Every credential in a wallet is signed by someone. A check in another country is only as good as the checker’s way of knowing who that is, and why to believe them.
Each EU country names who issues the identity in its wallet, and the EU publishes the list.
Each EU country tells the Commission who issues the identity in its wallet, and the Commission publishes the list, so a checker anywhere can verify it. What the rules require is that online public services accept it. Nothing we found obliges anyone to accept it in a check made in person. We have not confirmed when the rules apply in Norway, and no source says who will issue the identity there.
More on this: Each EU country names who issues the identity in its wallet, and the EU publishes the list.
The game asks: “What would make other countries trust the identity in your EUDI wallet?”
What we know
Member states enrol wallet users under the requirements for assurance level high.1
The Commission publishes a list of what the member states have notified, among it who issues the identity in each country’s wallet.2
For each issuer of the identity, the member state notifies the certificates that its signature on the identity can be checked with.3
In the EU’s technical framework (ARF), the checker validates the signature on the identity against the Commission’s list of identity issuers.4
Whoever asks for the identity or a credential is itself responsible for checking that it is genuine and valid.5
Where a public body asks for electronic identification for an online service, the member state must also accept the wallet.6
Private services that must use strong authentication to identify users online must accept the wallet when the user asks for it, no later than 36 months after the implementing acts entered into force. Micro and small enterprises are excepted.7
The Swedish government has given the police the task of preparing to issue the identity in the wallet (PID).8
Not settled
We found no rule that obliges anyone to accept the wallet in a check made in person, such as at the border or in a shop.
We have not confirmed when the rules on accepting the wallet apply in Norway, through the EEA agreement.
No source says who will issue the identity in the real Norwegian wallet. The government says it is following up a study of the question.9
On the trip: In the setup, when Kari gets her identity, and in every check after it: each one asks for the identity first.
Sources
CIR 2024/2977 Art. 3(7)Member States shall enroll wallet users in accordance with the requirements relating to enrolment at assurance level high
CIR 2024/2980 Art. 5(2) (as amended 2026)the Commission shall establish, maintain and publish a list compiling the information notified by Member States on wallet providers, providers of person identification data, providers of wallet-relying party access certificates and providers of wallet-relying party registration certificates
CIR 2024/2980 Annex II, section 3(1)(h)that can be used to verify the signature or seal created by the provider of person identification data on the person identification data it provides
ARF Annex 2, OIA_12a Relying Party SHALL validate the signature of a PID using a trust anchor provided in a PID Provider LoTE
Reg (EU) 2024/1183, Art. 5b(9)Relying parties shall be responsible for carrying out the procedure for authenticating and validating person identification data and electronic attestation of attributes requested from European Digital Identity Wallets.
Reg (EU) 2024/1183, Art. 5f(1)Where Member States require electronic identification and authentication to access an online service provided by a public sector body, they shall also accept European Digital Identity Wallets that are provided in accordance with this Regulation.
Reg (EU) 2024/1183, Art. 5f(2)those private relying parties shall, no later than 36 months from the date of entry into force of the implementing acts referred to in Article 5a(23) and Article 5c(6) and only upon the voluntary request of the user, also accept European Digital Identity Wallets that are provided in accordance with this Regulation.with the exception of microenterprises and small enterprises as defined in Article 2 of the Annex to Commission Recommendation 2003/361/EC
DiggRegeringen ger Polismyndigheten i uppdrag att förbereda utfärdandet av uppgifter för personidentifiering för fysiska personer (PID)
A public body can issue from its register, but we found no shared rulebook for hunting.
The EU’s rules give a way: a public body that is responsible for a register can issue from it, and such a document is recognised in every member state. But we found no shared rulebook for hunting, so nothing we found tells a Swedish hunt leader how to read a Norwegian hunter exam.
More on this: A public body can issue from its register, but we found no shared rulebook for hunting.
The game asks: “Who should vouch for your hunter exam and shooting test, and how can a hunt leader or game warden in another country read and trust them?”
What we know
The municipality holds the hunter exam, under instructions set by Landbruksdirektoratet.1
Local clubs in DFS or NJFF, or others approved by Landbruksdirektoratet, hold the shooting test, and the organiser attests the diploma for a passed test. An inspector approved by the organiser gives the receipt for a passed test.2,3,4
The Regulation defines a public body’s credential as one issued by the public body responsible for an authentic source, such as a register, or by a public body the member state names to issue on its behalf.5
A credential issued by, or on behalf of, a public body responsible for its source in one member state is recognised as a public body’s credential in every member state.6
Member states notify the public bodies that issue credentials to the Commission, which publishes the list, signed and readable by machines.7
Qualified providers are made known through the trusted list that each member state publishes.8
The Commission keeps a public catalogue of schemes for credentials.9
The regulation on the catalogue covers credentials from qualified providers and public bodies.10
An issuer of such credentials in a registered scheme must follow the scheme.11
Not settled
As far as we found, Swedish law asks for no shooting test for elk, and a Swedish host may accept the Norwegian shooting test instead of the elk shooting badge.
Apart from the rulebooks for the identity and the driving licence, we found none in the framework, and none for hunting, firearms or pets anywhere.
We found no EU act, ISO standard, Nordic agreement or proposal that defines a hunting licence shared across countries, or a common digital format for one.
On the trip: When Kari fetches her hunter exam and her shooting test, and when the hunt leader in Sweden reads them.
Sources
Hunting regulation § 10Kommunen arrangerer elektronisk jegerprøveeksamenEksamenen gjennomføres i henhold til denne forskrift og instruks om innhold og gjennomføring av jegerprøven fastsatt av Landbruksdirektoratet.
Hunting regulation § 19Skyteprøven kan arrangeres og ledes av lokale lag og foreninger som er tilsluttet Det Frivillige Skyttervesen eller Norges Jeger- og Fiskerforbund.Andre som disponerer skytebane kan etter søknad til Landbruksdirektoratet bli godkjent som arrangør.
Hunting regulation § 20Vitnemål for bestått skyteprøve attesteres av arrangøren på standardisert skjema.
LandbruksdirektoratetSkyteprøvekontrollør som er godkjent av arrangør, avgir kvittering for bestått skyteprøve elektronisk eller på papir.
Reg (EU) 2024/1183, Art. 3(46)issued by a public sector body that is responsible for an authentic source or by a public sector body that is designated by the Member State to issue such attestations of attributes on behalf of the public sector bodies responsible for authentic sources
Reg (EU) 2024/1183, Art. 45b(3)shall be recognised as an attestation of attributes issued by or on behalf of a public sector body responsible for an authentic source in all Member States.
Reg (EU) 2024/1183, Art. 45f(3)Member States shall notify public sector bodies referred to in Article 3, point (46), to the Commission.The Commission shall make available to the public, through a secure channel, the list of public sector bodies referred to in Article 3, point (46), in electronically signed or sealed form suitable for automated processing.
Reg (EU) No 910/2014, Art. 22(1)Each Member State shall establish, maintain and publish trusted lists, including information related to the qualified trust service providers for which it is responsible, together with information related to the qualified trust services provided by them.
CIR 2025/1569 Art. 8(1)The Commission shall establish and publish a catalogue of schemes for the attestation of attributes
CIR 2025/1569 Art. 1(4)catalogue of attributes and catalogue of schemes for the attestations of attributes referred to in points (1) and (2);
The wallet shows who provides a document before you accept it.
In the EU’s technical framework, the wallet shows who provides a new document before it stores it. We found nothing on what it shows when the provider is not the body that answers for the content by law, as when one organisation runs a register for another.
More on this: The wallet shows who provides a document before you accept it.
The game asks: “Your wallet names a different issuer from the website you’re on. Who should be named, and how can you tell it isn’t phishing?”
What we know
Every issuer identifies itself to the wallet with a certificate.1
The wallet asks for a credential only from a party whose certificate shows it is registered as an issuer.2
In the ARF, before it stores a new credential the wallet shows the user who its provider is, from the provider’s certificate.3
The certificate behind a public body’s signature on a credential states that the body answers for the source under law, or is named to act for the body that does, and names that law.4,5
Not settled
In the game, a credential names the body that answers for its content by law, also when another organisation runs the register or the website it is fetched from.
We found nothing on what the wallet shows when the provider of a credential is not the body that answers for its content by law.
On the trip: When Kari fetches her hunter exam: the website belongs to one organisation, and her wallet names another as the issuer.
Sources
CIR 2024/2977 Art. 4(2)Providers of electronic attestations of attributes shall identify themselves to wallet units using their wallet-relying party access certificate.
CIR 2024/2982 Art. 4(2)only from parties having an authentic and valid wallet-relying party access certificate attesting them as:
ARF Annex 2, ISSU_11The Wallet Instance SHALL also inform the User about the identity of the PID Provider or Attestation Provider, using the subject information in the PID Provider's or Attestation Provider's access certificate.
Reg (EU) 2024/1183, Art. 45f(1)(b)(i)indicating that the issuing body is established in accordance with Union or national law as the responsible for the authentic source on the basis of which the electronic attestation of attributes is issued or as the body designated to act on its behalf;
We found no specification for a digital European firearms pass.
Under the EU’s rules, a wallet document from a public body has the same legal effect as the paper one. But those rules leave each sector’s own rules on the form of documents as they are, and we found no specification for a digital European firearms pass.
More on this: We found no specification for a digital European firearms pass.
The game asks: “What would a digital firearms licence need to say for the police in another country to understand and trust it?”
What we know
The hunter must carry the Norwegian firearms licence, or a European firearms pass with the rifle in it, and be able to show it.1
A credential from a qualified provider, or from a public body responsible for the source behind it, has the same legal effect as the lawfully issued paper document.2
A credential issued by, or on behalf of, a public body responsible for its source in one member state is recognised as a public body’s credential in every member state.3
The Regulation leaves other EU and national rules on the form of documents as they are.4
A recital says that each sector’s own rules on the form of documents stand.5
EU law sets what the European firearms pass must contain, and that it is valid for at most five years.6
Not settled
We found no proposal or technical specification for a digital European firearms pass.
On the trip: When Kari fetches her firearms licence from the police, and when Swedish customs and police read it.
Sources
Vapenförordningen 10 kap. 11 §I stället för ett sådant tillstånd får ett europeiskt skjutvapenpass som meddelats i något av dessa länder och i vilket vapnet är antecknat medföras och visas upp.ska under vistelsen med vapnet här i landet medföra och kunna visa upp tillstånd från en behörig myndighet i Danmark, Finland eller Norge
Reg (EU) 2024/1183, Art. 45b(3)shall be recognised as an attestation of attributes issued by or on behalf of a public sector body responsible for an authentic source in all Member States.
Reg (EU) 2024/1183, Art. 2(3)This Regulation does not affect Union or national law related to the conclusion and validity of contracts, other legal or procedural obligations relating to form, or sector-specific requirements relating to form.
Reg (EU) 2024/1183, recital 55without prejudice to Union or national law defining additional sector-specific requirements as regards form with underlying legal effects
Dir 2021/555 Art. 1(3)It shall be valid for a maximum period of five years, which may be extended, and shall contain the information set out in Annex II.
As we read the rules, a second vet can’t add to a document the first vet issued.
On paper, every vet writes into one passport, also the vet abroad who gives the tapeworm treatment. A document in a wallet is signed by its issuer, and in the EU’s technical framework only that issuer can issue it anew. As we read it, the treatment becomes a document of its own that counts for a few days; a checker can ask for both and match them by the chip. We found no specification for a digital pet passport yet.
The paper pet passport
The dog, its chip and its owner, from the vet who issues it
The tapeworm treatment, written in by the vet who gives it
All of it in one book
In a wallet, as we read the rules
A pet passport: the dog, its chip and its owner, from the vet who issued it
A tapeworm treatment of its own, from the vet who gave it, counting for a few days
Asked for together, and matched by the chip number
As we read the rules, one book that many vets write in becomes documents that each have one issuer and their own validity.More on this: As we read the rules, a second vet can’t add to a document the first vet issued.
The game asks: “Who should vouch for Tass’s papers: the vet, a register, or someone else?”
What we know
Only a vet may issue the EU pet passport. In Norway, an authorised vet has the right to issue it.1,2
DyreID keeps a register of microchipped pets in Norway. It is owned by the Norwegian Veterinary Association.3
The register or system that a credential’s details come from, called an authentic source, can be kept by a public body or by a private organisation.4
The vet who treats the dog for tapeworm records it in the passport.5
In the EU’s new model passport, the number of pages and the size of the boxes may be adjusted to cover how long the animal is expected to live.6
A vet in Sweden treats the dog for tapeworm 24 to 120 hours before it enters Norway, and records it in the passport. Mattilsynet says the vet must be in the country the dog is leaving.5
In the SD-JWT format, the issuer signs the credential to protect its details, and the checker must check that signature, to make sure nothing was changed since it was issued.7
In the ARF, when a detail in a revocable credential changes, or one is added or removed, and the credential still has at least 24 hours to run, the issuer revokes it. The issuer should then ask the user to fetch a new one.8
In the ARF, issuing a credential anew means replacing the one in the wallet, so the provider that issued it first does it.9
With the protocol for showing credentials online (OpenID4VP), one request can ask for several credentials, each by a query of its own.10
A recital says it should be possible for the user to show details from several credentials at once.11
Within two years, the Commission is to assess with the member states how the pet passport could be made digital, including the option of using the EUDI wallet.12
Not settled
In a paper passport, a second vet writes the tapeworm treatment into the passport that the first vet issued. As we read the rules, a second vet can’t add to a credential another vet issued: the first vet’s signature covers all of it, and only the first vet can issue it anew. The second vet would issue a credential of its own. No passage says so directly.
As we see it, the dog’s documents in a wallet would be at least two kinds: the passport, with the dog, its microchip and its owner, from the vet who issued it; and each treatment, from the vet who gave it, valid for as long as it counts. Whether the microchip’s registration is part of the passport or a credential of its own is open.
As we see it, each of them would carry the dog’s microchip number, so that a checker who asks for them together can see that they are about the same dog.
We found no EU specification yet for a digital or wallet version of the pet passport.
No source says who would issue a vaccination credential: each vet clinic, a vets’ association, DyreID, or a shared vaccine register.
On the trip: At the vet before the trip, and at the vet in Sweden who treats Tass before the trip home.
Sources
MattilsynetDu som er autorisert veterinær, har rettigheter til å utstede kjæledyrpass
JordbruksverketDet är bara en veterinär som får utfärda passet.
DyreIDDyreID er eid av Den norske veterinærforening og har siden stiftelsen i 1993 driftet et sentralt dataregister over ID-merkede kjæledyr i Norge
Mattilsynetdokumenteres i EU-kjæledyrpasset eller EU-helsesertifikatet av veterinærengjennomføres mellom 24 og 120 timer før hunden kommer til Norgegjennomføres av en autorisert veterinær i landet hunden reiser fra når den skal til Norge
RFC 9901, section 9.1The JWT MUST be signed by the Issuer to protect the integrity of the issued claims.The Verifier MUST always check the signature of the Issuer-signed JWT to ensure that it has not been tampered with since its issuance.
ARF Annex 2, VCR_09If a technical PID or attestation is revocable, the PID Provider or Attestation Provider SHALL revoke that PID or attestation if the value of one or more of the attributes in the corresponding logical PID or attestation was changed (including attributes being added or deleted) and the technical PID or attestation is still valid for at least 24 hours.ask the User to request re-issuance of the PID or attestation using their Wallet Unit.
ARF ch. 6.6.6.2.1 (rendered)Re-issuance is therefore always performed by the same PID Provider or Attestation Provider
OpenID4VP 1.0, section 6A non-empty array of Credential Queries as defined in Section 6.1 that specify the requested Credentials.
Reg (EU) 2024/1183, recital 59It should be technically possible for the user to selectively disclose attributes, including from multiple, distinct electronic attestations, and to combine and present them seamlessly to relying parties.
Commission statement C/2026/4812is to be carried out within 2 years, in coordination with Member States, including considering major technical, practical, and infrastructural conditions and the option of using the European Digital Identity Wallet
Any registered provider can issue a document. How a checker knows it is real is left to its rulebook.
In the EU’s technical framework, any provider that is registered can issue a wallet document, so a hunting team could. How a checker in another country finds out that the issuer is real is left to each kind of document’s own rulebook, and we found none for invitations.
More on this: Any registered provider can issue a document. How a checker knows it is real is left to its rulebook.
The game asks: “How can the person checking it know that an invitation comes from a real hunting team with the right to hunt, and who answers if it’s wrong?”
What we know
Norway and Sweden both ask a hunter who brings firearms with a European firearms pass to carry documentation of the hunt, such as an invitation.1,2
In the ARF, any provider can issue credentials that are not qualified.3
In the ARF, a member state approves a provider of credentials by a set policy before it registers it.4
An issuer of such credentials registers, with what it is entitled to issue.5
A member state may narrow which credentials such an issuer may issue.6
In the ARF, the checker of a credential that is neither qualified nor from a public body finds the issuer’s certificate in whatever way the credential’s rulebook says.7
The ARF says such a rulebook should say how checkers get the issuers’ certificates: a recommendation, not a requirement.8
The ARF leaves lists of other issuers outside its scope.9
The ARF expects other legal or contractual frameworks to decide whether such credentials are recognised.3
What organisations told us
There is no digital system for invitations today, and much is done on trust. A simple agreement between the hunting team and the invited hunter was suggested at the workshop.10
Not settled
In practice the landowner, the hunting team, the leader of the hunt or a tour operator may write the invitation.
As far as we found, no register holds permissions to hunt or invitations: they are agreements between the hunter and the holder of the hunting rights.
On the trip: When the hunting team sends Kari its invitation, and when customs read it at the border.
Sources
Våpenforskrifta § 10-15Slik dokumentasjon kan til dømes vere deltakarliste, innbyding til jakt eller invitasjon frå godkjent våpensamlar.
Vapenlagen 8 kap. 5 §Personen ska medföra dokumentation som styrker att föremålen ska användas vid jakt eller tävling i Sverige.
ARF ch. 3.8 (rendered)Non-qualified EAAs can be provided by any (non-qualified) Trust Service Provider.mostly govern the rules for provision, use and recognition of EAAs.
ARF Annex 2, Reg_21A Member State SHALL approve an Attestation Provider according to a well-defined policy before including it in its Attestation Provider Registry.
CIR 2025/848 Annex I(12)(c)‘Non_Q_EAA_Provider’ to express the entitlement of the wallet-relying party as a trust service provider issuing non-qualified electronic attestations of attributes;
CIR 2025/848 Annex I(13)Member States may provide additional sub-entitlements to state which attestations a specific non-qualified issuer of electronic attestation of attributes shall issue.
ARF Annex 2, OIA_15a Relying Party SHALL validate the signature of a non-qualified EAA using a trust anchor provided according to the mechanism(s) specified in the applicable Attestation Rulebook
ARF Annex 2, ARB_26SHOULD define in the Rulebook the mechanism(s) allowing a Relying Party to obtain, in a trustworthy manner, the trust anchor(s) of the EAA Providers issuing this type of EAA.
ARF ch. 3.5 (rendered)Trusted Lists and Trusted List Providers may also exist for non-qualified EAA Providers. However, this is out of scope of the ARF.
Workshop on hunting, October 2026 (not published)
What could be started on now
Write a shared rulebook for hunting credentials (hunter, hunting fee, exam, shooting test and tracking dog), following the EU’s rules for rulebooks, so that Norway and Sweden can read each other’s credentials.
Register the rulebooks in the EU catalogue of schemes, so that other countries and wallets can find them.
Decide, for each document on the trip, which body vouches for it by law, and whether that body can issue it as the public body responsible for the register behind it.
For the invitation and other credentials from private parties, say in the rulebook how a checker in the other country finds out that the issuer is real.
