How Does Identity Proofing Work for the EUDI Wallet Under eIDAS 2?

What does eIDAS 2 require for EUDI Wallet identity proofing?

Regulation (EU) 2024/1183 was published on 30 April 2024 and entered into force on 20 May 2024. It amends Regulation (EU) No 910/2014, the original eIDAS Regulation, and establishes the European Digital Identity Framework. At its centre is the European Digital Identity Wallet: an app, provided or recognised by each Member State, that holds person identification data (PID) and other attestations such as diplomas, licences or bank account details, and lets the holder present them selectively to relying parties.

The proofing rule sits in the implementing acts. Commission Implementing Regulation (EU) 2024/2977, published on 4 December 2024 and in force 20 days later, covers PID and electronic attestations. It requires PID providers to enrol and verify wallet users consistent with assurance level high before issuing PID to a wallet unit. Wallets are therefore meant to be a high-assurance identity, comparable to the strongest notified national eID schemes, which is why the onboarding step carries so much weight.

Assurance levels come from the earlier framework. Commission Implementing Regulation (EU) 2015/1502 defines low, substantial and high. At high, identity proofing and the electronic identification means must protect against misuse and alteration by attackers with high attack potential. National implementations, certification schemes and supervisory practice decide how each route is accepted.

How does remote onboarding to the EUDI Wallet work under Implementing Regulation 2026/798?

Commission Implementing Regulation (EU) 2026/798 was published on 8 April 2026 and entered into force on 28 April 2026. It sets specifications for a defined remote route: a user who holds an electronic identification means at assurance level substantial can reach the high level required for wallet enrolment when that means is combined with additional remote onboarding procedures. Remote procedures of this kind generally combine checks on identity evidence with a comparison of the user's live face against a reference image, under controls meant to show that both the person and the capture are genuine.

This route is where synthetic media risk concentrates. Every additional procedure that uses a camera can be attacked: a printed photo or mask held in front of the lens, a replayed video, a real-time face swap, or an injected feed from a virtual camera or emulator. The provider has to show that the complete process, not just one component, reaches high assurance. Facial comparison and liveness alone cannot carry that weight.

Why is EUDI Wallet enrolment a high-value target for deepfake fraud?

Because the output is reusable. A fraudster who passes a single bank's onboarding gets one account. A fraudster who obtains a wallet with someone else's PID gets a high-assurance credential that many relying parties are expected to accept, including regulated entities using it for customer due diligence and strong authentication. The regulation is designed to make wallet acceptance widespread, so one successful enrolment attack can fan out into many accounts.

That shifts responsibility upstream. PID providers and wallet providers need proofing that withstands current attacks, and relying parties still need to watch for misuse after issuance. A bank accepting a wallet presentation should know which enrolment route produced the PID, and keep its own controls for step-up events such as account recovery and high-value payments.

How should PID and wallet providers test their remote proofing?

Test the full chain against the attacks that matter now, and keep the evidence. A workable programme covers these steps.

• Run presentation attack testing to ISO/IEC 30107-3 with photos, screens and masks on the devices users actually own.
• Test injection paths: virtual cameras, emulators, rooted devices and hooked SDKs, using CEN/TS 18099 as a reference for injection attack detection.
• Include real-time face swaps and fully synthetic faces matched to forged or borrowed documents.
• Measure false acceptance and false rejection by subgroup, so accessibility and fairness duties are met.
• Document remedies for users who fail automated proofing, and minimise retained biometric data under the GDPR.
• Re-test when generators, SDK versions or capture flows change, and record results for certification and audit.

Where does NeuroVerify fit in EUDI Wallet onboarding and acceptance?

NeuroVerify is Neural Defend's media authenticity check for the face capture inside remote proofing. One API call analyses a face image, video or audio and returns one unified risk score with signal-level evidence from six signals: Visual Safety Screening, Live Presence Verification, Face Manipulation Detection, AI Generative Model Analysis, AI Pixel-Level Manipulation and AI Content Compliance. Eligible image requests return in under 200 ms at p95 under defined test conditions, so it can run inline during enrolment without adding noticeable delay. The PID provider's policy decides the outcome.

It complements, and does not replace, the other layers: NeuroVerify does not analyse identity documents or read chips, so document validation stays with your document stack, and capture integrity controls stay with your SDK and device checks. Mobile SDKs for Android, iOS and Flutter and backend SDKs for Python, TypeScript and Node.js, Go and Java let it slot into existing wallet and onboarding apps. Deployment can be on-premises, air-gapped, in a private cloud or VPC, as a secure container or as a managed API, which helps PID providers keep biometric data under national control.

For evidence of face manipulation detection, on the public VendorBench-100 benchmark of 100 adversarial still images, Neural Defend ranked first of 36 systems with an MCC of 0.876 against 0.646 for the next vendor. One VendorBench author also co-authored Neural Defend's ARCAS 1B paper; the corpus and results are public. It does not measure video, audio, injection or latency, so certification testing must cover those. Neural Defend holds ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 42001 and SOC 2 Type II certifications.