The most important facts in brief
- Definition: EAAs are legally secure digital proofs of characteristics (e.g. age, professional qualification, driver’s license) that are certified by trustworthy sources.
- Strategic benefit: They enable the verification of specific facts without having to disclose the entire identity (selective disclosure – e.g. “of legal age” instead of the exact date of birth).
- EUDI Wallet Integration: EAAs are the core content of the upcoming European digital wallet.
- Interoperability: EAAs work across borders throughout the EU, both for public authorities and private companies.
_______________________________________________________________
With the introduction of the eIDAS 2.0 Regulation and the EUDI Wallet (European Digital Identity Wallet), the way we prove our identity is changing. Previously, the primary question was: “Who are you?”. In future, the focus will be on: “What are you allowed to do?”, “What qualifications do you have?” or “What distinguishes you?”.
Electronic Attestations of Attributes (EAA) are the digital answer to these questions. They are the translation of our analog certificates – from driving licenses to diplomas – into the digital world.
What is an attribute?
Before we talk about the technology, let’s clarify the term: an attribute is a property or characteristic that describes a person or an organization (entity). You can think of it like a piece of a puzzle that paints an overall picture of an identity.
Attributes encompass an enormous range of information:
- Personal identification data (PID): Such as your name, place of birth or nationality.
- Professional characteristics: Academic titles, professional designations or official licenses.
- Rights & authorizations: Specific authorizations, such as signing authority in a company or a driver’s license.
The leap into the digital world
In the context of digital identity, attributes are used to prove characteristics online beyond doubt without being physically present. A distinction is made between two categories:
- Static attributes: Information that (almost) never changes, such as your date of birth.
- Dynamic attributes: Characteristics that are in flux, such as your current registration address, your current professional status or your age.
For these attributes to be considered trustworthy online, they must come from a secure source – for example, from government registers, educational institutions or certified authorities. Only this digital confirmation turns a simple attribute into tamper-proof proof (EAA), which you can use to identify yourself to online services.
What are Electronic Attestations of Attributes?
An EAA is therefore a digital data record that confirms one or more attributes of a person and has been electronically signed or sealed by a qualified or non-qualified trust service provider (TSP).
The decisive difference: while a classic eID often transfers the entire data record, an EAA provides specific information. A Qualified Electronic Attestation of Attributes (QEAA) has the highest probative value, as it is issued by state-supervised providers.
The 3 types of attestations according to eIDAS 2.0
Not every digital certificate has the same legal force. To ensure interoperability throughout Europe, the EU defines three specific categories of attribute certificates. These differ primarily in terms of the issuer and legal validity:
- Self-issued attributes (self-asserted): Information that you enter yourself (e.g. a delivery address). They are practical for forms, but have no official probative value.
- Electronic attestations (EAA): These are issued by verified sources. They are digitally signed and significantly more secure than conventional documents. (EAA include EAA and PuB-EAA).
- Qualified electronic attestations (QEAA): The highest level. They are issued by state-supervised, qualified trust service providers (QTSPs). A QEAA is legally equivalent to a paper document with an official seal and is recognized throughout the EU.
| Type | Focus & Publisher | Level of confidence & probative value | Data source | Practical example |
| Q-EAA (Qualified) | State-approved: Issued by qualified trust services providers (QTSPs). | Maximum: EU-wide recognition obligation and maximum probative value in court. | Official documents or sovereign data. | Academic degrees, medical licenses or notarial deeds. |
| EAA (non-qualified) | Private sector: Issued by companies or organizations. | Flexible: Legal acceptance is context-dependent (e.g. general terms and conditions). | Any source (depending on business needs). | Digital employee IDs, customer cards or event tickets. |
| PuB-EAA (Public) | Official: Directly from public sector bodies. | Very high: Relies on the integrity of state registers; recognized throughout the EU. | Official state registers (e.g. population registers). | Birth certificates, proof of residence or driving licenses. |
Market check: How widespread will this evidence be?
It is important to understand that not all EAA types will flood the market at the same time. Based on the eIDAS 2.0 roadmap, the distribution in the wallets can be estimated as follows:
- Q-EAA & PuB-EAA (very high): These will form the basis of the EUDI Wallet. As the Member States are obliged to provide official documents (such as ID cards and driving licenses) digitally, every wallet user will automatically have these highly secure attributes.
- EAA (medium to increasing): The ball is in the private sector’s court here. The spread depends on how quickly companies (such as airlines, fitness chains or employers) recognize the added value and issue their own digital certificates.
Strategic importance for companies and authorities
The integration of EAAs is far more than just a technical gimmick – it is a massive lever for business processes. Depending on the use case and the required legal force, different types of EAA are used:
- Seamless onboarding & KYC (Q-EAA)
Heavily regulated sectors such as banks or insurance companies can check identity data and proof (e.g. income or professional qualifications) in real time. Instead of reviewing documents manually, the system validates the Q-EAA immediately – which massively reduces the drop-out rates during onboarding. - Digital authorization management (EAA & Q-EAA)
In logistics or industry, licenses, company affiliations or safety instructions can be verified directly in the EUDI Wallet.
Example: A fitness studio grants discounts with a simple EAA (employee ID), while a dangerous goods driver shows a Q-EAA for his driver’s license. - Authority automation (PuB-EAA)
Thanks to the “once-only principle”, online authorities accept PuB-EAAs directly from other state registers. Proof of residence or pension status no longer has to be obtained on paper, which minimizes bureaucracy for citizens and authorities. - Data protection through “selective disclosure”
EAAs make it possible to disclose only what is absolutely necessary.
The principle: A system only confirms “over 18 years” for proof of age without having to transmit the exact date of birth or name. - Borderless interoperability
Thanks to the EU-wide standard, an attribute issued in Germany (e.g. a master craftsman’s certificate) is immediately recognized digitally in Spain or Poland. This greatly facilitates the cross-border mobility of skilled workers and services.
Important for private users
- Zero tracking: In contrast to big tech logins, issuers do not know where or when you use your attribute. Your digital trail remains invisible.
- Voluntary: The use of the wallet and the EAAs is completely voluntary. You decide which data you store digitally and who you show it to.
Conclusion: Why EAAs are the future of identity
EAAs are far more than just digital copies of paper documents. They are the key to a data-efficient society. Thanks to functions such as selective disclosure, users retain full sovereignty over their data, while companies benefit from automated, tamper-proof processes.
Strategic advantage for your company: Companies that position themselves as relying parties or issuers at an early stage massively reduce their manual verification efforts and increase legal certainty in digital channels.
FAQs on the topic
-
+–Was ist der Unterschied zwischen einer EAA und einer digitalen Signatur?Nein. Eine Signatur bzw Unterschrift bestätigt die Willenserklärung zu einem Dokument, z.B. einem Vertrag. Ein EAA (Electronic Attestation of Attributes)… show more
Nein. Eine Signatur bzw Unterschrift bestätigt die Willenserklärung zu einem Dokument, z.B. einem Vertrag. Ein EAA (Electronic Attestation of Attributes) bestätigt ein Merkmal oder eine Eigenschaft einer Person, z.B. die Volljährigkeit.
-
+–Wann sind die EAAs verpflichtend notwendig?Mit dem Rollout der nationalen EUDI-Wallets (ab 2027/2028) werden EAAs zum Standard für digitale Nachweise in der EU. show more
Mit dem Rollout der nationalen EUDI-Wallets (ab 2027/2028) werden EAAs zum Standard für digitale Nachweise in der EU.
-
+–Können Unternehmen EAAs ausstellen?Ja, Unternehmen können als „Issuer“ für spezifische Berufs- oder Firmenmerkmale fungieren. show more
Ja, Unternehmen können als „Issuer“ für spezifische Berufs- oder Firmenmerkmale fungieren.
-
+–Ist ein EAA sicherer als ein PDF-Zertifikat?Definitiv. Ein PDF lässt sich leicht fälschen. Ein EAA ist kryptografisch versiegelt. Jede nachträgliche Änderung macht den Nachweis sofort ungültig…. show more
Definitiv. Ein PDF lässt sich leicht fälschen. Ein EAA ist kryptografisch versiegelt. Jede nachträgliche Änderung macht den Nachweis sofort ungültig. Zudem kann die Gültigkeit (z. B. bei entzogenen Lizenzen) in Echtzeit geprüft werden.
-
+–Was ist der Unterschied zwischen EAA und QEAA?Ein EAA (Electronic Attestation of Attributes) ist eine elektronische Bestätigung eines Attributs (z. B. Alter, Ausbildung oder Berechtigung), die von… show more
Ein EAA (Electronic Attestation of Attributes) ist eine elektronische Bestätigung eines Attributs (z. B. Alter, Ausbildung oder Berechtigung), die von einem Aussteller signiert wird. Ein QEAA (Qualified Electronic Attestation of Attributes) ist eine spezielle Form davon, die von einem qualifizierten Vertrauensdiensteanbieter gemäß eIDAS-Verordnung ausgestellt wird. QEAAs erfüllen strengere rechtliche und technische Anforderungen und haben daher eine höhere rechtliche Verbindlichkeit und europaweite Anerkennung.
-
+–Sieht der Aussteller (Issuer), wo ich mein EAA-Attribut vorzeige?Nein. Moderne EAA-Systeme sind so konzipiert, dass der Aussteller nicht verfolgen kann, wo oder wann Sie Ihr Attribut vorzeigen. Die… show more
Nein. Moderne EAA-Systeme sind so konzipiert, dass der Aussteller nicht verfolgen kann, wo oder wann Sie Ihr Attribut vorzeigen. Die Verifikation erfolgt direkt zwischen Ihnen und dem Empfänger. Dadurch bleibt Ihre Privatsphäre geschützt, und es entsteht kein zentrales Tracking Ihrer Nutzung.
-
+–Kann ich ein EAA widerrufen?Ja. EAAs können vom Aussteller widerrufen werden, zum Beispiel wenn sich ein Attribut ändert oder ungültig wird. Empfänger können den… show more
Ja. EAAs können vom Aussteller widerrufen werden, zum Beispiel wenn sich ein Attribut ändert oder ungültig wird. Empfänger können den Widerrufsstatus bei der Verifikation prüfen, um sicherzustellen, dass das Attribut noch gültig ist.
-
+–What are “Electronic Attestations of Attributes” (EAAs)?show more
The most important facts in brief
- Definition: EAAs are legally secure digital proofs of characteristics (e.g. age, professional qualification, driver’s license) that are certified by trustworthy sources.
- Strategic benefit: They enable the verification of specific facts without having to disclose the entire identity (selective disclosure – e.g. “of legal age” instead of the exact date of birth).
- EUDI Wallet Integration: EAAs are the core content of the upcoming European digital wallet.
- Interoperability: EAAs work across borders throughout the EU, both for public authorities and private companies.
_______________________________________________________________
With the introduction of the eIDAS 2.0 Regulation and the EUDI Wallet (European Digital Identity Wallet), the way we prove our identity is changing. Previously, the primary question was: “Who are you?”. In future, the focus will be on: “What are you allowed to do?”, “What qualifications do you have?” or “What distinguishes you?”.
Electronic Attestations of Attributes (EAA) are the digital answer to these questions. They are the translation of our analog certificates – from driving licenses to diplomas – into the digital world.
What is an attribute?
Before we talk about the technology, let’s clarify the term: an attribute is a property or characteristic that describes a person or an organization (entity). You can think of it like a piece of a puzzle that paints an overall picture of an identity.
Attributes encompass an enormous range of information:
- Personal identification data (PID): Such as your name, place of birth or nationality.
- Professional characteristics: Academic titles, professional designations or official licenses.
- Rights & authorizations: Specific authorizations, such as signing authority in a company or a driver’s license.
The leap into the digital world
In the context of digital identity, attributes are used to prove characteristics online beyond doubt without being physically present. A distinction is made between two categories:
- Static attributes: Information that (almost) never changes, such as your date of birth.
- Dynamic attributes: Characteristics that are in flux, such as your current registration address, your current professional status or your age.
For these attributes to be considered trustworthy online, they must come from a secure source – for example, from government registers, educational institutions or certified authorities. Only this digital confirmation turns a simple attribute into tamper-proof proof (EAA), which you can use to identify yourself to online services.
What are Electronic Attestations of Attributes?
An EAA is therefore a digital data record that confirms one or more attributes of a person and has been electronically signed or sealed by a qualified or non-qualified trust service provider (TSP).
The decisive difference: while a classic eID often transfers the entire data record, an EAA provides specific information. A Qualified Electronic Attestation of Attributes (QEAA) has the highest probative value, as it is issued by state-supervised providers.
The 3 types of attestations according to eIDAS 2.0
Not every digital certificate has the same legal force. To ensure interoperability throughout Europe, the EU defines three specific categories of attribute certificates. These differ primarily in terms of the issuer and legal validity:
- Self-issued attributes (self-asserted): Information that you enter yourself (e.g. a delivery address). They are practical for forms, but have no official probative value.
- Electronic attestations (EAA): These are issued by verified sources. They are digitally signed and significantly more secure than conventional documents. (EAA include EAA and PuB-EAA).
- Qualified electronic attestations (QEAA): The highest level. They are issued by state-supervised, qualified trust service providers (QTSPs). A QEAA is legally equivalent to a paper document with an official seal and is recognized throughout the EU.
Type Focus & Publisher Level of confidence & probative value Data source Practical example Q-EAA (Qualified) State-approved: Issued by qualified trust services providers (QTSPs). Maximum: EU-wide recognition obligation and maximum probative value in court. Official documents or sovereign data. Academic degrees, medical licenses or notarial deeds. EAA (non-qualified) Private sector: Issued by companies or organizations. Flexible: Legal acceptance is context-dependent (e.g. general terms and conditions). Any source (depending on business needs). Digital employee IDs, customer cards or event tickets. PuB-EAA (Public) Official: Directly from public sector bodies. Very high: Relies on the integrity of state registers; recognized throughout the EU. Official state registers (e.g. population registers). Birth certificates, proof of residence or driving licenses. Market check: How widespread will this evidence be?
It is important to understand that not all EAA types will flood the market at the same time. Based on the eIDAS 2.0 roadmap, the distribution in the wallets can be estimated as follows:
- Q-EAA & PuB-EAA (very high): These will form the basis of the EUDI Wallet. As the Member States are obliged to provide official documents (such as ID cards and driving licenses) digitally, every wallet user will automatically have these highly secure attributes.
- EAA (medium to increasing): The ball is in the private sector’s court here. The spread depends on how quickly companies (such as airlines, fitness chains or employers) recognize the added value and issue their own digital certificates.
Strategic importance for companies and authorities
The integration of EAAs is far more than just a technical gimmick – it is a massive lever for business processes. Depending on the use case and the required legal force, different types of EAA are used:
- Seamless onboarding & KYC (Q-EAA)
Heavily regulated sectors such as banks or insurance companies can check identity data and proof (e.g. income or professional qualifications) in real time. Instead of reviewing documents manually, the system validates the Q-EAA immediately – which massively reduces the drop-out rates during onboarding. - Digital authorization management (EAA & Q-EAA)
In logistics or industry, licenses, company affiliations or safety instructions can be verified directly in the EUDI Wallet.
Example: A fitness studio grants discounts with a simple EAA (employee ID), while a dangerous goods driver shows a Q-EAA for his driver’s license. - Authority automation (PuB-EAA)
Thanks to the “once-only principle”, online authorities accept PuB-EAAs directly from other state registers. Proof of residence or pension status no longer has to be obtained on paper, which minimizes bureaucracy for citizens and authorities. - Data protection through “selective disclosure”
EAAs make it possible to disclose only what is absolutely necessary.
The principle: A system only confirms “over 18 years” for proof of age without having to transmit the exact date of birth or name. - Borderless interoperability
Thanks to the EU-wide standard, an attribute issued in Germany (e.g. a master craftsman’s certificate) is immediately recognized digitally in Spain or Poland. This greatly facilitates the cross-border mobility of skilled workers and services.
Important for private users
- Zero tracking: In contrast to big tech logins, issuers do not know where or when you use your attribute. Your digital trail remains invisible.
- Voluntary: The use of the wallet and the EAAs is completely voluntary. You decide which data you store digitally and who you show it to.
Conclusion: Why EAAs are the future of identity
EAAs are far more than just digital copies of paper documents. They are the key to a data-efficient society. Thanks to functions such as selective disclosure, users retain full sovereignty over their data, while companies benefit from automated, tamper-proof processes.
Strategic advantage for your company: Companies that position themselves as relying parties or issuers at an early stage massively reduce their manual verification efforts and increase legal certainty in digital channels.
FAQs on the topic
-
+–Werden meine Daten bei sproof zentral gespeichert?Nein. Die Kontrolle liegt bei Ihnen. Die EAAs befinden sich sicher verschlüsselt in Ihrer persönlichen EUDI-Wallet auf Ihrem Smartphone, nicht… show more
Nein. Die Kontrolle liegt bei Ihnen. Die EAAs befinden sich sicher verschlüsselt in Ihrer persönlichen EUDI-Wallet auf Ihrem Smartphone, nicht in einer zentralen Cloud-Datenbank der Regierung.
