Commission Implementing Regulation (EU) 2025/1568 of 29 July 2025 laying down rules for the application of Regulation (EU) No 910/2014 of the European Parliament and of the Council as regards procedural arrangements for peer reviews of electronic identification schemes and for cooperation on the organisation of such reviews within the Cooperation Group and repealing Commission Implementing Decision (EU) 2015/296

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC (1), and in particular Article 12(6) and Article 46e(7) thereof,

Whereas:

(1) Regulation (EU) No 910/2014 provides for a peer review mechanism with respect to electronic identification schemes that are to be notified, in which Member States can participate on a voluntary basis. Peer reviews should enable Member States to understand the electronic identification schemes to be notified in accordance with Article 9(1), point (a), of Regulation (EU) No 910/2014 and effectively cooperate with a view to ensuring interoperability of those schemes and building trust across the Union. Peer reviews should be organised in such a way as to ensure equitable distribution of efforts and broad representation of all Member States and should not be understood as audits.

(2) Commission Implementing Decision (EU) 2015/296 (2) established the procedural arrangements for cooperation on electronic identification schemes within the context of the former eIDAS Cooperation Network, including for peer reviews conducted by members of that network. Since the peer review tasks are now to be organised by the European Digital Identity Cooperation Group established pursuant to Commission Decision C(2024)6132 of 5.9.2024 establishing the European Digital Identity Cooperation Group and amending Implementing Decision (EU) 2015/296, following Article 46e(1) of Regulation (EU) No 910/2014 (‘Cooperation Group’), Implementing Decision (EU) 2015/296 should be repealed.

(3) To make peer reviews easily accessible, any Member State should be able to request the initiation of a peer review. The request should indicate the reasons for requesting the peer review and contain sufficient information to corroborate that the peer review may contribute to the interoperability or security of electronic identification schemes to be notified. To this end, creating uniform rules for the minimum required information is necessary to ensure that the peer review can be completed in an efficient and timely manner. The Commission may organise meetings of the Cooperation Group to facilitate the timely initiation and conclusion of a peer review.

(4) Where a Member State provides information to the other Member States on an electronic identification scheme in accordance with Article 7, point (g) of Regulation (EU) No 910/2014 (‘pre-notification’), that action should formally be considered as a request by the notifying Member State to perform a peer review of its electronic identification scheme.

(5) To ensure effective preparation and execution of the peer review, standardised roles and responsibilities in the peer review should be identified. Member States should have the possibility to appoint representatives to fulfil those roles and responsibilities. As it is critical to ensure that all peer reviews run smoothly and are conducted in a streamlined and expeditious manner, the practicalities of each peer review, indicatively its exact scope and timing, should be agreed among the Member States involved in that peer review.

(6) To ensure that all Member States contribute to the implementation of the peer review mechanism, as well as to enable them to benefit from peer learning, representatives of each Member State should contribute to an equitable distribution of efforts among Member States across all peer reviews to be conducted.

(7) To foster a high level of trust in peer reviewed electronic identification schemes, Member States should provide the minimum required information, while ensuring the confidentiality of potentially sensitive information. Such information should be evaluated by three working groups in the peer reviews, each with a mandate corresponding to the central topics for evaluating an electronic identification scheme as set out in Commission Implementing Regulation (EU) 2015/1501 (3) and Commission Implementing Regulation (EU) 2015/1502 (4).

(8) As Implementing Decision (EU) 2015/296 already established English as the language of cooperation, unless otherwise agreed, it is existing practice of Member States to undertake the peer review process in English. Therefore, Member States should provide relevant information for the peer review at least in English. However, translation should not cause unreasonable administrative or financial burdens. In this respect, Member States are free to use automated translation tools, including the ones provided by the Commission.

(9) Taking into account the importance of peer reviews as a tool to ensure the trustworthiness of notified electronic identification schemes, a streamlined process should be established for the adoption of a clear and comprehensive final peer review report. During that process, the Cooperation Group and the Member States participating in the peer review should have the possibility to put additional questions to the Member State whose electronic identification scheme is being peer reviewed, while that Member State should have the opportunity to provide additional observations. To ensure transparency, the process should be completed with the publication of the Cooperation Group’s opinion on the conclusion of the peer review.

(10) Since electronic identification schemes may undergo changes after conclusion of their peer review, it is also necessary to set up a process for initiating an update of prior peer reviews if such changes can impact the interoperability, security or trustworthiness of the notified electronic identification scheme. This would enable the peer reviews to remain relevant over time as electronic identification schemes evolve.

(11) Regulation (EU) 2016/679 of the European Parliament and of the Council (5), and, where relevant, Regulation (EU) 2018/1725 of the European Parliament and of the Council (6), Directive 2002/58/EC of the European Parliament and of the Council (7) apply to the personal data processing activities under this Regulation.

(12) The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 and delivered its opinion on 28 May 2025.

(13) The measures provided for in this Regulation are in accordance with the opinion of the committee established by Article 48 of Regulation (EU) No 910/2014,

HAS ADOPTED THIS REGULATION:

Article 1

General principles for the peer review

Article 2

Initiation of the peer review

(a) a comparison between the pre-notified electronic identification scheme and requirements laid down in Implementing Regulation (EU) 2015/1502, under the form of a level of assurance mapping document for the peer review in accordance with Annex I to this Regulation;

(b) a high-level description of the electronic identification scheme, of its ecosystem and of electronic identification in the Member State having made the pre-notification, under the form of a whitepaper in accordance with Annex II to this Regulation;

(c) information regarding interoperability of the electronic identification scheme and the requirements laid down in Implementing Regulation (EU) 2015/1501, under the form of an interoperability framework mapping document in accordance with the template set out in Annex III to this Regulation.

Article 3

Preparation of the peer review

The members of the peer review group shall agree on assigning the following roles:

(a) one coordinator who shall be responsible for organising the peer review and managing communication with Member States, the Cooperation Group and the Commission;

(b) up to three rapporteurs depending on the scope of the peer review and each one of them to lead a working group as referred to in Article 4(2);

(c) at least one active member per working group, who shall assist in generating questions and providing feedback to the rapporteurs and contribute to drafting the final peer review report.

(a) organisation of the questions and answers;

(b) finalisation of the peer review report;

(c) drafting of the opinion on the peer reviewed electronic identification scheme.

Article 4

Organisation of the peer review

(a) an enrolment working group, peer-reviewing the alignment of the pre-notified electronic identification scheme with the requirements in relation to enrolment as set out in section 2.1 of the Annex to Implementing Regulation (EU) 2015/1502;

(b) an electronic identification means management and authentication working group, peer-reviewing the alignment of the pre-notified electronic identification scheme with the requirements in relation to electronic identification means management and authentication as set out in sections 2.2 and 2.3 of the Annex to Implementing Regulation (EU) 2015/1502;

(c) a management and organisation working group peer-reviewing the alignment of the pre-notified electronic identification scheme with the requirements in relation to management and organisation as set out in section 2.4 of Implementing Regulation (EU) 2015/1502.

(a) assessment of relevant documentation provided by the Member State having made the pre-notification;

(b) examination of processes described as part of that documentation;

(c) technical seminars;

(d) consideration of independent third-party assessments, where relevant assessments of this kind are available;

(e) drafting of the peer review report that summarises the peer review’s findings and results.

(a) it does not possess the information or documentation and obtaining it would generate an unreasonable administrative burden;

(b) the information or documentation requested concerns matters of public security or national security;

(c) the information concerns business matters, professional or company secrets;

(d) the sensitivity of the information makes it impossible to establish a secure channel to communicate the information to the members of the peer review group.

Article 5

Outcome of the peer review

(a) provide a draft peer review report to the Member State having made the pre-notification no later than three months after the start date of the peer review referred to in Article 3(3) unless the peer review is subject to an extension in accordance with Article 3(8) where the report is due according to the agreed extension;