Italy’s digital agency AgID has published the rules that private companies and public bodies must follow to register with the IT-Wallet system and join its experimentation phase, opening the national digital wallet framework to private wallet providers and credential issuers.
IT-Wallet already powers the government’s IO app, which lets users carry documents such as their driving licence and health insurance card on a smartphone, and the system is set to extend to solutions from public and private operators. The new regulation implements a June 17, 2026 prime ministerial decree that approved the IT-Wallet guidelines and experimentation rules.
Version 1.0 of the regulation covers private wallet providers, issuers of electronic attestations of attributes, verifiers of those attestations, aggregators and holders of authentic data sources. Until the onboarding portal is fully operational, applications go to AgID by certified email, signed with a qualified electronic signature or digital signature. Applicants must supply technical and administrative documentation, role-specific certifications, organizational requirements and insurance guarantees, and entry in the IT-Wallet register takes effect only after technical checks and validation tests are completed.
Registration gives access to the IT-Wallet experimentation space. Organizations that want to test technical solutions, services or use cases not yet covered by the legal framework, guidelines or technical specifications must submit a separate project application using a template attached to the regulation. Participation is voluntary and confers no acquired rights or priority access to public funds; participants receive no reimbursement of their costs and pay no fees to access the experimentation.
PagoPA remains the only provider of the public IT-Wallet solution. AgID holds regulatory control of the IT-Wallet register, while the state printing and minting company IPZS builds and runs the register’s technical infrastructure and provides the onboarding portal and validation systems.
Separately, Italy’s data protection authority, the Garante, has given a favorable opinion on a draft decree from the head of the Department for Digital Transformation that sets the technical and organizational measures for the IT-Wallet system. Its guidance covered the roles of the parties involved, measures for processing special categories of data and the handling of users’ requests to delete personal data.
The Garante also reviewed the data protection impact assessment accompanying the decree, which will be made available to participants as a reference. It reminded them that they must still assess any further high-risk aspects of their own processing under the GDPR’s accountability principle.
Sources: AgID, Federprivacy, Punto Informatico
–
By the ID Tech Editorial Team
