How the certification system works
The NL EUDI Wallet certification system is described in NL-SYS-01. That document is a high-level framework that explains the certification system and ensures its conformity with related regulations (NL-SYS-01 §1, p. 5). The system certifies European Digital Identity Wallets and the electronic identification scheme under which they are provided (NL-SYS-01 cover, p. 2). This page explains its structure. The next pages cover the parties involved, the documents, the certification process and the life of a certificate.
Built on conformity assessment standards
The system is based on the concept of a certification system described in ISO/IEC 17067 (NL-SYS-01 §1, p. 5). Certification is performed in compliance with ISO/IEC 17065 (NL-SYS-01 §4.3, p. 16). All underlying certificates and certification schemes shall comply with ISO/IEC 17067 and ISO/IEC 17065 (NL-SYS-01 §1, p. 5). The system operates under the conformity assessment system described in Regulation (EC) No 765/2008 on accreditation and market surveillance (NL-SYS-01 §2, p. 8).
The system and its schemes will demonstrate compliance with (NL-SYS-01 §2, p. 8):
- the functional framework of eIDAS (Article 5a) and Implementing Regulations (EU) 2024/2977, 2024/2979 and 2024/2982;
- the certification rules of eIDAS (Article 5c) and Implementing Regulation (EU) 2024/2981;
- the European cybersecurity certification scheme EUCC (Implementing Regulation (EU) 2024/482);
- Article 54 of the Cybersecurity Act (Regulation (EU) 2019/881);
- Article 8(3) of eIDAS together with Implementing Regulation (EU) 2015/1502;
- Regulation (EC) No 765/2008 on accreditation, in particular Articles 4 and 5.
References to Dutch national law are still a placeholder in the documents (NL-SYS-01 §2, p. 8). See legal basis for links to all EU instruments.
Three certifications and one top-level certificate
The certification of "the wallet and the eID scheme under which the wallet is provided" is set up as one top-level scheme. That scheme combines certificates from three subordinate certification schemes (NL-SYS-01 §4.2, p. 14):
| Subordinate certification | Documents | What it covers | Main evaluation activity |
|---|---|---|---|
| Functional certification of the Wallet Solution | NL-FS, NL-FS-W, NL-FS-P | Wallet functionality as required by eIDAS and its implementing acts, and compliance with the onboarding flow and PID issuance flow requirements. Mostly product evaluation with functional testing (NL-SYS-01 §1, p. 6). | Testing |
| Cybersecurity certification of the Wallet Solution | NL-CS Parts 1–4, NL-CS-WI, NL-CS-WSCA and their conditions documents | At least two components: the WSCA and WSCD certificates under the EUCC scheme, and a cybersecurity evaluation of the Wallet Unit (Wallet Instance together with WSCA/WSCD) under a FITCEM scheme (EN 17640:2022). Mostly product evaluation with security testing (NL-SYS-01 §1, p. 6). | Testing |
| Certification of the Wallet Provider and the PID Provider (the eID scheme) | NL-P-W, NL-P-P, with the requirements in NL-P-01, NL-P-02, NL-P-03, NL-P-04W and NL-P-04P | The technical, procedural and organisational requirements for these providers and their services, outside the product certifications. Mostly process evaluation and auditing (NL-SYS-01 §1, p. 6). | Audit |
The "main evaluation activities" column comes from Table 1 of NL-SYS-01 (NL-SYS-01 §4.3, p. 16).
On top sits the NL Top-Level Certification (NL-TL). It is the overall certificate of "the wallet and the eID-scheme under which the wallet is provided" that the regulation refers to. According to NL-SYS-01, it is the certificate the Netherlands needs to provide to Europe for each combination of wallet and eID scheme (PID Provider) (NL-SYS-01 §1, p. 7). The overall certificate is issued per Wallet Provider (NL-SYS-01 §1, p. 6).
A top-level certificate can only be issued if (NL-SYS-01 §1, p. 7):
- the PID Provider has an active certificate, and
- the Wallet Provider has an active certificate, and
- the Wallet Provider demonstrates that it meets the national admission conditions set in national law.
The figure below is Figure 2 of NL-SYS-01. It shows the certificates and declarations of conformity that the system produces.
NL-SYS-01, Figure 2: Set of certificates/declarations of conformity resulting from implementation of the national EUDI Wallet certification system (NL-SYS-01 §1, p. 6)
Scheme types
Each scheme is an ISO/IEC 17067 product certification scheme. NL-SYS-01 assigns these types (NL-SYS-01 §4.2, p. 15):
- European Digital Identity Wallet Functional Certification Scheme: Type 5
- European Digital Identity Wallet Cybersecurity Certification Scheme: Type 5
- National eID Scheme Certification Scheme: Type 6
According to NL-SYS-01, the certification scheme for the top-level certificate (NL-TL) is a Type 6 scheme, which includes initial certification and subsequent surveillance (NL-SYS-01 §7.1.1, p. 30). NL-TL describes itself as a composite certification scheme that relies on certificates from the subordinate schemes (NL-TL §6.5, p. 12).
The top-level certificate builds on the others
The top-level certification does not repeat assessments that valid subordinate certificates already cover adequately. The CAB checks the validity, scope, applicability and continuing status of those certificates. It evaluates whatever they do not sufficiently cover: requirements, dependencies and interfaces (NL-TL §6.5, p. 12). The CAB remains responsible for the top-level decision, however much it relies on subordinate results (NL-TL §6.5, p. 12).
CABs may also rely on external assurance evidence. The status of the assurance case is the assurance outcome. There are three outcomes (NL-SYS-01 §5.3, p. 19) (NL-SYS-01 §5.3, p. 20):
- Full reliance: the evidence shows the requirement is met, so no extra evaluation is needed.
- Partial reliance: the evidence covers part of the requirement or needs supplementing, so the CAB-CB performs supplementary evaluation.
- No reliance: the evidence is missing, inadequate or does not cover the requirement, so the CAB-CB evaluates the requirement in full.
The certification process explains the steps in detail.
Only remote HSM wallets in version 1
Under Certification System v1, only HSM-based architectures are accepted. The Wallet Instance runs on a mobile platform that meets established conditions. It interacts with a Wallet Provider backend, where the HSM-based WSCA/WSCD run (NL-SYS-01 Annex B, p. 39). See wallet architecture.
Assurance level
The cover of NL-SYS-01 states assurance level High/High. The first "High" is identity proofing (Implementing Regulation (EU) 2015/1502); the second is evaluation (Regulation (EU) 2019/881) (NL-SYS-01 cover, p. 2). For the cybersecurity certification, the scheme targets AVA_VAN.5 for the EUCC-related certifications, and assurance level "high" under Regulation (EU) 2019/881 for the FITCEM-related part (NL-SYS-01 §7.2, p. 34). Self-assessment is not permitted for the required level of assurance (NL-SYS-01 §7.2, p. 35).