eIDAS Regulation (2.0)

Regulation 2024/1183 amending Regulation 910/2014 as regards establishing the European Digital Identity Framework

Background and Scope

The eIDAS (Electronic Identification, Authentication, and Trust Services) Regulation is a regulatory framework implemented by the European Union (EU) to standardize electronic identification and trust services across member states. The regulation requires all member states to provide means of electronic identification for the citizens to access their online services across borders. It is also relevant to entities outside the EU that have significant operations or business interests in participating states.

Prior to the eIDAS Regulation, the landscape of electronic transactions across EU member states was fragmented and inconsistent. Each country had its own systems and rules for electronic identification and trust services, creating significant barriers to cross-border digital interactions. Introduced in 2014, eIDAS aims to enhance the security, speed, and convenience of electronic transactions within the EU.

Its scope extends to electronic identification schemes and trust services, including electronic signatures, electronic seals, electronic timestamps, electronic registered delivery services and website authentication certificates.

Digital Omnibus Regulation Proposal

In its Digital Omnibus Regulation Proposal, the Commission proposed that ENISA shall establish an EU-wide entry point for incident reporting under several EU regulations, including eIDAS, DORA, NIS2, CER Directive, and GDPR. The purpose is to reduce administrative burdens for businesses and enable a more focused approach to incident reporting.

Key Obligations

• Security and liability of trust service providers: Trust Service Providers must ensure high security standards and are liable for damages caused by non-compliance
• EU-wide interoperability and standards: Trust services and eID must comply with EU-wide standards for cross border functionality
• Legal equivalence of qualified trust services: Qualified electronic signatures, seals and timestamps must be legally equivalent to their physical counterparts
• Secure cross-border electronic identities: Provide secure cross-border identities that fulfill the requirements of private and public sectors
• User control and secure access to services: Enable citizens to securely access digital services while allowing them to retain authority over their personal data
• Fair and harmonised market conditions: Establish fair conditions for businesses and governments that provide and use digital trust services throughout the EU