Estonia's Information System Authority (RIA) closed applications on June 29, 2026 for a €21.65 million tender to build the country's EU Digital Identity Wallet (EUDI Wallet) — the mobile credential every EU member state must offer under eIDAS 2.0 (Regulation (EU) 2024/1183) by the end of 2026. The contract runs 96 months — development plus five years of operation — and uses a competitive dialogue procedure, with RIA planning to invite three to five applicants into a second stage before final award, according to Biometric Update's reporting on the tender notice.
What's Actually Being Procured
The wallet itself is not a new identity system. RIA is explicit that it "does not replace the existing national electronic identification solutions" — ID-card, Mobile-ID, and Smart-ID remain the underlying credentials. What the tender buys is a wallet application layered on top: a single partner responsible for person-identification-data issuance, electronic attestation management, digital signature services, and cross-border access management, all built to plug into X-Road, Estonia's decentralized data-exchange backbone. Authentication in the public sector is expected to route through the existing TARA framework, with qualified electronic signatures handled via SiGa — the same components Estonia has run for two decades, not a rip-and-replace.
That architectural choice deserves the credit it's due. eIDAS 2.0's steelman case is straightforward: without a legally mandated, cross-recognized wallet, a French student can't use a national ID to enroll in a Portuguese university portal, and a Latvian contractor can't sign a German lease electronically. Fragmented national eID schemes have been a real drag on the single market since the original eIDAS regulation in 2014 struggled with adoption. The European Commission's answer — one wallet per citizen, accepted everywhere, opt-in and free — is a legitimate fix for a genuine coordination failure that no single member state could solve unilaterally.
Where Estonia Is Ahead — and Why That's the Point
Where the regulation gets more contestable is in prescribing how every member state gets there on an identical clock, regardless of starting position. Estonia is arguably the best-positioned country in the EU to hit the deadline cheaply, precisely because it already has X-Road, TARA, and near-universal digital ID penetration to build on. Countries starting from paper-based or fragmented regional ID systems face a materially harder and costlier build — yet eIDAS 2.0 sets the same end-of-2026 date for everyone. Research from the Digital Identity and Wallet Observatory at Politecnico di Milano, cited by Corbado's 2026 rollout analysis, found that fewer than one-third of member states currently meet the readiness benchmark against that deadline. Germany, by contrast, has already announced its state-driven wallet won't launch until January 2027 — a month after the legal deadline — before opening to private issuers a year after that.
This is the strongest argument for proportionality in eIDAS 2.0's implementation, not its repeal: a single hard deadline enforced uniformly across 27 states with wildly different digital-infrastructure baselines invites either rushed, insecure launches or quiet non-compliance, neither of which serves users. Estonia's procurement approach — reuse the eID stack, hire one accountable integrator, avoid duplicative build-out — is the model other member states should have followed from the point eIDAS 2.0 entered into force, on 20 May 2024. That most did not is a planning and capacity problem, not evidence that the wallet mandate itself is misconceived.
The Real Bottleneck Isn't the Wallet — It's Adoption
Even Estonia's clean architecture doesn't solve the sequencing problem inherent to the regulation. Public bodies across the EU must accept EUDI Wallets from any member state by the end of 2026, but large private platforms in regulated sectors — banking, healthcare, telecom — don't have to accept them until the end of 2027. That one-year gap means a wallet Estonia ships on schedule may have little practical use outside government portals for its first year, a chicken-and-egg dynamic industry commentary has repeatedly flagged as the actual constraint on adoption, distinct from any individual country's build quality.
For Estonia specifically, the risk is not technical failure — RIA's track record with X-Road and Smart-ID is strong — but a mismatch between engineering readiness and EU-wide relying-party readiness. A wallet that works flawlessly in Tallinn is only as useful as the number of member states and platforms actually configured to accept it. RIA's tender, evaluated on its own terms, looks like disciplined, interoperable-by-design public procurement. Whether it delivers cross-border value on schedule depends far more on Brussels' enforcement of the 2027 private-sector deadline, and on the two-thirds of member states currently behind, than on anything Estonia's chosen vendor builds.