Malta – Tender for Implementation of a Fully Compliant European Digital Identity Wallet (EUDIW), Supporting Trust Ecosystem and Use Cases

Summary

The Department of Contracts (Malta) is tendering CT2274/2026 on behalf of the Malta Digital Innovation Authority (MDIA), the final beneficiary. The contract covers implementing a fully compliant European Digital Identity Wallet (EUDIW), its trust ecosystem and use cases. It is funded from the local budget and is not divided into lots. Version 1 is a Maltese/English mobile wallet app for iOS and Android, due within 6 months. It authenticates with the national eID server using the eID card over NFC, stores identity data and offers age verification and at least two use cases. Version 2, due within 21 months, is a fully compliant EUDIW under the EUDI Regulation (910/2014 as amended by 2024/1883), ARF v2.4 and the implementing acts, with these components: - Wallet Provider - PID Provider using OpenID Connect to eid.gov.mt at LoA High - Relying Party Registrar - PKI / Signing Certificate Provider - WRPAC Provider - RP verification component - Signature Creation Application (QES, PAdES) - HSM-based Remote WSCD - Wallet Unit supporting PACE over NFC, TEE/SE, ISO/IEC 18013-5/7, OpenID4VP/VCI and SD-JWT VC

The work runs through 16 milestones and ends with support for certification of the wallet. It also covers 7 years of hosting, operation, maintenance and support from commissioning of Version 1, 20,000 hours of new use-case development, 7,000 hours of regulatory consultancy and a design refresh every 3 years. Version 1 is hosted on MITA's Azure hybrid cloud; Version 2 is colocated in two MITA data centres.

The estimated value is EUR 15,659,714.03 excl. VAT, which is not a cap. The duration is 90 months, with two optional 24-month extensions. Repetition of services is allowed up to 55% of contract value and additional services up to 20%. Award is on best price/quality ratio, weighted 70% technical and 30% price, with a minimum average technical score of 60%. Bids are submitted in English via the ePPS (www.etenders.gov.mt). As first published, the clarification deadline was 10/08/2026 and the submission deadline 03/09/2026 at 09:30 CET.

Four change notices and Clarification Note 31 extended the deadlines several times. Clarification requests now close 09/10/2026, the buyer's last answers are due 14/10/2026, and submission is due 02/12/2026 at 09:30 (opening at 10:00). Clarification Note 10 issued an updated Financial Bid Form. The Q&A confirmed the following: - ISO/IEC 27001 applies to every consortium member or subcontractor involved in data processing or security-relevant components. - Key Expert 7 must be physically present in Malta. - The HSMs for the RWSCD must be fully separate from the PKI HSMs, and PKI components must be physically segregated. - There is no price revision for hardware (Item 11). DDP pricing includes all import costs. - Bidders must not rely on existing Azure WAF/CDN/DDoS protection. - No changes to eid.gov.mt are in scope, and the ICAO eMRTD model is not required.

Tender Analysis Agent · from the notice and the tender documents

Timeline 5

1. 13 Jul 2026Contract notice — TED 483367-2026
2. 6 Aug 2026Change notice — TED 546615-2026
3. 1 Sept 2026Change notice — TED 601493-2026
4. 15 Sept 2026Change notice — TED 633640-2026
5. 30 Sept 2026Change notice — TED 671205-2026

Updates 5

Status

RFP — OPEN

Source

https://ted.europa.eu/en/notice/-/detail/671205-2026 ↗

Requirements