On 9 December 2026, the Police and Border Guard Board (PPA) will revoke the digital certificates on more than 19,000 e-Residency ID cards. The cards were issued between 10 December 2021 and 16 August 2023, carry numbers UA0051053 to UA0076261, and will stop working for e-service authentication and digital signing. The PPA's instruction page says the cause is not a flaw. The contractor "is unable to renew the document chip's certification" under the stricter requirements of Regulation (EU) 2024/1183, known as eIDAS 2.0. It adds that "no security risk has been identified" and that past transactions "remain valid." The Estonian embassy in Brussels posted the notice on 5 October 2026. The police page itself carries no date.
The strongest case for revoking
Regulators have a serious argument here. A qualified electronic signature is only worth something because a trust service provider can vouch that the key sits inside a certified secure device. Regulation (EU) 2024/1183, dated 11 April 2024 and published on 30 April 2024, amends the original eIDAS Regulation (No 910/2014) and sets the framework for the European Digital Identity Wallet. If a chip's certification cannot be renewed, the provider cannot truthfully keep asserting that a signature meets the qualified standard. The PPA's parallel page on Digital ID says exactly this: the certificate "no longer meets the requirements for a qualified electronic signature," so the provider is "obliged to revoke the certificate." Revoking on schedule, with no known compromise, is better than quietly letting uncertified devices sign contracts. An identity system that bends its own rules when inconvenient is not one that foreign courts or banks will trust.
What the evidence says about Estonia's record
Estonia has handled this kind of event before, and the history is reassuring on process. In November 2017, after researchers disclosed a weakness in Infineon-made chips, the PPA suspended the certificates of 760,000 cards. By the end of March 2018, RIA reported that 494,000 cards, 95% of those used electronically, had been renewed, and that the cards stayed valid as ID and travel documents. In 2018, ERR reported that the PPA cancelled the certificates of about 11,100 further cards and filed a claim against the manufacturer for breaching security requirements. Those cases involved a live vulnerability. The 2026 case does not, which makes the response more proportionate in one respect and harder to justify in another.
Where the burden lands
The weakness in the current plan is who pays. The people affected are e-residents, often founders running Estonian companies from abroad, who cannot walk into a police station. The PPA's advice is to register for Smart-ID with the existing card before 9 December. Doing so yields certificates in the app valid for three years, or until the card's expiry if sooner. Registration needs the card, its six-digit CAN, PIN1 and PIN2. After 9 December, the card can no longer register a new Smart-ID account or a new device.
That is a workable bridge, but it has gaps:
- Dependence on action. Anyone who misses the deadline or has not read the notice loses the Smart-ID route and has to start again.
- No fast replacement. The PPA says reapplying means going through the full e-Residency application process and receiving a new card. For a company director who needs to sign filings, that is a real cost in time and money.
- Contractor risk. The failure sits with a supplier's inability to renew chip certification. The state issued these cards as a multi-year credential, and holders did not choose the chip.
The record on issuance reinforces why this matters. In July 2023, ERR reported that the PPA and the Ministry of the Interior decided to end the contract with BLS International Services, which had issued e-Residency cards abroad, after procedural breaches. Outsourced supply chains are part of the identity infrastructure, and Estonia's own history shows they can fail in ways users cannot see.
A proportionate way forward
A pro-innovation reading of eIDAS 2.0 does not ask regulators to relax certification. It asks the state to treat a compliance-driven revocation as a service failure, not a user obligation. Three steps would help:
- Ease replacement. Holders whose cards were revoked for a non-security reason should get a replacement without repeating the full application. The PPA page does not say whether this is planned.
- Individual outreach, with dates. A notice that sits undated on a police web page is weak for 19,000 people across many time zones. Direct email and a dated public notice cost almost nothing.
- Publish the chip-supply lessons. If a contractor could not renew certification, procurement should say how future card batches will avoid the same cliff, especially as wallet-based identity under eIDAS 2.0 matures.
The most useful reading of this episode is that the system caught a compliance gap before it became an incident, which is how a trust framework is meant to behave. The 2017 and 2018 episodes show Estonia can run mass re-issuance competently. The test now is whether it applies that standard to e-residents who live outside its borders. The state should absorb the cost of a supplier's lapse, not pass it to the people who relied on the card.