Issuing Qualified Electronic Attestations of Attributes: Becoming a QEAA Provider in the Wallet Ecosystem

Issuing an attestation into someone’s EUDI Wallet looks like an API call. Done at the qualified level, it is a regulated trust service — and the gap between those two readings is where the cost, and the liability, live.

There is a growing pitch aimed at any organisation that holds a fact worth proving — a professional body, an employer, a licensing authority, a university. The pitch is that the EU Digital Identity Wallet gives you a new distribution channel: issue your membership, your licence, your employment confirmation straight into the citizen’s wallet and let them present it anywhere. That much is true. What the pitch tends to skip is that the version of this with real legal weight — a qualified electronic attestation of attributes, or QEAA — requires you to become a qualified trust service provider under Regulation (EU) 2024/1183. That is not an integration. It is a regulated status with an audit attached.

Member States must make at least one certified wallet available within 24 months of the relevant implementing acts, which puts the practical deadline at the end of 2026. So the ecosystem you would be issuing into is arriving on a fixed clock. The decision about whether to be an issuer, and at what level, is a live one now.

Three ways to put an attribute in a wallet

The regulation gives you three distinct instruments, and choosing the wrong one is the first and most expensive mistake.

• An ordinary electronic attestation of attributes (EAA). Any trust service provider can issue one. It carries the baseline legal effect that it cannot be denied validity merely for being electronic or non-qualified, but it does not carry the EU-wide presumption of accuracy. This is the light path.
• A public-sector attestation (pub-EAA). Where a public body is responsible for an authentic source — a business register, a vehicle register, a professional roll — it can issue attestations against requirements set out in the regulation’s Annex VII. This route is reserved to that public-sector relationship.
• A qualified electronic attestation of attributes (QEAA). Issued only by a qualified trust service provider, meeting the requirements in Annex V, and carrying a qualified status that gives it legal presumption and cross-border recognition across the Union. This is the heavy path, and the one worth reading carefully before you commit to it.

Most organisations reach for the QEAA because it sounds like the serious option. The honest question is whether you need the qualified presumption at all, or whether an ordinary EAA — or letting an existing provider issue on your behalf — gets your relying parties what they need at a fraction of the obligation.

The QTSP status is the whole commitment

To issue a QEAA you must first hold qualified trust service provider status for that service. That is a supervised status, not a certification you buy. You submit a conformity assessment report from an accredited conformity assessment body to your national supervisory body, the supervisory body verifies that you meet the requirements, qualified status is granted, and your service is published on a national trusted list that wallets and relying parties consult to decide whether to trust what you issue. Being discoverable on the correct trust list is the mechanism by which your attestations are believed at all.

The status is ongoing, not a one-off gate. A qualified provider is audited by a conformity assessment body at least every 24 months, and must notify the supervisory body of material changes. That two-yearly cycle, plus the security and incident-reporting duties that come with being a qualified provider, is the real cost centre. The credential-issuance code is the small part. The regulated operating model around it is the large part.

What issuance actually involves, architecturally

Underneath the status, a QEAA issuer has to stand up a specific pipeline, and each stage maps to an obligation rather than a nicety.

Verification against an authentic source. A QEAA asserts that an attribute is true, so you need a defensible source for it. For the categories the regulation lists, Member States are required to enable qualified providers to verify certain attributes by electronic means against authentic sources. Where your attribute is your own — your membership register, your employment records — you are the authentic source, and the quality and currency of that source becomes a regulated dependency, not an internal data-quality nicety.

Binding, sealing and delivery. The attested attribute is expressed in one of the credential formats the wallet architecture supports, sealed so its origin and integrity are provable, and delivered into the wallet through a defined issuance flow the user initiates. The user must be able to request, obtain, store and manage the attestation themselves — issuance is user-mediated by design, not a silent push into a container you control.

Selective disclosure and revocation. A well-formed attestation lets the holder reveal only the attribute a verifier needs — proof of a licence category without the whole record. That is the same discipline I have written about from the verifier’s side in selective disclosure, and as an issuer you design for it or you undermine the wallet’s data-minimisation promise. You also need a status and revocation mechanism, because an attestation you cannot withdraw when the underlying fact changes is a liability you have signed.

The obligation that surprises people: data separation

The provision that tends to catch commercial issuers is the rule that personal data relating to the provision of qualified attestation services must be kept logically separate from other services you offer, and must not be combined with data from those other services. If your reason for issuing attestations is to enrich a marketing profile or cross-sell, the regulation closes that door deliberately. The attestation business has to sit in its own compartment. For an organisation whose instinct is to join its data up, that is an architectural and governance constraint to design for from the start, not a clause to discover in the audit.

Is the qualified path worth it for you

The QEAA path earns its cost in a narrow set of cases: you are the authoritative source of an attribute that others need to trust across borders, that attribute is central enough to your value that carrying the qualified presumption matters, and your relying parties genuinely require legal certainty rather than a plausible claim. A professional regulator attesting to a right to practise fits. A licensing authority fits. An employer confirming employment for one internal use rarely does.

The distinction that saves most organisations money is between being the source of truth and being the trust service provider. You can be the authentic source for an attribute and let an existing qualified provider issue against it, keeping the regulated status — and its audit — off your books. That partnership model is worth pricing before you decide to seek qualified status yourself. It is also the mirror image of the relying-party integration most firms will face first: for every issuer, there are many verifiers, and most organisations will consume attestations long before they ever issue one.

The question is not whether you can put an attribute into a wallet. Almost anyone can. It is whether you want to become a supervised trust service provider to do it — or hand the regulated part to someone who already is.