In force since 20 May 2024, the eIDAS 2.0 regulation (EU 2024/1183) fundamentally redraws digital trust in Europe. For institutions and trusted professions, this isn't a technical update. It's a paradigm shift.
From eIDAS 1 to eIDAS 2: what's changing?
The eIDAS 1 regulation, in force since 2014, laid the groundwork: qualified electronic signature, electronic seal, timestamping, qualified trust services. It was centred on services offered by providers.
eIDAS 2 adds three structural elements:
- The European Digital Identity Wallet (EUDI Wallet), rolled out by each Member State from 2026.
- Verifiable digital identity for legal entities, not only individuals.
- New qualified trust services, including electronic archiving, verifiable attributes, and remote management of signature devices.
- Qualified electronic signature
- Electronic seal
- Qualified timestamp
- Legal entity identity
- Digital wallet
- Verifiable attributes
- All eIDAS 1 +
- EUDI Wallet for citizens and companies
- Legal entity identity
- Verifiable attributes
- Qualified electronic archiving
- Remote signature management
The EU wallet: an identity vault in your pocket
The EUDI Wallet is a mobile app, provided by each state, letting a citizen or organisation present verifiable attributes on request: qualification, licence, professional status, mandate, IBAN. The recipient cryptographically verifies the source without contacting a third party.
For a notary, a lawyer, an accountant, the wallet will make it possible to instantly prove professional status, registration with a governing body, and scope of practice.
Legal-entity identity: the big new feature
eIDAS 1 mainly dealt with individuals. eIDAS 2 explicitly introduces the concept of digital identity for legal entities, with a qualification framework. A notarial practice, an accounting firm, a school will be able to hold an organisational identity recognised across the Union, usable to sign, seal and certify its communications.
What real impact on email?
Email isn't explicitly regulated by eIDAS 2. But the regulation creates the technical and legal foundation that finally allows it to be raised to the same level of proof as an electronic signature. Three consequences:
Recipients get used to visual proof of identity.
Regulators will require a verifiable chain of trust.
Players without a readable signature become the perceived weak link.
2026-2027 timeline
What institutions should do now
- Map critical outbound communications (financial, legal, contractual) sent by email.
- Identify flows where impersonation would have a reputational or financial impact.
- Put a visible identity proof in place for these flows, aligned with emerging eIDAS 2 standards.
STEGA TRUST fits within this framework. We cryptographically certify the sender's identity on an email, with verifiable proof aligned with eIDAS principles.
Frequently asked questions
One demo and you'll see the signature appear in Outlook.
Request a demo