Summary

  • The EU’s end-2026 wallet target measures availability; confidence also depends on whether certification evidence and oversight can move when a certification body or scheme changes.
  • ENISA’s draft already sets out a body-exit process, including evidence transfer and temporary national-authority surveillance. The remaining executive question is how users can see that the handover actually preserved the assurance behind a wallet.

A deadline counts wallets, not the life of their assurance

Europe is approaching a visible delivery date. The European Commission says Member States will make digital identity wallets available by the end of 2026, while ENISA says each country is to provide at least one certified wallet by then. That is a meaningful obligation. A wallet can let a person use public and private services, share selected documents and make legally binding signatures. But an issuance count says little about what happens to the trust chain after launch.

A wallet is not certified once for all time by one unchanging institution. Its assurance depends on evidence, surveillance, status information and authorities that may evolve. The question is not whether those institutions will ever change. It is whether the user can keep relying on a current, explainable certificate when they do.

The draft has a handover process; leaders should test its joins

ENISA’s candidate scheme v0.4.614 contains a section on a certification body ending its wallet-related work. The body must notify the national cybersecurity certification authority, set out a schedule, prepare a transfer plan and assist certificate holders. The authority reviews and coordinates that plan, identifies evidence for certificates that remain valid, and transfers the material—including certification reports and applicant evidence—to another accredited body. If no successor is immediately available, the national authority carries out monitoring and surveillance for a transitional period.

These are useful continuity provisions in a document that remains labelled a draft candidate.

The harder test lies at the joins. Does the successor accept the transferred evidence and understand the same scope? Who owns surveillance during the gap? Can a wallet holder still reach a clear status record while the record’s custodian changes? The scheme’s termination section answers parts of the institutional process. It does not by itself demonstrate that every operational handover will be visible and verifiable to users.

That is why the Commission’s separate requirement matters. Wallet providers must let users access information to verify a wallet solution’s certification status, through Commission-provided URLs. A handover should keep that route meaningful: a user should be able to distinguish a valid certificate under a new custodian from an expired, suspended or withdrawn one. The public texts reviewed do not establish one universal transition receipt connecting old issuer, successor, transferred evidence and surveillance owner. That is a practical test for implementation, not evidence that a wallet has failed it.

Relying-party certificates run on a second clock

Wallet certification is only one side of a service transaction. A business or agency asking a wallet to disclose information also needs to be registered as a relying party. Regulation (EU) 2026/1730 requires Member States to authorise at least one certificate authority and provide for automatic issuance without undue delay after registration. The certificate states its intended use and a harmonised access policy, so the wallet can explain when a request exceeds that scope.

A different implementation date applies to one specific check: wallet units’ authentication and validation of relying-party registration certificates is required from 11 August 2028 under Regulation (EU) 2026/1731. That date does not postpone every wallet safeguard. It does mean that the 2026 availability milestone and this later verification obligation should be tracked separately. A user may see a wallet launched before every part of the surrounding trust chain has reached its later operational date.

Make the service portable, not the incumbent permanent

Lu Heng’s Note 70 offers a useful institutional distinction: continuity of a necessary function does not prove that every authority claimed by the institution currently performing it must continue. Applied here, the objective is continuity of certification meaning and evidence, not permanent reliance on one certification body or one national arrangement.

For each wallet still in use, a credible handover should identify the certificate’s scope and validity, the successor body, the evidence transferred, the authority responsible for surveillance, and the user-facing status route. If a successor cannot take over immediately, the transitional supervisor and the limits of that supervision should be clear. The transition from national schemes toward a European scheme should be tested separately from the exit of an individual body; ENISA’s support programme describes work on both, but one does not automatically prove the other.

The end-2026 target remains important. It should be paired with a second measure: can a person, wallet provider and relying service verify that assurance survives a change of custodian? That test protects the function people need while leaving institutions replaceable when their role changes.

Sources