eIDAS 2.0 Compliance Checklist for E-Commerce Businesses (2026)

The Deadline

December 2026: EU Digital Identity Wallets go live across all 27 member states. Any business that verifies customer identity — age checks for alcohol, KYC for financial products, access control for restricted content — needs to be ready.

December 2027: Regulated sectors must accept EUDI Wallet verification. This is not optional.

Use this checklist to track your preparation.

Phase 1: Assessment (Now — Q2 2026)

Identify Your Verification Needs

• List all identity verification touchpoints in your business (checkout, account creation, age gates, KYC flows)
• Determine which verification type you need per touchpoint (age_over_18, age_over_21, age_over_16)
• Map your current verification process — what are you replacing? (manual ID checks, third-party KYC, honor system)
• Identify which countries your customers come from — this affects which wallet implementations you'll interact with

Evaluate Your Options

• Aggregator (recommended): Use a service like eIDAS Pro that holds the WRPAC certificate and handles compliance. You just call the API.
• Self-registration: Register as a Relying Party yourself, obtain your own WRPAC certificate. More control, more complexity.
• Hybrid: Use an aggregator for most countries, self-register in your primary market.

Technical Assessment

• Review your tech stack — Can your backend make REST API calls? Can your frontend display QR codes?
• Check platform compatibility — WooCommerce and Shopify have pre-built plugins available via OpenEUDI
• Assess SSE support — Server-Sent Events are used for real-time verification status
• Plan the UX flow — Where in the customer journey does verification happen?

Phase 2: Integration (Q2 — Q3 2026)

Set Up Development Environment

• Install the OpenEUDI SDK — npm install @openeudi/core (MIT license, free)
• Run in DEMO mode — Build and test the full flow without real wallets
• Implement QR code display — Generate and show QR codes at verification touchpoints
• Handle verification results — Success, failure, timeout, and session expiry paths
• Test with MOCK mode — Simulate various wallet responses (success, rejection, timeout)

Platform-Specific Integration

WooCommerce:

• Install the OpenEUDI WooCommerce plugin
• Configure which products require age verification
• Set verification thresholds per product category
• Test the checkout flow end-to-end

Shopify:

• Install the OpenEUDI Shopify app
• Configure Checkout UI Extension
• Test with Shopify's development store

Custom Integration:

• Implement the verification API endpoints
• Add SSE listener for real-time results
• Build the verification UI component
• Handle edge cases (browser SSE support, mobile deep links)

Data Handling

• Verify no PII is stored — Only verification results, not personal data
• Implement audit logging — Record verification events for compliance
• Set data retention policies — How long do you keep verification logs?
• Document your data flow — Required for GDPR compliance

Phase 3: Compliance Preparation (Q3 — Q4 2026)

If Using an Aggregator (e.g., eIDAS Pro)

• Sign up for a managed plan — Starter (EUR 49/mo), Standard (EUR 199/mo), or Scale (EUR 799/mo)
• Receive your Registration Certificate — eIDAS Pro handles WRPAC and issues merchant certificates
• Switch from DEMO to PRODUCTION mode — Update your configuration when wallets launch
• Verify cross-border coverage — Confirm all your target markets are supported

If Self-Registering

• Register as a Relying Party with your home member state's national authority
• Obtain a WRPAC certificate from a qualified trust service provider (ETSI TS 119 475)
• Integrate EU Trusted Lists — Configure trust list parsing and certificate chain validation
• Set up certificate renewal — WRPAC certificates expire and need periodic renewal
• Register for passporting — If operating across borders, ensure your registration is passported to all target markets

Legal and Compliance

• Update your privacy policy — Add EUDI Wallet verification data processing disclosures
• Update terms of service — Include verification requirements for age-restricted products
• Conduct a DPIA (Data Protection Impact Assessment) — Required when processing identity data at scale
• Appoint a DPO if not already done — Required for large-scale identity processing
• Document your GDPR basis — Legitimate interest or legal obligation for each verification touchpoint

Phase 4: Go Live (December 2026)

• Switch to PRODUCTION mode — Real EUDI Wallet verifications begin
• Monitor verification metrics — Success rate, latency, error types
• Set up alerting — Get notified of verification failures or latency spikes
• Train customer support — Common user questions about wallet verification
• Prepare fallback flows — Not all customers will have EUDI Wallets on Day 1

Phase 5: Mandatory Compliance (December 2027)

• Remove manual verification fallbacks for regulated products (if required by your sector's regulation)
• Verify all EU member states are supported — Wallet rollout may be staggered
• Audit compliance posture — Annual review of verification processes
• Stay current with regulation changes — eIDAS 2.0 implementing acts may evolve

Quick Reference

Resources

• OpenEUDI SDK: Free, MIT-licensed verification library
• eIDAS Pro: Managed WRPAC and production API
• EU Regulation 2024/1183: The legal text
• ETSI TS 119 475: WRPAC certificate specification

---

Need help with your compliance preparation? Schedule a free 30-minute consultation with our identity verification experts.

Related Articles

What is WRPAC and Why Every Online Business Will Need One by December 2026

The December 2026 deadline is approaching. Understand what WRPAC certificates are and why your business needs compliance now.

8 min read

eIDAS 2.0 Relying Party Registration: The Complete Guide

Everything you need to know about registering as a Relying Party under Article 5b of eIDAS Regulation 2024/1183.

12 min read