MEP Regina Doherty (PPE) has questioned the European Commission over the absence of mandatory phishing-resistant multi-factor authentication and hardware-backed security in the European Digital Identity (EUDI) Wallet framework, warning that the current requirements may leave users exposed to sophisticated cyber threats. In a written parliamentary question on 24 July 2026, Doherty also pressed the Commission on the uneven pace of implementation across Member States, demanding a clear timetable and enforcement plan.
The question targets the revised eIDAS Regulation, which establishes the legal basis for the EUDI Wallet — a digital identity tool designed to store and present sensitive personal credentials such as national IDs, driving licences, and health data. Doherty argues that strong customer authentication, including multi-factor authorisation, is widely recognised as an effective safeguard against unauthorised access, identity theft, and fraud. She asks why the Commission did not mandate phishing-resistant multi-factor authentication and hardware-backed security as minimum requirements in the regulation or its implementing acts.
Doherty further asks whether the Commission considers the current security requirements sufficient to protect users against sophisticated cyber threats, and whether it is considering introducing mandatory multi-factor authentication in future implementing acts or legislative revisions. On implementation, she requests a list of Member States on track to meet applicable deadlines, those lagging behind in legislative or technical preparations, and details on how the Commission will ensure timely and consistent rollout across the EU.
The question signals a push for stronger cybersecurity standards in the EUDI Wallet, potentially increasing compliance costs for Member States and wallet providers but enhancing user protection. The Commission is expected to reply within approximately six weeks, and its answer will indicate whether it plans to tighten security requirements or accelerate implementation oversight. Stakeholders most affected include EU citizens (as users), national authorities (responsible for implementation), and technology providers developing wallet solutions.