Level of Assurance
Level of Assurance (LoA) is a formal, legally defined measure of how much confidence a relying party can have that a person really is who they claim to be. It is not a technical implementation detail — it is a legal and risk classification that then drives your technical requirements.
The three levels
eIDAS defines three levels of assurance:
| Level | What it means, in plain terms |
|---|---|
| Low | Some confidence in the claimed identity. Reduces the risk of misuse or alteration, but with limited safeguards. Suitable for low-risk interactions. |
| Substantial | Substantial confidence. Meant to reduce identity-related risk considerably, with stronger technical and procedural safeguards than Low. |
| High | The highest confidence available. Designed to prevent misuse or alteration of identity even against attackers with significant capabilities. Required wherever identity fraud would cause serious harm. |
Think of it as a sliding scale of "how sure do I need to be, and how hard would it be for someone to fake it?" — the higher the level, the stronger the safeguards required to reach it.
Where is this defined?
LoA is not an EUDI-specific invention — it comes directly from EU law:
- eIDAS Regulation (EU) No 910/2014 — the original regulation that introduced the concept of assurance levels for electronic identification.
- Commission Implementing Regulation (EU) 2015/1502 — sets out the precise minimum technical specifications and procedures that define what Low, Substantial, and High actually require in practice.
- Regulation (EU) 2024/1183 ("eIDAS 2.0") — amends the original eIDAS Regulation to establish the European Digital Identity Framework, including the EUDI Wallet. It carries the same LoA concept forward into the wallet-based ecosystem.
Choosing the right LoA for your use case
As a Relying Party, the LoA you require is primarily a legal and risk-driven decision, not a technical preference. Ask: if the claimed identity turned out to be false or manipulated, how serious would the consequences be — for the person, for you, or for others?
- Low-risk interactions (for example, a newsletter sign-up, a low-value loyalty program) rarely need more than Low or Substantial.
- Higher-risk interactions — anything involving money, legal obligations, regulated services, or sensitive personal data — typically require High. Opening a bank account is a concrete example: it must be done at LoA High, as shown in the Berlin Digital Bank example.
Often the level is not actually yours to choose freely: sector-specific regulation (for example, anti-money-laundering rules in finance, or requirements for public-sector services) may already mandate a specific LoA for your use case. If you are unsure which level applies to you, this is a question for your legal or compliance function, not a purely technical decision.
Does this apply beyond PID?
Yes. LoA is a general eIDAS concept about the strength of identification, not something that only concerns the PID (Person Identification Data) credential.
- The PID is the foundational identity credential in the EUDI Wallet, and it is always issued and used at LoA High — it anchors trust for everything else.
- Other attestation types — EAA, QEAA, PUB-EAA (see What is a Credential?) — are not identity credentials themselves, but presenting any attestation still relies on the wallet correctly authenticating its holder. So the assurance question — "how confident am I that the right person is presenting this?" — remains relevant whenever strong assurance matters, even outside the PID itself.
This page explains LoA conceptually. For the architectural and technical consequences of each level — required credential formats, certificate requirements, key binding, and audit obligations — see Understanding the basics.