In short and in plain language
This article is about a digital wallet. It is an app on your phone. An app is a small program.
Your identity card and other papers can be kept in this app. You then share only what is needed.
The article explains what applies today. It also explains what is only a plan. And it explains whether you have to use the app.
This matters for anyone who often needs to show who they are. We check the identity function on your device with you, calmly.
Your ID card sits in a drawer, your driving licence lives in your wallet, and every further proof of anything comes on its own piece of plastic or paper. From the end of 2026 there is meant to be a second option alongside all of that: an app on your phone that holds identity documents and other attestations, and from which you hand over only the detail that is actually needed. The legal framework has been in force since 20 May 2024 (Official Journal of the European Union), and the deadline for making a wallet available runs out on 24 December 2026. This article separates three things that news reports routinely blur together: what already applies today, what becomes mandatory on a particular date, and what is so far a plan with a sender attached.
Key takeaways
- The European Digital Identity Wallet is no longer an idea but binding law: the regulation has applied directly in every member state since 20 May 2024.
- By 24 December 2026 each member state has to provide at least one such wallet. That is an obligation on states, not on you.
- Issuance, use and revocation are free of charge for natural persons, and using a wallet is explicitly voluntary.
- Anyone who does not use the app must not be disadvantaged in access to services, access to the labour market or in the freedom to conduct a business. Other routes stay open.
- In Germany a state wallet has been announced for early 2027. An announcement is a different thing from a deadline in the Official Journal.
What the digital wallet actually is
The official name is a mouthful: European Digital Identity Wallet. What it means is an application that brings two things together. First a digital proof of identity, derived from the chip in your ID card, which is meant to be legally equivalent to the existing online identification procedure (National EUDI Wallet project). Second, further attestations issued by other bodies: driving licence, pension card, certificates, membership cards. So the application is not a new ID document but a container for documents you already hold. A comparison shows how it differs from applications you may already know: the electronic patient record keeps findings and medication plans ready, while the wallet keeps identity and attestation data. They are separate systems with separate purposes and separate access routes.
The second difference concerns the direction in which data flows. In online banking you sign in to your bank, and afterwards the bank knows it was you; the payee verification in payment traffic also works inside that banking relationship. With a wallet it runs the other way round: you release individual details from your own app to a counterparty, and the body that issued your ID document learns nothing about it. That separation is written into the legal text. The technical framework must not allow issuers or other parties to track, link or correlate transactions or user behaviour unless the user has expressly authorised it (Official Journal of the European Union). That is not a promise from a brochure but a requirement placed on the technology.
The application
An app on the phone that keeps attestations encrypted on the device and protects access with its own PIN and the device lock (National EUDI Wallet project).
The identity function
Person identification data is derived from the chip of the ID card or the electronic residence permit. For later transactions the phone alone is then enough (National EUDI Wallet project).
The attestations
A digital driving licence, a social pass and a pension card are planned as the first additional attestations, with more following step by step depending on the issuer (National EUDI Wallet project).
What already applies today
The amending regulation was published in the Official Journal on 30 April 2024 and entered into force on the twentieth day after that, which is 20 May 2024 (Official Journal of the European Union). Since then a set of principles has been directly applicable law in every member state. That needs neither a German implementing act nor a finished app: the principles apply to every wallet that is issued in future, and they cannot be watered down nationally. If you want to know what is already binding, it is in the following five points, and each of them appears verbatim in the text of the regulation.
- Use is voluntary. Anyone who does not use a wallet must not be restricted or disadvantaged in access to public and private services, in access to the labour market or in the freedom to conduct a business (Official Journal of the European Union).
- Issuance, use and revocation are free of charge for all natural persons (Official Journal of the European Union).
- The wallet is provided under an electronic identification scheme notified at assurance level high, the highest level European law recognises (Official Journal of the European Union).
- The provider must not collect usage information that is not necessary for providing the service, and must not combine identity data with personal data from any other service (Official Journal of the European Union).
- Bodies that want to request data from your wallet have to register beforehand in a member state and state which data they need. They must not ask for anything else (Official Journal of the European Union).
In practice that means the framework stands while the applications are still missing. Pick up your phone today and you will find no finished European wallet on it. What does exist is the online identification function of the German ID card, and that is the technical precondition for the later switch. Since December 2025 there has also been an official test environment in which organisations try out their use cases exclusively with test data (National EUDI Wallet project) - but a test environment is not a product for a household. If operating the phone is hard work for you anyway, it is worth looking at the accessibility settings first: larger type, a read-aloud function and stronger contrast make any later setup easier.
What becomes mandatory when
Every deadline in the regulation hangs on a single date: the entry into force of the implementing acts. The Commission adopted five of them on 28 November 2024. They were published in the Official Journal on 4 December 2024 and entered into force on the twentieth day after that (Implementing Regulation 2979, Official Journal). That makes 24 December 2024 the reference day from which every other deadline is counted. If you only remember 24 December 2026, you know the result but not the arithmetic behind it - and that means you cannot check whether a report has verified the date or merely copied it.
| Date | Who it concerns | What applies |
|---|---|---|
| 20.05.2024 | all member states | The regulation applies directly. Voluntary use, no charge and the data protection limits are fixed from here on. |
| 24.12.2024 | Commission and states | The implementing acts enter into force. Every further deadline runs from that day. |
| 24.12.2026 | every member state | At least one wallet has to be available, 24 months after the implementing acts. |
| no separate deadline | public sector bodies | Where an authority requires electronic identification for an online service, it has to accept the wallet. |
| 24.12.2027 | large private bodies | Transport, energy, banking, health, education and others accept it on request, 36 months after the implementing acts. |
| exempt | micro and small enterprises | No obligation to accept arises for them from the regulation. |
The 36-month deadline does not hit every business. Micro and small enterprises within the meaning of the European definition are expressly exempt. What is covered are bodies that are already required by law or by contract to use online identification with strong user authentication; the sectors listed are transport, energy, banking, financial services, social security, health, drinking water, postal services, digital infrastructure, education and telecommunications (Official Journal of the European Union). And even there the obligation to accept only bites where the user asks for it. So if you would rather carry on with an ID card and a signature, nothing changes for you. We are happy to walk through it calmly in an appointment for tech help for seniors.
Why 24 December 2026 is in the calendar
What is so far only an announcement
Everything that concerns the German launch sits on a different level. The responsible Federal Ministry for Digital Affairs and State Modernisation writes that Germany plans to provide the first stage of the state wallet for early 2027 (BMDS). In its statement on the cabinet decision about the Digital Identities Act it says the technical infrastructure is being developed in parallel so that the application can be provided across the country on schedule from January 2027 (BMDS). Those are planning statements by the government, not dates from a law gazette. The difference is not pedantry: a deadline in the Official Journal is addressed to someone and can be enforced, while a plan can slip without anyone breaching the law.
The range of functions at launch is planning too. According to the national project, alongside the identity function a digital driving licence, a social pass and a pension card are expected to be supported as the first attestations; how many others follow depends on who issues them (National EUDI Wallet project). For wallets from other providers, certification is currently planned to become possible around twelve months after the state application goes live (BMDS). Which application will turn out to be the right one cannot be recommended to anyone in good faith today - there is simply none yet that could be compared. If you want to sort out your access credentials now anyway, a password manager will serve you better than waiting for an app.
Keeping the three levels apart
Voluntary means voluntary
The most important sentence in the whole regulation sits in Article 5a(15) and is short: the use of European Digital Identity Wallets is voluntary (Official Journal of the European Union). The paragraph goes on and expressly forbids that anyone who does not use the application be restricted or disadvantaged in access to public and private services, in access to the labour market or in the freedom to conduct a business. And it lays down that access to services must remain possible through other existing means of identification and authentication. Those three sentences are the reason you do not have to let yourself be pushed into anything. If you want to settle what happens to accounts and access after your death, the groundwork is in our article on digital legacy - there too the paper route remains admissible.
- No body may require you to identify yourself only in digital form. Other procedures have to stay open (Official Journal of the European Union).
- The national project puts it the same way: use remains voluntary and free of charge, and counterparties have to offer alternative procedures (National EUDI Wallet project).
- For citizens no compulsory use is envisaged. What is compulsory is that certain bodies offer identification via a wallet at all (National EUDI Wallet project).
- Anyone without a smartphone, or who does not want one, loses no entitlement by that. Analogue routes remain in place according to the ministry (BMDS).
The use of European Digital Identity Wallets shall be voluntary. Natural and legal persons that do not use the European Digital Identity Wallet shall not be in any way restricted or disadvantaged in the access to public and private services, the labour market and freedom to conduct a business.
What you need if you want to take part
Suppose you would like to use the application as soon as it exists. Then you need three things: a smartphone, an ID document with an active online identification function and a six-digit PIN. On German ID cards applied for since 15 July 2017 the online identification function is activated automatically (National EUDI Wallet project). On older cards it may be switched off. Many people no longer know whether a PIN was ever set at all; that is what the letter with the transport PIN is for, the one handed over when the card was collected. In our smartphone courses we go through exactly these steps together, without time pressure and on your own device.
- Check whether the online identification function of your ID card is active. Cards applied for before 15 July 2017 may have it switched off (National EUDI Wallet project).
- Dig out the PIN letter. Without a PIN or a transport PIN the identification function cannot be put into service.
- If the PIN is missing, the citizens' office sets a new one. The route is the same as for a forgotten card PIN and costs nothing but an appointment.
- Check whether your phone can read the ID chip at all. That needs a near-field interface, which older devices do not have.
- Put your important access credentials in order beforehand. Anyone who has already failed at the electronic patient record usually knows the reason: the missing PIN, not the missing technology.
- Leave everything else until an application has actually been published. Pre-installations from unknown sources carry a risk without any return.
Sort out the PIN
The six-digit PIN is the knowledge factor in every use of the identification function (National EUDI Wallet project). Without it nothing works, with it almost everything does.
Check near-field
The phone reads the ID chip via a near-field interface. Where it is missing, a card reader at the computer remains the route for public authority portals.
Allow time
The one-off verification takes longer than an ordinary app launch. Plan a quiet half hour for it, not five minutes between two appointments.
Data protection: what the regulation forbids
The regulation does not only write down what the wallet should be able to do, but also what nobody may do with it. That is the part usually missing from the reporting. The provider must not collect information about the use that is not necessary for providing the service, and must not combine person identification data with personal data from any other service of its own or of a third party (Official Journal of the European Union). Data related to the provision of the wallet has to be kept logically separate from any other data held. The European digital target behind it is spelled out: by 2030, 100 percent of Union citizens should have access to secure electronic identification means that give them full control over identity transactions and the personal data shared (Digital Decade Decision, Official Journal). If the underlying principles interest you, our data protection course covers them compactly.
- The technical framework must not allow issuers or other parties to track, link or correlate transactions or user behaviour unless you expressly authorise it (Official Journal of the European Union).
- Where an attestation does not require identification, technical means have to make unlinkability possible. So a proof of age can confirm adulthood without showing the date of birth (Official Journal of the European Union).
- Counterparties must not request data other than the data they declared when they registered (Official Journal of the European Union).
- Certification of a wallet lasts at most five years and requires a vulnerability assessment every two years. If a vulnerability is left unaddressed, the certification is withdrawn (Official Journal of the European Union).
- The source code of the application software components is published under an open-source licence, so that scrutiny does not have to rely on assurances (Official Journal of the European Union).
What the application stores on the device
What this means for everyday life at home
For most households little changes in 2026 and a fair amount in 2027 - but only if they want it to. You can take part, you do not have to. If you do take part, some of the paperwork disappears; if you leave it, everything stays as it was. One point deserves attention regardless: as soon as identity data sits on the phone, the device becomes more valuable, including to strangers. Before an old device leaves the house, the data belongs off it properly; how that reliably works is set out in our article on erasing data before a sale.
Second, the weight of backups shifts. An attestation in the wallet cannot be restored after a device is lost, it is issued afresh - inconvenient, but manageable. Your photos and documents, by contrast, are gone if no copy exists, so the backup strategy for phone data stays exactly as important as before. And third, the ID card itself is affected: under the Digital Identities Act the trip to the office for a renewal is set to fall away for everyone aged 70 and over, and under the planned rules the card can continue to be used without a time limit (BMDS). That too is so far a draft going through parliament, not a rule in force.
What to expect around the launch
Your roadmap up to early 2027
Until then there are exactly three sensible preparations, and none of them costs money: check the identification function, sort out the PIN, and measure reports against the legal sources. Everything else - pre-registrations, supposed waiting lists, paid support services around an application that has not been published - is not part of it. If you would rather not do the check on your own, we take it on during a home visit; a short enquiry through our contact form is enough, and we bring the card reader with us.
- Up to the end of 2026: find the ID card, check the online identification function, sort out the PIN. That is worth doing independently of any app, because the same function is needed for public authority portals.
- End of 2026: the European deadline runs out. Watch whether an application is published and who issues it. An official application comes from the official app directory on your device, not from a link in a message.
- Early 2027: if an application exists and you want to use it, set it up calmly. Expect a one-off verification with the ID card at the device.
- Through 2027: with every service, check whether another route remains open to you. It has to remain open (Official Journal of the European Union).
- After that: treat the application like the ID card itself. Switch the device lock on, install system updates, keep the PIN to yourself. Our price overview shows what an on-site setup costs.
Sources and Studies
Related Articles
Smart home data: new access rights from September 2026
From 12 September 2026, new connected devices must build in access to your data. Which deadlines apply, what you can ask for and what you cannot.
Selling your old phone: erase your data for good
Selling or handing on an old phone: why a factory reset alone is not enough, and the order in which account, cards and storage have to be released.
Secure Your Home Router: Safer Home Network in 2026
Secure your router and smart-home devices against outside access: WPA3, a guest network for IoT, firmware updates and strong passwords - explained step by step.