Skip to content
REPORT (COM(2021)0281 – C90200/2021 – 2021/0136(COD))

On the proposal for a regulation of the European Parliament and of the Council amending Regulation (EU) No 910/2014 as regards establishing a framework for a European Digital Identity

A-9-2023-0038

Committee on Industry, Research and Energy · Rapporteur: Romana Jerković

Official HTML ↗ PDF DOCX
✦ In shortFull textProcedure & committee votes
✦ In short · AI summary of this text, generated 26 Sept 2026

Written by a language model from the full text only; every figure comes from the text. The paragraph links open the paragraph a statement rests on — check the text itself before relying on it.

Parliament's amended version of the Commission proposal to amend Regulation (EU) No 910/2014 establishes a framework for a European Digital Identity, including European Digital Identity Wallets (EDIWs). It requires each Member State to issue at least one EDIW by 18 months after entry into force, free of charge, and to provide validation and revocation mechanisms. It sets rules for relying parties, certification, cross-border recognition, electronic attestation of attributes, and qualified trust services. It strengthens data protection, allows pseudonyms, and ensures accessibility for persons with disabilities.

Committee position. The Committee on Industry, Research and Energy proposes to adopt Parliament's position at first reading, amending the Commission proposal to establish a framework for a European Digital Identity, including detailed rules on EDIWs, trust services, and data protection.

Key points

  1. Each Member State must issue at least one European Digital Identity Wallet (EDIW) by 18 months after entry into force, issued directly, under mandate, or recognised.
  2. EDIWs must enable users to securely request, store, combine, share and revoke identity data and electronic attestations of attributes, and to generate pseudonyms.
  3. EDIWs must provide qualified electronic signatures free of charge by default and include a privacy dashboard for transaction history and data deletion requests.
  4. Member States must provide free validation mechanisms and means to revoke EDIWs upon user request, security compromise, or death of the user.
  5. Relying parties must register in the Member State where they are established, providing details of data they intend to request and its intended use.
  6. Relying parties processing special categories of personal data, such as health or biometric data, require prior approval from competent authorities.
  7. Very large online platforms must accept EDIWs for authentication upon voluntary user request and must respect the right to pseudonyms.
  8. Member States must ensure cross-border identity matching for natural persons using notified electronic identification means or EDIWs, and provide unique persistent identifiers for legal persons.
  9. Qualified electronic attestations of attributes must have the same legal effect as lawfully issued paper attestations and be recognised across Member States.
  10. Member States must ensure that qualified providers can verify attributes against authentic sources free of charge for at least the attributes listed in Annex VI.
  11. Qualified trust service providers must be audited at least every 24 months and are subject to administrative fines of at least EUR 10 000 000 or 2% of worldwide annual turnover.
  12. The Commission must review the Regulation by 24 months after entry into force and report every four years thereafter.

Who is affected

  • Member States, which must issue EDIWs, provide validation and revocation mechanisms, and designate competent authorities.
  • Relying parties, which must register, obtain approval for sensitive data, and accept EDIWs where required.
  • Very large online platforms, which must accept EDIWs upon user request and respect pseudonyms.
  • Qualified trust service providers, which must meet audit and penalty rules and provide separate legal entities for attestation services.
  • Persons with disabilities, who must have equal access to EDIWs and trust services.

Figures and deadlines

  • 18 months after entry into force: deadline for Member States to issue at least one EDIW.
  • 6 months after entry into force: deadline for Commission to adopt implementing acts on EDIW standards and delegated acts on technical specifications.
  • 12 months after entry into force: deadline for Member States to notify at least one electronic identification scheme with assurance level 'high'.
  • 12 months after adoption: deadline for development of codes of conduct for acceptance of EDIWs.
  • 24 months after entry into force: deadline for Commission to review the Regulation.
  • EUR 10 000 000 or 2% of total worldwide annual turnover: maximum administrative fines for qualified trust service providers.
  • EUR 7 000 000 or 1,4% of total worldwide annual turnover: maximum administrative fines for non-qualified trust service providers.
  • Every 24 months: frequency of audits for qualified trust service providers.

Legal basis: Article 294(2) and Article 114 of the Treaty on the Functioning of the European Union.