European eID: 32 notified schemes, and which ones a SaaS can actually use

If you have looked into letting European users sign in with their national electronic identity, you have probably formed one of two impressions: that there are a handful of these schemes, or that eIDAS means any EU citizen can use theirs anywhere. Both are wrong, and the second one is wrong in a way that will waste a quarter of your engineering year if you build on it.

This is the map we assembled before committing to build eID support. Every figure below comes from a primary source — the Commission’s own register, the regulation text, or the scheme operator’s own pricing page — and each carries the date we checked it.

There are 32 notified schemes, not six

The register covers the obvious ones — Germany’s eID, Italy’s SPID and CIE, Denmark’s MitID, Belgium’s itsme, Sweden’s BankID, Estonia’s ID-card — and a long tail most integration guides never mention: Portugal’s Chave Móvel Digital and Cartão de Cidadão, ID Austria, Croatia’s NIAS, Czechia’s mojeID, Bulgaria’s Evrotrust, Norway’s Buypass, Slovenia’s eID card, and the Polish, Latvian, Lithuanian, Slovak, Maltese, Cypriot, Luxembourgish and Romanian schemes.

Four EU/EEA countries have notified nothing: Ireland, Greece, Hungary and Iceland. All four have working national identity systems; none has gone through notification. Switzerland cannot notify at all, being outside the EU and EEA — and its federal E-ID was postponed on 30 June 2026, with the trust infrastructure now expected in the first half of 2027.

The trap: “notified” does not mean “available to you”

This is the single most expensive misunderstanding in the category, and the regulation is unambiguous about it. eIDAS mutual recognition binds public sector bodies only:

Article 7(f) then leaves the terms of access for everyone else — that is, for every commercial company — to the notifying Member State. So each country decides separately whether a private business may accept its citizens’ national eID, and several say no.

The inverse is also true, and equally counter-intuitive: some of the schemes with the largest real-world usage are not notified at all. Smart-ID, used across Estonia, Latvia and Lithuania, has never been notified by any country. Estonia’s own authority is explicit that it was assessed nationally instead:

The same applies to the Finnish bank IDs and Mobiilivarmenne — every one registered at substantial, none notified — to the Czech Bank iD with its five million users, and to the Dutch iDIN. Notification is a legal act between a Member State and the Commission. It is not a measure of whether anyone uses the thing.

What it actually costs, where the price is published

National eID is not a free API. Every scheme is operated by a bank consortium, a state agency or a licensed private company, and every one charges per authentication. What varies enormously is whether the price is published at all — and for a surprising number of countries, it is not.

Three countries are closed to commercial services by law

Not by policy, by statute — which is why no amount of commercial negotiation opens them.

• Netherlands (DigiD). The Wet digitale overheid restricts a public identification means to access to services provided by administrative bodies and designated organisations. Logius adds three cumulative conditions, the first being that you perform a public task established in law.
• Spain (Cl@ve). The 2014 order reserves adhesion to other public administrations. The private sector appears in the Cl@ve rules only as a potential identity provider — never as a relying party.
• Ireland (MyGovID). A “specified body” may use a person’s public service identity only in performing its public functions, and using or seeking a PPSN outside the designated categories is a criminal offence.

France sits in between: private companies qualify for FranceConnect in exactly two cases — services related to a change-of-address procedure, or where a regulatory text requires you to verify your users’ identity. The French administration is explicit that an obligation resting on your customers rather than on you is not sufficient.

Two schemes do not speak any federation protocol

If you are planning to add these as generic OpenID Connect providers, two of them will stop you. Swedish BankID is a JSON/REST API over mutual TLS — you hold a client certificate issued through a bank or a reseller. The German eID is EAC v2 against the card chip through an eID server, with a state-granted authorisation certificate. Neither is OIDC or SAML, and no amount of configuration makes them so.

Everything else reachable by a private company arrives as OIDC or SAML, directly or through a broker — which is why a broker is usually the right first move even when direct integration is theoretically possible.

The EU Digital Identity Wallet is a registration regime, not an open API

Regulation (EU) 2024/1183 entered into force on 20 May 2024, and Member States must offer a wallet by the end of 2026. Two provisions are routinely misread.

First, Article 5b requires a relying party that intends to rely on wallets to register in the Member State where it is established, declaring its intended use and the data it will request. “One integration, all of Europe” is not what the regulation says.

Second, the duty on private services to accept wallets — Article 5f(2) — is far narrower than the headlines suggest. It bites only where strong user authentication is already required of you by Union or national law or by contract; micro and small enterprises are exempt outright; and acceptance is only ever on the user’s voluntary request.

What this means if you are building

1. Pick countries, not “Europe”. There is no pan-European switch. Each country is a separate contract, a separate legal check and sometimes a separate protocol.
2. Start where the door is open and the price is published. Portugal, Italy, Slovenia and the Baltics all publish a tariff and admit commercial services without a sector test.
3. Use a broker for the Nordics first. Denmark makes it mandatory; Sweden and Norway make direct integration expensive enough that it rarely pays before real volume.
4. Do not store the national identifier. Several countries restrict processing of national identification numbers beyond what the GDPR requires — Denmark’s Data Protection Act restricts private-sector CPR processing specifically. A scheme-scoped pseudonym is almost always the right thing to persist.
5. An eID login is not KYC. It can be an input to customer due diligence. It does not discharge anyone’s anti-money-laundering obligations, and the obliged entity is you, not your identity provider.

Adetio is building eID as a per-tenant capability on exactly this model: you hold the relationship with the scheme or the broker, we provide the integration, the session model, the account linking and the pseudonymisation. That keeps the per-authentication cost on the contract where it belongs, and it means we are never a regulated intermediary standing between you and your users’ identity. The European eID product page has the current state; it is honest about what is live and what is not.