eIDAS 2.0 Compliance Checklist for E-Commerce Businesses (2026)

Corrected on 29 October 2026: an earlier version said eIDAS Pro would handle the relying-party registration for you, and listed passporting as a separate registration step. Each merchant is registered in its own Member State (Implementing Regulation (EU) 2026/1730), and eIDAS Pro prepares that registration; passporting then applies automatically.

Corrected 20 October 2026: an earlier version listed outdated plan prices (EUR 49 / 199 / 799 per month), said eIDAS Pro already holds a WRPAC and issues merchant certificates, called the WooCommerce and Shopify integrations OpenEUDI plugins, and gave the SDK an MIT license. Current prices are €79 (Starter), €279 (Standard) and €679 (Scale) per month; no WRPAC can be obtained anywhere yet; the plugins are eIDAS Pro's; and OpenEUDI is Apache-2.0. The WooCommerce plugin enforces a fixed 18+ threshold.

The Deadline

December 2026: EU Digital Identity Wallets go live across all 27 member states. Any business that verifies customer identity — age checks for alcohol, KYC for financial products, access control for restricted content — needs to be ready.

December 2027: Regulated sectors must accept EUDI Wallet verification. This is not optional.

Use this checklist to track your preparation.

Phase 1: Assessment (Now — Q2 2026)

Identify Your Verification Needs

• List all identity verification touchpoints in your business (checkout, account creation, age gates, KYC flows)
• Determine which age threshold you need per touchpoint (18+, 21+, 16+). The wallet's PID carries a birth date, not age flags, so the threshold is computed on the verifier side
• Map your current verification process — what are you replacing? (manual ID checks, third-party KYC, honor system)
• Identify which countries your customers come from — this affects which wallet implementations you'll interact with

Evaluate Your Options

• Aggregator (recommended): Use a service like eIDAS Pro that will obtain the WRPAC certificate that names your business (none can be obtained yet), prepare your registration and handle the technical compliance. You just call the API.
• Self-registration: Register as a Relying Party yourself, obtain your own WRPAC certificate. More control, more complexity.
• Hybrid: Start with an aggregator and move to your own WRPAC later; either way you are registered in your own Member State, and passporting covers the rest of the EU.

Technical Assessment

• Review your tech stack — Can your backend make REST API calls? Can your frontend display QR codes?
• Check platform compatibility — eIDAS Pro builds a WooCommerce plugin and a Shopify app
• Assess SSE support — Server-Sent Events are used for real-time verification status
• Plan the UX flow — Where in the customer journey does verification happen?

Phase 2: Integration (Q2 — Q3 2026)

Set Up Development Environment

• Install the OpenEUDI SDK — npm install @openeudi/core (Apache-2.0 license, free)
• Run in DEMO mode — Build and test the full flow without real wallets
• Implement QR code display — Generate and show QR codes at verification touchpoints
• Handle verification results — Success, failure, timeout, and session expiry paths
• Test with MOCK mode — Simulate various wallet responses (success, rejection, timeout)

Platform-Specific Integration

WooCommerce:

• Install the eIDAS Pro WooCommerce plugin (eIDAS Verify)
• Configure which products require age verification
• Exclude product categories that do not need it (the age threshold is fixed at 18+)
• Test the checkout flow end-to-end

Shopify:

• Install the eIDAS Pro Shopify app
• Configure Checkout UI Extension
• Test with Shopify's development store

Custom Integration:

• Implement the verification API endpoints
• Add SSE listener for real-time results
• Build the verification UI component
• Handle edge cases (browser SSE support, mobile deep links)

Data Handling

• Verify no PII is stored — Only verification results, not personal data
• Implement audit logging — Record verification events for compliance
• Set data retention policies — How long do you keep verification logs?
• Document your data flow — Required for GDPR compliance

Phase 3: Compliance Preparation (Q3 — Q4 2026)

If Using an Aggregator (e.g., eIDAS Pro)

• Sign up for a managed plan — Starter (€79/mo), Standard (€279/mo), or Scale (€679/mo)
• Let the aggregator prepare your registration — You are registered in your own Member State; eIDAS Pro will prepare that registration and obtain the WRPAC that names your business once registration opens
• Switch from DEMO to PRODUCTION mode — Update your configuration when wallets launch
• Verify cross-border coverage — Confirm all your target markets are supported

If Self-Registering

• Register as a Relying Party with your home member state's national authority
• Obtain a WRPAC certificate from a qualified trust service provider (ETSI TS 119 475)
• Integrate EU Trusted Lists — Configure trust list parsing and certificate chain validation
• Set up certificate renewal — WRPAC certificates expire and need periodic renewal
• Check cross-border coverage — Your registration in your home member state is valid in all 27 through passporting; no separate registration is needed for other markets

Legal and Compliance

• Update your privacy policy — Add EUDI Wallet verification data processing disclosures
• Update terms of service — Include verification requirements for age-restricted products
• Conduct a DPIA (Data Protection Impact Assessment) — Required when processing identity data at scale
• Appoint a DPO if not already done — Required for large-scale identity processing
• Document your GDPR basis — Legitimate interest or legal obligation for each verification touchpoint

Phase 4: Go Live (December 2026)

• Switch to PRODUCTION mode — Real EUDI Wallet verifications begin
• Monitor verification metrics — Success rate, latency, error types
• Set up alerting — Get notified of verification failures or latency spikes
• Train customer support — Common user questions about wallet verification
• Prepare fallback flows — Not all customers will have EUDI Wallets on Day 1

Phase 5: Mandatory Compliance (December 2027)

• Remove manual verification fallbacks for regulated products (if required by your sector's regulation)
• Verify all EU member states are supported — Wallet rollout may be staggered
• Audit compliance posture — Annual review of verification processes
• Stay current with regulation changes — eIDAS 2.0 implementing acts may evolve

Quick Reference

Resources

• OpenEUDI SDK: Free, Apache-2.0-licensed verification library
• eIDAS Pro: Managed WRPAC and production API
• EU Regulation 2024/1183: The legal text
• ETSI TS 119 475: WRPAC certificate specification

---

Need help with your compliance preparation? Schedule a free 30-minute consultation with our identity verification experts.

Related Articles

What is WRPAC and Why Every Online Business Will Need One by December 2026

The December 2026 deadline is approaching. Understand what WRPAC certificates are and why your business needs compliance now.

8 min read

eIDAS 2.0 Relying Party Registration: The Complete Guide

Everything you need to know about registering as a Relying Party under Article 5b of eIDAS Regulation 2024/1183.

12 min read