LEGAL NEWS IN THE SPOTLIGHT | ENISA publishes first draft of EU certification scheme for digital identity wallets

On 31 March 2026, the European Union Agency for Cybersecurity (ENISA) released the first draft (the Draft) of the European cybersecurity certification scheme for European Digital Identity Wallets (the EUDI Wallets) and their electronic identification schemes. Pursuant to Article 48(1) of Regulation (EU) 2019/881 (the Cybersecurity Act), ENISA is responsible for developing the European Cybersecurity Certification Framework (the Framework), which establishes a comprehensive set of certification schemes applicable to ICT products, services, and processes. The Framework aims to increase trust in the cyber resilience of ICT items whilst preventing the practice of “certification shopping”. As part of its effort, ENISA has already developed a certification scheme on hardware, software and components, whilst other certification schemes for cloud services, 5G networks and managed society networks are expected.

The EUDI Wallets are digital wallets that allow citizens and businesses to store, access, share and sign personal identification data and/or documents online. The Draft focuses on ensuring seamless interoperability of EUDI Wallets across the EU while ensuring the wallets facilitate strong, secure interactions. The Draft’s requirements also cover the security controls that various EUDI Wallet ecosystem stakeholders must implement in their organisational and management systems.

The Draft is currently open for public consultation until 30 April 2026. Once finalised, the document will be formally adopted by the EU Commission.

Newsletter n. 117 – April 2026