eIDAS brought foreign electronic identities into public services
Mandatory recognition gave qualifying national eIDs a route into other Member States' online public services. Integration still depended on assurance, eligibility and the particular scheme.
An online public service could recognise a person's domestic electronic identity yet still fail to accept an equivalent identity issued across the border. On 29 September 2018, the eIDAS regulation's mandatory recognition rule began applying to qualifying public services and notified electronic identification schemes. It created a defined obligation to authenticate eligible foreign identities, with conditions governing which schemes and assurance levels qualified.
For companies supplying identity technology and software to public bodies, the rule created specific delivery requirements. A receiving service needed to obtain and interpret identity information from another system, relate it to its own records and let the person continue the administrative process. Legal recognition established the requirement; dependable integration determined whether the user could complete the task.
The recognition rule had a defined perimeter
Article 6 applied where national law or administrative practice required electronic identification and authentication to access an online service provided by a public sector body. The foreign means had to belong to a notified scheme included in the Commission's published list. Member States were not required to notify every national scheme. A product claim that every European electronic identity had become interchangeable would therefore have overstated the law.
The deadline also depended on the scheme. Recognition became compulsory twelve months after Commission publication or at the rule's commencement, whichever was later. A scheme published later could consequently have a later mandatory deadline. Suppliers scheduling integrations needed to check the individual scheme's publication record to determine when acceptance became compulsory. Earlier voluntary recognition remained possible.
Assurance determined which identity could be accepted
Mandatory recognition concerned the substantial and high assurance levels. The receiving service itself had to use substantial or high, and the foreign electronic identification means needed an assurance level equal to or above the service's requirement. An identity with substantial assurance did not satisfy a service requiring high assurance. Public bodies could recognise means offering low assurance voluntarily, but the mandatory provision did not require them to do so.
Implementing Regulation 2015/1502 made assurance depend on enrolment, management of the identification means, authentication, and management and organisation. Unless an exception applied, all the elements specified for a level had to be met. This gave identity vendors a more demanding product boundary than adding a strong login feature. Account recovery, issuance and operational controls could be relevant to the assurance claim alongside the authentication mechanism the user saw.
The interface needed to preserve meaning
Implementing Regulation 2015/1501 described an architecture of interoperating national nodes. It required common message formats capable of carrying the minimum identification data and assurance level, while distinguishing public bodies from other relying parties. It also required integrity and authenticity of communications. The framework connected national systems; it did not establish one central European identity database.
Scroll to view all columns
| Comparison | Natural person | Legal person |
|---|---|---|
| Required names | Current first name(s) and family name(s) | Current legal name |
| Other required identity fields | Date of birth and a unique identifier | A unique identifier |
| Identifier requirement | Constructed by the sending Member State; as persistent as possible | Constructed by the sending Member State; as persistent as possible |
| Examples of optional fields | Birth names, birthplace, current address and gender | Current address, VAT number, tax reference, LEI and EORI |
Identification fields prescribed by Article 11 and the Annex to Implementing Regulation 2015/1501. The optional examples shown are not exhaustive. A natural person representing a legal person requires the combined attributes for both. These fields identify the applicant; they do not establish entitlement to the requested service.
Source2
A software supplier still had to fit that information into the receiving service. Different character sets, the matching of a returned identifier to an existing account and an interrupted authentication could create support work. The regulation explicitly addressed original characters and, where appropriate, transliteration. Designing for these cases could improve how a public service handled users' applications. Teams would need to measure abandonment and administrative costs to establish the benefit.
Private businesses needed a separate adoption case
eIDAS encouraged private businesses to use notified means voluntarily. The notifying Member State could define access terms for relying parties other than public sector bodies. The requirement to provide cross-border authentication free of charge related to online public services; it did not establish a universal free service for commercial applications. A private entity acting under a mandate to provide public services could qualify as a public sector body under the regulation.
Scroll to view all columns
| Comparison | Qualifying public service | Ordinary use by private businesses |
|---|---|---|
| Acceptance | Mandatory when Article 6 conditions and the scheme deadline apply | Voluntary use encouraged by the regulation |
| Authentication access | Cross-border authentication for the public online service is free of charge | Notifying Member State may define access terms |
| Commercial work | Integrate eligible schemes into the service's existing process | Establish access, user coverage and a reason for the customer to adopt |
Regulation 910/2014, Articles 6 and 7(f) and recital 17, sets these legal boundaries; the commercial implications follow from them. A private entity providing mandated public services can qualify as a public sector body.
A startup selling identity integration therefore needed to distinguish procurement for public services from ordinary commercial distribution. An enterprise customer would still assess access arrangements, the identities its users actually held and the work required to integrate them. National recognition could support a product's credibility, but it did not by itself provide an acquisition channel or prove demand. Investors could evaluate a specific customer workflow before assuming that legal interoperability created a broad private market.
A recognised identity did not finish the transaction
Recognition related to authentication. As recital 14 explained, access to and final delivery of a service remained linked to the person's right to receive it under national law. A successfully authenticated applicant could still need to establish residence, authority to act for an organisation or another relevant entitlement. Product teams had to retain those distinct decisions in the workflow.
Recognition was one part of eIDAS. Its principal regime for trust services, covering matters such as electronic signatures and seals, generally applied from 1 July 2016. Article 6 followed the separate timetable tied to the 2015 implementing acts. Suppliers needed to distinguish those obligations when offering cross-border identification within a larger transaction, with clear handoffs to the systems deciding eligibility and completing the service.
Sources
- Regulation (EU) No 910/2014 on electronic identification and trust services, original adopted text (opens in a new tab)
European Union, preserved by The National Archives
- Commission Implementing Regulation (EU) 2015/1501 on the interoperability framework, original adopted text (opens in a new tab)
European Commission, preserved by The National Archives
- Commission Implementing Regulation (EU) 2015/1502 on assurance levels for electronic identification means, original adopted text (opens in a new tab)
European Commission, preserved by The National Archives
Published
