An electronic attestation of attributes is a signed statement about a person or organisation from someone other than the state identity issuer: an employer, a university, a bank, a professional body. eIDAS 2.0 also defines qualified (QEAA) and public-body (PuB-EAA) variants with stronger legal effect.
EAAs are what make the wallet useful beyond identity. A diploma, a professional licence, a bank account attestation, a company mandate, an insurance policy. The wallet holds them next to PID and presents them over the same protocols.
The regulation splits them into three tiers. A plain EAA can come from anyone, and Article 45b(1) says it cannot be refused as evidence in court just for being electronic or unqualified. A qualified EAA comes from a qualified trust service provider. A public-body EAA is issued by or on behalf of a public sector body responsible for an authentic source. The last two have the same legal effect as each other under Article 45b(2), equivalent to a lawfully issued paper attestation. What the public-body tier adds is automatic cross-border recognition under Article 45b(3).
The tier matters when you have to justify relying on it. A plain EAA may be fine for a hiring decision. A regulated licence check usually wants the qualified or public-body tier. Do not assume qualified outranks public-body, because on legal effect they are level.
Defined in
Regulation (EU) 2024/1183 Art. 45b; ARF v3.0.0 section 5.4
Most of the business value in this ecosystem sits in EAAs rather than in PID, which surprises people. Identity is table stakes. The interesting part is everything built on top of it. If you already hold authoritative data about your customers, you can issue it yourself and become a source of trust rather than only a consumer of one.
Authbound handles the protocols, formats, trust lists and revocation checks behind these terms. See what people build with them.
