The certification loss comes just five months after the Government Digital Service (GDS) achieved DIATF compliance for One Login in December 2024. Compliance with DIATF is a legal requirement for digital identity systems used in UK public services, including right to work and right to rent checks, as well as background screening through the Disclosure and Barring Service.
The timing is particularly problematic given that Technology Secretary Peter Kyle had announced in January that One Login would serve as the identity verification mechanism for the upcoming Gov.uk Wallet. The wallet, designed to store digital versions of government-issued documents such as driving licenses, is scheduled to roll out later this year. Use of the wallet will be optional and limited to official credentials, not private-sector items like travel cards or event tickets.
The decertification may also complicate efforts to build interoperability with regional systems. The Scottish government had been seeking compatibility between ScotAccount and One Login, a goal that now faces new technical and compliance barriers.
The program’s stability had already been under scrutiny. In April, whistleblowers raised concerns about possible security vulnerabilities, echoing earlier reports dating back to 2022. Although not directly linked to the certification loss, those concerns have gained renewed attention in light of One Login’s current compliance gaps. According to official assessments, the system meets only 21 of the 39 outcomes in the National Cyber Security Centre’s Cyber Assessment Framework. It also has yet to fully adopt the government’s “Secure by Design” standards.
With over six million users and integration across dozens of government platforms, One Login had been on track to reach 100 services by the end of 2025. This included the launch of identity verification for company directors via Companies House on April 8. The certification loss places many of these deployments in a grey area, particularly in sectors that require DIATF compliance to remain operational.
The GDS has not issued a public statement clarifying how it plans to address the disruption or whether ongoing integrations will be paused. The timing is sensitive, as Parliament is currently reviewing the Data (Use and Access) Bill, which would give One Login statutory authority to transition out of its current beta phase.
Meanwhile, industry reaction has been swift. Several private sector identity associations have formally urged the UK government to restrict One Login and Gov.uk Wallet usage to public-sector applications only. These groups cite concerns about unfair competition and mission creep into commercial identity verification markets, where accredited providers already operate under DIATF requirements.
Suppliers across the trust framework have also expressed frustration over the cascading effects of a single partner’s lapse jeopardizing an entire program. Many are now questioning the governance model underlying One Login’s reliance on third-party certification, and what safeguards—if any—will be introduced to prevent similar disruptions in future.
Sources: Computer Weekly, Cogency Global, Gov.uk
–
May 13, 2025 – by Ji-seo Kim
