It happened a few weeks ago. I was at a bar with a group of friends, talking about my old piece on the badge and Apple Wallet, when someone unexpectedly asked a very specific question: "Isn't there a European digital wallet in the works? So the badge on your phone becomes useless, right?"

A fair question, and you'll hear it more and more. But it's worth being precise first, because it's easy to mix things up: that "European wallet" is called EUDI -- European Digital Identity -- and it's a completely different thing from Apple Wallet or Google Wallet, the ones that already hold your badges, tickets, and boarding passes today. EUDI is a specific standard and app, defined by the European Union, not a generic container you can drop any credential into -- and Member States are required to provide it, it's not optional. "So it's all in there now" is still the most natural conclusion in the world.

The short answer is no. The long one is worth telling, because it also explains why this standard was built exactly this way, and not some other way.

EUDI was built for the single market

Let's start with something that always gets lost in the headlines: EUDI wasn't born as a cybersecurity project. It was born as a single-market project.

Before this regulation, the old eIDAS framework (2014) required Member States to recognize each other's national digital identity schemes -- but only for public services, and only on a voluntary basis. The private sector was left out entirely: every bank, every platform, every company that needed to verify who it was dealing with had to figure it out on its own. Scanned documents, copies of ID cards ending up who knows where, a different process in every country.

In June 2021 the European Commission proposes the reform. The path is long -- political agreement between June and November 2023 -- and Regulation (EU) 2024/1183 enters into force on 20 May 2024. But the underlying principle, the one worth remembering once everything else has been forgotten, is a single one: self-sovereign identity. The user controls what they share, with whom, and when. Not the entire document handed over to whoever asks for it -- one attribute at a time, only the one requested.

Three design choices, not just three specs

Here's the part I find genuinely interesting, more than the technical specs themselves: three design choices that reveal the intention behind the standard, before you even get to how it works in detail.

The first: not one format, but two. One meant to be shown physically to a reader, up close, offline (it's called mdoc). One meant for online flows, where everything already runs on HTTP and JSON (SD-JWT). It isn't an afterthought -- the project had to cover both the physical and the digital world from day one, and you can see it in the fact that there are two parallel paths instead of one forced to do everything.

The second: the document holder has to explicitly approve every single presentation, on the phone screen. That isn't an interface detail -- it's written into the regulation itself, and it can't be bypassed. It's a choice that slows the interaction down on purpose. Speed wasn't the primary goal.

The third, and the most counterintuitive: unlinkability is a legal requirement, not just good practice. Whoever issues you a document can't know where or when you use it, or link it to anything else you do -- it's flat-out prohibited. If your instinct, on hearing "European digital identity," is to think more control, more tracking, this part of the standard goes in the opposite direction.

Put together, these three choices sketch out a tool meant to be used with care, not logged a hundred times a day. And that's exactly what makes the earlier question interesting.

Knowing who you are isn't enough to know what you can do

Back to the question from the bar, then. EUDI answers one question only: who you are. It doesn't answer a different, separate question that anyone opening a door, authorizing a payment, or granting access to a service still has to ask: what can you do, right now, here.

They're two systems. Two different owners -- a state that certifies your identity, an organization that sets its own access rules. Two different lifecycles -- your identity doesn't change if you switch jobs, your permissions do, the same day.

And this isn't my opinion, dropped in here to make the article sound more authoritative: it's written into the way the regulation itself separates the two things. EUDI, by definition, deals with identification and authentication. Authorization -- who can do what, where, when -- remains a separate system, one the regulation doesn't touch, because that was never the problem it was trying to solve.

So no, the badge doesn't become useless. If anything, it becomes something smaller and more precise than it is today: a system that decides what you can open, not who you are -- and from now on, someone else might already have answered that second question for you.

It's already happening at a store counter

This isn't theoretical, by the way. Several US states have already started accepting digital driver's licenses for age verification on restricted purchases -- alcohol, tobacco. Illinois launched a free app for merchants that scans the customer's digital ID and returns only a yes-or-no on age, nothing else. Georgia did the same in late 2025. Same underlying technical principle, same base standard (mdoc, ISO 18013-5) that EUDI in Europe is also built on.

The reason it works well in this context is the same as before: it's a check that happens occasionally, not a hundred times a day. Nobody expects to show ID every five minutes at the counter, so the few seconds it takes and the active approval on screen aren't a problem -- if anything, that's probably what you want in a check like this.

It's the scenario this standard was designed for from the start, and it shows.

The deadline is narrower than it sounds

There's a deadline going around everywhere, and it's broader than the real one.

"From 2027, all companies will have to accept the European wallet" is the line you'll read most often, and it's imprecise. The regulation only mandates acceptance for strong authentication on online services, and only in specific sectors -- transport, energy, banking and financial services, healthcare, a handful of others named explicitly. It explicitly excludes micro and small businesses. And even where it applies, it's always at the user's voluntary request: nobody is required to use EUDI to identify themselves, the obligation is only to accept it if someone presents it.

The physical control of a door, a gate, a turnstile -- that stays a separate system. Offline, by definition. The regulation doesn't touch it, because that was never the problem it set out to solve in the first place.

This is the part that usually gets left out of the headlines, and it's also why it's worth writing out in full instead of stopping at the date.

The answer I'd give him today

Back to the bar, then, with the full answer.

No, the badge doesn't become useless. What changes is its job: it no longer needs to prove who you are, only to decide what you can open. From now on, the first question might already be answered by someone else -- a phone, with more guarantees than we've ever had before, and with explicit consent at every step that the old paper document never asked anyone for.

It remains to be seen how, when, and how slowly all of this will actually make it into everyone's pocket. I'm not sure a bar is the right place for this conversation. The distinction, though -- that's worth holding on to.