European UnioneIDAS Regulation, Article 5f(2): Acceptance of the European Digital Identity Wallet by Private Relying Parties Required to Use Strong User Authentication
Regulation (EU) No 910/2014, Article 5f(2)
An identity reliance rule binding private bodies.
As of .
What it requires
- This duty reaches you if you provide services as a private relying party other than a microenterprise or small enterprise, and Union or national law, or a contractual obligation, requires you to use strong user authentication for online identification, in any area (Art. 5f(2) names transport, energy, banking, financial services, social security, health, drinking water, postal services, digital infrastructure, education and telecommunications as examples and the list is open); it applies no later than , 36 months after the implementing acts under Article 5a(23) and Article 5c(6) entered into force on .
- Accept European Digital Identity Wallets that are provided in accordance with the Regulation, only upon the voluntary request of the user (Art. 5f(2)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Settledness
- As of
- Open questions
- Does 'required by contractual obligation' in Article 5f(2) reach a requirement a relying party sets for itself in its own terms of service, or only strong user authentication that a contract with a third party, such as a bank or a payment network, requires of it?
- Which entry-into-force date starts the 36 months in Article 5f(2) when Article 5b(11) describes the implementing acts that followed (Implementing Regulation (EU) 2025/848 among them) as acts 'as referred to in Article 5a(23)', and do the acts of alone start them?
What it reaches
Applicability criteria
- As of
- Combinator
- All of
- Criteria
- private relying parties that provide services
- with the exception of microenterprises and small enterprises as defined in Article 2 of the Annex to Commission Recommendation 2003/361/EC
- required by Union or national law to use strong user authentication for online identification or where strong user authentication for online identification is required by contractual obligation
What this law does
Article 5f(2) of Regulation (EU) No 910/2014, as inserted by Regulation (EU) 2024/1183, requires private relying parties that provide services and fall within the tests stated in the Article to accept European Digital Identity Wallets that are provided in accordance with the Regulation. The acceptance is only upon the voluntary request of the user. Whether a private relying party is covered turns on the size and strong user authentication tests in the Article's own text.
The areas the Article names, introduced by the word including, are transport, energy, banking, financial services, social security, health, drinking water, postal services, digital infrastructure, education and telecommunications. The duty applies no later than 36 months from the date of entry into force of the implementing acts referred to in Article 5a(23) and Article 5c(6).
Commission Implementing Regulation (EU) 2024/2977, adopted pursuant to Article 5a(23), entered into force on . Commission Implementing Regulation (EU) 2024/2979, adopted pursuant to Article 5a(23), entered into force on . Commission Implementing Regulation (EU) 2024/2980, adopted pursuant to Article 5a(23), entered into force on .
Commission Implementing Regulation (EU) 2024/2982, adopted pursuant to Article 5a(23), entered into force on . Commission Implementing Regulation (EU) 2024/2981, adopted pursuant to Article 5c(6), entered into force on . Article 16(1) leaves the penalties for infringements of the Regulation to the Member States.
When LexLint raises it
When your app profile says your app is a bank, provides financial services, provides telecom services, handles health records or runs an essential service.