Topic starter
24/10/2026 8:49 pm
TL;DR: EUDI trust lists are signed, machine-readable registries that tell wallets, issuers, certificate authorities, and relying parties who is allowed to participate and what each entity is designated to do, according to Procivis. The real governance shift is that trust becomes enumerated, versioned, and cryptographically verifiable rather than implied by bilateral arrangements.
Editorial analysis by NHI Mgmt Group, based on content published by Procivis: “EUDI trust lists: what they are and how they work”.
Key questions
Q: How should organisations govern trust lists in a federated identity ecosystem?
A: They should treat trust lists as governed control points, not static directories.
Q: Why do signed trust lists matter more than simple registration records?
A: Signed trust lists matter because they let consumers verify both identity and authority without relying on manual checks or bilateral agreements.
Q: What breaks when trust list refreshes are delayed or missed?
A: The local trust state can become stale, meaning consumers may continue to accept entities that have been suspended or withdrawn.
Practitioner guidance
- Map every trusted role to its service type Document which entities are authorised as wallet providers, PID issuers, certificate authorities, and relying parties, then verify that each appears in the correct list layer with the correct designation.
- Operationalise trust list refresh checks Set explicit monitoring for next-update pointers and signature validation so local trust state is refreshed before relying parties or issuers drift out of the approved set.
- Separate enumeration from authorisation Ensure teams do not treat presence in any trust list as blanket approval.
Bottom line: EUDI trust lists turn ecosystem participation into a signed, role-specific governance decision rather than a loose recognition process.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →