Commission Implementing Regulation (EU) 2026/1731 of 15 July 2026 amending Implementing Re…
as it stood on 2026-07-15, permalink: /eu-eurlex/32026r1731/2026-07-15
Point-in-time view as at 2026-07-15. This version has been
superseded, it applied 2026-07-15 → open. Jump to the
version in force today or see
exactly what changed next.
Text included, per-article reading view.
Deterministic extraction of the verbatim retrieved document; each article carries its own hash and anchor.
© European Union, 1998-2026. Reuse permitted with attribution under Commission Decision 2011/833/EU. Consolidated texts have no legal effect; only acts published in the Official Journal are authentic.
art_1
#art_1
Article 1
Implementing Regulation (EU) 2024/2977 is amended as follows:
| (1) | The following Article 3a is inserted:‘Article 3aProtection of the portrait1. In addition to information requirements pursuant to Regulation (EU) 2016/679, wallet providers shall ensure that the wallet solutions they provide issue warnings to wallet users where wallet-relying parties request the disclosure of the portrait, indicating that the request involves the sharing of biometric data and requires confirmation for the selective disclosure of the portrait.2. For the implementation of selectively disclosing the portrait to a wallet-relying party, the wallet providers shall ensure the wallet solutions require the wallet user to explicitly and specifically confirm the presentation of the portrait.3. The portrait shall not be retained by wallet-relying parties unless its processing is necessary for the purposes of identification and authentication in compliance with Union data protection law or where this is provided for by Union or national law, in compliance with Union data protection law. The portrait shall not be transferred to third countries or international organisations unless permitted by Union data protection law.’; |
|---|
| (2) | in Article 4, paragraph 1 is replaced by the following:‘1. Electronic attestations of attributes issued to wallet units shall comply with at least one of the standards set out in Annex II of Implementing Regulation (EU) 2024/2979.’; |
|---|
| (3) | in Article 5, paragraph 4, point (b) is replaced by the following:‘(b)where the wallet unit attestation of the wallet unit to which the person identification data was issued to has been revoked;’; |
|---|---|
| ‘(b) | where the wallet unit attestation of the wallet unit to which the person identification data was issued to has been revoked;’; |
| (4) | The Annex is replaced by the text set out in Annex I to this Regulation. |
|---|
art_2
#art_2
Article 2
Implementing Regulation (EU) 2024/2979 is amended as follows:
| (1) | in Article 3, paragraph 2 is deleted; |
|---|
| (2) | in Article 5, paragraph 1, point (a) is replaced by the following:‘(a)perform wallet cryptographic operations involving critical assets, stored in a wallet secure cryptographic device and not required for the authentication of the wallet user only in cases where those applications have successfully authenticated wallet users;’; |
|---|---|
| ‘(a) | perform wallet cryptographic operations involving critical assets, stored in a wallet secure cryptographic device and not required for the authentication of the wallet user only in cases where those applications have successfully authenticated wallet users;’; |
| (3) | the following Article 5a is inserted:‘Article 5aCryptographic mechanismsWallet providers shall, for the purposes of paragraph 2 of Article 4, use only the cryptographic mechanisms referred to in Annex Ia.’; |
|---|
| (4) | Article 6 is amended as follows:(a)paragraph 1 is replaced by the following:‘1. Wallet providers shall issue wallet unit attestations for each wallet unit. Wallet providers shall sign or seal the wallet unit attestations in a way that the signatures or seals can be validated by means of a certificate listed in accordance with Annex II section 2, point (1), letter (h) of Implementing Regulation (EU) 2024/2980.’;(b)paragraph 2 is replaced by the following:‘2. Wallet providers shall ensure that the wallet unit attestations referred to in paragraph 1 comply with the technical specifications set out in Annex Ib.’;(c)in paragraph 3, point (b) is replaced by the following:‘(b)provide secure identification and authentication mechanisms for wallet users that are independent of wallet units’; |
|---|---|
| (a) | paragraph 1 is replaced by the following:‘1. Wallet providers shall issue wallet unit attestations for each wallet unit. Wallet providers shall sign or seal the wallet unit attestations in a way that the signatures or seals can be validated by means of a certificate listed in accordance with Annex II section 2, point (1), letter (h) of Implementing Regulation (EU) 2024/2980.’; |
| (b) | paragraph 2 is replaced by the following:‘2. Wallet providers shall ensure that the wallet unit attestations referred to in paragraph 1 comply with the technical specifications set out in Annex Ib.’; |
| (c) | in paragraph 3, point (b) is replaced by the following:‘(b)provide secure identification and authentication mechanisms for wallet users that are independent of wallet units’; |
| ‘(b) | provide secure identification and authentication mechanisms for wallet users that are independent of wallet units’; |
| (5) | in Article 9, paragraph 2, point (b) is replaced by the following:‘(b)the name, contact details, and the unique identifier of the corresponding wallet-relying party and the Member State in which that wallet-relying party is established;’; |
|---|---|
| ‘(b) | the name, contact details, and the unique identifier of the corresponding wallet-relying party and the Member State in which that wallet-relying party is established;’; |
| (6) | in Article 10, paragraph 1 is replaced by the following:‘1. Wallet providers shall ensure that electronic attestations of attributes issued in accordance with the technical specifications applicable for common embedded disclosure policies set out in Annex III can be processed by the wallet units that they provide.’; |
|---|
| (7) | Article 12 is amended as follows:(a)paragraph 2, point (c) is replaced by the following:‘(c)creating signatures or seals in accordance with at least the mandatory signature or seal format referred to in Annex IV;’;(b)paragraph 3 is replaced by the following:‘3. The signature creation applications may either be integrated into or be external to wallet instances.’;(c)the following paragraph is inserted:‘4. The signature creation applications used by wallet units shall support at least the application programming interface referred to in Annex IV.’; |
|---|---|
| (a) | paragraph 2, point (c) is replaced by the following:‘(c)creating signatures or seals in accordance with at least the mandatory signature or seal format referred to in Annex IV;’; |
| ‘(c) | creating signatures or seals in accordance with at least the mandatory signature or seal format referred to in Annex IV;’; |
| (b) | paragraph 3 is replaced by the following:‘3. The signature creation applications may either be integrated into or be external to wallet instances.’; |
| (c) | the following paragraph is inserted:‘4. The signature creation applications used by wallet units shall support at least the application programming interface referred to in Annex IV.’; |
| (8) | in Article 14, paragraph 1 is deleted; |
|---|
| (9) | the following Article 14a is inserted:‘Article 14aEU Digital Identity Wallet Trust Mark1. Wallet providers shall ensure that wallet units display the EU Digital Identity Wallet Trust Mark. The EU Digital Identity Wallet Trust Mark shall be in the form set out in Annexes VI and VII.2. Wallet providers shall ensure that wallet units enable wallet users to access information allowing them to verify the certification status of the wallet solution. For that purpose, wallet providers shall ensure that, following the registration of a wallet solution, the corresponding wallet units include the URLs provided by the European Commission for such verification. Wallet providers shall ensure that their wallet units have access to EU Digital Identity Wallet Trust Mark data that comply with the technical specifications set out in Annex VIII.3. The reference colours for the EU Digital Identity Wallet Trust Mark shall be Pantone No 661 and 116, or blue (100 % cyan + 67 % magenta + 0 % yellow + 40 % black) and yellow (0 % cyan + 20 % magenta + 100 % yellow + 0 % black), when a four colour process is used; when RGB colours are used the reference colours shall be blue (0 red + 51 green + 153 blue) and yellow (255 red + 204 green + 0 blue).4. Only where the use of colour is not practicable, the EU Digital Identity Wallet Trust Mark may be used in black and white as set out in Annex VII.5. Where the EU Digital Identity Wallet Trust Mark is used on a dark background, it may be used in negative format using the same background colour. Where the EU Digital Identity Wallet Trust Mark is used in colour on a coloured background that makes it difficult to see it, a delimiting outer line around the EU Digital Identity Wallet Trust Mark may be used to improve contrast with the background colours.6. The EU Digital Identity Wallet Trust Mark shall have a minimum size of 64 × 85 pixels at 150 dpi.7. Wallet providers shall ensure that the EU Digital Identity Wallet Trust Mark is used in a manner enabling the clear indication of the wallet unit that the EU Digital Identity Wallet Trust Mark pertains to. The EU Digital Identity Wallet Trust Mark may be associated with graphic or textual elements clearly indicating the wallet unit it is used for, provided that they do not change its recognisability as an EU Digital Identity Wallet Trust Mark, nor alter the association with the list of certified European Digital Identity Wallets referred to in Article 5d of Regulation (EU) No 910/2014.8. Where wallet providers have revoked a wallet unit attestation, they shall ensure that the EU Digital Identity Wallet Trust Mark is no longer displayed by the corresponding wallet unit.’. |
|---|
| (10) | Annexes Ia and Ib are added as set out in Annex II and Annex III to this Regulation. |
|---|
| (11) | Annex II is replaced by Annex IV to this Regulation. |
|---|
| (12) | Annex III is replaced by Annex V to this Regulation. |
|---|
| (13) | Annex IV is amended in accordance with Annex VI to this Regulation. |
|---|
| (14) | Annex V is deleted. |
|---|
| (15) | The text set out in Annex VII to this Regulation is inserted as Annex VI. |
|---|
| (16) | The text set out in Annex VIII to this Regulation is inserted as Annex VII. |
|---|
| (17) | The text set out in Annex IX to this Regulation is inserted as Annex VIII. |
|---|
art_3
#art_3
Article 3
Implementing Regulation (EU) 2024/2980 is amended as follows:
| 1. | in Article 5, paragraph 2 is replaced by the following:‘2. Where applicable, the Commission shall establish, maintain and publish a list compiling the information notified by Member States on wallet providers, providers of person identification data, providers of wallet-relying party access certificates and providers of wallet-relying party registration certificates, as referred to in Annex II, sections 2, 3, 4 and 5.’; |
|---|
| 2. | Annex II to Implementing Regulation (EU) 2024/2980 is amended as set out in Annex X to this Regulation. |
|---|
art_4
#art_4
Article 4
Implementing Regulation (EU) 2024/2982 is amended as follows:
| (1) | in Article 1, paragraph 2 is replaced by the following:‘(2) the presentation of attributes of person identification data and electronic attestations of attributes to wallet-relying parties;’; |
|---|
| (2) | Article 3 is amended as follows:(a)paragraph (1) is replaced by the following:‘(1) authenticate and validate the wallet-relying party access certificates where interacting with wallet-relying parties without delegating execution of these processes to an operating system browser or other intermediary application;’;(b)paragraph (2) is deleted;(c)paragraph (3) is replaced by the following:‘(3) authenticate and validate requests made using wallet-relying party access certificates;’;(d)paragraph (4) is replaced by the following:‘(4) authenticate and validate the wallet-relying party registration certificate;’;(e)paragraph (5) is replaced by the following:‘(5) display to wallet users information contained in the wallet-relying party access certificates;’;(f)paragraph (8) is deleted;(g)paragraph (9) is replaced by the following:‘(9) do not present any requested attributes to wallet-relying parties until the following steps have been completed:(a)verification that embedded disclosure policies have been processed within the wallet unit in accordance with Article 10 of Implementing Regulation (EU) 2024/2979;(b)verification that wallet users have partially or in full approved the presentation.’; |
|---|---|
| (a) | paragraph (1) is replaced by the following:‘(1) authenticate and validate the wallet-relying party access certificates where interacting with wallet-relying parties without delegating execution of these processes to an operating system browser or other intermediary application;’; |
| (b) | paragraph (2) is deleted; |
| (c) | paragraph (3) is replaced by the following:‘(3) authenticate and validate requests made using wallet-relying party access certificates;’; |
| (d) | paragraph (4) is replaced by the following:‘(4) authenticate and validate the wallet-relying party registration certificate;’; |
| (e) | paragraph (5) is replaced by the following:‘(5) display to wallet users information contained in the wallet-relying party access certificates;’; |
| (f) | paragraph (8) is deleted; |
| (g) | paragraph (9) is replaced by the following:‘(9) do not present any requested attributes to wallet-relying parties until the following steps have been completed:(a)verification that embedded disclosure policies have been processed within the wallet unit in accordance with Article 10 of Implementing Regulation (EU) 2024/2979;(b)verification that wallet users have partially or in full approved the presentation.’; |
| (a) | verification that embedded disclosure policies have been processed within the wallet unit in accordance with Article 10 of Implementing Regulation (EU) 2024/2979; |
| (b) | verification that wallet users have partially or in full approved the presentation.’ |
| (3) | in Article 4, paragraph 1 is replaced by the following:‘1. Wallet providers shall ensure that wallet solutions support the protocols and interfaces set out in Annex I for the issuance of person identification data and electronic attestations of attributes to wallet units.’; |
|---|
| (4) | Article 5 is amended as follows:(a)paragraphs 1 and 2 are replaced by the following:‘1. Wallet providers shall ensure that wallet solutions support protocols and interfaces for the presentation of attributes to wallet-relying parties, remotely, and, where appropriate, in proximity, in accordance with the technical specifications set out in Annex II.2. Wallet providers shall ensure that, at the request of users, wallet units respond to successfully authenticated and validated requests from wallet-relying parties referred to in Article 3, in accordance with the technical specifications set out in Annex II.’;(b)paragraph 5 is deleted. |
|---|---|
| (a) | paragraphs 1 and 2 are replaced by the following:‘1. Wallet providers shall ensure that wallet solutions support protocols and interfaces for the presentation of attributes to wallet-relying parties, remotely, and, where appropriate, in proximity, in accordance with the technical specifications set out in Annex II.2. Wallet providers shall ensure that, at the request of users, wallet units respond to successfully authenticated and validated requests from wallet-relying parties referred to in Article 3, in accordance with the technical specifications set out in Annex II.’; |
| (b) | paragraph 5 is deleted. |
| (5) | Article 8 is replaced by the following:‘Article 8Entry into forceThis Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.Article 3(4) shall apply from 11 August 2028.This Regulation shall be binding in its entirety and directly applicable in all Member States.’. |
|---|
| (6) | The Annex is deleted. |
|---|
| (7) | The text set out in Annex XI to this Regulation is added as Annex I. |
|---|
| (8) | The text set out in Annex XII to this Regulation is added as Annex II. |
|---|
art_5
#art_5
Article 5
This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.
This Regulation shall be binding in its entirety and directly applicable in all Member States.
Provenance and validity dates, identifier, hash
| as of | 2026-07-15 → this version applied |
| valid | 2026-07-15 → open publisher-asserted |
| type | REG_IMPL Commission Implementing Regulation (EU) 2026/1731 of 15 July 2026 amending Implementing Regulations (EU) 2024/2977, (EU) 2024/2979, (EU) 2024/2980 and (EU) 2024/2982 as regards applicable standards and specifications |
| language | en |
| published | 2026-07-15 |
| lex_id | eu-eurlex:32026r1731:2026-07-15 |
| record sha256 | 31ed21aaf34de425beb3545a2988431f6d39ca119071add471e611be30671e6e |
New here? What am I looking at?
This is a consolidated text: the original law with every later amendment merged in, as the official publisher produced it for a given date. Laws are amended constantly, so “the law” has no single text, only a text per date. That date is the banner above.
It has no legal force. Only the version published in the official gazette (Mémorial / Official Journal) is authentic, the publishers say so themselves, and so do we. Lex reproduces their text without altering a byte, and links the source on every page. This is legal information, never legal advice: it reports what the text said, never what it means for your situation.
“Valid from → to” = the window in which this text applied. “Open” = still current as far as the publisher has consolidated. Each article carries its own hash so you can prove it was not tampered with , here is how.
timeline next version (2026-07-15) →
| tier | A, publisher-supplied validity dates |
| history begins | publisher |
| index built | 2026-08-07T19:46:23Z · corpus 8d5e859 |
| stamp signature | valid (ECDSA-P256) |