Commission Implementing Regulation (EU) 2024/2981 of 28 November 2024 laying down rules for the application of Regulation (EU) No 910/2014 of the European Parliament and the Council as regards the certification of European Digital Identity Wallets

Image omitted; see official source	Official Journal of the European Union	EN L series
---	---	---
	2024/2981	4.12.2024

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC ¹, and in particular Article 5c(6) thereof,

Whereas:

• (1) Pursuant to Article 5c of Regulation (EU) No 910/2014, the certification of European Digital Identity Wallets (‘wallets’) is to be made in accordance with functional, cybersecurity, and data protection requirements to ensure a high level of security and trust in the wallets. Those certification requirements need to be harmonised across Member States in order to prevent market fragmentation and to build a robust framework.

• (2) Regulation (EU) 2016/679 of the European Parliament and of the Council ² and, where relevant, Directive 2002/58/EC of the European Parliament and of the Council ³ apply to the personal data processing activities under this Regulation.

• (3) The Commission regularly assesses new technologies, practices, standards or technical specifications. To ensure the highest level of harmonisation among Member States for the development and certification of the wallets, the technical specifications set out in this Regulation rely on the work carried out on the basis of Commission Recommendation (EU) 2021/946 of 3 June 2021 on a common Union Toolbox for a coordinated approach towards a European Digital Identity Framework ⁴ and in particular the Architecture and Reference Framework which is part of it. In accordance with recital 75 of Regulation (EU) 2024/1183 of the European Parliament and of the Council ⁵, the Commission should review and update this Implementing Regulation, if necessary, to keep it in line with global developments, the Architecture and Reference Framework and to follow the best practices on the internal market.

• (4) In order to attest conformity to cybersecurity requirements included in the certification framework, the certification of wallet solutions should refer to, where available and relevant, European cybersecurity certification schemes established pursuant to Regulation (EU) 2019/881 of the European Parliament and of the Council ⁶. In the absence of such schemes, or when they partially cover cybersecurity requirements, this Regulation sets out the general requirements applying to national certification schemes, covering functional, cybersecurity, and data protection requirements.

• (5) Pursuant to Article 5a(11) of Regulation (EU) No 910/2014, the wallets are to be certified against assurance level high as set out in Regulation (EU) No 910/2014, as well as Commission Implementing Regulation (EU) 2015/1502 ⁷. That assurance level has to be reached by the overall wallet solution. Under this Regulation, some components of the wallet solution may be certified at a lower assurance level, provided this is duly justified and without prejudice to the assurance level high reached by the overall solution.

• (6) All national certification schemes should assign a scheme owner who will be responsible for the development and maintenance of the certification scheme. The scheme owner may be a conformity assessment body, a governmental body or authority, a trade association, a group of conformity assessment bodies, or any appropriate body and can be different than the body operating the national certification scheme.

• (7) The object of certification should include the software components of the wallet solution, such as the wallet instance. The wallet secure cryptographic application (‘WSCA’), the wallet secure cryptographic device (‘WSCD’) and the platforms on which these software components are executed, while being part of the operating environment, should only be included in the object of certification when they are provided by the wallet solution. In other cases, and in particular when these devices and platforms are provided by end users, providers should establish assumptions on the wallet solution’s operating environment, including on these devices and platforms, and implement measures to confirm that these assumptions are verified in practice. In order to ensure protection of critical assets through hardware and system software used to manage and protect cryptographic keys created, stored or processed by the WSCD, the WSCD needs to satisfy high standards of certification as reflected in international standards such as Common Criteria (‘EUCC’), established in Commission Implementing Regulation (EU) 2024/482 ⁸, by EAL4 evaluation and advanced methodical vulnerability analysis, such as comparable to AVA_VAN.5. These certification standards should be used at the latest when certification of the conformity of wallets is carried out following a European cybersecurity certification scheme adopted pursuant to Regulation (EU) 2019/881.

• (8) Fully mobile, secure and user-friendly wallets are supported by the availability of standardised and certified tamper-resistant solutions, such as embedded secure elements, external devices such as smartcards, or embedded SIM platforms in mobile devices. It is important to ensure the timely access to embedded secure elements for national eID means and wallets and to coordinate efforts by Member States in this area. The European Digital Identity Cooperation Group established pursuant to Article 46e(1) of Regulation (EU) No 910/2014 (‘Cooperation Group’), should therefore establish a dedicated subgroup for this purpose. Consulting relevant stakeholders, this subgroup should agree on a joint roadmap for access to embedded secure elements to be considered by the Commission for the review report on the Regulation (EU) No 910/2014. In order to facilitate the uptake of the wallet at national level, the Commission should furthermore, in cooperation with Member States, develop and continuously update a manual for use cases as part of the Architecture and Reference Framework.

• (9) The object of certification of national certification schemes should also include the processes that are used to provide and operate the wallet solution, even if the definition or execution of those processes are subcontracted to third parties. In order to demonstrate that the processes satisfy the schemes’ requirements, assurance information is allowed to be used as evidence, provided that a dependency analysis is used to determine if the assurance information is sufficient. Assurance information comes in many different forms, including reports and certificates of conformity, which can be private, national, European or international, based on standards or on technical specifications. The objective of the dependency analysis is to assess the quality of the assurance information available about a wallet’s components.

• (10) Following procedures established for this purpose, the Cooperation Group should be able to provide opinions and recommendations on the draft national certification schemes submitted to it. These national certification schemes should be specific to the wallet architecture and there should be specific profiles for each specific architecture supported.

• (11) In order to ensure a common understanding of, and harmonised approach to, the assessment of the most critical risks that might affect the provision and operation of wallets, a register of risks and threats that should be taken into consideration when designing wallet solutions independently of their specific architecture should be drawn-up. The cybersecurity objectives described in Regulation (EU) No 910/2014, such as confidentiality, integrity and availability of the wallet solution, as well as user and data privacy, should be borne in mind when identifying which risks should be included in the register. Due consideration of risks and threats included in this risk register should be part of the requirements of national certification schemes. To keep in line with the continuously evolving threat landscape, the risk register should be maintained and regularly updated in collaboration with the Cooperation Group.

• (12) When establishing their certification schemes, scheme owners should perform a risk assessment to refine and complement the risks and threats listed in the register with risks and threats specific to the architecture or implementation of the wallet solution. The risk assessment should consider how the applicable risks and threats can be appropriately treated. Wallet providers should complement the scheme’s risk assessment to identify any risks and threats specific to their implementation and propose appropriate treatment measures for evaluation by the certification body.

• (13) To demonstrate that a wallet solution architecture meets the applicable security requirements, each architecture-specific scheme or profile should contain at least a description of the wallet solution architecture, a list of security requirements applicable to the wallet solution architecture, an evaluation plan to confirm that a wallet solution based on this architecture meets those requirements and a risk assessment. National certification schemes should require wallet providers to demonstrate how the design of the wallet solution that they provide matches the reference architecture and details the security controls and validation plans for the specific wallet solution. National certification schemes should also define a conformity assessment activity to verify that the wallet design properly reflects the selected profile’s reference architecture. National certification schemes should comply with the requirements set out in Article 51 of Regulation (EU) 2019/881, except for its points (e) and (f), related to logging.

• (14) Concerning the certification of products, certificates of conformity issued under the EU cybersecurity certification scheme on EUCC, and certificates of conformity issued under national certification schemes in the context of the SOG-IS Mutual Recognition Agreement, should be allowed to be used. Furthermore, other national certification schemes should be allowed to be used for less sensitive product components, such as those established following the standard CEN EN 17640 for fixed time cybersecurity evaluation methodology.

• (15) The EU Digital Identity Wallet Trust Mark (‘Trust Mark’) should be used to indicate in a clear, simple and recognisable manner that a wallet has been provided in accordance with Regulation (EU) No 910/2014. Therefore, it should be considered as a mark of conformity for a wallet solution certified under national certification schemes. National certification schemes should not define any other marks of conformity.

• (16) In order to discourage fraud, national certification schemes should define actions to be taken where certification under the scheme is being claimed fraudulently.

• (17) To ensure an efficient management of vulnerability notifications, providers of wallet solutions and the electronic identification scheme under which they are provided should define and implement processes to evaluate the severity and potential impact of vulnerabilities. National certification schemes should set a threshold over which the certification body is to be notified. Such notification requirement should not affect the criteria established by data protection legislation and Member States’ data protection authorities for notification on personal data breaches. Possible synergies could be established between the mandatory notification of breach or compromise of the wallet solutions and the notification of personal data breaches pursuant to Regulation (EU) 2016/679. The certification body’s assessment of a vulnerability impact analysis report should be without prejudice to a data protection authority’s assessment of a data protection impact assessment pursuant to Articles 35 and 36 of Regulation (EU) 2016/679.

• (18) The providers of wallet solutions and the electronic identification scheme under which they are provided should notify the scheme owner of any justifications for exceptions to the vulnerability assessment required for the evaluation of the WSCD and WSCA, as set out in Annex IV.

• (19) The cancellation of a certificate of conformity might have severe consequences such as the revocation of all deployed wallet units. Therefore, certification bodies should only consider cancellation if an unremedied vulnerability is likely to significantly affect the reliability of the wallet solution or the reliability of another wallet solution.

• (20) A specific process for the update of national certification schemes should be put in place to manage the transition between successive releases of the schemes, in particular in relation to actions to be taken by the certificate holder regarding upcoming evaluations, maintenance, recertification and special evaluations.

• (21) To facilitate transparency, wallet providers should publicly share security information about their wallet solution.

• (22) Where national certification schemes rely on assurance information from other certification schemes or sources, a dependency analysis should be carried out to verify that the assurance documentation, for instance assurance reports and certificates of conformity, is available and adequate for the wallet solutions and the electronic identification scheme under which they are provided. The basis for this dependency analysis should be the risk assessment of the wallet solutions and the electronic identification scheme under which they are provided. The evaluation should determine whether the assurance documentation available for a given wallet solution and the electronic identification scheme under which it is provided is adequate to provide assurance corresponding to the targeted evaluation level. The evaluation should also update the dependency analysis, or entirely re-evaluate it, where necessary.

• (23) Certification bodies should issue certificates of conformity in national certification schemes, together with a publicly available certification report, as referred to in Article 5d(2), point (a), of Regulation (EU) No 910/2014. The associated certification assessment report should be made available to the Cooperation Group.

• (24) National certification schemes should set out yearly surveillance evaluation to ensure that the processes around the management and maintenance of the wallets are operating effectively, meaning that they operate as defined in the policies determining the processes. The biennial vulnerability assessment is a requirement stemming from Regulation (EU) No 910/2014, to ensure that the wallet solution continues to cover appropriately the cybersecurity risks and threats identified in the risk register, including any evolution of the threat landscape. The notions of surveillance evaluations, recertification evaluations and special evaluations should be in accordance with EN ISO/IEC 17021-1:2015.

• (25) A certification cycle ends with the expiry of the certificate of conformity, or with the issuance of a new certificate of conformity following a successful recertification evaluation. The recertification evaluation should include an evaluation of all components of the object of certification, including an evaluation of the effectiveness and, where applicable, a vulnerability assessment. During recertification, it should be possible to reuse results from previous evaluations on components that have not changed.

• (26) When a European cybersecurity certification scheme is adopted, national certification schemes with the same scope should cease issuing certifications after a defined transition period as referred to in Article 57(1) of Regulation (EU) 2019/881.

• (27) National certification schemes should rely on existing frameworks and reuse evidence as appropriate in order to ensure harmonisation and interoperability. Member States may conclude agreements for the cross-border reuse of certification schemes or parts thereof. The European Commission and ENISA should, in cooperation with the Cooperation Group, support Member States in the development and maintenance of their national certification schemes ensuring knowledge-sharing and best practices.

• (28) The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 of the European Parliament and of the Council ⁹, and delivered its opinion on 30 September 2024.

• (29) The measures provided for in this Regulation are in accordance with the opinion of the Committee referred to in Article 48(1) of Regulation (EU) No 910/2014,

HAS ADOPTED THIS REGULATION:

CHAPTER I GENERAL PROVISIONS

Article 1

Subject matter and scope

This Regulation sets out reference standards and establishes specifications and procedures to build a robust framework for the certification of wallets to be updated on a regular basis to keep in line with technology and standards developments and with the work carried out on the basis of Recommendation (EU) 2021/946 on a common Union Toolbox for a coordinated approach towards a European Digital Identity Framework, and in particular the Architecture and Reference Framework.

Article 2

Definitions

For the purpose of this Regulation, the following definitions apply:

• (1) ‘wallet solution’ means a combination of software, hardware, services, settings, and configurations, including wallet instances, one or more wallet secure cryptographic applications and one or more wallet secure cryptographic devices;

• (2) ‘scheme owner’ means an organisation which is responsible for developing and maintaining a certification scheme;

• (3) ‘object of certification’ means products, processes and services or a combination thereof to which specified requirements apply;

• (4) ‘wallet secure cryptographic application’ means an application that manages critical assets by being linked to and using the cryptographic and non-cryptographic functions provided by the wallet secure cryptographic device;

• (5) ‘wallet instance’ means the application installed and configured on a wallet user’s device or environment, which is part of a wallet unit, and that the wallet user uses to interact with the wallet unit;

• (6) ‘wallet secure cryptographic device’ means a tamper-resistant device that provides an environment that is linked to and used by the wallet secure cryptographic application to protect critical assets and provide cryptographic functions for the secure execution of critical operations;

• (7) ‘risk register’ means a record of information relevant to the certification process about identified risks;

• (8) ‘wallet provider’ means a natural or legal person who provides wallet solutions;

• (9) ‘certification body’ means a third-party conformity assessment body operating certification schemes;

• (10) ‘wallet unit’ means a unique configuration of a wallet solution that includes wallet instances, wallet secure cryptographic applications and wallet secure cryptographic devices provided by a wallet provider to an individual wallet user;

• (11) ‘critical assets’ means assets within or in relation to a wallet unit of such extraordinary importance that where their availability, confidentiality or integrity are compromised, this would have a very serious, debilitating effect on the ability to rely on the wallet unit;

• (12) ‘wallet user’ means a user who is in control of the wallet unit;

• (13) ‘incident’ means an incident as defined in point (6) of Article 6 of Directive (EU) 2022/2555 of the European Parliament and of the Council ¹⁰;

• (14) ‘embedded disclosure policy’ means a set of rules, embedded in an electronic attestation of attributes by its provider, that indicates the conditions that a wallet-relying party has to meet to access the electronic attestation of attributes.

CHAPTER II NATIONAL CERTIFICATION SCHEMES

Article 3

Establishment of national certification schemes

• (a) the software components, including settings and configurations of a wallet solution and of the electronic identification scheme under which the wallet solutions are provided;

• (b) the hardware components and platforms on which the software components referred to in point (b) run on or rely upon for critical operations, in cases where they are provided directly or indirectly by the wallet solution and electronic identification scheme under which they are provided and when they are required to meet the desired level of assurance for those software components. When the hardware components and platforms are not provided by the wallet provider, national certification schemes shall formulate assumptions for evaluation of the hardware components and platforms, under which resistance against attackers with high attack potential in line with Implementing Regulation (EU) 2015/1502 can be provided, and specify the evaluation activities to confirm these assumptions as referred in Annex IV;

• (c) the processes that support the provision and operation of a wallet solution, including the user onboarding process as referred to in Article 5a of Regulation (EU) No 910/2014, covering at least enrolment, electronic means management and organisation pursuant to section 2.1, 2.2, and 2.4 of Annex I to Implementing Regulation (EU) 2015/1502.

• (a) the specific architecture of a wallet solution and of the electronic identification scheme under which they are provided;

• (b) the security controls associated to assurance levels set out in Article 8 of Regulation (EU) No 910/2014;

• (c) an evaluation plan drawn-up in accordance with section 7.4.1 of EN ISO/IEC 17065;2012;

• (d) the security requirements necessary to address the cybersecurity risks and threats listed in the risk register set out in Annex I of this Regulation, up to the required assurance level, and to meet, where applicable, the objectives defined in Article 51 of Regulation (EU) 2019/881;

• (e) a mapping of the controls referred to in point (b) of this paragraph to the components of the architecture;

• (f) a description of how the security controls, the mapping, the security requirements and the evaluation plan referred to in points (b) to (c) allow providers of wallet solutions and the electronic identification scheme under which they are provided to adequately address the cybersecurity risks and threats identified in the risk register referred to in point (d), up to the required assurance level based on a risk assessment to refine and complement the risks and threats listed in the risk register with risks and threats specific to the architecture.

Article 4

General requirements

• (a) European cybersecurity certification schemes established pursuant to Regulation (EU) 2019/881, including the EUCC;

• (b) national cybersecurity certification schemes covered by the EUCC, in accordance with Article 49 of Implementing Regulation (EU) 2024/482.

• (a) other relevant national certification schemes;

• (b) international, European, and national standards;

• (c) technical specifications that meet the requirements set out in Annex II to Regulation (EU) No 1025/2012 of the European Parliament and of the Council ¹¹.

• (a) specify the elements listed in section 6.5 of EN ISO/IEC 17067:2013;

• (b) be implemented as a type 6 scheme, in accordance with section 5.3.8 of EN ISO/IEC 17067:2013.

• (a) only providers referred to in Article 5a(2) of Regulation (EU) No 910/2014 are eligible to be issued certificates under the national certification schemes;

• (b) only the Trust Mark is used as mark of conformity;

• (c) providers of wallet solutions and the electronic identification scheme under which they are provided include references to Regulation (EU) No 910/2014 and this Regulation when referring to the scheme;

• (d) providers of wallet solutions and the electronic identification scheme under which they are provided, complement the scheme’s risk assessment as referred to in Article 3, paragraph 5 point (f), to identify risks and threats specific to their implementation and propose appropriate treatment measures for all relevant risks and threats;

• (e) responsibilities and the legal action are established and include references to the applicable national legislation, which defines the responsibilities and possible legal action, where certification under the scheme is being used fraudulently.

Article 5

Incident and vulnerability management

• (a) the impact of the vulnerability on the certified wallet solution;

• (b) possible risks associated with the proximity or likelihood of an attack;

• (c) whether the vulnerability can be remedied using available means;

• (d) where the vulnerability can be remedied using available means, possible ways to remedy the vulnerability.

Article 6

Maintenance of national certification schemes

• (a) rules for the governance of the national certification schemes’ definition and requirements;

• (b) the establishment of timelines for the issuance of certificates following the adoption of updated versions of the national certification schemes, both for new certificates of conformity and for previously issued ones;

• (c) a periodic review of the national certification schemes, to ensure that the national certification schemes’ requirements are being applied in a consistent manner, taking into account at least the following aspects:

• — requests for clarification addressed to the scheme owner related to the national certification scheme requirements;

• — feedback from stakeholders and other interested parties;

• — responsiveness of the national certification scheme owner to requests of information.

• (d) rules for monitoring reference documents and procedures for the evolution of national certification schemes’ reference versions, including at least transition periods;

• (e) a process to ensure the latest cybersecurity risks and threats as listed in the risk register set out in Annex I of this Regulation are covered;

• (f) a process for managing other changes in national certification schemes.

CHAPTER III REQUIREMENTS RELATING TO SCHEME OWNERS

Article 7

General requirements

• (a) information coming from certification bodies, national accreditation bodies, and relevant market surveillance authorities;

• (b) information resulting from its own or another authority’s audits and investigations;

• (c) complaints and appeals received pursuant to Article 15.

CHAPTER IV REQUIREMENTS RELATING TO PROVIDERS OF WALLET SOLUTIONS AND THE ELECTRONIC IDENTIFICATION SCHEME UNDER WHICH THEY ARE PROVIDED

Article 8

General requirements

• (a) Cyber Resilience Act where applicable, or requirements meeting the security objectives set out in Article 51 of Regulation (EU) 2019/881;

• (b) the establishment and implementation of policies and procedures concerning the management of risks associated with the operation of a wallet solution, including the identification and assessment of risks and the mitigation of the identified risks;

• (c) the establishment and implementation of policies and procedures related to the management of changes and to the management of vulnerabilities in accordance with Article 5 of this Regulation;

• (d) the establishment and implementation of human resource management policies and procedures, including requirements on expertise, reliability, experience, security training, and qualifications of personnel involved in the development or operation of the wallet solution;

• (e) requirements relating to the wallet solution’s operating environment, including in the form of assumptions on the security of the devices and platforms on which the software components of the wallet solution run, including WSCDs and where applicable and relevant, conformity assessment requirements to confirm that those assumptions are verified on the relevant devices and platforms;

• (f) for each assumption that is not backed by a certificate of conformity or other acceptable assurance information, a description of the mechanism that the wallet provider uses to enforce the assumption, as well as a justification that the mechanism is sufficient to ensure that the assumption is verified;

• (g) the establishment and implementation of measures to ensure the use of a currently certified version of the wallet solution.

• (a) evidence related to the information referred to in Annex IV, point 1, including where necessary details on the wallet solution and its source code, including:

• — architecture information: for every component of the wallet solution (including product, process and service components), a description of its essential security properties, including its external dependencies;

• — controls and assurance levels: for every security control of the wallet solution, a description of the control and the required assurance level, based on the Annex to Implementing Regulation (EU) 2015/1502, which sets out a number of technical specifications and procedures that apply to the various controls implemented by the electronic identification means;

• — mapping the controls to architecture components: a description of how the controls of the wallet are implemented using the different components of the wallet solution, based on a rationale explaining why a given assurance level is required, and how the control is implemented with all required security aspects at the appropriate level;

• — rationale and justification of risk coverage: a justification of:

• — the mapping of controls to components;

• — the suitability of the proposed evaluation plan to appropriately cover all controls;

• — the coverage provided by the controls of the cybersecurity risks and threats identified in the risk register, complemented by controls of risks and threats specific to the implementation, at the appropriate assurance level;

• (b) the information listed in Annex V;

• (c) a complete list of the certificates of conformity and other assurance information used as evidence during the evaluation activities;

• (d) any other information relevant for the evaluation activities.

CHAPTER V REQUIREMENTS RELATING TO CERTIFICATION BODIES

Article 9

General requirements

• (a) detailed and technical knowledge of the relevant architectures of a wallet solution and of the electronic identification scheme under which they are provided, as well as of the threats and risks relevant to those architectures;

• (b) knowledge of available security solutions and of their properties pursuant to the Annex of Implementing Regulation (EU) 2015/1502;

• (c) knowledge of the activities performed in virtue of certificates of conformity applied to components of the wallet solution and the electronic identification scheme under which they are provided, as being the object of certification;

• (d) detailed knowledge of the applicable national certification scheme as established in accordance with Chapter II.

• (a) information coming from national accreditation bodies, and relevant market surveillance authorities;

• (b) information resulting from their own or another authority’s audits and investigations;

• (c) complaints and appeals received pursuant to Article 15.

Article 10

Subcontracting

Certification bodies may subcontract the evaluation activities, as set out in Article 13, to third parties. Where evaluation activities are subcontracted, national certification schemes shall establish the following:

• (1) all subcontractors of the certification body performing evaluation activities shall, as applicable and appropriate for the activities to be performed, meet the requirements of harmonised standards like EN ISO/IEC 17025:2017 for testing, EN ISO/IEC 17020:2012 for inspection, EN ISO/IEC 17021-1:2015 for audit, and EN ISO/IEC 17029:2019 for validation and verification;

• (2) certification bodies shall take responsibility for all evaluation activities outsourced to other bodies and demonstrate that they have taken appropriate measures during their accreditation, including by relying on their subcontractors’ own accreditation, when applicable;

• (3) the degree to which prior agreement to outsourcing needs shall be obtained from scheme owners or the client whose wallet solution is being certified under the certification scheme.

Article 11

Notification to the supervisory body

Certification bodies shall notify the supervisory body referred to in Article 46a(1) of Regulation (EU) No 910/2014 of the issuance, suspension and cancellation of certificates of conformity of wallet solutions and the electronic identification scheme under which they are provided.

Article 12

Incident and vulnerability management

CHAPTER VI CONFORMITY ASSESSMENT ACTIVITIES

Article 13

Evaluation activities

• (a) the methods and procedures to conduct evaluation activities, including those related to WSCD, as set out in Annex IV;

• (b) the audit of the implementation of the wallet solution and the electronic identification scheme under which they are provided, based on the risk register, set out in Annex I and complemented where necessary by implementation-specific risks;

• (c) functional testing activities, based, when available and appropriate, on test suites that are defined according to technical specifications or standards;

• (d) assessment of the existence and suitability of maintenance processes, including at least version management, update management and vulnerability management;

• (e) assessment of the operating effectiveness of the maintenance processes, including at least version management, update management and vulnerability management;

• (f) dependency analysis provided by the wallet provider, including a methodology to assess the acceptability of assurance information, which shall include the elements set out in Annex VI;

• (g) vulnerability assessment, at the appropriate level, including:

• — a review of the design of the wallet solution, and where applicable, of its source code;

• — testing of the resistance of the wallet solution against attackers with high attack potential for assurance level ‘high’ pursuant to Section 2.2.1 of the Annex to Implementing Regulation (EU) 2015/1502;

• (h) assessment of the evolution of the threat environment and its impact on the coverage of the risks by the wallet solution, to determine which evaluation activities are required on the various components of the wallet solution.

Article 14

Certification activities

• (a) the content of the certificate of conformity as set out in Annex VII;

• (b) how the results of the evaluation are to be reported in the public certification report, including at least a summary of the preliminary audit and validation plan, as set out in Annex VIII;

• (c) the content of the evaluation results reported in the certification assessment report, including the elements set out in Annex VIII.

Article 15

Complaints and appeals

National certification schemes shall contain procedures or references to the applicable national legislation, which define the mechanism to effectively lodge and handle complaints and appeals in relation to their implementation of the certification scheme or to a certificate of conformity issued. These procedures shall include the provision of information to the complainant of the progress of the proceedings and on the decision taken, and information to the complainant on the right to an effective judicial remedy. National certification schemes shall require that all complaints and appeals that have not been or cannot be resolved by the certification body are sent to the scheme owner for assessment and resolution.

Article 16

Surveillance activities

• (a) compliance by holders of a certificate of conformity issued under national certification schemes with their obligations concerning certification pursuant to Regulation (EU) No 910/2014 and pursuant to national certification schemes;

• (b) compliance of the certified wallet solution with the requirements set out in national certification schemes.

Article 17

Consequences of non-compliance

National certification schemes shall set out the consequences of non-conformity of a certified wallet solution and of the electronic identification scheme under which they are provided, with the requirements set out in this Regulation. Those consequences shall include the following aspects:

• (1) the obligation on the certification body to inform the holder of the certificate of conformity and to request the holder of the certificate of conformity to apply remedial actions;

• (2) the obligation on the certification body to inform other relevant market surveillance authorities where the non-conformity concerns relevant Union legislation;

• (3) the conditions for carrying out remedial actions by the holder of the certificate of conformity;

• (4) the conditions for the suspension of a certificate of conformity by the certification body and for restoration of the certificate of conformity after the non-conformity has been remediated;

• (5) the conditions for cancellation of a certificate of conformity by the certification body;

• (6) the consequences of non-compliance by the certification body with the requirements of the national certification scheme.

CHAPTER VII CERTIFICATION LIFECYCLE

Article 18

Certification lifecycle

CHAPTER VIII RECORDKEEPING AND PROTECTION OF INFORMATION

Article 19

Retention of records

• (a) records of the information provided to the certification body or any of its sub-contractors during the certification process;

• (b) specimens of hardware components that have been included in the scope of certification for the wallet solution.

Article 20

Protection of information

Under national certification schemes, all persons or organisations that are granted access to information in the execution of activities under the national certification scheme shall be required to ensure the security and protection of trade secrets and other confidential information, as well as preserving intellectual property rights, and take the necessary and appropriate technical and organisational measures to ensure this confidentiality.

CHAPTER IX FINAL PROVISIONS

Article 21

Transition to a European cybersecurity certification scheme

This Regulation shall be subject to review, on the adoption of the first European cybersecurity certification scheme for wallet solutions and the electronic identification schemes under which they are provided, with the objective of taking into account the contribution of such a European cybersecurity certification scheme to the overall certification of wallet solutions and the electronic identification schemes under which they are provided.

Article 22

Entry into force

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at Brussels, 28 November 2024.

For the Commission

The President

Ursula VON DER LEYEN

ANNEX I

RISK REGISTER FOR EUROPEAN DIGITAL IDENTITY WALLETS

Introduction

The risk register describes the main security and privacy risks and threats that apply to wallets, and which shall be properly addressed in every architecture and implementation of wallets. The high-level risks (Section I) are related to the use of wallets by users and relying parties, and they are associated to direct threats targeting the assets of wallets. In addition, a few system-level risks (Section II) to wallets are identified, which would typically result from a combination of threats applying to the entire wallet system.

Risk type	Risk ID	Related risk titles
High-level risks to the wallets	R1	Creation or use of an existing electronic identity
High-level risks to the wallets	R2	Creation or use of a fake electronic identity
High-level risks to the wallets	R3	Creation or use of fake attributes
High-level risks to the wallets	R4	Identify theft
High-level risks to the wallets	R5	Data theft
High-level risks to the wallets	R6	Data disclosure
High-level risks to the wallets	R7	Data manipulation
High-level risks to the wallets	R8	Data loss
High-level risks to the wallets	R9	Unauthorised transaction
High-level risks to the wallets	R10	Transaction manipulation
High-level risks to the wallets	R11	Repudiation
High-level risks to the wallets	R12	Transaction data disclosure
High-level risks to the wallets	R13	Service disruption
High-level risks to the wallets	R14	Surveillance
System-related risks	SR1	Wholesale surveillance
System-related risks	SR2	Reputational damage
System-related risks	SR3	Legal non-compliance

The register also identifies technical threats (Section III) targeting the implementation of the wallet solution. These threats are related to the high-level risks in the sense that each one of them could be used to trigger many high-level risks.

Threat type	Threat ID	Related threat titles	Subcategories of threats
Technical threat	TT1	Physical attacks	1.1 Theft
Technical threat	TT1	Physical attacks	1.2 Information leakage
Technical threat	TT1	Physical attacks	1.3 Tampering
Technical threat	TT2	Errors and misconfigurations	2.1 Errors made when managing an IT system
Technical threat	TT2	Errors and misconfigurations	2.2 Application-level errors or usage errors
Technical threat	TT2	Errors and misconfigurations	2.3 Development-time errors and system misconfigurations
Technical threat	TT3	Use of unreliable resources	3.1 Erroneous use or configuration of wallet components
Technical threat	TT4	Failure and outages	4.1 Failure or dysfunction of equipment, devices or systems
Technical threat	TT4	Failure and outages	4.2 Loss of resources
Technical threat	TT4	Failure and outages	4.3 Loss of support services
Technical threat	TT5	Malicious actions	5.1 Interception of information
Technical threat	TT5	Malicious actions	5.2 Phishing and spoofing
Technical threat	TT5	Malicious actions	5.3 Replay of messages
Technical threat	TT5	Malicious actions	5.4 Brute-force attack
Technical threat	TT5	Malicious actions	5.5 Software vulnerabilities
Technical threat	TT5	Malicious actions	5.6 Supply chain attacks
Technical threat	TT5	Malicious actions	5.7 Malware
Technical threat	TT5	Malicious actions	5.8 Random number prediction

Finally, the register lists direct threats to the wallets, and each one is associated to a (non-exhaustive) selection of risks (Section IV).

SECTION I

High-level risks to the wallets

R1. Creation or use of an existing electronic identity
Creation or use of an existing electronic identity is defined as the creation of an electronic identity in a wallet that exists in the real world and is assigned to another user. By essence, this risk leads to the risks of Identity theft (R4), and Unauthorised transactions (R9).
R2. Creation or use of a fake electronic identity
Creation or use of a fake electronic identity is defined as the creation of an electronic identity in a wallet that does not exist in the real world.
R3. Creation or use of fake attributes
Creation or use of fake attributes is defined as the creation or use of attributes that cannot be validated to be issued by the claimed provider and cannot be trusted.
R4. Identify theft
Identity theft is defined as the unauthorised acquisition of the wallet unit or loss of authentication factors enabling to impersonate a person.
R5. Data theft
Data theft is defined as the unauthorised extraction of data. Data theft is also associated to threats, such as data interception (unauthorised capture of data in transit) and data decryption (unauthorised decoding of encrypted data), which are likely to lead in some cases to Data disclosure (R6).
R6. Data disclosure
Data disclosure is defined as the unauthorised exposure of personal data including special categories of personal data. The privacy breach risk is very similar when considered from a privacy rather than security viewpoint.
R7. Data manipulation
Data manipulation is defined as the unauthorised alteration of data.
R8. Data loss
Data loss is defined as the situation where data stored in the wallet is lost through misuse or malicious action. This risk is often a secondary risk of Data manipulation (R7) or Service disruption (R13), where all or part of the data cannot be restored.
R9. Unauthorised transaction
Unauthorised transactions are defined as operational activities conducted without the permission or knowledge of the wallet user. In many cases, an unauthorised transaction can lead to Identity theft (R4) or Data disclosure (R6). It is also related to unauthorised transactions, such as the misuse of cryptographic keys.
R10. Transaction manipulation
Transaction manipulation is defined as the unauthorised alteration of operations in the wallet. Transaction manipulation is an attack on integrity, and it is related to a data integrity breach.
R11. Repudiation
Repudiation is defined as a situation where a stakeholder can deny performing an action or being involved in a transaction, and other stakeholders do not have proper evidence to contradict them.
R12. Transaction data disclosure
Transaction data disclosure is defined as the disclosure of information related to information on a transaction between stakeholders.
R13. Service disruption
Service disruption is defined as an interruption or degradation in the normal operation of the wallet. A specific kind of service disruption is user lock-out, defined as the inability of a user to access their account or their wallet.
R14. Surveillance
Surveillance, or monitoring, is defined as the unauthorised tracking or observation of a wallet user’s activities, communication, or data. Surveillance is often related to inference, which is defined as the deduction of sensitive or personal information from seemingly innocuous data.

SECTION II

System-related risks

These risks are not used in the list of threats, as they are usually the consequence of multiple threats, repeated in a way that threatens the full system.

SR1. Wholesale surveillance
Wholesale surveillance is defined as the tracking or observation of the activities of many users through their wallet’s communication or data. Wholesale surveillance is often associated to surveillance (R14) and inference at a global scale, where information about many users is combined to deduce sensitive or personal data about users or to identify statistical trends that can be used to design further attacks.
SR2. Reputational damage
Reputational damage is defined as the harm caused to an organisation’s or governmental body’s reputation. Reputational damage will also stem from other risks when a breach or incident is covered by media and paints the organisation under an unfavourable light. Reputational damage can lead to further risks, such as loss of trust, stemming from the user’s reasonable doubts, and loss of ecosystem, when the full ecosystem collapses.
SR3. Legal non-compliance
Legal non-compliance is defined as a situation when relevant laws, regulations or standards cannot be adhered to. In the context of the wallet, as security and privacy of the solution are legal requirements, all threats are likely to lead to some kind of legal non-compliance.

SECTION III

Technical threats

The technical threats are not all linked to specific risks on the wallets, because many of them are means that could be used to implement attacks corresponding to many different risks.