Authentic source

An authentic source is the legally authoritative register - such as the BRP - that EUDI Wallet attestations verify attributes against under eIDAS 2.

An authentic source is a repository or system that holds the authoritative value of an attribute: the population register (BRP) for name and birth date, the business register for company data, a professional register for licences, or a vehicle register for a vehicle's details. Article 3(47) of eIDAS 2 defines it as a repository or system, held under the responsibility of a public sector body or a private entity, that contains and provides attributes about a natural or legal person or an object, and that is considered a primary source of that attribute or is recognised as authentic in Union or national law, including administrative practice. The terms authoritative source, base registry, and the Dutch 'gezaghebbende bron' are sometimes used informally for the same concept, but eIDAS 2 itself uses 'authentic source' ('authentieke bron' in Dutch). An authentic source's value is generally treated as legally authoritative for the attribute it holds, though - like any register - the source itself can still contain errors. In the Dutch basisregistraties, for example, this is reinforced by a statutory duty of mandatory use under laws such as the Wet basisregistratie personen (BRP) and the Handelsregisterwet 2007: public bodies must rely on the registered value, and any copy that differs from it is treated as incorrect. Dutch basisregistraties are a national example of this concept, but the two are not identical: not every eIDAS 2 authentic source is a Dutch basisregistratie, and not every basisregistratie is designated for cross-border attribute verification - the Basisregistratie Grootschalige Topografie (BGT), for example, holds topographic map data that eIDAS 2 attestation providers have no cause to verify attributes against. Which Dutch basisregistraties are additionally designated as authentic sources for eIDAS 2 purposes follows from national implementation of eIDAS 2, alongside related national frameworks such as the Wet digitale overheid (Wdo); at the time of writing, this designation is still being completed for several registers.

In the EUDI ecosystem, Article 45e of eIDAS 2 obliges member states to ensure that qualified providers issuing QEAAs can verify relevant attributes electronically against the applicable public-sector authentic source, at the user's request, within a deadline set by related implementing acts. This applies at least to the attributes listed in Annex VI, where a public-sector authentic source is relied on.

For person identification data, Regulation (EU) 2024/2977 - the implementing regulation on PID - and the Architecture and Reference Framework (ARF) specify that this verification takes place when the attestation is issued, rather than each time it is later presented to a relying party. For other attribute categories, the ARF describes the same issuance-time approach as a design choice rather than a requirement spelled out in Article 45e itself. Because verification typically happens only at issuance, an attestation's data can become stale if the authentic source changes afterwards; whether the attestation remains trustworthy then depends on revocation and status list mechanisms, not on the authentic source itself.

Because the wallet presents the resulting attestation rather than querying the register live, relying parties do not contact the authentic source directly during that presentation flow, and the register itself learns nothing about when or where the attestation is later used. Public-sector bodies issuing Pub-EAAs are subject to a separate set of requirements under Article 45f of eIDAS 2, described in that entry. This link to a register is what makes a digital attribute more than a claim: it traces to the source that legally defines it. The overall rollout timeline for member states to offer the EUDI Wallet is covered in that entry; until it is complete, not every attribute category can yet be verified against an authentic source in every member state.