Subscribe
By the end of 2026, every EU citizen is supposed to have access to a digital identity wallet: one app on their phone that holds their ID, driver’s license, healthcare card, and more, accepted from Lisbon to Tallinn. Clean, simple, modern. Romania is part of that plan. And if you spend about ten minutes looking at how things actually work on the ground here, the gap between that vision and the current reality becomes almost surreal.
In March 2026, Bucharest hosted its first serious EUDI Wallet interoperability exercise. Thirteen organizations participated. Forty-four tests were run. Thirty-six passed. Those numbers got reported as a success, and in the narrow sense of the word, they were. But this was a controlled environment with selected participants, curated conditions, no ordinary citizens anywhere near it. Calling that “deployment-ready” is a stretch by any measure.
Romania has spent years near the bottom of the EU’s Digital Economy and Society rankings. Rural broadband is still patchy. E-government services are inconsistent at best. A digital wallet that has to talk in real time to government databases, healthcare registries, vehicle authorities, and private sector verifiers is not a minor upgrade. It is a complete overhaul of infrastructure that has never fully worked in the first place.
One of the core things a digital ID is supposed to do is certify where you live. That attribute, your residential address, flows through the EUDI Wallet as a verified, cryptographically signed piece of data that services across Europe can query and trust.
Romania canceled over 162,000 identity cards in the past two years because the addresses on them were fake. Not vaguely inaccurate. Fabricated. One address in Bucharest had over 10,000 Moldovan citizens registered at it. Another had 22,000. Romanian law had no limit on how many unrelated people could register at a single property, as long as the owner signed off. So, people signed off, money changed hands, and a chunk of the national population registry quietly filled up with fiction.
Digitizing that registry does not clean it. It freezes it into something harder to fix. A plastic card with a wrong address can be canceled and reissued in a day. A cryptographically signed digital credential that has already been verified and circulated across EU systems is a different kind of problem entirely.
Romania tried to get ahead of privacy concerns by removing home addresses from physical ID cards. The reasoning was sound. Why put your full address on a document you hand to strangers? But the execution fell apart almost immediately. Banks rejected the new cards. Notaries rejected them. Post offices rejected them. Proving where you live suddenly required a separate certificate, obtained through a separate process, which meant citizens now had more bureaucratic steps than before, not fewer, all in the name of simplifying things.
That contradiction points to something structural. Romanian institutions know the language of data protection. GDPR is technically in force, the supervising authority exists, and official statements about privacy are easy to find. But enforcement is another matter. In 2024, the data protection authority conducted no compliance oversight of hospitals, meaning the organizations that handle among the most sensitive personal data in existence, and the total fines issued across private healthcare for the entire year came to €7,500. That is not a privacy culture. That is paperwork.
Even if Romania solved every one of its domestic problems overnight, the EUDI Wallet itself carries risks that no single country controls. The system’s security relies on Trusted Execution Environments embedded in smartphones: hardware and software ultimately governed by Google and Apple. That means the cryptographic keys protecting your digital identity sit inside infrastructure owned by American tech companies, with no meaningful EU oversight of how those environments are managed or what access they permit.
Critics have raised this repeatedly. The response from Brussels has been measured optimism. Which is a polite way of saying the concern has been acknowledged and set aside.
Romania has a deadline. Brussels set it, and it does not move. But a deadline is not a foundation. And right now, the country is being asked to build something permanent on ground that has not been cleared yet.