Ignorance is no excuse — even the honest kind

By 24 December 2026, each of the EU’s twenty-seven member states must offer its citizens a certified digital identity wallet. The countdown began when the Commission’s first implementing regulations came into force in December 2024, and it ends on Christmas Eve.

That leaves four months. As of 3 August 2026, not one country has shipped a certified wallet.

Denmark is furthest along. Its AltID went into production on 3 June, but with a caveat: its register of relying parties — the services that will accept the wallet — does not yet qualify as one under eIDAS 2.0. Across Europe, the certification infrastructure itself is still being built.

Earlier this year ENISA, the EU’s cybersecurity agency, summed up the situation in a single sentence: “no EUDI Wallet has been deployed or certified, and the specification remains work in progress.”

Some countries have already planned to miss the deadline. Germany has spent €79.3 million and is aiming to launch on 2 January 2027, nine days late. An assessment in January found that only 12 of the 27 member states were on track to have a working wallet by the end of the year.

And where a wallet does arrive, there is a second problem. A survey of 2,000 adults in France and Germany found that 51% had not heard of the EUDI wallet. Another 27% had heard of it but didn’t know what it does. That leaves just one in five with any grasp of it.

So a piece of infrastructure that the law will make mandatory is four months away, and half the people it is meant for don’t know it exists.

What the wallet actually is

On the figures above, four in five people don’t know what this wallet is. So let’s start there.

It is an app on your phone. It can hold things like an identity card, a driving licence, proof of insurance or a diploma. When someone needs to check something, the wallet shows just the one thing they need.

At a bar, it confirms that you are over eighteen. Your name doesn’t go across, and neither do your date of birth or your address. At a hospital, it passes on your insurance cover and the rest stays put.

That, at least, is what it is designed to do. This piece asks whether that promise is being kept.

The obvious conclusion from the missed deadlines is that this is just another EU delay.

What is worth noticing is what carried on while the delay went on.

What Belgium already has

Belgium already has a national digital identity system, used by around 80% of adults over sixteen. It passed eight million users in 2025 and now handles 594 million authentications a year. People use it to log in to their bank, file their taxes, open their medical records and sign contracts.

The state didn’t build it.

It was built by a consortium called Belgian Mobile ID, made up of four banks (Belfius, BNP Paribas Fortis, KBC/CBC and ING) and three telecom operators (Orange Belgium, Proximus and Telenet). The state stayed out until mid-2021, when the Federal Holding and Investment Company took a 20% stake. It is still a shareholder.

Look at the order in which that happened.

The banks and telecoms built it first. The state came in later, as a minority shareholder.

Meanwhile the state is building a separate app, MyGov.be, run by the federal policy and support service, which chose Zetes in July to supply its e-signatures. European wallet trackers list Belgium as “existing app: upgrade confirmed”. According to reports, the private system is likely to plug into the national one.

So one is not replacing the other. The two will overlap.

It doesn’t check who you are

Part of this is less a misunderstanding than something that went unsaid. The explanation didn’t reach people, and many of us, me included, filled the gap with assumptions.

These systems don’t check who you are. They confirm that you are there.

When you log in, the system doesn’t ask who is this person? It asks two things: is the link registered earlier still valid, and is someone using it right now? The identity check happened once, at enrolment, through a bank’s know-your-customer checks or a national eID card. Every login after that confirms presence, not identity.

A fair objection is that all this still rests on the national eID. That’s true: the system as a whole does depend on identity checks.

What matters is where that dependency sits. It sits at enrolment, and it is the bank that carries out the check. The state hasn’t stopped verifying identity. Its role has shifted to recognising what a bank has already verified.

[Premise] What if proving that you exist, without revealing who you are, is already the norm in everyday life?

This is not a prediction. The rest of this piece takes it as a working assumption and uses it to look at the present again.

Why a state can’t build this

A state can’t build a system like this. Not because it doesn’t want to, but because of how such systems stay alive.

Identity infrastructure survives only if people use it often. A login you need once a year gets forgotten: the password is lost, the app deleted. What survives is what people use every week.

Governments don’t deal with their citizens every week. Banks and phone companies do.

All four started in the private sector, and none of them grew because a government made people use it. Each became the quickest way to log in to banks, insurers and online shops. That made it indispensable, and in time it became the de facto standard.

A single country might be explained by its culture. When it happens in four, the cause is structural.

The most telling case in that table is Sweden.

With BankID at 99%, Sweden has scheduled certification of its state wallet for 2029: ready for certification in 2028, certified in 2029. That is three years after the legal deadline. Switzerland is also looking beyond 2026.

It is hard to call that negligence. When 99% of people already use something that works, a state wallet isn’t urgent. The better a private identity system works, the further the state wallet slips. The regulation didn’t allow for that.

What the law asked for, and what the design delivered

Everything so far rearranges facts that were already public. This is where the real problem lies.

eIDAS 2.0 doesn’t just recommend privacy. It requires it.

Article 5a(16) says that once an attestation of attributes has been issued, the framework “shall not allow” the issuer, or any other party, to obtain data that would allow transactions or user behaviour to be tracked, linked or correlated, unless the user has explicitly authorised it. The same paragraph requires the framework to enable privacy-preserving techniques that ensure unlinkability where the user does not need to be identified. Article 5a(4) requires that selective disclosure be possible.

In plain terms: if a bar checks that someone is over eighteen, and a hospital checks the same person’s insurance, the two should not be able to compare notes and work out that it was the same person.

That is what the law asked for. To be precise, it asked for it where identifying the user isn’t required. The condition is real, but so is the requirement.

In June 2024 the Commission brought together a group of cryptographers and asked them to review the design as it then stood. Their verdict: the design falls short of the privacy requirements set out in the regulation, because it relies on cryptographic methods that were not designed to meet them. They concluded that it needed a substantial redesign, and pointed to anonymous credentials — the BBS family, which has been in the research literature for more than twenty years.

Two years later, on 15 April 2026, the Commission announced that its age verification app was technically ready. The technical documentation from the same period says:

Support for a zero-knowledge proof is upcoming.

It is tempting to guess at motives here: who held it back, and why.

We don’t need to. The structure tells us enough.

• The people who need anonymity are citizens.
• The ones who have to implement it are the banks, telecoms, healthcare providers and very large online platforms that will be obliged to accept the wallet from 2027.

Their interests don’t line up.

There is a technical problem as well. Aggregate data, such as a breakdown by age band, is supposed to be anonymous, and it feels safe. But slice it finely enough and the aggregate itself identifies people. Re-identification from aggregate data has been studied for a long time, and the findings consistently point the same way. Deleting a few fields does not make data anonymous.

Why so few people know: two explanations

Go back to that survey: half the people asked in France and Germany had not heard of the wallet.

There are two ways to explain that.

One: the explanation didn’t land. It isn’t that nothing was published, but that what was published didn’t reach the people it was meant for.

Two: the explanation was out there somewhere, but people had no spare time in their day to go looking for it.

Before choosing, it is only fair to add another figure from the same survey. Once told that the wallet could confirm their age without handing over their name, date of birth or address, 63% said they would be more likely to use it.

So people are not indifferent. Told what it does, they say they want it. That figure supports the idea that the explanation simply didn’t reach them.

Still, hearing an explanation in a survey is not the same as finding time to look for one on an ordinary day, so the question stays open. But if the second explanation is right, something left hanging earlier falls into place.

These systems didn’t win by explaining themselves. They won by being attached to the bank.

You can’t avoid your bank, and you can’t avoid filing your taxes. Someone with no time to spare doesn’t read explanations; they use what they already have. So the private sector didn’t win with better technology or better communication. It won because people are stretched thin.

That people have no room in their lives to scrutinise institutions is something you can observe. Who created that situation is not. So I will leave it there.

One more thing needs saying. Taking part is not optional.

From 2027, banks, telecoms, healthcare providers and very large online platforms must accept this wallet. Once they do, it becomes the way in. Someone without a wallet won’t just be mildly inconvenienced; they will be shut out.

Not taking part means being left behind. Not because anyone left behind deserves it, but because, structurally, the ways in shrink to just one.

If that is right, half the population not knowing is not a neutral fact. Leaving people in the dark about something that is about to become compulsory is less a failure to explain than a way of leaving them out.

So ignorance is no excuse, not even the honest kind. But the explanation is owed by whoever set this up without announcing it, not by the person who runs into it without knowing.

[Author’s position] I feel frustrated here, and it isn’t a simple frustration.

The structure is almost annoyingly complete, it has its excesses, and it also protects people’s lives. Four banks and three telecoms holding the identity checks for most adults in a country is an oligopoly. That oligopoly is also free and secure, and it genuinely makes people’s days easier. Both things are true, which makes simply opposing it impossible.

This is not a conclusion. It is where I stand. The judgement is yours to make.

Regulation has been here before

Here is one more timeline.

itsme was designed and launched after the GDPR was adopted and before it started to apply. That was exactly the period when every European company was redrawing its systems for the GDPR.

And the way itsme describes itself — collecting no more personal data than it needs, not tracking behaviour for advertising, using a separate key for each partner — follows the pattern of the data minimisation the GDPR asked for.

This is not a claim about cause and effect. It has not been established that itsme was built this way because of the GDPR. What has been established is that the timing and the design line up. The facts are laid out here; what to make of them is up to the reader.

What would need to happen first

Big tech, finance and the state would all have to be on the same side.

They aren’t. Their interests diverge, and at times one of them gains when the others fail.

And here something comes into view that wasn’t visible at the start of this piece.

The 2027 acceptance obligation is precisely the provision that puts them on the same side.

Obliging banks, telecoms, healthcare providers and large platforms to accept the wallet is a way of tying all the interested parties into one system. The regulation understood the order in which things had to happen.

It is just that the private sector completed step one a decade ago.

Likely objections

“Having no certified wallets yet is just an administrative delay. You’re reading too much into it.” This is the strongest objection, and the delay itself is not the argument. The argument is that presence has been proven every day while the delay went on. A working system arrived before the regulation did, and the regulation is coming to put it on paper rather than to build it.

“So what’s the alternative?” One possible direction: store context rather than identity, treat that context as who a person is now, and let it change with their future behaviour. If presence is confirmed, no information about the person actually standing there is used.

This approach has a cost, and there is no reason to hide it. Storing context means building a database of context. Identity is a handful of fixed attributes; context is behaviour that piles up over time, and it can be more sensitive. And if context changes with future behaviour, who decides whether a change counts? The moment someone holds that role, a new kind of power exists. Take away the power to issue identities and you may create a power to judge people’s conduct.

This problem is not solved, and it is better not to pretend otherwise.

So what begins in December?

Not a new era of proving identity. That era began a while ago in Belgium, and at around the same time in Norway, Sweden and Denmark.

Nor is the regulation simply arriving late. Read that way, the story becomes regulation is useless and the private sector does everything, and the timeline above rules that out.

The regulation isn’t late. This is its second visit.

In 2016, with the GDPR, it set the framework within which the banks and telecoms built. Now, in December 2026, it returns with eIDAS 2.0 to sign off on what they built.

It is more accurate to say that the private sector built inside a framework the regulation had already set than to say it got there before the regulation.

But this second visit comes with a catch. The law asked for anonymity, and the design hasn’t delivered it yet. And half the public doesn’t know.

The app that eight million Belgians use every day to prove they exist already knows who they are. When the regulation arrives in December, will it change that, or sign off on it?

That is for the reader to judge.