Corrected 20 October 2026: an earlier version of this post said that IR 2026/798 also governs the onboarding of the EU age-verification app, that wallet issuer metadata must declare the enrolment path and carry onboarding timestamps, and that the OpenEUDI SDK and eIDAS Pro's managed verifier expose and check that metadata. The regulation says none of this: it lists the identity-proofing standards (clauses of ETSI TS 119 461) for one remote onboarding route to the EUDI Wallet. We removed those claims. eIDAS Pro's EUDI Wallet verification is not yet live in production.
The regulation nobody is reading
On 8 April 2026, the European Commission published Commission Implementing Regulation (EU) 2026/798 in the Official Journal. It was adopted on 7 April and entered into force on 28 April 2026. It is one of the quieter releases in the current eIDAS 2 rollout, but it touches an important step: how a citizen gets onboarded onto an EU Digital Identity Wallet, which happens before any downstream verification you rely on.
If you are a merchant, verifier, or developer planning to trust EUDI Wallet attestations in production, it helps to know how the identity behind a wallet was proven. IR 2026/798 covers one part of that answer.
This article is a plain-English walk-through. For the raw legal source, see the EUR-Lex entry.
What the regulation covers
IR 2026/798 is an implementing act under Article 5a(24) of the amended eIDAS Regulation (EU) 2024/1183. In plain terms, it lays down the reference standards and specifications for how users are remotely onboarded onto an EUDI Wallet.
There are two important scoping points.
First, it is narrowly about remote onboarding — the flow where a citizen enrols from their own device, without visiting a physical counter.
Second, it applies to a specific combination: eID means at Level of Assurance "substantial" combined with additional remote onboarding procedures that together meet Level of Assurance "high". This sentence is doing a lot of work, so we will unpack it.
The act itself is short. Article 1 points to an Annex, and the Annex lists the clauses of ETSI TS 119 461 V2.1.1 (the European standard for identity proofing) against which conformance is assessed, together with adaptations. Those adaptations are addressed to the provider of person identification data (PID) and to the identity proofing service it relies on.
Levels of Assurance in one page
eIDAS defines three Levels of Assurance (LoA) for electronic identification means: low, substantial, and high. The distinction is about how confident the issuer is that the person presenting the eID is who they claim to be.
- Low — limited degree of confidence. Typical example: username and password registered online without document checks.
- Substantial — substantial degree of confidence. Typical example: a national eID based on document verification plus a liveness selfie.
- High — highest degree of confidence, considered equivalent to face-to-face identification. Typical example: in-person enrolment at a government office with physical document inspection.
The EUDI Wallet is required to operate at LoA high. Many existing eID means sit at LoA substantial. How do you get from one to the other without forcing everyone to visit a government office?
IR 2026/798 sets the standards for that route.
The "substantial plus additional procedures equals high" construction
The regulation covers this combination: a user who already has an LoA substantial eID means can onboard onto an LoA high wallet provided additional remote identity-proofing procedures are layered on top of the existing substantial-level authentication. The combination, taken as a whole, must meet the LoA high requirements set out in Implementing Regulation (EU) 2015/1502 — the foundational LoA definitions from the original eIDAS framework.
The ETSI TS 119 461 clauses the Annex lists include:
- Identity proofing by authentication with an eID means.
- Remote identity proofing with an identity document, both attended (with an operator, for example over video) and unattended (automated).
- Additional identity proofing that enhances an identity proven with an eID from the standard's "Baseline" to its "Extended" level of identity proofing.
The Annex also applies operational requirements to the PID provider and its identity proofing service: risk assessment, practice statements, incident reporting, business continuity, and data protection by design for biometric data.
Why this matters for verifiers
IR 2026/798 places no obligations on verifiers. Its requirements apply to PID providers and identity proofing services, and conformance is assessed against the listed ETSI clauses. When your backend receives a PID from an EUDI Wallet, you check the issuer's signature against the trusted lists; the regulation is part of why you can rely on that issuer's identity proofing, including for users who onboarded remotely.
For the protocol-level mechanics of a wallet presentation, see our technical deep dive on how eIDAS verification works and Understanding OpenID4VP.
The open questions
Two things the regulation deliberately leaves open.
Exact technical procedures. The regulation points to clauses of an ETSI standard rather than describing procedures itself. How each PID provider meets those clauses in practice will vary from country to country.
Cross-border recognition of remote enrolment. If a French wallet enrolled under the French national eID's substantial-plus-additional pathway is presented to a German verifier, is it recognised as LoA high? The answer should be yes under cross-border recognition rules, but the operational details — whether a German verifier's compliance team accepts the French pathway — will depend on how each country's national supervisor interprets the regulation.
We will be tracking how member states converge or diverge on these points in coming months. If you sell into multiple EU countries and need to think about this seriously, our piece on cross-border verification under eIDAS is the companion read.
What merchants should do today
Nothing urgent. IR 2026/798 is infrastructure-level legislation — it governs what PID providers and identity proofing services do, not what verifiers do. Your integration work does not change.
What it does mean is that the standards for remote wallet onboarding at LoA high are now fixed in law, and member states can build their onboarding flows against them. For a view of where each country stands on that build-out, see our April 2026 rollout tracker.
Accepting EUDI Wallets is a separate track: relying-party registration and an access certificate (WRPAC). See What is WRPAC and why every business needs one by December 2026 and our Relying Party registration guide.
eIDAS Pro's EUDI Wallet verification is built but not yet live in production, because no WRPAC can be obtained yet; bank eID verification is available today. See our managed plans or the OpenEUDI SDK quickstart.
Share this article
Help others learn about eIDAS verification