eIDAS2 and business wallets reshape corporate identity governance

At a glance

What this is: This is an analysis of how eIDAS2 business wallets and qualified electronic attribute attestations reframe corporate identity governance around reusable, verifiable attributes instead of fragmented credentials.

Why it matters: IAM, IGA, and compliance teams need to understand this shift because it changes how organisations prove roles, authorisations, and access rights while reducing reliance on duplicated identity systems.

Context

Corporate identity governance has become harder to manage because credentials, certificates, cloud access, and third-party access often sit in separate silos. That fragmentation increases audit friction and makes it harder to prove access rights consistently across regulated environments.

eIDAS2 introduces business wallets and qualified electronic attribute attestations as a way to carry trusted evidence about roles, permissions, and authorisations. In practice, this matters most where access decisions must be defensible under NIS2, ENS, and GDPR requirements.

Key questions

Q: How should IAM teams govern business wallets for corporate identity?

A: IAM teams should treat business wallets as an evidence layer, not as a replacement for governance. The key is to define which attributes are trusted, who can issue them, how long they remain valid, and which access decisions may rely on them. That keeps wallet use aligned with auditability, minimisation, and lifecycle control.

Q: Why do fragmented identity silos create compliance risk under eIDAS2?

A: Fragmented silos make it hard to prove a consistent relationship between identity, authorisation, and access history. Under eIDAS2, the organisation must be able to justify access with trusted evidence, not just a local account record. When those records differ across systems, audit trails become expensive to reconstruct and easier to challenge.

Q: What should organisations do first before adopting attribute attestations?

A: They should inventory which decisions actually depend on roles, powers, or permissions, then identify the systems that issue or consume that evidence. That first step prevents wallet projects from becoming another front end on top of the same fragmented identity model.

Q: What is the difference between selective disclosure and standard IAM access control?

A: Selective disclosure limits what identity evidence is shared in a transaction, while standard IAM access control decides whether access should be granted. In practice, selective disclosure reduces the data exposed to the relying party, and access control still governs whether the asserted attribute is sufficient for the action requested.

Technical breakdown

How eIDAS2 changes attribute-based identity evidence

eIDAS2 shifts part of identity assurance from static account records to verifiable attribute evidence. A qualified electronic attribute attestation can prove a role, authorisation level, or signing power without exposing unrelated personal data. That matters because the access decision becomes evidence-driven rather than directory-driven. The result is closer to attribute-based access control in practice, but with legal trust and portability attached to the attribute itself rather than to a local IAM record. For corporate identity programmes, the technical question is no longer only whether a user authenticated, but whether the organisation can trust the evidence behind the authorisation claim.

Practical implication: Treat verified attributes as governance inputs and map which access decisions can move away from duplicated local records.

Business wallets and selective disclosure in corporate access

A business wallet is the corporate analogue of a digital wallet that stores trusted identity evidence and shares only what a relying party needs. Selective disclosure is the control point: the holder can present a minimal assertion, such as a role or entitlement, instead of a full identity profile. That reduces unnecessary data spread and supports privacy by design. It also changes integration design because the organisation has to decide which access workflows can consume wallet-based evidence and which still depend on traditional directory checks, certificate validation, or manual approval.

Practical implication: Define which onboarding, access, and signing workflows can consume wallet-based evidence without falling back to duplicated verification steps.

Why identity silos become an audit problem under NIS2, ENS, and GDPR

Fragmented identity models make it difficult to prove consistency across authentication, authorisation, and evidence retention. When credentials live in many systems, audit teams must reconstruct who had what access, when, and on what basis. eIDAS2 and qualified attestations do not remove governance, but they create a more coherent evidence layer for access justification, particularly where regulators expect traceability and data minimisation. The governance challenge is to align identity lifecycle, evidence retention, and access recertification around one defensible model rather than several disconnected ones.

Practical implication: Map identity evidence retention and recertification controls to the systems that will generate wallet-based proofs.

NHI Mgmt Group analysis

Identity governance is moving from credential control to evidence control. eIDAS2 business wallets do not simply add another login method. They reframe the governance unit from the account to the attribute, which is a more defensible model when access depends on role, authority, or signing power. The practical implication is that IAM teams must think in terms of trusted evidence flows, not just authentication flows.

Fragmented identity creates a governance burden that regulators now expose. When directories, certificates, cloud entitlements, and third-party access records diverge, the organisation cannot easily prove a single access narrative. That fragmentation is exactly what NIS2, ENS, and GDPR pressure, because auditability and minimisation fail when identity evidence is duplicated across silos. Practitioners should treat identity consolidation as an assurance problem, not a convenience project.

Business wallet models strengthen selective disclosure, but only if the reliance rules are explicit. The value is not in storing more identity data in a new container. The value is in proving fewer facts, more precisely, to the right relying party. That means governance teams need clear trust boundaries, evidence validity rules, and lifecycle ownership for each attribute source.

Selective disclosure will force IAM, IGA, and compliance teams to share one operating model. A wallet-based identity flow touches issuance, access decisioning, recertification, and audit evidence at once. If those controls are managed separately, the promised simplification becomes a new source of inconsistency. The practical conclusion is that identity governance must be redesigned as a connected evidence lifecycle.

eIDAS2 creates a practical path toward reusable corporate identity, but reuse only works when provenance is stable. Reusable attributes reduce repeated checks, yet they also raise the stakes on issuer trust, attribute freshness, and revocation handling. The governance question is not whether reuse is efficient, but whether the organisation can sustain it without weakening assurance at the point of access.

What this signals

Attribute-based governance will matter more than credential volume. Business wallets only become useful when organisations know which attributes they trust, where those attributes originate, and how they are revoked. That turns identity architecture into an evidence lifecycle problem rather than a password or certificate problem.

Privacy by design becomes operational, not abstract. Selective disclosure is only meaningful when access workflows are built to accept minimal proofs instead of full identity profiles. For practitioners, the real work is aligning provisioning, approval, and audit processes to the least amount of evidence required.

For practitioners

• Map attribute-based access decisions Identify which access and approval decisions can move from local credential checks to trusted attribute evidence, especially for roles, signing authority, and regulated access.
• Separate identity evidence from identity records Document where role, authorisation, and permission evidence lives today, then define which systems remain the source of record for each attribute.
• Align recertification with evidence validity Set recertification triggers around attribute freshness, issuer trust, and revocation status instead of treating wallet-based evidence as permanently valid.
• Redesign onboarding for selective disclosure Limit the data each workflow requests so that employees and third parties disclose only the attributes needed for the specific transaction.

Key takeaways

• eIDAS2 business wallets shift identity governance toward trusted attribute evidence instead of repeated credential validation.
• The main operational challenge is not authentication strength alone, but proving roles, authorisations, and access rights across silos.
• IAM and compliance teams should redesign lifecycle, recertification, and audit processes around attribute provenance and selective disclosure.

Key terms

• Business Wallet: A business wallet is a controlled digital container for identity evidence used in corporate and regulated settings. It stores verifiable attributes, credentials, or attestations so the holder can prove role or authority without exposing unnecessary personal data or relying on repeated manual verification.
• Qualified Electronic Attestation Of Attributes: A QEAA is a digitally issued, high-assurance statement about a person’s attributes, such as identity-related facts needed for onboarding or verification. It matters because it can replace lower-trust document scanning with verifiable evidence from a qualified trust service, provided the bank can audit the provenance and validation path.
• Selective Disclosure: Selective disclosure is the practice of sharing only the identity attributes needed for a specific decision. In credential-based systems, it reduces oversharing, lowers retention burden, and limits exposure when a verifier does not need the full record to make a trustworthy judgment.
• Purpose-based Identity Governance: A governance approach that ties each identity to a clear business purpose, defined access scope, and a review or expiry point. It prevents permissions from drifting beyond the work they were created to support, which is essential when non-human identities can persist after a project ends.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.