Self-Sovereign Identity and eIDAS 2.0: An Analysis of Control, Privacy, and Legal Implications

2026-01-27

AI Summary

This study addresses the limitations of eIDAS 1.0 in accommodating decentralized identity models, particularly concerning user control, privacy protection, and regulatory compliance. It presents the first systematic comparison between the eIDAS 2.0 regulation—including its annexes—and the core principles of Self-Sovereign Identity (SSI), contextualized within the European Digital Identity Architecture (ARF). Through legal text analysis, policy evaluation, and technical architecture mapping, the research comprehensively assesses the extent to which eIDAS 2.0 supports SSI. The findings reveal both alignments and legislative gaps in key areas such as user sovereignty, data minimization, and cross-domain interoperability. This work provides a theoretical foundation and practical guidance for future regulatory refinement and the real-world deployment of SSI technologies in alignment with European digital identity frameworks.

Technology Category

• Application Domains: Humanities & Computational Social Science
• Philosophy and Ethics of AI: AI & Law, Justice, Regulation & Governance
• Humans and AI: Intelligent User Interfaces

Application Category

• Security and Privacy: Data transparency and provenance
• Responsible Web: Consent frameworks and practices on the web
• Systems and Infrastructure for Web, Mobile and WoT: Decentralized Web and Fediverse systems

Abstract

European digital identity initiatives are grounded in regulatory frameworks designed to ensure interoperability and robust, harmonized security standards. The evolution of these frameworks culminates in eIDAS 2.0, whose origins trace back to the Electronic Signatures Directive 1999/93/EC, the first EU-wide legal foundation for the use of electronic signatures in cross-border electronic transactions. As technological capabilities advanced, the initial eIDAS 1.0 framework was increasingly criticized for its limitations and lack of comprehensiveness. Emerging decentralized approaches further exposed these shortcomings and introduced the possibility of integrating innovative identity paradigms, such as Self-Sovereign Identity (SSI) models. In this article, we analyse key provisions of the eIDAS 2.0 Regulation and its accompanying recitals, drawing on existing literature to identify legislative gaps and implementation challenges. Furthermore, we examine the European Digital Identity Architecture and Reference Framework (ARF), assessing its proposed guidelines and evaluating the extent to which its emerging implementations align with SSI principles.

Problem

• Self-Sovereign Identity
• eIDAS 2.0
• privacy
• legal implications
• digital identity

Innovation

• Self-Sovereign Identity
• eIDAS 2.0
• Digital Identity
• Privacy by Design
• Decentralized Identity