The Credential With a Real Deployment Curve Is a Driving Licence, and We Cannot Issue One
What follows is our single largest gap against the European framework, by our own roadmap, and it is written here rather than left for an evaluation to find. Nothing here is legal advice.
The market fact that reframes every vendor pitch
The digital credential with actual mass deployment today did not come from an identity startup. It is a driving licence, issued by a government, living in the phone wallet the person already had.
Several US states issue one. EU pilots run on the same standard. The wallets are the ones already installed on every handset, and the issuers are motor vehicle authorities rather than companies raising rounds.
That matters commercially more than any feature comparison. The format question in digital identity is being settled by states and platform wallets, not by vendors, and a vendor whose credentials are in a shape those two do not read is optimising a system nobody is deploying into.
What the standard actually is
ISO/IEC 18013-5 comes from the same joint technical committee that standardises physical identity cards and passports, which is the correct pedigree for something a police officer will look at.
It specifies more than a data format. It defines how a verifier retrieves data from a device in person, over a local channel established by scanning a code, so the check works with no network on either side. That offline case is the hard one and it is the one the standard is built around, because a roadside stop is not a place to discover that a server is unreachable.
The data model is binary and compact rather than JSON-shaped, which is a deliberate choice for constrained channels and one reason it is not something a system built for web credentials picks up incidentally.
The honest other half
What is already done is the second required format, and that is not a consolation prize. The framework asks for both because the two serve different retrieval situations, and having one of them properly implemented is meaningfully further along than having a proprietary format and a plan.
Issuance in this standard's format is a documented roadmap item. It is not built, it has no delivery claim attached here, and stating it as roadmap is the whole of the claim.
The reason it is on the roadmap rather than deferred indefinitely is the same reason the European work matters at all: a self-issued identifier is worth nothing until a relying party trusts the issuer, and eIDAS 2.0 manufactures exactly that trust, by regulation, for roughly 450 million people.
What happens to identity vendors when the state issues the credential
The uncomfortable version of the question: if a government issues a high-assurance credential and a platform ships the wallet, what is a private identity company for?
The answer is not "issuing competing credentials", and any vendor whose plan is that is going to lose slowly.
What remains is real and it is where we work. Verification across the long tail of businesses that will never build against a state credential themselves. Reuse in contexts the state does not cover, which is most commercial onboarding. Trust infrastructure for non-government issuers, because a university, an employer, an exchange and a marketplace all issue attestations and none of them appears on a national trusted list. And the connective work of letting a verifier accept several credential shapes without integrating each one separately.
A state credential increases the value of that layer rather than removing it. It does remove the business of being the credential.
What to ask any vendor about format support
"Can you issue the same subject in both required formats?" For anything aiming at the European framework this is a yes-or-no with no partial credit, and the honest answer from us today is no.
"Does your presentation flow work with no network on either side?" Offline is the case that separates a specification reading from an implementation.
"What do you do when a verifier hands you a credential in the other format?" Reading a format is a much lower bar than issuing it, and a vendor that conflates the two is telling you something.
"Which parts are built and which are roadmap?" Ask for the split explicitly. Most material in this market presents both in one voice.
Where this leaves a decision
If your programme depends on issuing credentials that satisfy the European framework, we cannot do that today, the missing half is named above, and you should ask us for its status rather than assume progress.
If your problem is that verification is expensive and the credentials your users already hold do not travel, that is buildable now on the format we do implement, and the state-issued credential arriving in a few years makes that layer more useful rather than less.