If you follow digital identity space, you’ll know that smartphone manufacturers are making moves to upgrade their wallets to include forms of identification alongside existing capabilities around passes and payments.

At the same time, EUDI Wallets are moving towards production across Europe.

For Relying Parties, the interesting question is what this means in practice.

Can we really talk about commercial wallets in the same way that we talk about EUDI Wallets?

That was the focus of Explained by eID Easy S01E04, where John Jolliffe was joined by Andrea Feliziani, Chief Compliance Officer at eID Easy, and Andrii Hrynchuk, Lead Developer at eID Easy.

Watch the full session →

In this post

We cover the main takeaways from the session:

• what actually makes an EUDI Wallet
• how EUDI and commercial wallets differ legally
• why they are becoming surprisingly similar technically
• why the issuer behind the credential matters
• what this means for Relying Parties deciding which wallets and credentials to accept

What makes an EUDI Wallet is certification, not ownership

It is tempting to think about this as government wallets versus private wallets.

But that is not quite right.

Under the EUDI framework, a wallet can be:

• provided by a Member State
• provided under a mandate from a Member State
• provided independently and recognised by a Member State

That means private-sector companies can build or operate EUDI Wallets too.

The important distinction is therefore not who owns the wallet.

What makes an EUDI Wallet is the certification regime behind it and its formal recognition within the EUDI framework.

Commercial, or "big tech", wallets such as Google Wallet and Apple Wallet sit outside that certification framework.

Different legal worlds

This creates two different trust models.

EUDI Wallets are certified against the relevant implementing acts and Architecture and Reference Framework, operate at assurance level high and are subject to the EUDI supervision framework.

They can hold Personal Identification Data (PID), qualified attestations and public-sector attestations, and must offer qualified electronic signatures free of charge for non-professional use.

Commercial wallets are different.

They are governed mainly by general law and the provider’s own model. Their level of identity proofing and assurance depends on the measures implemented by that provider.

That does not mean they cannot be useful for identity.

It means the Relying Party needs to understand what it is actually relying on.

Legally divergent, technically converging

This was one of the more interesting points from the session.

From a technical perspective, EUDI Wallets and commercial wallets are becoming much more similar.

They can use many of the same credential formats and presentation protocols.

For online use, the same verifier infrastructure can potentially receive credentials from different wallets.

So technically, the gap is getting smaller.

But the key difference remains:

Who signed the credential, and what does that signature mean?

That is where the trust models separate.

The issuer matters more than the wallet logo

A commercial wallet can contain different kinds of identity credentials.

Take a mobile driving licence.

If a government authority issues the licence directly into Google Wallet or Apple Wallet, the government authority is still the issuer. The wallet is holding and presenting the credential.

A passport-derived credential works differently.

The wallet reads data from the passport chip, verifies that the data is genuine, performs identity proofing such as liveness and face matching, and then the wallet provider signs a new credential with its own key.

The information originally came from a government-issued document.

But the resulting digital credential is issued by the commercial wallet provider.

And a lost or cancelled passport does not automatically revoke that derived credential.

For a Relying Party, these differences matter.

The session’s recommendation was simple:

Record the issuer type and assurance level for every presentation, and set policy according to the use case.

Where each wallet type fits

There is currently a trade-off between legal effect and reach and convenience.

EUDI Wallets are relevant where stronger legal effect is needed, including use cases such as:

• AML customer identification
• sectors where EUDI Wallet acceptance is mandatory
• cross-border public services
• qualified electronic signatures

Commercial wallets can be useful where that same level of regulated assurance is not required, for example:

• age gating where the law does not prescribe a specific method
• loyalty and membership
• ticketing
• lower-risk onboarding
• users outside the EU

In those cases, the Relying Party decides whether the level of assurance is sufficient for the use case.

What this means for Relying Parties

The practical takeaway from the session was not to choose one wallet world and ignore the other.

Users are likely to have both.

Instead:

1. Start with the use case.
What does the customer actually need to prove?

2. Set policy by credential and assurance level.
Do not assume every credential inside the same wallet carries the same trust.

3. Look at the issuer, not just the wallet.
The same wallet can hold credentials issued by completely different parties.

4. Support both wallet worlds where they make sense.
Use the right wallet and credential for the level of trust your service requires.

One integration, two legal worlds

For eID Easy, this is the practical direction behind the Wallet Hub.

EUDI Wallets and commercial wallets may increasingly share technical formats and protocols, while remaining very different from a legal and trust perspective.

The goal is therefore not to treat every wallet as equivalent.

It is to give Relying Parties one integration while allowing the right trust and acceptance rules to be applied underneath.

As the session summarised it:

One integration, two legal worlds.

Watch the full session

Want the deeper technical and compliance discussion, including mobile driving licences, passport-derived credentials, registration and intermediaries?

Watch Explained by eID Easy S01E04 →

This article is for general information and does not constitute legal advice. Wallet certification status and national timelines continue to evolve.