Access Control

ENISA’s draft EUDI Wallet certification scheme handles the provider layer cleanly, but the wallet-held decision layer — where eIDAS 2.0 Article 5a user rights actually operate — sits distributed across sections of the Security Requirements rather than named and sequenced as one evaluable surface. This post explains how the scheme already touches the decision layer in pieces, shows the layered architecture, and sets out the three focused asks we submitted before the 30 April 2026 deadline — additions that consolidate the layer without expanding the scheme’s scope.

Working on wallet notifications in CEN TC224 WG20, I keep hearing the same objection: ‘This is too complicated for the average user.’ But the complexity isn’t optional — it’s already mandated. The real question is whether we trust citizens with the information they need to protect themselves.

As Lead Editor of CEN/TS 18297, I reviewed the three draft Implementing Acts against the EUDI Wallet regulatory framework and submitted 17 comments to the European Commission consultation. The three critical findings share a common root: the regulations define what the wallet must do, but do not ensure the information needed to do it is available at the point of disclosure.