European regulators set a clear mandate for member states to roll out the European Digital Identity Wallet (EUDI wallet) in 2026. Citizens will soon store official credentials, biometric data, and personal attestations directly on mobile hardware. However, protecting this identity data against future threats requires integrating post-quantum cryptography into devices that rely on legacy cryptographic standards.
Wei Yuan, lab manager and director of operations at Applus+ Laboratories, highlights how hardware limitations complicate this migration. Mobile handsets often lack dedicated security elements, leaving manufacturers to choose between restricted hardware availability and cloud-based remote HSM configurations. Each architectural choice creates distinct attack surfaces that testing laboratories must evaluate under evolving ENISA certification schemes.
Hardware manufacturers face significant financial risks if they delay building crypto agility into their hardware designs. Updating cryptographic algorithms in backend servers requires simple code updates, but replacing deployed hardware chips can force expensive product recalls. Choosing rigid architecture today creates immense technical debt when post-quantum cryptography standards become mandatory across international markets.
Security engineers must recognize that real-world implementation errors cause far more breaches than mathematical vulnerabilities in algorithm designs. Flaws in side-channel protections, key storage mechanisms, and API integrations compromise secure devices long before attackers crack the underlying math. Vendor teams must prioritize rigorous physical and logical testing over simple protocol compliance.
Applus+ Laboratories continues to assist hardware vendors and software developers as they prepare for incoming Cyber Resilience Act (CRA) requirements in late 2026. Organizations that adopt strict certification standards early will maintain market access while avoiding emergency redesigns. Building resilient, quantum-safe identity systems requires actionable hardware engineering today rather than theoretical planning tomorrow.