ENISA Invites Feedback for EU Digital Identity Wallet Cybersecurity Certification

Why It Matters

The certification framework will set the security baseline for billions of digital identities, shaping trust in the EU’s digital market. Ongoing privacy objections could delay rollout and force regulatory refinements.

Key Takeaways

• ENISA opens public consultation on EUDI wallet certification scheme.
• Feedback deadline April 30, 2026; webinar April 8, 2026.
• EU requires one certified wallet per country by 2026.
• Privacy group flags biometric data, pseudonymity, and passkey issues.
• ENISA signed €1.6 M (≈$1.8 M) for national certification support.

Pulse Analysis

The European Union’s push for a unified digital identity ecosystem hinges on robust security standards, and ENISA’s draft certification scheme is the linchpin. By aligning cloud‑service cybersecurity requirements with the EU Cybersecurity Act, the framework promises consistent protection for EUDI wallets across 27 member states. The public consultation invites stakeholders—from tech vendors to civil‑society groups—to shape the scheme’s principles, while the upcoming webinar and certification conference provide platforms for detailed discourse. This collaborative approach reflects the EU’s broader strategy to embed resilience into its digital infrastructure.

Parallel to the technical rollout, privacy advocates are sounding alarms over the scheme’s biometric provisions. A mandatory facial image in every wallet transaction raises concerns about data minimization and potential misuse across commercial and governmental contexts. Critics also point to loopholes that could erode pseudonymity and enable excessive data requests, undermining the EU’s own General Data Protection Regulation (GDPR) ethos. These objections are not merely academic; they could trigger legal challenges or force the Commission to amend implementation acts before the 2026 certification deadline.

For businesses, the certification outcome will dictate market entry requirements and influence cross‑border service design. Companies that achieve ENISA certification early may gain a competitive edge, signaling compliance to consumers and partners alike. Conversely, firms reliant on proprietary passkey solutions may need to adapt to meet mandatory standards, potentially spurring innovation in privacy‑preserving authentication. As the EU tightens its digital identity rules, the certification scheme will become a critical benchmark for trust, security, and regulatory alignment across the continent.