Free standards, same barriers: what the Geneva mDL announcement changes and what it does not
This week in Geneva, at the Global Digital Collaboration conference, ISO, IEC, the German standards body DIN and the OpenWallet Foundation announced that the standards underpinning mobile driving licences and mobile identity credentials, the ISO/IEC 18013 series and the ISO/IEC 23220 series, become free to download. The OpenWallet Foundation manages the initiative. DIN operates a portal where registered users can obtain the documents at no charge, ISO and IEC keep their copyright, and a group of sponsors covers the cost: AAMVA and Austroads, the driver licensing associations of North America and Australasia, France Titres, which runs the French identity wallet, and a set of vendors and consultancies including Idemia, Scytales, iDAKTO, FaceTec, Fime, Stelau, Explicit Selection, FAST and A4 Advisory.
Why now, and why these sponsors
A standard becomes valuable once enough people build on it. The mdoc format defined in 18013-5 has already been adopted by the European digital identity wallet, by the wallets of Apple and Google, and by a growing number of driver licensing authorities. Every additional implementer increases the value of the installed base. The sponsors are, almost without exception, organisations that have already bet on this format and sell products, services or public credentials built on it. Sponsoring free access is a very cheap way to consolidate a lead. It also answers the persistent criticism that ISO standards are open in governance but closed in access, at a moment when W3C verifiable credentials and the SD-JWT format, both free from the start, compete for the same use cases.
What it means
Read plainly, the announcement is a signal that the mdoc family is becoming the default format for government issued credentials on phones, and that the industry is now willing to invest in removing the small frictions that slowed its spread. ISO and IEC present it as a new model, sponsorship funded free access for standards that count as critical digital infrastructure. If the model holds, other families could follow, and the biometric interchange formats or the smart card standards that many national ID programmes cite in their tenders would be obvious candidates.
Why it is symbolic rather than significant
For a government team, the price of the document was never the obstacle. The whole series cost less than a day of consulting. The obstacles are elsewhere, and none of them moved this week.
The first is capacity. A specification of several hundred pages only becomes useful when someone in the ministry or the agency can turn it into a procurement requirement, evaluate a bidder’s claim of conformance and check the delivered system against it. Most implementing teams in Africa or the Pacific do not have that person, and free access to the PDF does not create one.
The second is conformance. Reading the standard costs nothing now. Proving that a wallet, a verifier or an issuing system actually complies still requires test tools, certification laboratories and interoperability events, all of which are paid services delivered by the same ecosystem that sponsored the announcement.
The third is platform dependence. A credential in mdoc format lives in a wallet, and on most citizens’ phones that wallet belongs to Apple or Google. The standard defines the data, the platform decides the conditions of presence. ID30 argued in June that governments should concentrate on issuing the credential rather than building the wallet. Free standards make that advice easier to follow. They do not change who controls the wallet.
What a government team should do with it
Download the documents and put them in the hands of the people writing the next tender. Cite 18013-5 and 23220 explicitly as requirements, rather than accepting a bidder’s own description of interoperability. Ask every bidder which conformance tests they have passed and who ran them. And budget for the capacity that the announcement does not provide: the engineer or the adviser who can read the specification on your behalf and say whether what was delivered is what the standard describes.
The barrier was never the 227 francs. It is the ability to hold the ecosystem to its own standard. That still has to be built at home.
Source: Biometric Update, 2 September 2026. Related ID30 reading: What counts is the credential, not the wallet.
Want to comment, ask a question, or join the discussion? Continue the conversation on LinkedIn.