What is an electronic attestation of attributes (EAA)?
By Stephan Bergmann, hashID. Updated
An electronic attestation of attributes (EAA) is a digitally signed proof of a fact about a person or an organisation, such as "member of a rowing club since 2019" or "holds a nursing qualification". The person keeps it in an EU digital identity wallet and shows it when someone asks. The term comes from the EU regulation eIDAS 2.0.
The legal definition
Regulation (EU) 2024/1183, which updated the eIDAS regulation, defines an EAA as "an attestation in electronic form that allows attributes to be authenticated" (Article 3, point 44). An attribute is a characteristic, quality, right or permission of a person, a company or an object.
Examples
- Membership of a club or an association
- A degree, a course or a training certificate
- Proof of employment or a role in a company
- A licence or a permit
- Powers to represent a company
- Being over 18, without showing the date of birth
The three kinds of attestation
eIDAS 2.0 knows three kinds. They differ in who issues them and how much legal weight they carry (Article 45b).
| Kind | Issued by | Legal effect |
|---|---|---|
| EAA | A trust service provider, on behalf of the source | Cannot be refused only because it is electronic |
| QEAA (qualified) | A qualified trust service provider, supervised and listed in the national trusted lists | Same legal effect as a lawfully issued paper attestation |
| Pub-EAA (public body) | A public sector body responsible for an authentic source, or a provider on its behalf | Same legal effect as paper, recognised in all member states |
The details are compared in EAA, QEAA, Pub-EAA and PID: the differences.
How it works: three roles
- Issuer: the organisation that knows the fact, or a service acting for it, signs the attestation and sends it to the wallet.
- Holder: the person keeps it in their wallet and decides each time what to show.
- Verifier, also called relying party: whoever asks checks the signature and whether the attestation is still valid. They need no account with the issuer.
Why not just a plastic card or a PDF?
| Plastic card or PDF | EAA in a wallet | |
|---|---|---|
| Can it be faked? | Copied or edited in minutes | No: any change breaks the signature |
| What does the checker see? | Everything printed on it | Only what the holder chooses to share |
| When someone leaves | The card stays in their pocket | The issuer revokes it, and every check shows it |
| Where does it work? | Wherever someone looks at it | In person and online, in the EU and beyond |
When will people have wallets?
Every EU member state must offer its citizens at least one free European Digital Identity Wallet by 24 December 2026 (Article 5a of eIDAS 2.0). The wallets read attestations in the standard formats SD-JWT VC and mdoc (ISO/IEC 18013-5).
Issuing EAA without a crypto team
Issuing an EAA takes signing keys, certificates and the OpenID4VCI protocol. EAA Broker does that part: you send a list, and your people pick up their attestation with a link and a code. How that looks for a club is shown in Digital membership cards for clubs and associations.