LoA: Level of Assurance

Definition

The Three eIDAS Assurance Levels Explained

LoA Low provides a limited degree of confidence in the claimed identity. It is suitable for services where the risk of identity fraud is low, such as accessing public information or newsletter subscriptions. Identity proofing may involve self-asserted attributes with basic verification like email confirmation. Authentication typically uses simple mechanisms like username and password.

LoA Substantial provides a moderate degree of confidence. It is appropriate for services with moderate risk, such as accessing personal data or making non-critical transactions. Identity proofing requires verification against authoritative sources (like government databases), and authentication must use at least two factors from different categories (knowledge, possession, inherence). Many existing national eID schemes operate at this level.

LoA High provides the highest degree of confidence and is required for EUDI Wallets. Identity proofing must use in-person or equivalent remote verification against a physical identity document (typically an eID card read via NFC). Authentication requires multi-factor authentication with at least one factor based on hardware possession (like a secure element). Cryptographic keys must be protected by hardware-backed key storage.

The distinction between these levels is not merely technical but also legal. Under eIDAS 2.0, the LoA of an identity credential determines which services must accept it and what legal liability attaches to its use. LoA High credentials from EUDI Wallets will have legal equivalence to physical identity documents across all EU Member States.

LoA High Requirements for EUDI Wallets

Achieving LoA High in an EUDI Wallet requires meeting strict requirements across four domains: identity proofing (enrollment), authentication mechanism, credential management, and infrastructure security. Each domain has specific technical and procedural requirements that must be satisfied.

For identity proofing, the user must be verified against a government-issued identity document with strong anti-forgery features. In most EUDI Wallet implementations, this involves reading the chip of a national eID card via NFC and performing biometric matching (comparing the user's live photo or fingerprint against the reference data stored on the card chip). This creates a strong, verifiable link between the physical person and their digital identity.

The authentication mechanism must combine multiple independent factors. Typical EUDI Wallet authentication uses device possession (the registered smartphone) combined with user verification (biometrics or PIN). The device key used for authentication must be stored in hardware-backed secure storage, ensuring it cannot be extracted or cloned.

Infrastructure security requirements ensure that the systems supporting LoA High authentication are themselves protected to appropriate standards. This includes ISO 27001 certification for organizational security, Common Criteria evaluation for cryptographic components, and regular security assessments. The entire chain from identity proofing through credential issuance to authentication must maintain LoA High assurance.

Cross-Border Recognition and Mutual Acceptance

One of the primary purposes of the LoA framework is enabling cross-border recognition of digital identities. Under eIDAS 2.0, when a Member State issues EUDI Wallet credentials at LoA High, all other Member States must accept those credentials for public services requiring electronic identification. This creates a unified digital identity space across the EU without requiring every country to adopt the same technical implementation.

The mutual recognition mechanism works through peer review and notification. Each Member State must submit its EUDI Wallet scheme for peer review, demonstrating that it meets the LoA High requirements defined in the eIDAS Implementing Regulation. After successful peer review and notification to the European Commission, the scheme is published in the Official Journal of the EU, triggering mandatory acceptance by other Member States.

This framework allows different national approaches -- Belgium's itsme-based wallet, Germany's Online-Ausweis-based AusweisApp, and Poland's mObywatel -- to achieve mutual recognition through demonstrated compliance with the common LoA High requirements rather than technical uniformity.

Examples

Related Terms