Skip to content
DRAFT REPORT (COM(2025)0838 – C100305/2025 – 2025/0358(COD))

On the proposal for a regulation of the European Parliament and of the Council on the establishment of European Business Wallets

ITRE-PR-785244

Committee on Industry, Research and Energy · Rapporteur: Eero Heinäluoma

Official HTML ↗ PDF DOCX
✦ In shortFull text
✦ In short · AI summary of this text, generated 25 Sept 2026

Written by a language model from the full text only; every figure comes from the text. The paragraph links open the paragraph a statement rests on — check the text itself before relying on it.

This is the rapporteur's draft report on the proposed regulation establishing European Business Wallets, a digital tool for economic operators and public sector bodies. It amends the Commission proposal to add security, data-sovereignty and interoperability requirements, and to exempt small municipalities from the obligation to accept the wallets. The amendments require wallet providers, qualified electronic registered delivery service providers and cloud providers hosting wallet data to be established in the Union, with wallet data stored and processed only in the Union. They add rules on automated transactions by digital or AI-driven agents, on data export and portability between wallets, and on strict limits to the attributes that relying parties may request. They set a transition period of 36 months after entry into force of the implementing acts during which public sector bodies may keep alternative solutions, and require the Commission to review the regulation three years after entry into force.

Committee position. The rapporteur proposes to amend the Commission proposal to strengthen security, data sovereignty and interoperability, to exempt small municipalities from public sector obligations, to add rules on automated transactions and data portability, and to require safeguards and mutual recognition agreements for third-country systems.

Key points

  1. The draft report adopts Parliament's position at first reading and calls on the Commission to refer the matter to Parliament again if it substantially amends its proposal.
  2. It amends the recitals to state that wallets should enable secure interaction between economic operators as well as with public administrations, and to support innovation without compromising security.
  3. It adds that more than one qualified electronic registered delivery service should serve as the mandatory secure legal communication channel, and that their providers must be established in the Union and not controlled by a third country.
  4. It requires wallet-relying parties to request only attributes strictly necessary for the procedure and to apply state-of-the-art security measures to protect business data.
  5. It provides that automated processes, including those run by digital or AI-driven agents under a valid, auditable and revocable authorisation, must be verifiable and auditable and offer an equivalent level of assurance.
  6. It requires wallet providers and supporting infrastructure service providers, including cloud providers, to be established in the Union, and provides that wallet data is exclusively stored and processed in the Union.
  7. It gives wallet owners the right to export their data in a structured, commonly used and machine-readable format and to import it into another wallet, to avoid vendor lock-in.
  8. It requires public sector bodies to enable the use of wallets by economic operators 24 months after entry into force of the implementing acts, and exempts municipalities with 10,000 inhabitants or less.
  9. It allows public sector bodies, for 36 months after entry into force of the implementing acts, to keep alternative solutions that comply with qualified electronic registered delivery service requirements and offer a gateway to the wallets.
  10. It requires the Commission to assess third-country wallet systems for equivalence of cybersecurity and data protection and independence from high-risk entities, with equivalence decisions lasting no more than three years while mutual recognition agreements are negotiated.
  11. It requires the Commission and member states to inform economic operators, especially small and medium-sized enterprises, and public sector bodies about the wallets, and the Commission to develop an implementation roadmap with milestones and use-cases.
  12. It requires the Commission to review the regulation three years after entry into force and every four years thereafter, assessing administrative burden reduction, cross-border interoperability and uptake.

Who is affected

  • Economic operators, including small and medium-sized enterprises: wallet use is voluntary; they gain a tool for digital interaction with public bodies and each other.
  • Public sector bodies: must enable wallet use in relevant procedures, except municipalities with 10,000 inhabitants or less, which are exempt.
  • Wallet providers, qualified electronic registered delivery service providers and cloud providers: must be established in the Union and keep wallet data in the Union.
  • Self-employed persons and sole traders: may use the secure communication channel as a standalone service with their European Digital Identity Wallet.
  • Third-country economic operators: may obtain European Business Wallets and have their systems recognised as equivalent under conditions.

Figures and deadlines

  • 24 months after entry into force of the implementing acts: deadline for public sector bodies to enable wallet use.
  • 36 months after entry into force of the implementing acts: end of the transition period during which alternative solutions may be used.
  • 10,000 inhabitants or less: threshold below which municipalities are exempted from the obligations.
  • 15 calendar days: deadline for a notifying entity to respond to a request for additional information.
  • 30 calendar days: period after which a supervisory body must inform the notifying entity of the reason for delay.
  • 24 hours: deadline for the Commission to add or revoke a provider and update the list.
  • three years: maximum period of an equivalence decision for third-country systems.
  • 3 years after entry into force: deadline for the Commission's review report.

Legal basis: Article 294(2) and Article 114 of the Treaty on the Functioning of the European Union.