Estonia's Information System Authority (RIA) opened an international tender on 18 May 2026 seeking a single contractor to build and operate the country's EU Digital Identity Wallet (EUDI Wallet), with a contract value of €21.65 million running up to 96 months, including five years of live service after launch (RIA; Biometric Update). Applications closed 29 June 2026. The winning vendor must deliver a wallet that issues person identification data, supports electronic attestation of attributes and digital signatures, and — critically — plugs into Estonia's two-decade-old eID infrastructure without breaking it.
The deadline pressure is real and external. Regulation (EU) 2024/1183, which established the European Digital Identity Framework, requires every member state to make at least one compliant EUDI Wallet available to citizens by the end of 2026 (European Commission). Estonia is not choosing to move fast; Brussels set the clock, and RIA is one of the few authorities racing to meet it with a formal, competitive procurement rather than a sole-source patch.
The case for the mandate
The strongest argument for the EU wallet mandate is not abstract. A single, interoperable digital identity that works from Tallinn to Lisbon removes a genuine friction point: today, a citizen's national eID typically stops being useful the moment they cross a border for a bank account, a rental lease, or a university enrollment. Fragmented national schemes have made cross-border online authentication one of the EU single market's quieter failures for over a decade, despite the original 2014 eIDAS regulation's promise of mutual recognition. A binding deadline, backed by a common Architecture Reference Framework, is a defensible way to force 27 governments past a coordination problem that voluntary alignment never solved. Estonia, whose e-Residency programme has already enrolled more than 140,000 people from over 100 countries and enabled more than 41,800 companies (e-Residency dashboard), has more to gain than most from that interoperability actually working.
Where the mandate is running into reality
But the EU-wide rollout is behind schedule, and Estonia's tender is best read against that backdrop. ENISA's own draft certification scheme, cited in Commission-adjacent reporting, states plainly that "in early 2026, no EUDI Wallet has been deployed or certified, and the specification remains work in progress" (Biometric Update). At the EU's own Launchpad 2025 interoperability testing event, only 74% of peer-to-peer tests succeeded and just 44% of Reference Implementation tests passed, with only France, Germany and Austria showing high preparedness among the 11 member states that even fielded a wallet. The same reporting notes this pattern suggests "only a limited number of Member States are likely to meet the November 2026 EUDIW deadline." The Netherlands has signaled it may miss the deadline outright; Bulgaria reportedly has not begun building a state wallet at all.
That is the environment Estonia's €21.65 million tender lands in — not a race where everyone is roughly on pace, but one where a deadline set centrally in Brussels is colliding with technical specifications the Commission itself hasn't finished stabilizing. Building a national wallet against a moving target of implementing acts and evolving trust-model standards is a recipe for exactly the kind of rushed, under-tested rollout that critics of heavy-handed digital regulation warn about: mandates that outrun the underlying technical readiness end up producing brittle, insecure, or simply broken compliance rather than genuine capability.
Why Estonia's approach is the right answer to a real problem
What should reassure skeptics of top-down EU tech mandates is not the deadline itself but how Estonia is meeting it. RIA is using a competitive dialogue procedure — inviting three to five qualified applicants into a structured, iterative negotiation rather than handing the contract to an incumbent or building in-house under deadline pressure (Biometric Update). That process forces vendors to demonstrate, before any code ships, that their solution actually interoperates with Estonia's existing eID and X-Road data-exchange layer — the infrastructure e-Residency and virtually every Estonian public e-service already depend on. Margit Aus, RIA's Head of EUDI Wallet, framed the requirement bluntly: RIA wants "a comprehensive solution... that enables users to securely store and present authentication data, use various attestation of attributes, and give digital signatures" (RIA) — not a wallet built to satisfy a Brussels checklist in isolation from the system citizens already use daily.
That distinction matters more than the deadline debate. A wallet retrofitted onto working national infrastructure by a vendor chosen through rigorous, competitive dialogue is a fundamentally different — and safer — proposition than a wallet rushed into existence to hit a fixed date against unfinished EU-wide specifications. If Brussels wants member states to hit its 2026 deadline without degrading trust in digital identity systems that already work, Estonia's procurement discipline, not just its speed, is the model worth exporting. The real risk to the EUDI Wallet project isn't Estonia moving too fast; it's other member states moving fast without Estonia's procurement rigor, or not moving at all.