ISO 18013-5 mDL

Origin: composes. ISO/IEC standardized this years before EU digital-identity policy existed. Solidus has not implemented it.

ISO/IEC 18013-5 is the international standard that defines a mobile driving licence (mDL), a driving licence stored and presented from a smartphone instead of a plastic card. Published by ISO/IEC JTC 1/SC 17 (the joint technical committee that also standardizes physical ID documents and machine-readable passports), it specifies:

• The data model, what fields a driving licence contains, and how they're structured and cryptographically signed so a verifier can trust the data came from the real issuing authority. This generic container is called an mdoc (see that entry for the technical detail).
• Device retrieval, how a verifier's device reads the mDL directly off the holder's phone at close range, over QR code plus Bluetooth Low Energy, NFC, or Wi-Fi Aware, the "tap your phone at the airport gate" flow.
• Security and privacy mechanics, selective disclosure of individual fields (so a bar checking age-over-21 doesn't also see your home address), and cryptographic protections against a verifier's device silently cloning or replaying the data.

A companion standard, ISO/IEC 18013-7, extends this to online presentation, proving your mDL to a website or app rather than a physical reader, and is meant to pair with -5, not replace it.

Where this already exists, today, outside the EU

mDL isn't a future EU-only concept, it's live now. Several U.S. states issue mobile driver's licenses built on this exact standard, integrated into Google Wallet and Apple Wallet, already used at real TSA checkpoints and by real retailers checking age. The EU's decision to require this same standard for the EUDI Wallet's PID is an adoption of existing, working infrastructure, not a new invention.

Solidus's actual relationship to it

Solidus has shipped none of this. No mdoc issuance, no mdoc verification, no device-retrieval flow, no CBOR/COSE tooling: this is, by Solidus's own internal roadmap, the single largest gap standing between what Solidus has built and what full EUDI-ARF interoperability would require, because the ARF mandates that a real PID be issued in both mdoc and SD-JWT VC format, and Solidus only has the SD-JWT VC half. This isn't a subtle shortfall to argue around: it's a straightforwardly missing credential format, and it stays missing until it's actually built.

Check it yourself

The standard's normative text is a paid ISO publication (iso.org/standard/69084.html), but you don't need to buy it to see the format in action, install a real state mDL app built on Google's or Apple's public mDL SDK and inspect what it actually presents. There is no Solidus equivalent to compare it to yet.