Compliance

eIDAS Verifier is the product in the Thoryn catalog most tightly bound to the EU regulatory surface. Its compliance story is the regulation itself.

ARF 1.4+ (Architecture and Reference Framework)

The verifier is ARF-conformant: full OpenID4VP flow, SD-JWT VC format, W3C Presentation Exchange 2.0, selective disclosure, holder binding, trust-chain resolution via Trust Registry, status-list revocation. mdoc support per ISO 18013-5. Wallet-attestation verification (roadmap) for the attestation chain.

eIDAS 2.0 (Regulation (EU) 2024/1183)

Under Art. 5a–5d, a relying party verifying EUDIW credentials has specific obligations:

• Publish an RP-register entry with your member state's register
• Request only the minimum necessary attributes — enforced by the verifier's presentation definitions
• Retain presentation audit records for the period specified by your member state
• Offer user control — presentation definitions carry display metadata so wallets render informed-consent screens

The verifier supports every technical obligation. The registration obligation is operator-side; we provide the playbook.

ISO 18013-5 (mdoc)

For mobile-driving-licence-format credentials, the verifier implements ISO 18013-5 mdoc parsing and cryptographic validation. Compatible with legacy ISO-18013-compliant readers (e.g. physical passport readers at borders).

EUDI Wallet implementing acts

The Commission's implementing acts under eIDAS 2.0 specify the technical details of wallet attestation, trust-list publication, and interoperability profiles. The verifier tracks the latest published acts and ships updates without requiring relying-party integration changes.

Conformance testing

CI runs the verifier against the NL reference wallet, the EU reference wallet, and the ARF conformance suites. Conformance failures block releases. Relying parties inherit conformance — you don't have to certify independently.