process carried out in accordance with one of the standards for the security assessment of information technology products included in the list established in accordance with the second subparagraph; or

a process other than the process referred to in point (a), provided that it uses comparable security levels and provided that the public or private body referred to in paragraph 1 notifies that process to the Commission. That process may be used only in the absence of standards referred to in point (a) or when a security evaluation process referred to in point (a) is ongoing.

the certificate that supports the signature was, at the time of signing, a qualified certificate for electronic signature complying with Annex I;

the qualified certificate was issued by a qualified trust service provider and was valid at the time of signing;

the signature validation data corresponds to the data provided to the relying party;

the unique set of data representing the signatory in the certificate is correctly provided to the relying party;

the use of any pseudonym is clearly indicated to the relying party if a pseudonym was used at the time of signing;

the electronic signature was created by a qualified electronic signature creation device;

the integrity of the signed data has not been compromised;

the requirements provided for in Article 26 were met at the time of signing.

the certificate that supports the signature was, at the time of signing, a qualified certificate for electronic signature complying with Annex I;

the qualified certificate was issued by a qualified trust service provider and was valid at the time of signing;

the signature validation data corresponds to the data provided to the relying party;

the unique set of data representing the signatory in the certificate is correctly provided to the relying party;

the use of any pseudonym is clearly indicated to the relying party if a pseudonym was used at the time of signing;

the integrity of the signed data has not been compromised;

the requirements provided for in Article 26 were met at the time of signing.

provides validation in compliance with Article 32(1); and

allows relying parties to receive the result of the validation process in an automated manner, which is reliable, efficient and bears the advanced electronic signature or advanced electronic seal of the provider of the qualified validation service.

if a qualified certificate for electronic seal has been temporarily suspended, that certificate shall lose its validity for the period of suspension;

the period of suspension shall be clearly indicated in the certificate database and the suspension status shall be visible, during the period of suspension, from the service providing information on the status of the certificate.

it binds the date and time to data in such a manner as to reasonably preclude the possibility of the data being changed undetectably;

it is based on an accurate time source linked to Coordinated Universal Time; and

it is signed using an advanced electronic signature or sealed with an advanced electronic seal of the qualified trust service provider, or by some equivalent method.

they are provided by one or more qualified trust service provider(s);

they ensure with a high level of confidence the identification of the sender;

they ensure the identification of the addressee before the delivery of the data;

the sending and receiving of data is secured by an advanced electronic signature or an advanced electronic seal of a qualified trust service provider in such a manner as to preclude the possibility of the data being changed undetectably;

any change of the data needed for the purpose of sending or receiving the data is clearly indicated to the sender and addressee of the data;

the date and time of sending, receiving and any change of data are indicated by a qualified electronic time stamp.

those set out in Annex VII;

the qualified certificate supporting the qualified electronic signature or qualified electronic seal of the public sector body referred to in Article 3, point (46), identified as the issuer referred to in point (b), of Annex VII, containing a specific set of certified attributes in a form suitable for automated processing and:

they are provided by qualified trust service providers;

they use procedures and technologies capable of ensuring the durability and legibility of electronic data and electronic documents beyond the technological validity period and at least throughout the legal or contractual preservation period, while maintaining their integrity and the accuracy of their origin;

they ensure that those electronic data and those electronic documents are preserved in such a way that they are safeguarded against loss and alteration, except for changes concerning their medium or electronic format;

they shall allow authorised relying parties to receive a report in an automated manner that confirms that electronic data and electronic documents retrieved from a qualified electronic archive enjoy the presumption of integrity of the data from the beginning of the preservation period to the moment of retrieval.

The report referred to in point (d) of the first subparagraph shall be provided in a reliable and efficient way and shall bear the qualified electronic signature or qualified electronic seal of the provider of the qualified electronic archiving service.

they are created and managed by one or more qualified trust service providers;

they establish the origin of data records in the ledger;

they ensure the unique sequential chronological ordering of data records in the ledger;

they record data in such a way that any subsequent change to the data is immediately detectable, ensuring their integrity over time.