"Aligned With the Framework" Means Nothing Until Somebody Names the Subset
We have shipped part of what this framework requires and not the rest, and this page names which. Nothing here is legal advice.
The phrase that survives every procurement
Vendors say they are aligned with the European architecture and reference framework. Buyers write it into requirements. Nobody defines it, and the reason is that the framework is not one thing to be aligned with.
It is a large specification naming credential formats, presentation protocols, issuance protocols, wallet attestation, hardware key binding, trust infrastructure and conformance criteria. A product can implement a third of it, honestly, and describe itself the same way as a product that implements all of it.
So the phrase is not a lie. It is unfalsifiable, which is worse for a buyer, because it cannot be checked and therefore cannot be compared.
The question that makes it checkable
"Which specific protocols and formats have you implemented, and which have you not?"
That converts an adjective into a list. Every serious vendor can produce the list, and the ones who cannot have told you something.
Here is ours.
What we have shipped
The issuance protocol and the presentation protocol the framework's implementing acts point to. The token-based selective-disclosure credential format. The identifier specification and the credential data model.
What we have not
The binary credential format the framework also requires, which has its own page and is our largest gap against this whole area.
Wallet attestation, the mechanism by which a wallet proves to an issuer that it is a genuine, unmodified wallet rather than software pretending to be one.
Hardware key binding, which ties a credential to a secure element on a specific device.
And conformance itself. No accredited assessment, no notification, no certification of any kind. Nobody has tested our implementation against the framework's criteria, including us.
So the accurate sentence is that we have shipped a subset of the required protocols and are not conformant, and any shorter version of that sentence is doing work it has not earned.
Why the missing pieces are the harder half
The protocols we have shipped are software. The pieces we have not are mostly attestations about hardware and about the wallet itself, which need a manufacturer, a certification path, or a device capability rather than an implementation.
That is why the ordering happened this way, and it is also why the gap does not close by writing more code. It closes through certification and partnership, which take longer and depend on other parties.
The roadmap position, stated as roadmap
Conformance with the framework is a roadmap conformance statement targeted for the fourth quarter of 2026, and not a held certification. The binary format and the qualified-provider path are documented roadmap items.
What is already done is the protocol subset above, running and inspectable. What is not is everything that requires somebody else to assess or attest, and no date we publish changes that dependency.
What to ask any vendor claiming to be "aligned"
"Name the protocols you have implemented." A list, not an adjective. This single question separates most of the field.
"Can you issue in both required credential formats?" For anything aiming at the framework this is a yes or no with no partial credit. Ours is no.
"Do you support wallet attestation and hardware key binding?" These are usually missing and rarely mentioned, because they are the parts that depend on device capabilities.
"Who has assessed you against the criteria?" If the answer is nobody, being "aligned" is a self-assessment, which is not worthless and is not conformance.
Where this leaves a decision
If your programme requires conformance, we do not have it, the missing pieces are named above, and the ones that matter most depend on assessment rather than on engineering.