EU Business Wallet: Trust Requires Certification

30 Jun 2026 EU Business Wallet: Trust Requires Certification

A Key Building Block of the Single Market Requiring the Same Level of Security as the EU Digital Identity Wallet

The European Business Wallet is set to become a core component of the Single Market’s digital infrastructure. It will enable companies to exchange official documents, prove representation rights and carry out legally binding transactions across borders.

It is also expected to be used alongside the European Digital Identity Wallet under Regulation EU No 910/2014, forming part of the same ecosystem of trusted digital services. In this context, the European Business Wallet will interact with identity data, credentials and trust services, and will therefore be exposed to similar risks and security requirements.

Recent developments already demonstrate the risks of deploying components within this ecosystem without prior certification. The age verification application promoted at Union level, intended to be integrated into or used in conjunction with the European Digital Identity Wallet, was shown by independent security researchers to be compromisable in less than two minutes[1]. These findings were made in the absence of prior independent security evaluation, including penetration testing[2] and certification.

This example exposes a structural weakness of an approach relying on ex-post supervision. Introducing non-certified applications into the wallet ecosystem creates systemic vulnerabilities and undermines trust in the entire infrastructure. Relying parties cannot be expected to distinguish between certified and non-certified components within the same system.

While the European Digital Identity Wallet is subject to a certification framework under Regulation EU No 910/2014, no equivalent mechanism is currently proposed for the European Business Wallet. This inconsistency creates a gap in the trust framework and risks undermining the security and credibility of the entire ecosystem.

There is therefore no justification for applying a lower level of security to the European Business Wallet. It must meet the same level of security as the European Digital Identity Wallet.