eIDAS 2 for Transport & Mobility

The EU has decided that the driving licence belongs in a digital wallet. A directive ((EU) 2025/2205) adopted in October 2025 makes the digital driving licence the main format across the EU and requires it to be issued into EUDI Wallets under eIDAS 2. For anyone who rents, shares or hires out vehicles, that changes licence verification completely. This guide covers the digital driving licence, the wallet acceptance deadlines, what operators transport and mobility sector can verify and issue beyond the driving license under eIDAS 2, and how to build a compliant solution.

This change has not only legal, but also commercial implications. Checking a driving licence is something mobility operators do millions of times a year and it can be really expensive — photos of documents, automated document checks, manual review queues, and fraud that gets through anyway. A licence presented from a wallet is verified against the issuing authority in seconds, works across borders, and reveals only what is needed.

What eIDAS 2 changes for transport and mobility

1. Wallet acceptance becomes mandatory. Transport is named in eIDAS 2 as a sector that must accept the EUDI Wallet. Transport operators which are classified as public sector bodies face the deadline first, private operators a year later.
2. The driving licence moves into the wallet. Under the new Driving Licence Directive, the digital licence becomes the main format across the EU and is issued into wallets, using the international mDL standard.
3. Licence checks stop being document checks. Instead of examining a photo of a card, an operator verifies a cryptographically signed credential against the authority that issued it.
4. Entitlements become issuable. Student passes, senior and disability concessions, corporate mobility budgets and season tickets can be issued as credentials rather than cards.

The timeline:

Micro and small enterprises — fewer than 50 employees and at most €10 million in annual turnover — are exempt from the acceptance obligation. This matters for small operators, not for major rental, sharing or transport groups.

Three deadlines

End of 2026 applies to transport operators that are public sector bodies. Public services were not given a transition period under eIDAS 2 — their obligation applies as soon as wallets are available.

End of 2027 applies to private companies in named sectors, transport among them, that are required to use strong user authentication.

End of 2029 is when the driving licence rules apply. That is the legal date — several Member States are expected to issue digital licences well before then.

The roles transport operators play

Under eIDAS 2 an organisation can accept credentials, issue them, or provide a wallet. For transport, the first is where nearly all the value sits — because the credential that matters most is issued by someone else.

Verifier: where transport lives

As a verifier, an operator requests and checks credentials from customer wallets — identity for onboarding, a driving licence for rental, an entitlement for a discounted fare.

This means registering as a relying party with the national registrar, declaring which data each service will request, and being able to check that credentials received are genuine, still valid, and belong to the person presenting them.

Who actually issues driving licences

Not operators. National driver licensing authorities issue mDLs, under the Driving Licence Directive rather than under eIDAS 2. Member States notify the Commission of their authorised licence issuers, and the Commission publishes that list — which is what lets an operator in one country verify a licence from another without any bilateral arrangement.

If you are a licensing authority rather than an operator, the public sector guide covers the issuing side.

Issuer: entitlements are the operator's own opportunity

As an issuer, an operator can put its own credentials into customer wallets. Travel entitlements are the obvious candidate: student passes, senior and disability concessions, employer mobility budgets, season tickets. These are simple credentials with a natural expiry date, and the operator both issues and verifies them — so the value does not depend on anyone else adopting anything.

Core transport and mobility use cases at a glance

Verifying driving licences from the wallet

What happens today. A customer photographs their licence and an ID document. The operator runs automated document authentication, often with a selfie and a liveness check. A share of cases lands in a manual review queue. Some fraudulent or revoked licences get through anyway, because what is being checked is a picture of a card, not the card's actual status. A licence from another Member State may be difficult to read and impossible to validate. Every step costs money and loses customers.

What happens with an mDL. The customer presents their licence from their wallet. The operator checks the signature against the published list of authorised licence issuers, confirms the licence is valid and has not been revoked, and reads the categories it needs. No photographs, no document authentication vendor, no manual review — and it works the same way for a licence issued anywhere in the EU.

Selective disclosure changes what is being ask for. Most checks do not need the whole licence. Renting a car needs the licence categories, confirmation of validity, and often an age threshold. The wallet can confirm that someone is over 25 without disclosing their date of birth, and confirm they hold category B without disclosing their address or licence number. Less data collected means less data to protect and less exposure if something goes wrong.

Two ways customers will present it. In person — at a rental counter or an unattended kiosk — the licence is presented directly from the phone, using the proximity flows defined in the mDL standard. Remotely, in an app or during online booking, it is presented over the standard presentation protocol, OID4VP. Both are specified; both need supporting.

One thing to plan for. Drivers keep the right to request a physical licence, so the plastic card does not disappear. mDL verification is an additional channel, and a very good one, but existing checks stay in place for customers who do not have a wallet.

Accepting the wallet for accounts and ticketing

This is the obligation with the deadline. Enabling users to sign-up/login with their wallet. It involves four things:

• Register as a relying party with the national registrar, and declare which data each service will request. Wallets check requests against this registration.
• Support the standard protocols and formats. Credentials are presented over OID4VP, in the formats the regulation mandates: ISO/IEC 18013-5 for driving licences and SD-JWT VC for other attestations.
• Validate what comes back. Check the signature, check the credential is still valid, and check it belongs to the person presenting it.
• Keep the alternatives. Customers who do not use a wallet must still be able to sign up and travel.

For account-based ticketing this is more useful than it first appears. A verified identity at sign-up reduces account fraud, chargebacks and the sharing of personal travel products — problems most operators currently manage with friction rather than solve.

Note: This requirement applies only to service providers where strong user authentication is legally required. Strong user authentication means verifying a user’s identity using at least two independent factors, such as a password and a phone or biometric authentication.

Travel entitlements and concessions

A large share of European public transport journeys are made on a discounted fare, and almost all of them are proven with something physical: a student card, a pensioner card, a disability pass, an employer letter. These are easy to forge, tedious to check, and expensive to reissue.

Issued as credentials, they are checked in the same motion as the ticket, verified cryptographically, and revoked instantly when the entitlement ends. For an operator this is the easiest place to start, for three reasons: the credential is simple, it has a natural expiry, and the operator is both the issuer and the verifier — so nothing depends on anyone else adopting anything first.

Professional driver credentials

Commercial transport runs on qualifications the driver has to carry and the employer has to check: professional competence certificates, dangerous goods qualifications, category entitlements for heavy vehicles.

The same infrastructure that handles a driving licence handles these, and the operational case is stronger, because these checks happen repeatedly — at hiring, at depots, at borders, in roadside checks — and expiry dates matter. Fleet and logistics operators, training providers and chambers all have a role here.

Digital travel credentials

For operators involved in cross-border travel, a second EU initiative is worth watching. The Commission has proposed an EU Digital Travel application and a framework for digital travel credentials — a digital version of the data in a passport or ID card chip, stored in the traveller's EUDI Wallet and used for pre-travel submission and border checks.

Both the Council and the Parliament agreed their positions in late 2025, and the file is still in negotiation. Use would be voluntary for travellers, but Member States would have to accept digital travel credentials once the legislation is adopted and the common technical solution is available. Timing is contested — Parliament has pushed for a much earlier start than originally proposed.

Nothing here is settled, so no operator should plan against a date. But the direction is clear, and the infrastructure that accepts an mDL is the same infrastructure that will accept a travel credential.

Build vs buy: how to build a compliant solution

Whether acting as verifier, issuer, or both, a transport operator faces the same decision as every other organisation in the eIDAS 2 ecosystem: how much of the solution to build, and how much to buy. The customer-facing applications — the booking flow, the app, the ticketing experience, the rental counter — are where an operator differentiates and will always be built in-house or with existing partners. The identity layer underneath — credential formats, exchange protocols, trust checks, key management, revocation — is standardised by definition and changes every time the EU specifications evolve. For that layer, there are three possible implementation paths:

• Build apps, buy infrastructure (recommended) — build only the customer-facing applications and use a proven, standards-compliant provider for the identity layer. Fastest time to market, lowest regulatory and technical risk.
• Build apps, own infrastructure — use open-source identity infrastructure to retain full control of the stack, while still avoiding implementing the credential formats, protocols, and trust validation from scratch.
• Build everything in-house — implement and maintain the full stack internally, and keep it current as the specifications evolve. Viable only for institutions with a dedicated identity engineering team.

The walt.id solution

walt.id covers both of the first two paths. The walt.id Community Stack provides open-source issuer, verifier, and wallet infrastructure for organisations that want to own their stack; the walt.id Enterprise Stack is the managed offering on top of it — built on open-source technology used by more than +55.000 developers, governments, and businesses. For transport and mobility specifically:

• Verifier — accept mobile driving licences, identity credentials and entitlements from the EUDI Wallet, in person and remotely, with full ISO/IEC 18013-5 support and trust, revocation and wallet-authenticity checks handled automatically. Results can be passed to existing booking, risk and fraud systems during verification.
• Issuer — issue travel entitlements, concessions, season tickets and professional driver credentials in all mandated formats (ISO/IEC 18013-5, SD-JWT VC, W3C VC), with revocation built into the issuance workflow so entitlements can be withdrawn the moment they end.
• Wallet — where an operator or authority does want to embed wallet capabilities into an existing app, with flexible key management from on-device to HSM-backed.

A role-by-role compliance breakdown is available in the eIDAS 2 Implementers Guide or reach out to our team to learn more.

Frequently asked questions

When do transport and mobility companies have to accept the EUDI Wallet?

Two different dates apply. Transport operators which are public sector bodies have to accept the wallet as soon as wallets are available — the end of 2026. Private transport and mobility companies required to use strong user authentication have until the end of 2027.

What is the EU digital driving licence?

A digital version of the driving licence, established by Directive (EU) 2025/2205, adopted in October 2025. It becomes the main licence format across the EU, is issued into EUDI Wallets, and uses the international mDL standard, ISO/IEC 18013-5. Member States have until the end of 2028 to transpose the rules and the directive applies from the end of 2029, though several countries are expected to issue digital licences earlier.

Does the digital driving licence replace the plastic card in the EU?

No. Drivers keep the right to request a physical licence. Operators will need to handle both for the foreseeable future, which means mDL verification is an additional channel rather than a replacement for existing checks.

Do transport operators issue digital driving licences into wallets?

No. Driving licences are issued by national driver licensing authorities. Member States notify the Commission of their authorised issuers and the Commission publishes that list, which is how an operator in one country can verify a licence issued in another.

How can a digital driving licence be verified which was issued in another Member State?

By checking the credential against the Commission-published list of authorised licence issuers. No bilateral arrangements or country-by-country integrations are needed, which is the main practical difference from verifying physical licences today.

Can the digital driving licence category be checked without seeing the whole licence?

Yes. Selective disclosure lets a wallet confirm that someone holds a specific licence category, or is above an age threshold, without revealing their date of birth, address or licence number. This also reduces the amount of personal data an operator collects and has to protect.

Can travel passes and concessions be issued into EUDI wallets?

Yes, and it is often the easiest place to start. Student, senior, disability and employer entitlements are simple credentials with a natural expiry, and the operator both issues and verifies them, so the value does not depend on anyone else.

What are digital travel credentials?

A proposed EU framework for a digital version of passport and ID card data, stored in the traveller's EUDI Wallet and used for pre-travel submission and border checks. The Council and Parliament agreed their positions in late 2025 and negotiations are ongoing, so the timing is not yet fixed.