Why this checklist, today
The Bitkom eIDAS Summit is happening as we publish this — 28 and 29 April 2026, Berlin and online. Germany goes live on 2 January 2027, eight months from now. The Article 5f obligations that bind banks, telcos, regulated services, and very large online platforms land at the end of 2027. The 13 April 2026 Bitkom survey put 52 % of Germans at "never heard of the EUDI Wallet," which means the user-side awareness curve and the merchant-side integration curve will collide in 2027 whether your team is ready or not.
The checklist below is five questions that separate merchants on track from merchants accruing 2027 integration debt. Score yourself honestly. The interpretation is at the bottom.
Q1 — Are you actually in scope under Article 5f? Which paragraph applies?
Many merchants assume they are not regulated. They often are. Payment service providers, telcos, and regulated services that already use strong user authentication for online identification fall under Article 5f(2). Very large online platforms designated under the Digital Services Act fall under Article 5f(3). The two have different scopes and timelines — do not assume you can read one and ignore the other.
Ready looks like: a clear yes/no answer with the applicable paragraph written down and signed off by legal. Not ready looks like: "our compliance team is still looking at it," eight months before launch.
Q2 — Have you mapped your wallet relying-party registration path?
Under Article 5b you register as a relying party in the member state where you are established and obtain a Wallet Relying Party Access Certificate (WRPAC) from a Qualified Trust Service Provider. National registers come online through 2026 and registration is the gating dependency for everything downstream — without a WRPAC, you cannot present a verifiable request to a wallet at all.
Ready looks like: identified national authority, named owner inside your team, draft submission ready or already in flight. Not ready looks like: unsure which member state's register applies to you, no internal owner.
Q3 — Have you scoped your attributes to the minimum needed?
The POTENTIAL pilot's final report found that over-requesting attributes triggered measurable user friction in test, and will trigger regulator attention in production. Selective disclosure is a feature: an age-only attribute is enough for age-restricted commerce, and a single-attribute flow is dramatically easier to ship than a full-PID flow.
Ready looks like: every attribute requested has a documented business reason; age-only flows used wherever age is enough. Not ready looks like: requesting full personal identification data for transactions where age or a single claim would suffice.
Q4 — Is your wallet+fallback flow designed and tested?
The Bitkom survey found that 52 % of Germans had never heard of the EUDI Wallet. Through 2027, most users at your checkout will not have a wallet installed. Wallet-only is a self-imposed conversion gap. The same POTENTIAL pilot identified clean fallbacks as the single biggest production-readiness signal across the consortium.
Ready looks like: at least one non-wallet path already live (existing national eID, document upload with biometric checks, in-person verification), and checkout copy tested for both flows. Not ready looks like: planning a wallet-only checkout for 2027 because "by then everyone will have one."
Q5 — Have you tested against at least two wallet implementations?
Cross-vendor interoperability is the unsolved problem flagged by every large-scale pilot. A flow that works against one wallet will not necessarily work against another, and your users will not all carry the same one in 2027.
Ready looks like: integration tests run against at least two of: IT-Wallet (live in the IO app), the France Identité sandbox, the Spanish Cartera Digital test, the German DMSO test environment when available. Not ready looks like: integrated against one wallet implementation, or against zero.
How to read your score
5/5 — on track for a clean Q1 2027 launch. Use the next eight months to harden ops and to dry-run cross-border flows. 3–4 — at risk for January 2027. Close the open questions in Q2–Q3 2026 (now to September) or stage for a later launch rather than missing the date in public. 0–2 — not currently on track. Treat 2027 as a build year, not a launch year. Avoid public commitments to a January cutover; you will likely break them, and breaking them in regulated verticals attracts attention you do not want.
Want a sanity check?
If you scored under 4 and your sector triggers Article 5f(2) or 5f(3), reply to this post or email us with your answers — we will sanity-check your readiness path against your specific sector and member state, and flag the integration order that gets you to a clean launch first.
Share this article
Help others learn about eIDAS verification