Summary

  • The EU’s 2026 Trust Mark is meant to open a verification path: a wallet unit must let its user reach information about the wallet solution’s certification status.
  • The first generation of wallets is certified through national schemes. Member States assign scheme owners; accredited conformity-assessment bodies issue certificates; Member States submit the record to a European Commission-maintained, machine-readable list.
  • Public certification reports, responsibility details and appeal procedures give users and relying parties a way to see who stands behind a wallet’s status.
  • The end-2026 delivery deadline is a legal requirement, not proof that every national wallet has already been issued or certified.

Analysis

A mark with a route behind it

The EU Digital Identity Wallet Trust Mark is designed to travel with a live check. Under the July 2026 implementing regulation, wallet providers must display the mark and make information available so users can verify the wallet solution’s certification status. After registration, the wallet unit must include a European Commission URL for that verification and have access to Trust Mark data in the required technical format. The mark takes a step beyond a badge printed on a download page: the wallet itself must lead to status information.

That route matters because the regulation also identifies a point when the mark must disappear. If a provider revokes a wallet-unit attestation, it must stop displaying the mark on that unit. The rule links a visible sign to a changing record. It gives the provider an update duty and gives the user a place to check the state behind the screen.

The certificate still has national owners

The common mark does not create one central certification office. The European Commission’s 2026 assessment says Member States must provide at least one wallet by the end of 2026. It also says the first-generation wallets will be certified under national schemes while an EU-level cybersecurity certification scheme is being developed. ENISA’s public certification page lists the European scheme as a draft candidate, not an adopted scheme.

Each national scheme has a scheme owner assigned by the Member State. The owner develops and maintains the scheme and governs how it operates. European rules allow the owner to be a conformity-assessment body, a government authority, a trade association, a group of assessment bodies or another appropriate organisation. The scheme owner can differ from the body operating the scheme.

Certification belongs to a separate role. A conformity-assessment body evaluates the wallet solution and the electronic identification scheme under which it is provided. The body must be accredited by a national accreditation body and meet stated competence requirements. The scheme owner writes and maintains the rulebook; the assessment body examines a wallet against it; the accreditation body qualifies the assessor. One emblem sits above that division of work.

The owner cannot turn subcontracting into an exit. When it privately subcontracts tasks, the regulation requires duties and responsibilities to be set by contract and says the scheme owner remains responsible for those subcontracted activities. The chain contains handoffs, but the rule keeps one accountable point for the scheme’s outsourced work.

The public record is part of the certificate

The certification body issues a certificate together with a public certification report. That report must identify and describe the wallet and its underlying electronic identification scheme, present or point to public security information, summarise the audit and validation plan, and summarise the review and certification decision. A more detailed certification-assessment report carries additional design, risk and validation material; the regulation says it may be made available to the European Commission and the European Digital Identity Cooperation Group.

Member States submit and update the wallet record for European Commission’s machine-readable list. The required information includes the responsible authorities, applicable supervision and liability arrangements, how suspension or revocation works, and the certificate and assessment-report information. A relying party can therefore look past the image of a trust mark and find the named system, authority and current status that support it.

The appeal path is national too. Each national scheme must set out how complaints and appeals are lodged and handled, how a complainant is told about progress and the decision, and where the right to an effective judicial remedy sits under national law. A common status page can make a wallet easier to recognise across borders; it cannot decide a dispute on the user’s behalf.

A common interface, with a chain to inspect

This split is workable if the public route preserves the distinctions. The Trust Mark is common; the first certification schemes are national; the European Commission’s list joins the national record to a European verification point. The public report gives a summary, while the detailed assessment has a narrower audience. The scheme owner, assessor, accreditation body and appeal route each have a different job.

The rollout arrives against a fixed calendar. Regulation (EU) 2024/1183 requires each Member State to provide at least one wallet by the end of 2026. The European Commission’s June assessment says all Member States are working on development, then describes first-generation certification as national while the European cybersecurity scheme is under development. Those are implementation statements, not counts of issued or certified wallets.

As each wallet appears, the useful test is whether its Trust Mark opens the right record: the wallet solution, the national scheme, the responsible bodies, the public certification report and the live certification status. The link should make a national decision legible at European scale. The badge earns its place when the certificate behind it can be found and its owner can be named.

Sources