ADR-001: Elevate EUDI Wallet to HIGH priority in response to EU Commission age verification mandate
Date: 2026-04-16
Status: Accepted
Deciders: Mahmoud (GloryLabs)
Context
On 2026-04-15 the European Commission announced a technology framework for mandatory online age verification, built on the EUDI Wallet ecosystem (OpenID4VP + ISO 18013-5 mdoc / SD-JWT). Key facts:
- Platforms face substantial fines under DSA Article 28b for insufficient age verification
- EUDI Wallets must be available in select EU countries by end of 2026
- The Netherlands is building NL ID-wallet as its EUDI implementation
- The EU framework is a "floor" — platforms that adopt it are considered DSA-compliant
- Critics note VPN bypass is possible but the Commission considers it unavoidable
Source: https://nos.nl/artikel/2610545-europese-commissie-wil-strengere-online-leeftijdscontrole-geen-smoesjes-meer
ValideerLeeftijd's existing roadmap had EUDI Wallet as LOW priority in Phase 4–5. This ADR records the decision to elevate it.
Decision
Elevate EUDI Wallet / OpenID4VP from LOW (Phase 4–5) to HIGH (Phase 5 / v2.0).
Concurrently, add:
- DSA signed verification receipts (#36) — immediately valuable across all existing methods; platforms need audit evidence now
- NL ID-wallet tracking (#34) — monitor and integrate when public beta ships
- ID document scan (#35) — covers users without wallet or bank account
Rationale
- Regulatory certainty: The EU mandate removes market uncertainty — EUDI Wallet is the direction, not a bet.
- First-mover advantage: Being ready before the mandate lands (end 2026) is a commercial advantage — Dutch platforms will scramble.
- Technical alignment: ValideerLeeftijd already implements the Yivi QR+disclosure pattern. EUDI Wallet is conceptually identical but uses OpenID4VP instead of IRMA protocol. The learning is already done.
- DSA receipts are immediate: Issue #36 (signed JWT receipts) can be shipped in days, adds compliance value to all existing methods, requires no external dependencies.
Consequences
- EUDI Wallet becomes v2.0 scope (previously v3.0)
- Face scan (Yoti) de-prioritised to Phase 6 — lower regulatory urgency
- New issues created: #33 (EUDI), #34 (NL ID-wallet), #35 (document scan), #36 (DSA receipts), #37 (age token)
- VERIFICATION_METHODS_PLAN.md updated to reflect new priority order
CLAUDE.md roadmap updated
Deferred
- Social media minimum age enforcement: the Commission is assembling an expert panel (findings expected summer 2026). We monitor but do not build until direction is clearer.
- VPN/proxy detection: acknowledged as an unavoidable limitation by the Commission itself. Not worth building.
Reacties