By Petra Beck, Senior Analyst Capture Software, Infosource
- The expanded eIDAS (electronic Identification, Authentication and Trust Services) 2.0 regulation is entering implementation stage in the EU. It will become mandatory for government agencies and businesses in select verticals within the next 2 years.
- The expanded regulation has far reaching implications for software vendors, service providers and public and private organisations with a focus on Government to Consumer (G2C) and Business to Consumer (B2C) end customers. These entities need to reflect the new requirements in their business plans, portfolio planning, and strategic partnerships.
- A large number of use cases in the Capture & IDP market involve ID Capture and verification as one of the input steps. Some business applications primarily involve Capturing ID, e.g., hospitality or access restrictions. Solutions for these business cases need to embrace the additional input source. End customers and service providers need to adjust their process steps to support the additional input source and more importantly the hybrid inputs which will shift towards eIDs.
- eIDAS regulations will drive a shift in demand from physical ID Capture to the processing of eIDs covering all EU ID types that are part of the EUID Wallet.
EU LEGISLATION FRAMEWORK
- The eIDAS regulatory framework is an element of the European Commission’s 2030 Digital Decade Programme.
- The program outlined digital goals for 2030 as part of Europe’s Digital Transformation strategy. One of the four key dimensions of this program is the digitalisation of public services. More specifically the defined goals were:
- Key Public Services: 100% online
- e-Health: 100% of citizens have access to medical records online
- Digital Identity: 80% of citizens have access to digital ID
FIRST STEPS AND DRIVERS OF THE EIDAS REGULATION
- The roots of the eIDAS regulation lie in efforts to harmonise digital signature legislations in the EU and interoperability between EU member states starting in the 1990s.
- The EC initiated the European electronic Identification, Authentication and trust Services initiative (eIDAS Regulation). The initial Regulation (EU) No. 910/2014 was implemented on July 23, 2014 by the European Parliament and Council. The initial scope was cross-border electronic identification, authentication and website certification within the EU.
- The initial eIDAS regulation did not mandate the EU Member States provide their citizens and businesses with a digital identification system enabling secure access to public services or to ensure their use across EU borders. It also lacked provisions for use of digital ID for private services, or with mobile devices. This caused discrepancies between countries, limited deployment (14 member states), as well as limited take-up due to lack of business cases and suboptimal user experience.
EIDAS 2.0 BROADENS THE SCOPE CONSIDERABLY
- eIDAS 2.0, first introduced in 2018, has broadened the scope by adding more types of electronic trust services and introducing the concept of qualified trust service providers, adding detailed guidelines to ensure consistency in the EU and address growing security concerns.
- eIDAS 2.0 broadens the scope by adding electronic registered delivery services, electronic certificates for authentication, and electronic seals for electronic documents.
- The concept of “qualified trust service providers” (QTSPs) sets particularly high standards for security and reliability.
- The inconsistent deployment is addressed through more detailed technical and operational requirements for trust service providers and guidelines for the supervision and enforcement of the standards.
FRAMEWORK OF A EUROPEAN DIGITAL IDENTITY WALLET
- eIDAS 2.0 takes the concept of a European digital identity controlled by citizens even further to introduce a European Digital Identity Wallet (EDIW) or EUDI Wallet that can be read by public bodies, companies, and institutions to verify the identity of citizens.
- The European Commission has established a draft ecosystem as basis for the infrastructure of the EU ID Wallet.
WHAT ARE THE NEXT STEPS
- At the end of June 2023 representatives of the Council and Parliament of the European Union reached an agreement on key elements of a new EU digital identity policy outlined in the proposed legislative framework known as eIDAS 2.0.
- The next step is to establish the actual law, i.e., the publication in the official journal of the EU, which involves the review of the member states.
- In parallel the EU Member States are collaborating with the EC to build a prototype of the European Digital Identity Wallet (EUDI Wallet), which can subsequently be used to test a variety of use cases. The first version of this toolbox was published by the EC on Feb 10, 2023.
- The Commission is investing €46 million from the Digital Europe Programme in four large-scale pilots. These pilots were kicked off in April 2023 and are used to test and drive further enhancements of the EU Digital Identity Wallet in use-cases including the Mobile Driving Licenses, eHealth, payments, and education, and professional qualifications.
- According to the EC guidelines, Member States should issue the new EU Digital Identity Wallets 24 months after adoption of an Implementing Act setting out the technical specifications for the wallet.
WHICH CAPTURE AND IDP USE CASES DOES eIDAS 2.0 IMPACT?
A significant number of Capture & IDP Use Case involve ID verification. These include:
- ID capture use cases, e.g., for hotel check-in
- eGovernment services, e.g., request of citizen services like birth certificates, drivers licenses, etc.
- Renting a car, using a digital driver’s license
- Access verification, e.g. proof of citizenship, age, etc.
- Onboarding type use case cases, e.g., bank account opening, mortgage application, application for a job opening, school or university
The EC highlights the application for a bank loan as one of the use cases on their website, where the new eIDAS regulation is expected to make a significant difference:
“Applying for a bank loan is a process that typically includes numerous steps, from setting up appointments and having physical meetings, to collecting and signing all the paper documents – and repeating the operation if documents are missing.”
By using the European Digital Identity, the user only has to select the necessary documents that are stored locally on his digital wallet to reply to the bank’s request. Then, verifiable digital documents are created and sent securely for verification to the bank, which can then continue with the application process.
Public services and certain private services will be obliged to recognise the EU Digital Identity Wallets.
Relevant private services where acceptance of the wallet will be obligatory are those where strong assurance of the identity of their customers is critical, e.g., areas of transport, energy, banking and financial services, social security, health, postal services, digital infrastructure, education or telecommunications.
INFOSOURCE CAPTURE SOFTWARE DIVISION
Infosource is a leading global analyst firm headquartered in Geneva, Switzerland. In December 2019, Infosource acquired HSA, Inc., an analyst firm founded in 1989 that specialised in Capture software, which now serves as foundation for Infosource’s software division.
Infosource Software is the leading authority on Capture and Intelligent Document Processing systems and provides analysis and guidance on the Capture and IDP software market. The scope of Infosource’s analysis covers software and solutions for the ingestion of unstructured and semi structured business inputs with the objective of automating business processes.
Our software analyst team conducts in-depth analysis of the business use cases as well as other metrics that are critical to analyse the changing market requirements of end customers in the respective vertical markets.
