Finland's national act for European digital identity wallets entered into force on October 1, 2026, according to Identity Week. Wallets, including Finland's own digital identification solution, are expected to reach the public in 2027, so relying parties now have a defined legal framework and roughly a year to prepare.
What happened
Identity Week reported on October 7, 2026 that the new act aligns Finnish law with the EU's amended eIDAS Regulation. The market is open to both public providers and certified private providers. Alongside the October legislation, an updated ecosystem description with service packages and technical parameters is to be published.
The wallet, as described in the report:
- Is a smartphone app, and use is voluntary for citizens. Basic wallet applications are free.
- Supports selective disclosure, so a person can share only the attributes a service needs.
- Holds multiple certificates and is meant to be accepted across the EU.
- Uses a digital identification credential issued after verifying a valid passport or ID card. Identity providers must check that document's validity against primary registers.
Finland is also consolidating its national rules for strong electronic identification into a single act that supplements eIDAS. Anna-Kaisa Ikonen, Minister of Local and Regional Government, framed the change around user control:
"Wallets will also be more secure, as they will give people better control of their personal information."
The timeline has moved. In an October 2025 release, the Digital and Population Data Services Agency (DVV), which builds the national wallet under Ministry of Finance guidance, said the app would launch at the end of 2026. That release also listed an eID produced with the National Police Board, a mobile driving licence from Traficom pending the EU Driving Licence Directive, and certificates from other public and private issuers.
Why it matters
For identity teams, the EUDI wallet changes where identity proofing happens. Instead of each service running its own document checks, the wallet carries a credential already tied to a register-verified passport or ID card. Selective disclosure means a service can ask for a narrow claim, such as age or nationality, rather than collecting a full identity record. That reduces what you store and what you can lose in a breach.
The private-provider model matters too. With certified private wallets allowed, relying parties should expect more than one wallet issuer and plan trust decisions around certification status rather than a single government app. The ecosystem description promised with the legislation is where the technical parameters should appear. Treat it as the input for integration planning.
The 2027 public availability date also gives organisations with Finnish customers a concrete planning window. The report does not give a mandatory acceptance date for private-sector relying parties, so check that against the act itself.
What to check in your environment
- Inventory Finnish identity flows. List services that onboard or authenticate Finnish users today, and how they do it: strong electronic identification, document upload, or knowledge-based checks.
- Map attribute needs. For each flow, write down the minimum attributes you actually need. Selective disclosure only reduces data collection if your forms and APIs stop asking for the full record.
- Watch for the ecosystem description. Assign someone to track the updated ecosystem description and its technical parameters, and review it with your IdP or CIAM vendor when it appears.
- Ask your IdP or CIAM vendor about EUDI support. Get their roadmap for accepting wallet presentations as an authentication or proofing method, and a timeline relative to 2027.
- Define how you will trust private wallets. Decide how you will verify that a private wallet provider is certified before accepting its credentials, and who owns that trust list.
- Get legal review of the act. Have counsel confirm whether, and from when, your organisation is expected to accept wallets, since the source coverage does not specify relying-party obligations.