As Brussels races to make the EU Digital Identity Wallet a legal reality by the end of 2026, the TrustED project — and use cases with volunteers and hospitals — show what “citizen-centred” digital sovereignty actually looks like in practice.
By 2026 all 27 Member States must make wallets widely available, with public and private services beginning to accept them for authentication. To stress-test the concept before that deadline, four large-scale pilot consortia launched in April 2023, involving more than 350 private companies and public authorities across 26 Member States plus Norway, Iceland and Ukraine.
Regulators are also thinking about who has to accept these wallets, and when. Very large online platforms under the Digital Services Act, will be required to accept an EUDI Wallet if a user asks for it, though they cannot force people to authenticate this way. Banks, telecoms and other regulated sectors face their own mandatory-acceptance deadlines shortly after wallets go live.
TrustED partners are working to close — not in a lab, but with real volunteers, real hospitals, and real data.
Putting people at the centre: what TrustED pilots reveal
This is where regulation meets lived experience. While Brussels finalises the legal framework, Fundación Cibervoluntarios has been running real-world pilots with TrustED to test whether self-sovereign identity and privacy-preserving technologies actually work for the people who will use them — not just for the institutions that issue them.
The first pilot, led by Fundación Cibervoluntarios in Spain, put a digital volunteering credential in the hands of more than 70 Spanish volunteers spanning very different life stages — from 18-to-30-year-olds to adults over 50. Participants interacted directly with the TrustED digital wallet, which issues, stores and shares verifiable credentials of identity and volunteering activity. The goal went beyond usability testing: it was about surfacing what people actually expect, fear and demand when it comes to security, privacy and trust in exchanging their personal data — the same questions eIDAS 2.0 is trying to answer at EU scale.
The second pilot moved into a far more sensitive domain: healthcare. Working with the Centro Hospitalar e Universitário de Coimbra in Portugal, TrustED validated a federated learning platform built to analyse and predict viral respiratory infections — flu, COVID-19 and RSV — through structured interviews and hands-on validation with researchers, technical staff and healthcare professionals. The platform lets different institutions train shared AI models together without ever centralising or transferring clinical data. Each hospital keeps full control of its own information, satisfying regulatory requirements while reinforcing genuine data sovereignty rather than just claiming it on paper.
Two pilots, one principle
What connects a volunteering credential tested by retirees and young people in Spain to a federated AI model handling clinical data in Portugal is the same principle eIDAS 2.0 is trying to encode into law: people, not platforms, should decide what happens with their data.
Cibervoluntarios’ work shows that principle only holds up if it survives contact with real users — people who are not cryptography experts, who have very different comfort levels with technology, and who need to trust a system before they will use it. That is exactly the kind of evidence the EU’s own large-scale pilots are gathering as they head toward the 2026 deadline: proof that self-sovereign identity and privacy-preserving technologies can be both technically sound and genuinely usable.
Initiatives like TrustED — grounded in the everyday experience of volunteers, patients and healthcare workers — are helping ensure that when digital sovereignty becomes law, it also works in practice.