Reusable attestations in Europe: what qualified attestations change
Under eIDAS 2.0, a qualified attestation carries a legal presumption of accuracy across the EU. Our review recommends that Essence help people hold and present them, rather than issue them.
A bank onboarding a customer, an insurer checking a licence or a public body confirming an address each wants the same assurance: that the fact in front of it is true, and that it can rely on it. Across the European Union, a new kind of statement now offers that assurance, and what gives it weight is legal, not technical.
What a qualified attestation is
An attestation of attributes is a signed statement about a person: their date of birth, a licence they hold, a professional registration, a verified address. Under eIDAS 2.0, the EU's updated regulation on electronic identification and trust services, such a statement can be issued as a qualified electronic attestation of attributes.
What makes it qualified is the issuer. A qualified attestation comes from a qualified trust service provider, one assessed against European standards: ETSI EN 319 401 for trust service providers in general, and ETSI TS 119 471 for attribute attestations in particular. Such a provider can appear on an EU trusted list.
The result is legal weight. A qualified attestation carries a presumption of accuracy across the EU, and the organisation that receives one can rely on that presumption. An ordinary attestation from a commercial source does not carry it.
Nothing about the cryptography is different. A qualified attestation and an ordinary one can use the same format and travel over the same protocols.
Why it matters for reuse
Reuse is the promise behind attestations. A fact verified once, properly, should not need verifying again by every organisation that needs it. For the person, that means proving something once, keeping the proof, and showing it again when asked. Qualification makes reuse legally useful, because it tells the next organisation how far it can rely on what it is shown.
Regulation will soon test this. The EU Anti-Money Laundering Regulation applies from July 2027 and asks financial firms to collect and verify specific attributes about their customers. Firms will need evidence they can stand behind, and qualified attestations are one way to provide it.
Where Essence fits
Every attestation involves three parties. A provider issues it. A person holds it. An organisation checks it.
Our review looked at which of those roles Essence should take, and recommended that Essence should not become a qualified trust service provider for attestations of attributes.
The reason is architectural before it is commercial. To issue a qualified attestation, a provider has to perform attribute proofing: it must see, in the clear, the attributes it attests. Essence is built so that our servers never decrypt or expose the personal data in a person's vault. Becoming the party that has to read that data would contradict what the platform exists to do.
That legal status already exists among qualified providers, and organisations can rely on it without Essence holding it too. Our place is with the person and the organisation that checks. The aim is that people keep their attestations in their own vaults and choose when to present them, and that organisations receive what they asked for and nothing more.
The specifications attestations travel on
Qualified attestations are to be issued over OpenID4VCI and presented over OpenID4VP, and ETSI TS 119 471 sets out a profile for them in the SD-JWT VC format. Those are the open specifications Essence is building on.
Our August release built the first part of that support: credential configurations, credential offers with single-use codes, issuance records that hold metadata and never the credential itself, revocation across every copy of a credential at once, and erasure that removes the link to the person while revocation status survives.
SD-JWT VC lets the person holding a credential reveal some claims and withhold the rest, which is how reuse and data minimisation fit together.
Our review recommends three further steps, to be built as additions to this work rather than as a separate system: telling a qualified attestation from an ordinary one, checking issuers against EU trusted lists, and letting people hold and present qualified attestations issued by others.
If you are a regulated firm preparing for July 2027, the useful question to ask of any platform is whether it can show you, with evidence, when an attestation is qualified. That is the direction our review sets for Essence. If you are a public body or a qualified provider, we are not seeking your status; we want people to be able to carry what you issue. If reusable attestations are part of your plans, we would be glad to compare notes.
Published 27 August 2026