This case study illustrates how the Guidelines on the Sharing of Interoperability Solutions may be used in practice to support compliance with Article 4 of the Interoperable Europe Act. It presents Poland’s adaptation of the mObywatel ecosystem to the EUDI Wallet as an example of how an existing national digital public infrastructure can be reused, adapted and partially rebuilt to meet common European interoperability requirements. The case study does not provide a legal assessment of the Polish implementation itself, but explores how governance arrangements, certification approaches, semantic mappings, interface patterns, signature-integration practices, pilot lessons and operational know-how may become shareable interoperability assets, while highlighting the links between the implementation process and the operational pathways set out in the Guidelines.
1. Background and policy context
This case study forms part of a wider series examining how the Guidelines on the Sharing of Interoperability Solutions may be applied in practice. It examines how Poland can adapt the existing mObywatel ecosystem to provide an EUDI-compliant wallet, which national assets can be reused, and which legal, organisational, semantic and technical capabilities must be adapted or newly established. Its relevance for the sharing of interoperability solutions lies in identifying which elements of Poland’s adaptation process - such as governance models, semantic mappings, certification approaches, interface patterns, onboarding playbooks, conformance evidence and operational know-how - could be documented and shared as reusable interoperability assets under the Interoperable Europe framework.
The analysis is structured around the four layers of the European Interoperability Framework (EIF): legal, organisational, semantic and technical interoperability. This framing is dictated by the scope of the EUDI Wallet, which goes beyond the technical layer. It also depends on binding legal effects, common trust rules, authentic sources, schema governance, issuer and verifier interoperability, certification, user control, and cooperation between public and private relying parties. [17], [18]
The case study draws on two complementary evidence sources:
Public-source research includes EU legislation, European Commission materials, Polish government and Centralny Ośrodek Informatyki (COI) communications, the UC122 legislative package , mObywatel service materials, pilot information and ENISA certification materials.
Stakeholder input is used to clarify practical implementation choices, governance arrangements, challenges and lessons learned. Unless independently supported by public sources, stakeholder input should be understood as contextual evidence rather than as a formal position of the Polish government.
Rather than a single-purpose identity application, mObywatel is a mobile and web ecosystem for digital documents, public-service transactions, document verification and trust-service functions. Its scale gives Poland an established distribution channel, a tested user experience and substantial delivery capacity. The same scale also raises the stakes: existing users expect continuity, and any potential transition to the EUDI Wallet is expected not to degrade the established functionality of the ecosystem. Furthermore, the ecosystem predates the EUDI Wallet legislation and was not created with transnational interoperability as a goal. [4], [7], [21]
That being said, the domestic baseline is substantial. mObywatel already supports a plethora of national mobile documents and services, visual and cryptographic verification patterns, browser-based verification, integration with public services, and qualified electronic-signature flows delivered with qualified trust service providers. These capabilities reduce delivery risk, but they do not in themselves create cross-border legal or semantic portability. For example, the mObywatel service information states that mDowód (digital ID) cannot be used during a stay abroad. [7], [8], [9]
This creates the central case-study tension. Poland already operates a national digital wallet in practical terms, but the European wallet introduces a different legal and technical model. Existing domestic credentials remain tied to Polish law, Polish registers and Polish relying-party patterns. The task is therefore to Europeanise a mature national digital public infrastructure without losing the value of what already works. [10], [11], [12], [21]
|
Area |
Current Polish baseline |
Implication for EUDI adaptation |
| User base and trust | mObywatel operates on a national scale and is a familiar channel for citizens | The transition must protect continuity and avoid degrading existing services |
| Domestic services | Digital documents, public-service transactions, verification flows and signature functionality already exist | These assets can support implementation but remain nationally bounded unless aligned with EUDI rules |
| Verification patterns | Visual, QR-based and browser-based verification are already in use | Verifier patterns can inform EUDI use cases but must be adapted to EU trust, certificates and relying-party rules |
| Legal scope | Current mObywatel documents are valuable domestically but do not automatically have cross-border effect | Cross-border legal recognition requires eIDAS-compliant wallet credentials, attestations and trust arrangements |
The revised eIDAS framework establishes the European Digital Identity Wallet as a common European framework rather than as a single central EU application. Member States must provide at least one wallet under common specifications, and implementation is shaped by EU-level rules on wallet functions, person-identification data, electronic attestations of attributes, protocols, interfaces, notification, certification, identity matching, breach response and relying-party registration. [10], [11], [13], [14], [15], [16]
Poland's main domestic legal vehicle is draft bill UC122. The public-source material indicates that UC122 addresses wallet provision, relying-party registration, identity matching, verification against authentic sources, electronic attestations of attributes, national certification arrangements and related amendments to the mObywatel framework. Because the analysed file remained a draft, these elements should be treated as proposed arrangements until the legislative process is complete. [5], [6]
The Interoperable Europe Act is relevant as a wider governance lens. It does not replace eIDAS, but it reinforces the need for interoperability by design, reusable solutions, shared semantic assets, governance mechanisms and cross-border digital public services. In this case, the Act helps to frame what can be learned and shared from Poland's adaptation process. [17], [18]
2. EUDI implementation: from pilot to full mObywatel integration
The Polish approach to the implementation of the EUDI Wallet appears, on the basis of public sources and stakeholder input, to be a staged transition. Public-source evidence initially suggested ambiguity between separate and integrated approaches. Stakeholder consultation further clarified that Polish implementation actors describe this as risk-managed sequencing: first, a separate pilot to test EUDI-specific functionality; subsequently, possible integration into mObywatel once European standards, certification expectations and the cross-border ecosystem have matured. [1], [2], [3], [21]
| Phase | Description | Interoperability rationale |
| Phase 1 – separate pilot application |
According to stakeholder engagement, a separate wallet application is planned as a pilot environment so citizens can begin testing European wallet functionality. This should be read as a stakeholder-reported implementation plan rather than a confirmed production-state fact. |
This limits risk while standards, implementing acts and cross-border ecosystems continue to mature, and avoids disrupting the main national app too early. |
| Phase 2 – full integration into mObywatel |
Interviewees presented full integration into mObywatel as the long-term objective, with one application for citizens and no permanent dual-app model. The possible 2028 timing was provided as an estimate, but should not be seen as an official deadline |
This preserves the citizen-facing value of mObywatel while making EUDI-compliant functions part of the national ecosystem. |
This staged approach should be read as a stakeholder-reported risk-management logic. It would be difficult to justify disrupting a broadly used service solely to accelerate regulatory compliance while the broader European ecosystem is still maturing. The separate pilot would therefore provide a protected environment for testing, conformance work and user feedback, while preserving the strategic objective of one citizen-facing application. [21]
3. Reuse, adaptation and rebuilding
For the Polish case, the central reuse distinction is between supporting infrastructure and the certified wallet core. Interviewees indicated that Poland can reuse parts of the mObywatel ecosystem directly, adapt other parts as operational capability, and rebuild the EUDI-specific wallet core where European requirements differ materially from the domestic model. [21]
| Category | What it includes | Implication for the case study |
| Reuse directly where possible |
Common design system, reusable UI components, shared front-end elements, backend services, microservices and existing building blocks developed for mObywatel. |
The mObywatel ecosystem is a real implementation asset. Reuse includes working code and services, not only policy continuity. |
| Adapt as ecosystem capability |
User onboarding experience, verification channels, service integration, trust-service partnerships, public-register connections and delivery know-how. |
These assets accelerate implementation but still need to be tested against EUDI assurance, certification, semantic and cross-border requirements. |
| Rebuild for EUDI compliance |
Core wallet functions requiring different cryptography, protocols, communication mechanisms, key management and EUDI-specific trust infrastructure. |
Existing domestic mobile-document functionality cannot be relabelled as an EUDI Wallet. The certified wallet core requires new or substantially redesigned foundations. |
This distinction also clarifies the conditions for meaningful reuse. Assets are more transferable when they are modular, evidence-based and maintainable. Their value depends not only on their existence, but on their ability to operate under common European rules, avoid reliance on purely national assumptions, and provide the conformance evidence required for certification and cross-border use.
Adaptation and resharing is particularly relevant where Poland examines or incorporates reusable EUDI components developed elsewhere and adapts them to mObywatel. This pathway helps frame what is modified, under which conditions adaptations may be reshared, and how the adapted elements remain maintainable and interoperable.
4. Interoperability analysis across the EIF layers
4.1 Legal interoperability
Legal interoperability means moving from domestic recognition to reliable cross-border legal effect. While mObywatel's current mobile documents are useful in Polish contexts, EUDI use requires Polish and foreign wallets, person-identification data, electronic attestations of attributes, signatures and relying-party requests to be recognised across borders. eIDAS 2.0 sets the common baseline; national law must assign the functions required to provide, certify, supervise, suspend and support the wallet, and to connect it with authentic sources and public services. [10], [13], [14], [15], [16]
UC122 is Poland's main legal instrument for this adaptation. Public sources indicate that it covers wallet provision, relying-party registration, identity matching, verification against authentic sources, electronic attestations of attributes, national certification arrangements and related changes to the mObywatel framework. The legal design must also allow controlled data exchange while preserving legal certainty and supporting GDPR assessment. [5], [6], [21]
4.2 Organisational interoperability
Organisational interoperability is a critical implementation layer. Public sources identify the Ministry of Digital Affairs and COI as central actors: the Ministry leads eIDAS 2 implementation, legislative work and programme coordination, while COI serves as the government's in-house software provider, technical developer and operator of key digital systems. Stakeholder engagement also indicated that Naukowa i Akademicka Sieć Komputerowa (NASK) is expected to act as Poland's conformity assessment body, and that the Institute of Communications is developing the national certification programme and methodology. These role descriptions should be treated as stakeholder-reported intended arrangements unless confirmed in adopted national measures. Commercial trust service providers remain relevant for signatures, certificates and future wallet functionality. [3], [8], [21]
| Actor or group | Role in the implementation model |
| Ministry of Digital Affairs | Policy lead for eIDAS 2 implementation, legislative work and overall coordination. |
| COI | In-house developer, technical operator and builder of digital identity services, national interoperability infrastructure and mObywatel functionality. |
| NASK | Stakeholder consultation identifies NASK as the intended conformity assessment body, drawing on certification and cybersecurity expertise; final status should be confirmed against adopted national arrangements. |
| Institute of Communications | Interviewees identify the Institute of Communications as developing the national certification programme, methodologies and processes; final status should be confirmed against adopted national arrangements. |
| Trust service providers | Providers of signatures, certificates and support for non-professional citizen signatures, with future wallet integration relevance. |
| Sectoral relying parties and issuers | Banks, telecoms, health, education, transport and public-service actors that must be onboarded into wallet use cases and trust relationships. |
The in-house model can itself be an interoperability asset. Shared technical standards, institutional knowledge, regulatory familiarity and a deep understanding of existing systems can speed up integration and adaptation. However, this model also has capacity limits: resources may not scale as quickly as demand, making sequencing and prioritisation essential. [21]
4.3 Semantic interoperability
Semantic interoperability is a substantial but less visible part of the transition. The EUDI framework depends on standardised person-identification data and electronic attestations of attributes, while Poland's existing ecosystem is based on national registers, identifiers and legal categories. Adaptation therefore requires clear mappings of meaning, provenance, assurance levels and update rules, including a firm distinction between EU-recognised credentials and credentials limited to domestic use. [13], [15]
UC122 is a relevant document because it refers to authentic sources, electronic attribute verification and semantic structures for attestations. In practice, the key questions are who owns each schema, who approves new versions, how register changes reach credentials and relying parties, how Polish-only attributes are separated from EU-recognised ones, and how identity matching works in cross-border cases. [6], [13], [15], [21]
4.4 Technical interoperability
Technical interoperability is where Poland's existing maturity is valuable but not sufficient. The mObywatel ecosystem already offers a scaled mobile channel, design system, user experience, verification patterns, backend services and trust-service integrations. The EUDI Wallet, however, requires common architecture, protocols and interfaces; issuance and presentation of Person Identification Data (PID) and Electronic Attestations of Attributes (EAA); selective disclosure; wallet and relying-party trust; registration and access certificates; identity matching; revocation; breach response; conformance testing; and certification evidence. [11], [12], [13], [14], [15], [16], [21]
Stakeholder engagement identified key management and secure storage as a particularly difficult technical challenge. The interviewees described ideal device-based secure storage as not widely available, required certified hardware as scarce, APIs as often unavailable, and many Member States as moving toward remote HSM approaches. This issue is central because the EUDI Wallet must meet high-assurance requirements while remaining deployable on real mobile devices. [21]
5. Example credential: mobile driving licence
A mobile driving licence provides a useful illustrative example, based primarily on stakeholder input. Poland already has relevant national data and domestic digital driving-licence functionality, while the EUDI Wallet adds the requirement for cross-border issuance, presentation and verification. [21]
| Lifecycle step | What happens | Interoperability issue |
| Authoritative source | Relevant driver and vehicle data originate in authoritative government registers. | The source must be legally authoritative, technically accessible and semantically mapped to the credential schema. |
| Issuance | A competent issuing authority creates the mobile driving licence credential and issues it into the user's wallet. | The issuer, schema, assurance level, signature/seal and revocation model must be EUDI-compatible. |
| Storage and presentation | The user stores the credential in the wallet and presents it to a relying party, for example during vehicle rental abroad. | Selective disclosure, user consent, proximity or remote presentation and cross-border trust must be implemented. |
| Verification | The relying party validates the credential. | The verifier must recognise issuer trust, credential validity, status information and permitted data use. |
This example is evolutionary for Poland because domestic building blocks already exist. The European challenge is to make the same type of credential usable outside the national legal and technical context, without requiring the citizen to carry a physical document or depend on purely domestic verification patterns. [21]
6. Certification, assurance and security
Certification is both a governance requirement and a technical dependency, not merely a final administrative step. The EUDI Wallet must demonstrate conformity with cybersecurity, functional and data-protection requirements. Public sources identify certification as a core area of the implementing regulations, while stakeholder engagement indicated that, as of July 2026, Poland was finalising its national certification programme. [14], [20], [21]
The role allocation described in stakeholder consultation is important but should be treated as intended or reported rather than final. According to the interviewees, NASK is expected to act as the conformity assessment body, and the Institute of Communications is developing the national certification programme and methodology. This model would build on existing cybersecurity and certification expertise, but readiness will depend on adopted national arrangements, institutional capacity, prepared evidence, stable technical requirements and the final certification scope. [21]
From an architectural perspective, the certification boundary is a key consequence of the staged pathway. If EUDI functionality starts in a separate pilot and later moves into mObywatel, Poland will need to define how certification, recertification, material changes, shared services and release management work across that transition. The study therefore recommends keeping the certified wallet core sufficiently isolated to support assurance and controlled change, while reusing shared services where this does not create unnecessary recertification risk.
7. Main challenges and risks
The combined public-source and stakeholder evidence suggests that the most difficult challenges are not simple software implementation tasks. They are transition-management problems at the intersection of evolving EU specifications, domestic service continuity, certification, governance, capacity and user trust.
| Challenge | What the evidence shows | Implication |
| Moving standards and fixed deadlines |
Interviewees identified changing technical specifications, implementing acts and specification versions as a dominant risk, while the legal deadline remains fixed. |
Poland needs agile change management without destabilising mObywatel. |
| European ecosystem readiness |
Interviewees expressed concern that only a limited number of Member States may be ready early; some may still be defining procurement or implementation structures. |
Cross-border testing may be limited by partner readiness, not only by Polish readiness. |
| Secure storage and key management |
Interviewees indicated that certified device-based Secure Elements are not widely available, APIs may be missing, and remote HSM approaches are being used across Europe. |
Security architecture choices will shape assurance, certification, user experience and future portability. |
| In-house capacity constraints |
Interviewees described the in-house model as agile and knowledge-rich, but also indicated that COI capacity is constrained by public-sector budget and resource processes. |
Scaling delivery requires prioritisation and may limit how quickly additional wallet functions or sectoral credentials can be added. |
| Relying-party onboarding |
The EUDI model requires registered relying parties and controlled data requests. Public and private sectors will need onboarding, certificates and governance. |
The wallet will only be valuable if verifiers can be onboarded without duplicating burdensome integrations. |
| Data protection and user trust |
Interviewees described continual GDPR assessment and legal design for controlled data exchange as necessary; the wallet must also support selective disclosure and understandable user controls. |
Trust depends on both compliance and usability: users need to understand what they share, with whom and for what purpose. |
8. Lessons for sharing and reuse
Stakeholder input suggests that Poland can share experience, documentation and implementation approaches, while examining reusable solutions from other Member States and treating practical know-how as potentially more valuable than direct code reuse. [17], [18], [21]
Examples of shareable value include signature-integration practices, certification frameworks, early publication of certification approaches and lessons from European pilots. This is consistent with the Interoperable Europe Act's broader conception of reusable interoperability solutions: useful assets can be legal, organisational, semantic, technical or assurance-related. [17], [18], [21]
If Poland chooses to publish stable, non-sensitive outputs from the EUDI implementation, publication may be appropriate for reference architectures, schema mappings, documentation, test assets or certification material. Publishing such assets through the Interoperable Europe Portal or connected catalogues would increase discoverability and reduce repeated bilateral requests.
| Shareable asset category | Potential Polish contribution |
| Governance and legal design |
Role catalogues, RACI models, legal mappings, relying-party terms, incident and supervision models, and lessons from UC122 implementation. |
| Semantic assets |
PID/EAA mappings, national-to-EU schema profiles, provenance rules, catalogue governance and versioning approaches. |
| Technical patterns |
Reference architecture, trust-integration patterns, API profiles, deployment documentation and modular design-system practices where shareable. |
| Certification and assurance |
Certification programme structure, conformity evidence templates, cross-border test cases, recertification triggers and security-operating procedures. |
| Adoption and operations |
Migration journeys, relying-party onboarding playbooks, citizen communication, support model and indicators for production readiness. |
Key lesson
A reusable interoperability solution is a maintained package of knowledge and evidence. For an EUDI Wallet, that package may include legal provisions, role allocation, schema mappings, interface profiles, certification evidence, tests, operational playbooks and change-management rules.
Direct sharing may be particularly relevant where reuse depends on contextual know-how rather than public artefacts. In this case, it could cover implementation experience, workshops, bilateral technical exchanges, onboarding support and lessons learned from adapting national services to the EUDI framework.
9. Conclusions and lessons
Poland's principal advantage lies in having a mature national ecosystem on which EUDI-compliant functionality can be built. The same maturity creates the main risk: assuming that domestic scale and technical quality reduce the need to redesign legal effect, semantics, trust, certification and governance for cross-border use.
On the basis of public sources and stakeholder engagement, the Polish implementation strategy is best understood as a staged transition: a separate pilot application while standards and ecosystems mature, followed by possible integration into mObywatel once the solution can be made stable, compliant and user-friendly. This interpretation reconciles the apparent public-source ambiguity between separate and integrated models, but the precise production architecture and timing should still be treated as implementation-dependent rather than fixed. [1], [2], [3], [21]
Analytical lessons and recommendations:
-
Treat mObywatel as infrastructure to be adapted, not as finished European credentials. Domestic credentials, identifiers and verification practices must still be tested against EU legal, semantic and technical requirements.
-
Separate the certified wallet core from supporting reusable infrastructure. Design systems, user-interface code, backends and microservices may be reusable, but the EUDI wallet core requires new cryptographic, protocol and trust foundations.
-
Manage architecture as a certification decision. The boundary between the pilot app, future mObywatel integration and shared services will determine certification scope, recertification risk and release management.
-
Prioritise stable end-to-end use cases. A small number of credentials, such as the mobile driving licence, can demonstrate the full chain from authentic source to issuance, disclosure, cross-border verification and revocation.
-
Share the implementation method. Poland's most valuable contribution to other administrations may be certification approaches, semantic mappings, governance models, signature integration, pilot lessons and operational playbooks rather than full source-code publication.
Bibliography
[1] Ministry of Digital Affairs, “Europejski portfel tożsamości cyfrowej zmierza do mObywatela”, 4 March 2026.
[2] Ministry of Digital Affairs, “Rozwijamy mObywatela, a nie wygaszamy”, 23 February 2026.
[3] Central IT Centre (COI), “Europejski portfel tożsamości cyfrowej zmierza do mObywatela”, 6 March 2026.
[4] Ministry of Digital Affairs, “12 milionów mObywateli. Cyfrowe usługi zmieniają Polskę”, 26 May 2026.
[5] Government Legislation Centre, UC122 legislative dossier, status open; Committee for European Affairs page last modified 1 July 2026.
[6] Chancellery of the Prime Minister, summary of draft bill UC122 on trust services, electronic identification and the EUDI Wallet.
[7] Ministry of Digital Affairs, mObywatel service overview.
[8] Ministry of Digital Affairs, qualified electronic signature in mObywatel, October 2025.
[9] mObywatel, guide to visual, functional, QR-based and browser-based document verification.
[10] Regulation (EU) 2024/1183 establishing the European Digital Identity Framework.
[11] European Commission, overview of the EUDI Wallet implementing regulations.
[12] European Commission, EUDI Wallet Toolbox, Architecture and Reference Framework and reference implementation.
[13] Commission Implementing Regulation (EU) 2024/2977 on person identification data and electronic attestations of attributes.
[14] Commission Implementing Regulation (EU) 2024/2981 on certification of EUDI Wallets.
[15] Commission Implementing Regulation (EU) 2025/846 on cross-border identity matching.
[16] Commission Implementing Regulation (EU) 2025/848 on registration of wallet-relying parties.
[17] Regulation (EU) 2024/903, the Interoperable Europe Act.
[18] European Interoperability Framework: principles, interoperability layers and recommendations.
[19] Central IT Centre (COI), POTENTIAL pilot overview and implementation reflections.
[20] ENISA, work supporting certification of European digital identity wallets.
[21] Stakeholder consultation notes for the case study “EUDI Wallet & mObywatel”, with representatives of the Ministry of Digital Affairs and COI; these constitute a stakeholder input and should not be interpreted as a formal government position.