Compliance tools · Cybersecurity and data protection

eIDAS 2.0 compliance tool

Regulation (EU) 2024/1183 · European Union · Binding instrument

Name anyone on your staff. The system makes them your compliance person.

A member of your own staff, with no compliance background, reads the training module, answers the interview, and finishes with your eIDAS 2.0 documentation cited article by article. The knowledge stays in the business.

Every account level runs inside a dedicated Claude account. Anyone can try a toolkit in their own Claude account; compliance work runs in a dedicated one. The Claude Max plan is £90 a month, paid to Anthropic, and is not included in any level.

See a finished report before you pay

eIDAS 2.0 is Regulation (EU) 2024/1183, a binding instrument in the European Union. Electronic identity, trust services and the European Digital Identity Wallet.

The free assessment screens for eIDAS 2.0 when a business operates online or provides digital services. The Regulation's duties fall on trust service providers and on relying parties required to use strong user authentication, with micro and small enterprises excluded.

Sectors this instrument reaches: trust service providers; electronic identification scheme providers; very large online platforms; mobile device manufacturers; electronic communications providers.

Screen your business against all 116 agent toolkits, free →

• Your exact position under eIDAS 2.0: what is in place, what is missing, and what to do about each gap.
• Documentation with article citations, ready for auditors, insurers, customers and public buyers.
• A trained person inside the business who understands what the regulation requires, and stays.
• A dated record of every section completed, with the reports themselves staying in your own Claude account. The toolkit is carried by an account level, see the plans.
• All of it completed in-house, at your own pace, without booking a single meeting.

Check that eIDAS 2.0 applies to your business, free →

Does eIDAS 2.0 apply to my business?

You are in scope if you are a trust service provider, an electronic identification scheme provider, a wallet provider, a relying party, a very large online platform, a mobile device manufacturer acting as a DMA gatekeeper, or an electronic communications provider. The trigger is operating online in these roles in the EU.

Who does eIDAS 2.0 apply to?

The regulation applies to notified electronic identification schemes (Article 7), wallet providers designated or authorised under Article 5a, trust service providers established in the Union (Articles 19a, 20, 21, 24), relying parties (Article 5b(1)), very large online platforms under Article 33(1) of the DSA (Article 5f(3)), mobile device manufacturers and electronic communications providers acting as DMA gatekeepers (Article 12b), and web-browser providers (Article 45(1a)).

Does eIDAS 2.0 apply to a small business?

Microenterprises and small enterprises as defined in Article 2 of the Annex to Commission Recommendation 2003/361/EC are excluded from the Article 5f(2) duty to accept wallets, and web-browser providers that are microenterprises or small enterprises are exempt from Article 45(1a) interoperability for their first five years.

When does eIDAS 2.0 apply from, and what are the deadlines?

The regulation entered into force on the twentieth day following publication in the Official Journal (Article 2). Wallet provision deadlines and private sector acceptance obligations are triggered by the entry into force of the Commission implementing acts, which run from 21 November 2024 through 21 May 2026 under Articles 5a(23), 5b(11), 12(6), 12(8), 19a(2), 20(4), 21(4), 24(1c), 24(5), 29a(2), 32a(3), 42(2), 44(2), 46a(7) and 46b(7).

What does eIDAS 2.0 require me to do?

Wallet providers must deliver the Article 5a(5) to 5a(21) functionalities, including free qualified electronic signatures. Trust service providers must manage risk, notify breaches within 24 hours (Articles 19a(1)(b), 24(2)(fb)), undergo conformity assessment every 24 months (Article 20(1)), verify identities (Article 24(1a)) and keep records after cessation. Relying parties must register (Article 5b(1)) and web-browser providers must recognise qualified certificates (Article 45(1a)).

What records or documents does eIDAS 2.0 require me to keep or produce?

Qualified trust service providers must keep records accessible after cessation of activities (Article 24) and submit conformity assessment reports to the supervisory body within three working days of receipt (Article 20(1)). Relying parties must inform their Member State without delay of changes to registration information (Article 5b(6)).

What happens if I do not comply with eIDAS 2.0?

Member States must set penalties that are effective, proportionate and dissuasive (Article 16(1)), with administrative fines of at least EUR 5 000 000 for natural persons and at least EUR 5 000 000 or 1 per cent of total worldwide annual turnover for legal persons, whichever is higher (Article 16(2)). The supervisory body must withdraw qualified status where a failure is not remedied within the set time limit (Article 20(3)), and a wallet breach not remedied within three months of suspension leads to withdrawal and revocation (Article 5e(2)).

How do I start complying with eIDAS 2.0?

The first practical step for a relying party is to register in the Member State of establishment before using wallets for digital service provision (Article 5b(1)). Wallet providers and trust service providers begin with the certification and conformity assessment duties under Articles 5c(1) and 20(1).

Which ComplianceSME account includes the eIDAS 2.0 toolkit?

The eIDAS 2.0 agent toolkit is included from the Micro level.

Related in cybersecurity and data protection: GDPR · ePrivacy Directive · NIS2 Directive · CER Directive