Blog

There is a concept within the EUDI Wallet ecosystem that many organisations are not yet aware of and that will determine who gains a competitive advantage in the digital trust market over the coming years: QEAAs, Qualified Electronic Attestations of Attributes. In simple terms, a QEAA is a verifiable credential with full legal validity throughout…

whose verification has its days numbered. These are companies that completed the electronic verification process between 22 October 2024, when verification became mandatory, and 22 April 2025, using an identifier other than the NTR: VAT (value added tax number), LEI (global legal entity identifier), PSD (payment service provider authorisation number) or a local code. For…

Not all electronic signatures are the same. Any company that has tried to submit a digitally signed document to a public administration and been told that the type of signature was not valid knows this. So does any lawyer who has tried to challenge an electronically signed contract and realised that the burden of proof…

Crypto-agility is the ability of a security system to replace its cryptographic algorithms, keys and protocols quickly and automatically, without significantly altering the underlying infrastructure or disrupting business continuity. With the imminent arrival of post-quantum standards (FIPS 203, 204 and 205), crypto-agility is no longer a theoretical advantage and becomes an essential operational requirement for…

There is a date in the European regulatory calendar that is not yet on the radar of most Spanish organisations but will affect virtually every company with more than fifty employees providing services in regulated sectors. 24 December 2026 is the deadline established by Regulation (EU) 2024/1183 (eIDAS 2.0) for the European Digital Identity Wallet…

There is a way of interpreting the Digital Product Passport timeline that may seem reassuring: the first mandatory sector-specific DPPs, apart from the battery passport arriving in February 2027, will not become applicable until 2028-2029 for the most advanced sectors and until 2029-2031 for the others. A margin of two or three years. Enough time…

There is a conversation that many companies are not having with their cloud providers, but should have before signing their next software contract. The question is straightforward: if a US authority calls your cloud provider at three in the morning and requests access to your documents, what happens? If your provider is a US company:…

The transition to post-quantum cryptography (PQC) will not be a switch that is turned off and on overnight. There is a dangerous transition period in which legacy systems must coexist with the new security standards. The technical solution that guarantees simultaneous interoperability and security is hybrid certificates. These cryptographic artefacts allow organisations to begin deploying…

On 6 August 2026 (today), Commission Implementing Regulation (EU) 2026/1778 of 16 July 2026 enters into force, establishing the rules for implementing the Digital Product Passport (DPP) Registry created by Article 13 of Regulation (EU) 2024/1781 (ESPR). From this moment onwards, the technical rules determining how the identity of economic operators is verified, how passports…

In December 2025, at the EUDI Wallet Launchpad held in Brussels, one thing became clear: Spain is not late to the deployment of the European Digital Identity Wallet. It is among the first five countries. Together with France, Italy, Denmark and Greece, Spain presented the IDUE Wallet (the national name for the EUDI Wallet) as…