Back

Is a personhood credential a QEAA under eIDAS 2.0?

No, and the reason is the useful part: qualified is an institutional status, not a cryptographic one. Where the two systems actually meet is the wire format.

The short answer

No. A qualified electronic attestation of attributes has to be issued by a qualified trust service provider and meet the requirements in Annex V of Regulation (EU) 2024/1183. Qualified status is granted by a member state supervisory body after a conformity assessment, and the provider then appears on that member state's trusted list.

That is an institutional property. It is a statement about who issued the attestation and who supervises them, not about how the attestation was signed. A credential issued by a permissionless system cannot acquire it by being better cryptography, in the same way that a well-built private laboratory does not become an accredited one by buying better instruments.

This is worth saying plainly because the decentralized identity world tends to read “qualified” as a technical tier, and the eIDAS world tends to read “decentralized” as a claim to the same authority through other means. Neither reading is right, and the confusion costs both sides time.

What it can be

It can be an electronic attestation of attributes without the qualified prefix. The regulation separates attestations issued by a qualified provider, attestations issued by or on behalf of a public body responsible for an authentic source, and everything else. A personhood credential from an open issuer sits in the third group, and that group is not a loophole or a lesser copy of the first. It is the category the regulation leaves open for attestations whose value does not come from a supervised issuer.

The distinction matters most in what each one can be used for. A qualified attestation carries legal effect: presented where the attribute type is legally recognised, it has to be accepted across the union. A non-qualified one carries whatever the verifier decides it carries, which for a sybil signal is usually exactly enough.

There is a version of this that goes wrong, and it is worth naming. An open issuer that describes its credential in language borrowed from the qualified tier is not bridging anything, it is trading on a distinction it has not earned. The honest position is narrower and more useful: here is what this proves, here is who vouches for it, and here is what it does not do.

Where the two systems actually meet

The formats. The wallet ecosystem settled on SD-JWT VC and mdoc as credential formats, and on OpenID4VC for issuance and presentation. Those are open specifications with no institutional gate on them, which means a verifier built to accept a wallet presentation can parse a credential from an open issuer without a second code path.

What differs is the trust anchor. In the wallet ecosystem the verifier resolves the issuer against a trusted list published by a member state. In an open system it resolves a DID and checks a signature against whatever it has decided to trust. Same envelope, same protocol, different answer to the question of who gets to vouch.

That difference is also where the legal effect lives. Resolving against a trusted list is what makes a qualified attestation carry weight in a regulated process; resolving a DID leaves the weight entirely up to the verifier. So for anyone building one, the expensive work is the format and protocol handling, and it is shared. The trust decision is a policy layer on top, and it is worth keeping separate in the code, because it is the part that differs per credential and per jurisdiction.

What this means if you are the relying party

Ask what you need the credential to do. If you need an attribute to hold up in a regulated process, a dispute or an audit, you need the qualified path, and no open credential substitutes for it. If you need to know that two accounts are not the same person, you do not, and asking a supervised provider to certify uniqueness is paying for the wrong instrument.

Most systems need both, for different questions, and the mistake is treating them as competing answers to one question. The onboarding that has to satisfy a regulator and the rate limit that has to survive a bot farm are not the same problem, and a single credential type that served both would be over-specified for one and under-specified for the other.

Get your personhood credential

Verify through the Gateway and receive a DID, a verifiable credential and a personhood token. No personal data is retained.

Stay updated.