CEN Standards

ENISA’s draft EUDI Wallet certification scheme handles the provider layer cleanly, but the wallet-held decision layer — where eIDAS 2.0 Article 5a user rights actually operate — sits distributed across sections of the Security Requirements rather than named and sequenced as one evaluable surface. This post explains how the scheme already touches the decision layer in pieces, shows the layered architecture, and sets out the three focused asks we submitted before the 30 April 2026 deadline — additions that consolidate the layer without expanding the scheme’s scope.

Working on wallet notifications in CEN TC224 WG20, I keep hearing the same objection: ‘This is too complicated for the average user.’ But the complexity isn’t optional — it’s already mandated. The real question is whether we trust citizens with the information they need to protect themselves.

As Lead Editor of CEN/TS 18297, I reviewed the three draft Implementing Acts against the EUDI Wallet regulatory framework and submitted 17 comments to the European Commission consultation. The three critical findings share a common root: the regulations define what the wallet must do, but do not ensure the information needed to do it is available at the point of disclosure.

prCEN TS 18297 defines how relying parties request access to personal data in the EUDI Wallet — and how wallet users stay protected. As co-editor of this technical specification, I explain the five core security controls and why they matter for the everyday person navigating digital identity.