Estonia's Information System Authority (RIA) closed applications on June 29, 2026 for a €21.65 million procurement to build and operate the country's national European Digital Identity Wallet — the app that, under the EU's revised eIDAS Regulation, must let Estonian public bodies accept digital wallets from citizens of any EU member state by the end of this year. The tender, run as a competitive dialogue with three to five shortlisted bidders invited into a second stage, covers an eight-year (96-month) contract with multiple extension options, spanning software development, identity-data issuance, electronic attestation of attributes, digital signature services, and ongoing operation (RIA, Biometric Update).
A mandate landing on the country least likely to fumble it
If any EU state was positioned to absorb the EUDI Wallet requirement without disruption, it is Estonia. The country has run a mandatory chip ID-card since 2002, and RIA's own figures put roughly 1.2 million valid ID-cards and 219,000 Mobile-ID users in circulation as of July 2026 (RIA eID statistics) — against a population of about 1.37 million. RIA is explicit that the new wallet will not replace this stack: ID-card, Mobile-ID and Smart-ID continue to work, and the procurement requires the winning wallet to be "compatible with Estonia's existing eID ecosystem" rather than a rip-and-replace (RIA EUDI Wallet page). For e-Residency specifically — the program that has drawn over 142,000 digital residents from more than 180 countries and generated over 43,000 companies as of July 2026 (e-Residency dashboard) — the wallet is additive: a second, EU-interoperable identity layer sitting alongside the e-Resident digital ID card that program already issues.
What the deadline actually requires — and what it doesn't
It's worth being precise about the date that's driving this tender, because coverage of eIDAS2 often blurs two separate deadlines. Member states must make at least one certified EUDI Wallet available to citizens by the end of 2026 — a duty tied to implementing acts that entered force on December 24, 2024, starting a 24-month clock. Separately, public-sector acceptance of wallets issued anywhere in the EU is also targeted for end-2026 under RIA's own account, while mandatory private-sector acceptance (banking, telecoms, healthcare, energy, transport, large platforms) follows in 2027 (RIA EUDI Wallet page). Estonia is not building a wallet from a standing start — it ran a market consultation in mid-2025 to shape the tender documents before this procurement launched (RIA market consultation notice) — but it is still procuring an eight-year operating contract for a system it needs live within months of contract award. That is a tight runway for a competitive-dialogue process designed to let bidders and the buyer jointly refine technical requirements before final bids are locked in.
The steelman: this speed is a real risk, not a talking point
Critics of the eIDAS2 rollout have a stronger case than "regulation bad," and it deserves stating plainly before dismissing it. European Digital Rights (EDRi) has argued that the European Commission's implementation timeline is forcing member states to build systems around implementing acts that the Commission itself has signaled may need to be reopened within a year — meaning technical foundations laid now could require costly rework later, and that several implementing acts governing safeguards against "over-identification and over-sharing" of personal data were adopted without full public consultation, all while bypassing European Parliament approval entirely (EDRi). This is not a fringe objection: a wallet meant to mediate access to banking, healthcare, and government services for hundreds of millions of people is, by design, a piece of infrastructure where a rushed privacy architecture is expensive to fix after the fact. Unlinkability — the technical guarantee that a wallet holder's interactions with different services can't be correlated back to them — is precisely the kind of property that is far easier to build in from day one than to retrofit onto a contract already running for eight years.
Why Estonia is still the right test case to root for
The answer to that risk isn't to slow every member state to the pace of the least-prepared one — it's to let states with genuine institutional capacity move first and absorb the technical lessons. Estonia's track record supports betting on it here: two decades of production experience running compulsory digital identity at national scale, a regulator (RIA) that ran its own pre-procurement market consultation rather than skipping straight to a rushed RFP, and a procurement structure — competitive dialogue with a shortlist stage — specifically designed to surface technical problems before a contract is signed rather than after. A wallet that genuinely interoperates across all 27 member states, without replacing the ID-card and Mobile-ID infrastructure Estonians already trust, is a meaningfully pro-innovation outcome: it lowers cross-border friction for e-Residency-founded businesses and EU citizens alike, without forcing anyone off systems that already work. The real test isn't whether Brussels' calendar is realistic in the abstract — it's whether RIA's contract, once awarded, ships something that respects the privacy architecture eIDAS2 actually promises. That's the detail worth watching once bidders are shortlisted, not the topline euro figure.