Question 1

What is the EU Digital Identity Wallet (EUDIW) and when will it be available?

Accepted Answer

The EUDIW is a free application that every EU member state must make available to citizens by 26 November 2026. It allows users to store and share verified identity attributes (national ID, driving licence, credentials) securely. Businesses in regulated sectors must accept it as a valid identification method by end-2027.

Question 2

Is biometric verification mandatory for remote identity checks in 2026?

Accepted Answer

Not universally mandatory, but de facto necessary to achieve the eIDAS 2.0 LoA "high" assurance level required for high-risk business relationships under AMLD6 and FCA guidelines. For medium-risk cases, high-quality automated document verification with forgery detection may be sufficient.

Question 3

What are the main threats to digital identity in 2026?

Accepted Answer

The three priority threats are: (1) generation-4 deepfakes that bypass first-generation biometric solutions; (2) synthetic identities built from real data combined with fabricated information; (3) image injection attacks that bypass real-time video capture requirements.

Question 4

Does eIDAS 2.0 apply to UK businesses after Brexit?

Accepted Answer

Not directly — eIDAS 2.0 is EU law. However, UK businesses with EU operations must comply. The UK's own Digital Identity and Attributes Trust Framework (DIATF) creates a parallel domestic framework with similar assurance levels, now on a statutory footing under the Data (Use and Access) Act 2025.

Question 5

How do I evaluate a digital identity verification solution's reliability?

Accepted Answer

Three objective criteria: conformity certification at eIDAS LoA "high" or equivalent (PVID, NIST IAL2) from an accredited body; ISO/IEC 30107-3 PAD test results from an accredited laboratory (iBeta, TÜV, BSI); published and auditable false positive and false negative rates verified by an independent third party.

Question 6

Is biometric verification required for KYC compliance?

Accepted Answer

Biometric verification is not universally mandatory for KYC. AMLD6 requires identity verification from reliable, independent sources but leaves the choice of methods to obliged entities. Biometrics become mandatory in specific national frameworks — for example, where a regulator requires Level of Assurance High verification for remote onboarding — or where internal risk policies demand it for high-risk customer segments.

Question 7

What is the difference between biometric verification and identification under the EU AI Act?

Accepted Answer

Biometric verification (1:1) compares a live sample against a template linked to a known, pre-enrolled individual. Biometric identification (1:N) searches an entire database to find a possible match for an unknown individual. As of 2 August 2026, only biometric identification is presumed high-risk under Annex III of Regulation (EU) 2024/1689. Real-time remote biometric identification by law enforcement in publicly accessible spaces is prohibited under Article 5, except in cases of imminent threat involving specific serious crimes.

Question 8

Does biometric processing always require explicit consent under the GDPR?

Accepted Answer

Explicit consent under Article 9(2)(a) is a valid legal basis but not the only one. For workplace biometrics, supervisory authorities including the CNIL have noted that consent may not be freely given due to the power imbalance between employer and employee, making other legal grounds necessary. For consumer-facing digital services, explicit consent remains the most common basis. Regardless of the legal basis, a DPIA is always required before deployment.

Question 9

What is liveness detection and why is it necessary?

Accepted Answer

Liveness detection verifies that the biometric sample comes from a physically present person, rather than a photograph, mask or deepfake. Without this layer, a facial verification system can be defeated by a printed photo. ISO/IEC 30107-3 Levels 1 and 2 are the market reference standards for presentation attack detection. Certified liveness detection is a prerequisite for verification systems seeking to meet Level of Assurance High under eIDAS 2.0.

Question 10

How should biometric templates be handled under the GDPR?

Accepted Answer

Biometric templates must be encrypted at rest and in transit, stored separately from identity data, and deleted as soon as the processing purpose is fulfilled. Retention periods must be defined before deployment and recorded in the Article 30 register. If a data breach involves biometric templates, notification to the supervisory authority within 72 hours is mandatory under Article 33 of the GDPR. Because a compromised biometric template cannot be changed, the security controls applied to template storage require a higher standard of care than those applied to standard personal data.

Data

Digital Identity Trends 2026: The Future of Online Verification and e-ID

Biometric Verification: Fingerprint, Facial and Voice

RegTech 2026: Regulatory Technology Guide

Compliance Automation ROI: Benchmarks by Industry

Document Fraud in France 2026: Data & Trends

Document verification ROI calculator: TCO analysis and payback period

Document Fraud and Validation Costs: The Data

AI vs Manual Document Verification: ROI Comparison

Document Fraud Statistics and Trends 2026: Key Data

Compliance Fines and Penalties: UK Penalties by Sector

Cost of Compliance: True Cost of Manual Checks

Manual Document Validation: True Cost (TCO)

Document Fraud 2026: Statistics and Detection