Self-Sovereign Identity and eIDAS 2.0: An Analysis of Control, Privacy, and Legal Implications

• URL: http://arxiv.org/abs/2601.19837v1
• Date: Tue, 27 Jan 2026 17:43:48 GMT
• Title: Self-Sovereign Identity and eIDAS 2.0: An Analysis of Control, Privacy, and Legal Implications
• Authors: Nacereddine Sitouah, Marco Esposito, Francesco Bruschi,
• Abstract summary: We analyse the eIDAS 2.0 Regulation and its accompanying recitals, drawing on existing literature to identify legislative gaps and implementation challenges.<n>We examine the European Digital Identity Architecture and Reference Framework (ARF), assessing its proposed guidelines and evaluating the extent to which its emerging implementations align with SSI principles.
• Score: 0.9940728137241215
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: European digital identity initiatives are grounded in regulatory frameworks designed to ensure interoperability and robust, harmonized security standards. The evolution of these frameworks culminates in eIDAS 2.0, whose origins trace back to the Electronic Signatures Directive 1999/93/EC, the first EU-wide legal foundation for the use of electronic signatures in cross-border electronic transactions. As technological capabilities advanced, the initial eIDAS 1.0 framework was increasingly criticized for its limitations and lack of comprehensiveness. Emerging decentralized approaches further exposed these shortcomings and introduced the possibility of integrating innovative identity paradigms, such as Self-Sovereign Identity (SSI) models. In this article, we analyse key provisions of the eIDAS 2.0 Regulation and its accompanying recitals, drawing on existing literature to identify legislative gaps and implementation challenges. Furthermore, we examine the European Digital Identity Architecture and Reference Framework (ARF), assessing its proposed guidelines and evaluating the extent to which its emerging implementations align with SSI principles.

Related papers

• A NIS2 pan-European registry for identifying and classifying essential and important entities [0.0]
  The NIS2 Directive establishes a common cybersecurity governance model across the European Union.<n>This thesis presents an analysis of the NIS2 Directive in this context and translates its provisions into concrete technical requirements.<n>Using the Design Science Research methodology, the thesis transforms complex legal provisions into structured, deterministic classification algorithms.
  arXiv  Detail & Related papers  (2025-08-26T19:40:33Z)
• Bridging the Mobile Trust Gap: A Zero Trust Framework for Consumer-Facing Applications [51.56484100374058]
  This paper proposes an extended Zero Trust model designed for mobile applications operating in untrusted, user-controlled environments.<n>Using a design science methodology, the study introduced a six-pillar framework that supports runtime enforcement of trust.<n>The proposed model offers a practical and standards-aligned approach to securing mobile applications beyond pre-deployment controls.
  arXiv  Detail & Related papers  (2025-08-20T18:42:36Z)
• Never Compromise to Vulnerabilities: A Comprehensive Survey on AI Governance [211.5823259429128]
  We propose a comprehensive framework integrating technical and societal dimensions, structured around three interconnected pillars: Intrinsic Security, Derivative Security, and Social Ethics.<n>We identify three core challenges: (1) the generalization gap, where defenses fail against evolving threats; (2) inadequate evaluation protocols that overlook real-world risks; and (3) fragmented regulations leading to inconsistent oversight.<n>Our framework offers actionable guidance for researchers, engineers, and policymakers to develop AI systems that are not only robust and secure but also ethically aligned and publicly trustworthy.
  arXiv  Detail & Related papers  (2025-08-12T09:42:56Z)
• DIRF: A Framework for Digital Identity Protection and Clone Governance in Agentic AI Systems [2.8257837699423933]
  Digital cloning, sophisticated impersonation, and the unauthorized monetization of identity-related data pose significant threats to the integrity of personal identity.<n>Mitigating these risks requires the development of robust AI-generated content detection systems, enhanced legal frameworks, and ethical guidelines.<n>This paper introduces the Digital Identity Rights Framework (DIRF), a structured security and governance model designed to protect behavioral, biometric, and personality-based digital likeness attributes.
  arXiv  Detail & Related papers  (2025-08-04T02:27:14Z)
• Zero-Trust Foundation Models: A New Paradigm for Secure and Collaborative Artificial Intelligence for Internet of Things [61.43014629640404]
  Zero-Trust Foundation Models (ZTFMs) embed zero-trust security principles into the lifecycle of foundation models (FMs) for Internet of Things (IoT) systems.<n>ZTFMs can enable secure, privacy-preserving AI across distributed, heterogeneous, and potentially adversarial IoT environments.
  arXiv  Detail & Related papers  (2025-05-26T06:44:31Z)
• Securing External Deeper-than-black-box GPAI Evaluations [49.1574468325115]
  This paper examines the critical challenges and potential solutions for conducting secure and effective external evaluations of general-purpose AI (GPAI) models.<n>With the exponential growth in size, capability, reach and accompanying risk, ensuring accountability, safety, and public trust requires frameworks that go beyond traditional black-box methods.
  arXiv  Detail & Related papers  (2025-03-10T16:13:45Z)
• On the Trustworthiness of Generative Foundation Models: Guideline, Assessment, and Perspective [377.2483044466149]
  Generative Foundation Models (GenFMs) have emerged as transformative tools.<n>Their widespread adoption raises critical concerns regarding trustworthiness across dimensions.<n>This paper presents a comprehensive framework to address these challenges through three key contributions.
  arXiv  Detail & Related papers  (2025-02-20T06:20:36Z)
• AILuminate: Introducing v1.0 of the AI Risk and Reliability Benchmark from MLCommons [62.374792825813394]
  This paper introduces AILuminate v1.0, the first comprehensive industry-standard benchmark for assessing AI-product risk and reliability.<n>The benchmark evaluates an AI system's resistance to prompts designed to elicit dangerous, illegal, or undesirable behavior in 12 hazard categories.
  arXiv  Detail & Related papers  (2025-02-19T05:58:52Z)
• Assessing the Trustworthiness of Electronic Identity Management Systems: Framework and Insights from Inception to Deployment [9.132025152225447]
  This paper introduces an integrated Digital Identity Systems Trustworthiness Assessment Framework (DISTAF)<n>It is supported by over 65 mechanisms and over 400 metrics derived from international standards and technical guidelines.<n>We demonstrate the application of DISTAF through a real-world implementation using a Modular Open Source Identity Platform (MOSIP) instance.
  arXiv  Detail & Related papers  (2025-02-15T11:26:30Z)
• A Systematisation of Knowledge: Connecting European Digital Identities with Web3 [0.8999666725996974]
  The term self-sovereign identity (SSI) and decentralised identity are often used interchangeably. This article aims to provide a clear distinction between the two concepts in relation to the revised Regulation as Regards establishing the European Digital Identity Framework (eIDAS 2.0)
  arXiv  Detail & Related papers  (2024-09-26T22:35:25Z)
• Exploring the Risks and Challenges of National Electronic Identity (NeID) System [8.93312157123729]
  We discuss the different categories of NeID risk and explore the successful deployment of these systems. We highlight the best practices for mitigating risk, including implementing strong security measures, conducting regular risk assessments, and involving stakeholders in the design and implementation of the system.
  arXiv  Detail & Related papers  (2023-10-24T13:09:50Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.