The EU digital identity wallet and eIDAS 2.0, from Türkiye

eIDAS 2.0 is the EU's Regulation (EU) 2024/1183. It requires every EU member state to provide at least one European Digital Identity Wallet (EUDI Wallet), so that people and businesses in the Union can identify themselves and share documents across borders, and the deadline falls at the end of 2026. Tamga Wallet is built on the same open standards as those wallets, which is why we call it EU-aligned. It is not an official EUDI Wallet: that status belongs to wallets that a member state provides or recognises and that have been certified. Türkiye is not bound by the regulation, but the standards it rests on are becoming the common language of digital documents, and that matters for people and institutions here.

What is eIDAS 2.0?

eIDAS is the EU's regulation on electronic identification and trust services. The first version, Regulation (EU) No 910/2014, dealt mainly with national eID schemes and e-signatures. Regulation (EU) 2024/1183, usually called eIDAS 2.0, amends it and adds a new idea: a wallet on the phone that holds identity data and other documents, and shares them under the user's control.

The regulation was adopted on 11 April 2024, published in the Official Journal on 30 April 2024 and entered into force on 20 May 2024, the twentieth day after publication.

When must EU countries offer a wallet?

Article 5a(1) says each member state shall provide at least one European Digital Identity Wallet within 24 months of the entry into force of the implementing acts that set its technical rules. The first five of those implementing regulations were adopted on 28 November 2024 and published on 4 December 2024; they entered into force twenty days later, on 24 December 2024. Counting 24 months from there gives the end of 2026.

What must an EUDI Wallet do?

Article 5a(4) lists what a wallet must let the user do. In short:

• request, receive, store, select, combine, delete, share and present identity data and other attestations under the sole control of the user, with selective disclosure possible;
• generate pseudonyms and keep them encrypted on the device;
• see a log of all transactions in one dashboard, from which the user can ask a relying party to erase personal data (under GDPR Article 17) and report a suspicious request to the data protection authority;
• sign with qualified electronic signatures, free of charge for natural persons.

Several other rules in the same article protect the user's privacy:

• the wallet must not tell the issuer how its documents are used (Art. 5a(5)(b));
• the wallet provider must not collect usage data beyond what is needed, or combine wallet data with data from its other services (Art. 5a(14));
• the technical framework must not let anyone track, link or correlate a user's transactions, and must support techniques that keep presentations unlinkable where identification is not needed (Art. 5a(16));
• the source code of the wallet's application software components must be open source (Art. 5a(3));
• issuing, using and revoking the wallet is free of charge for natural persons (Art. 5a(13));
• using the wallet is voluntary; nobody may be refused or disadvantaged for not using one, and other ways of identification must remain (Art. 5a(15)).

Who can provide an official EUDI Wallet?

Article 5a(2) allows three ways: a wallet provided directly by a member state, under a mandate from a member state, or independently of a member state but recognised by it. In every case a member state stands behind it.

The wallet must also be certified. Under Article 5c, conformity assessment bodies designated by member states certify that a wallet meets the requirements. Member states then notify the Commission of certified wallets, and a list of certified wallets is published (Article 5d). The name "EUDI Wallet" is therefore not a label any app can give itself. It follows from a member state's decision and a certification.

Who must accept the wallet?

Article 5f sets three levels:

1. Public services. Where a member state requires electronic identification for an online public service, it must also accept EUDI Wallets.
2. Private services that must use strong authentication. Where law or contract requires strong user authentication (the article names transport, energy, banking, financial services, social security, health, drinking water, postal services, digital infrastructure, education and telecommunications), private relying parties must accept the wallet within 36 months of the implementing acts, when the user asks for it. Micro and small enterprises are exempt.
3. Very large online platforms. Where they require authentication, they must accept the wallet on the user's request, and only for the minimum data the service needs.

Which technical rules sit under the regulation?

The regulation sets the obligations; the implementing regulations and the technical framework set the details. Regulation (EU) 2024/2977 covers identity data and attestations issued to wallets, and Regulation (EU) 2024/2979 covers the integrity and core functions of wallets; others cover protocols, certification and notifications. The European Commission also publishes the Architecture and Reference Framework (ARF) openly on GitHub. Its version 3.0.0 was released on 23 July 2026.

Underneath, these documents point to open standards from outside the EU institutions: OpenID for issuing and presenting documents, IETF SD-JWT for selective disclosure, ISO/IEC 18013-5 for the mdoc format and in-person presentation, and the IETF Token Status List for revocation.

What does "EU-aligned" mean for Tamga Wallet?

It means Tamga Wallet uses the same formats, protocols and security profile as EU wallets, and follows the privacy rules above in its own design:

The Article 5a(4) features have a counterpart in the app: you choose the fields on an approval screen, each site gets its own pseudonym with Sign in with Tamga, History lists every sharing on your phone, and from there you can ask an organisation to delete your data or report a request to the data protection authority: Ask to delete. Issuers are not told where you show their documents, and the wallet provider keeps only a technical record of your wallet unit.

What does it not mean?

Some things should be said plainly:

• No official status. Tamga Wallet is not an official EUDI Wallet of any member state and has no connection with any government body. It is the first wallet of Tamga Network, but a separate product from the network.
• EU trust lists are not read yet. Today the wallet reads Tamga Network's trust lists. Reading the trust lists of the EU and its member states comes later.
• Interoperability is shown by tests. Alignment is proved by tests against the EU's reference verifiers; we will publish the results on the European alignment page.
• Not every document crosses the border by itself. A verifier in the EU decides which issuers it trusts. A document issued on Tamga Network is readable by EU-standard software, but trusting its issuer needs recognition between trust lists.

Why does this matter for Türkiye?

Türkiye is not an EU member state, so Article 5a does not oblige it to provide a wallet, and a Turkish wallet cannot become an EUDI Wallet on its own. Three things still make the regulation relevant here.

First, the standards are open and not limited to the EU. OpenID, IETF and ISO specifications can be used by anyone. A university in Türkiye that issues diplomas in these formats today issues them in a form EU wallets and verifiers already understand.

Second, trust can be connected later without reissuing documents. Tamga Network uses the same two-level trust list model as the EU: a list of trusted lists that points to national lists. Each state can run its own list, and recognition of other lists, the EU's included, comes through the same door. When a state takes over its list, documents, wallets and verifiers stay the same.

Third, there is a path to official recognition. If Türkiye regulates such wallets and recognises them, Tamga Wallet will enter that process.

Frequently asked questions

Is Tamga Wallet an EUDI Wallet?

No. It is an independent wallet built on the same open standards. The EUDI Wallet name belongs to wallets that an EU member state provides or recognises and that have been certified.

When will EU countries offer their wallets?

The regulation requires each member state to provide at least one wallet within 24 months of the implementing acts entering into force. The first ones entered into force on 24 December 2024, which puts the deadline at the end of 2026.

Is using an EUDI Wallet mandatory?

No. Article 5a(15) makes use voluntary and forbids restricting or disadvantaging people who do not use one. Other means of identification must remain available.

Can someone in Türkiye use an EU country's wallet?

Article 5a(1) speaks of natural and legal persons in the Union. Who can get a particular national wallet depends on that member state's own rules, so the answer differs from country to country.

Does eIDAS 2.0 apply to Turkish companies?

The regulation binds EU member states and the services covered in the EU. A Turkish company offering services inside the EU should check its own obligations with a lawyer; this post is not legal advice.