Ing. Calogero Bono
The Italian Digital Agency (AgID) has published version 1.0 of the regulation that defines how to register with the IT-Wallet System and how to take part in the Testing Space. The news is on the agency's website, dated 29 October 2026. The text sets out who does what in the chain of Italy's digital wallet and establishes security obligations. It matters for those who develop services, for those who sell them and for those who manage customer data.
A few terms before we get into the facts. An IT-Wallet is Italy's digital wallet, where you keep documents and certificates on your phone. An electronic attribute attestation is a digital proof of a piece of data, for example a qualification or a professional title. A verifier is whoever checks these attestations. An authentic source is the body that holds the original data. PEC is certified email.
What does the regulation cover?
According to AgID, the document sets the operational rules for two things. The first is registration with the IT-Wallet System. The second is taking part in the Testing Space, where AgID guides and coordinates public and private bodies in validating and testing technical solutions. The agency works with ACN, the Department for Digital Transformation and the other competent authorities.
AgID calls it an important step toward making the digital wallet operational, one that supports coordinated growth of the ecosystem in line with technical, security and data protection requirements.
Who does what in the chain?
The regulation confirms two roles by law.
- The Istituto Poligrafico e Zecca dello Stato (IPZS) is the sole provider of the Register and of the Personal Identification Data Electronic Attestations (IT-Wallet ID) of public interest.
- PagoPA is the sole provider of the public IT-Wallet solution.
For everyone else there is a registration procedure. It covers providers of private IT-Wallet solutions, providers of electronic attribute attestations, verifiers, aggregators and holders of authentic sources.
The security obligations
AgID oversees compliance with precise obligations. These include processing System data on infrastructure located in the European Union, continuous monitoring of systems and incident management. The agency keeps regulatory and supervisory ownership of the Register. It can verify requirements over time and suspend or revoke registration in case of non-compliance.
How do you register?
The application goes through the onboarding portal provided by IPZS, or through other methods indicated by AgID on its website. Until the portal is fully operational, the form attached to the regulation is required. It must be signed with a qualified electronic signature or a digital signature by the legal representative and sent via PEC to protocollo@pec.agid.gov.it.
AgID and ACN, each within its own remit, can carry out checks with the support of IPZS. They verify compliance with the technical specifications of the tools used and with security requirements.
If no refusal arrives within ninety days of submission, the application is considered accepted with reservation. Entry in the Register becomes effective only after passing validation checks and technical tests. The review is carried out by AgID, which can rely on ACN's opinion for cybersecurity.
How does the Testing Space work?
It is a controlled environment where registered parties can carry out validation, testing, integration and monitoring of technical solutions. You need an admission application to AgID for one or more projects. To try out features, services, use cases or modes not yet provided for by the regulatory framework or technical specifications, you must submit a project, using the model attached to the regulation.
Before the formal application, you can ask for an informal discussion with AgID and DTD on the feasibility of the project. After submission, AgID evaluates it, consulting ACN for cybersecurity and the Department for Digital Transformation for consistency with national strategic guidelines.
Limits to know
The source is an institutional press release, not an independent analysis. It does not say when the onboarding portal will be fully operational. It does not say how many parties have already registered or which private services will arrive first. It gives no membership costs and no timelines for technical validation tests.
The regulation is version 1.0, so it may be updated. The full text and annexes are on the AgID website, and we have not summarised them line by line here. Read them before you act.
What changes for those who work with digital
For now it mainly affects those who want to become providers, verifiers or aggregators. You need a legal representative with a qualified signature, a PEC address and infrastructure that processes data within the EU. Anyone who manages servers will need to know where the data physically sits and how it is monitored. On this front there is the topic of hosting and managed servers with security updates.
For a business that will not be a provider, the effect is more indirect. A digital attestation could one day replace paper documents or cards. We covered this for customers in the guide on the digital card in the wallet. Those who issue qualifications, such as online courses, can read how completion certificates are handled today to see what will need to be verifiable. The regulation does not say, however, that these cases fall within the system.
On the personal data front, the framework connects to the topic of digital identity, already covered in this article on SMEs. For a sensitive sector such as healthcare, what applies is set out in the piece on informed consent on tablets.
Our take
The regulation is useful because it brings order. It separates public roles from private ones and provides for suspension and revocation. That is a good sign for anyone worried about a market without rules. We also like the Testing Space with its preliminary informal discussion, which lowers the cost of mistakes.
We do see two risks, though. The first is the bureaucratic burden. A PEC with a qualified signature from the legal representative is within reach of a large operator, less so for a small software house. The second is acceptance with reservation after ninety days, which leaves a company in a grey zone until testing is done. These are our assessments, not data from the source. The real test will be the onboarding portal.
Frequently asked questions
Who runs the public IT-Wallet?
PagoPA is the sole provider of the public solution. IPZS is the sole provider of the Register and of the personal identification and public interest attestations. AgID keeps regulatory and supervisory ownership of the Register.
How is the registration application submitted?
Through IPZS's onboarding portal or other methods indicated by AgID. During the first phase, the attached form is used, signed by the legal representative and sent via PEC.
How long does it take to be registered?
It depends on the checks. The application is accepted with reservation if no refusal arrives within ninety days. Entry in the Register is effective only after validation and technical tests.
Can data be stored outside the European Union?
According to the press release, no, for processing System data. The obligations require infrastructure located in the European Union.
Can you try services not yet provided for?
Yes, but through a defined path. You need a testing project submitted to AgID using the attached model. Beforehand you can request an informal discussion with AgID and DTD.
What to watch in the coming months for the IT-Wallet
The key question is whether the onboarding portal will arrive, and when. In the meantime, you can prepare.
- Read the regulation and its annexes on the AgID website and check which category you would fall into.
- Check where your systems' data is hosted and how it is monitored.
- If you have an out-of-the-box service idea, consider an informal discussion with AgID and DTD before starting the project. To build it, custom software development can help integrate your systems.
