eIDAS 2.0 and AI in EU trust services and digital identity

The original eIDAS Regulation (EU) 910/2014 created the EU framework for electronic identification and trust services: electronic signatures, electronic seals, electronic time stamps, electronic registered delivery services, website authentication certificates and the legal recognition of electronic identification means notified by member states. Regulation (EU) 2024/1183 amends that framework to introduce the European Digital Identity Wallet, expand the catalogue of qualified trust services to include qualified electronic attestations of attributes (QEAAs), qualified electronic ledgers and qualified electronic archiving, and impose stricter security and interoperability requirements [1].

AI-driven components routinely sit inside the workflows that depend on eIDAS. Identity proofing in qualified trust service provider (QTSP) onboarding now typically uses AI for document authenticity checks, biometric liveness detection and selfie-to-document matching. KYC flows in financial services use AI for the same reason, often interfacing with eIDAS-notified electronic identification means or the EUDIW once it rolls out. Signature creation and validation services use AI for document understanding and compliance checks. Each of these touch points sits inside the eIDAS regulatory perimeter when the output is a qualified service or feeds an eIDAS-notified flow.

The Implementing and Delegated Acts under eIDAS 2.0 - including the Implementing Regulations on the EUDIW architecture and the trust framework, adopted in 2024 and 2025 - flesh out the technical baseline, including identity-proofing levels and the cryptographic and operational requirements for QTSPs.

Article 24 of eIDAS (as amended) sets out the requirements for qualified trust service providers when issuing qualified certificates. Identity verification of natural and legal persons must be carried out using one of: physical presence, electronic identification means at substantial or high level of assurance, qualified electronic signature/seal certificate previously issued, or "other identification methods which ensure the identification of the natural person with a level of assurance equivalent to physical presence" subject to confirmation by a conformity assessment body.

That last route is where AI-driven remote identity verification (RIV) lives. The 2024 Implementing Regulation on remote identity proofing for trust services, drafted by ENISA and adopted by the Commission, sets the minimum security and reliability requirements: liveness detection, authenticity checks on the identity document, secure capture of biometric data, fraud-detection signals, and human review thresholds. AI components are explicitly permitted, but the QTSP must demonstrate to the supervisory body and the conformity assessment body that the AI component meets the equivalent-to-physical-presence threshold and that the overall process is auditable [2].

The supervisory body in each member state retains the power to inspect, audit and ultimately withdraw qualified status. ENISA publishes guidance on remote identity proofing and on the security framework for qualified trust services, including specific guidance on AI-based fraud-detection components.

The EUDIW is the flagship deliverable of eIDAS 2.0. Member states must offer at least one wallet to natural and legal persons by the end of 2026 (with the precise national rollout dates varying), and private-sector relying parties in defined sectors - banking, telecom, transport, energy, healthcare and large platforms - must accept the wallet for authentication where they currently require strong customer authentication. The wallet allows holders to store and selectively disclose identity attributes, qualified electronic attestations, mobile driving licences, payment credentials and education credentials.

For AI workflows, the wallet changes two things. First, the authoritative identity payload is now presented through a standardised, cryptographically signed credential rather than being inferred from a photographed document. Identity proofing AI in many flows can be replaced or substantially augmented by a wallet presentation. Second, AI systems that consume wallet credentials must respect the selective-disclosure model and the data-minimisation principles in Article 5a of eIDAS 2.0 - asking for only the attributes that are necessary for the service.

The Architecture Reference Framework (ARF), maintained by the eIDAS Expert Group and the Commission, is the operative technical specification. ARF version 1.5 (2025) is the current baseline for wallet implementations and integrating systems [3].

Each member state maintains a national trusted list of qualified trust service providers and the qualified trust services they offer. The Commission publishes the consolidated EU/EEA list. Inclusion on the trusted list is the legal effect of qualified status, and removal is the operative supervisory sanction available to national supervisory bodies. A QTSP that uses an AI-driven identity-proofing component and fails to meet the equivalent-to-physical-presence threshold can be removed from the list, which extinguishes the legal effect of all certificates it issues going forward.

Conformity assessment bodies (CABs) audit QTSPs against ETSI standards (EN 319 401, EN 319 411-1/2 and the related technical specifications) every two years. The CABs are increasingly trained to audit AI components specifically: model performance metrics, false-acceptance and false-rejection rates, bias and demographic robustness, drift monitoring and human-review thresholds. The 2024 ENISA guidance on remote identity proofing is the operative cross-reference for what auditors expect to see.

AI used for biometric identification at distance is high-risk under the EU AI Act (Regulation 2024/1689) Annex III, point 1, and remote-biometric-identification AI in identity-proofing flows is therefore subject to the full Article 9 risk management, Article 10 data governance, Article 14 human oversight and Article 15 accuracy/robustness/cybersecurity obligations on top of eIDAS [5]. GDPR adds the lawful-basis question (special category data under Article 9 GDPR for biometric data when used for unique identification), retention limits and data-subject rights.

For a QTSP that uses AI-driven identity proofing, the practical compliance stack is: eIDAS sets the trust-service-specific security and reliability requirements, the AI Act sets the AI system's lifecycle obligations as a high-risk system, GDPR governs the personal data dimension, and DORA (where the QTSP is in scope as a digital infrastructure entity under NIS2 or as a financial entity) governs the operational resilience layer. Mature QTSPs run a single integrated programme rather than four parallel ones.

Impetora's TRACE methodology was built around AI systems that have to survive supervisory and conformity-assessment review, and eIDAS QTSPs face exactly that shape of audit. Trust covers the policy, residency and audit-trail layer, including the identity-proofing process documentation that supervisory bodies and CABs review. Readiness covers the data and workflow audit on which the technical documentation, biometric data-protection assessment and ETSI conformance evidence depend. Architecture covers production-grade design with logging, monitoring and human-oversight integration that meets the equivalent-to-physical-presence threshold. Citations and Evidence covers the audit-trail layer that survives CAB review and AI Act post-market monitoring.

The practical path for a QTSP or wallet-relying-party AI engagement: scope the system against the specific eIDAS service or wallet flow, document the identity-proofing process and human-review thresholds, integrate the ETSI conformance and AI Act technical documentation as one evidence base, and prepare for both the biennial CAB audit and the AI Act post-market monitoring rhythm.