Digital Identity Is Not Just a Technology Project. It's a Trust Project.

Every national identity programme starts with a detailed technical specification. It defines biometric matching accuracy, card durability, enrolment capacity, encryption standards and system availability. Governments and suppliers spend months reviewing these requirements, negotiating details and making sure the numbers are right.

And yet, some technically advanced identity programmes have struggled to gain public acceptance, faced legal challenges or failed to achieve widespread adoption. Meanwhile, others built on relatively simple technology have become part of everyday life.

So what makes the difference?

In my experience, it is rarely technology alone. It is trust.

Why a strong technical specification is not enough

There is a common assumption in our industry that a well-designed technical specification is the foundation of a successful national identity programme.

If the biometric algorithms are accurate, the cards are secure and the infrastructure is reliable, the programme should succeed.

I understand why this thinking is so common. Technical requirements can be measured, tested and verified. Trust is much harder to quantify.

But a national digital identity system is not simply another technology platform.

It creates a relationship between citizens and the state. In many cases, citizens have little choice about whether to participate. They are expected to provide sensitive personal information, including fingerprints, facial images and identity details, trusting that this information will be stored securely and used responsibly.

That is a significant responsibility.

A system can meet every technical requirement and still struggle if citizens are reluctant to enrol, institutions do not trust the credentials or the legal framework fails to provide adequate safeguards.

Technical compliance is necessary, but it does not automatically create public confidence.

The three levels of trust

Through my experience working on national identity programmes across Europe and Africa, I have come to see trust as operating at three different levels.

All three matter, and weaknesses in one can affect the success of the entire programme.

1. Citizen trust

Citizens need to understand why they should enrol, what benefits they will receive and how their personal information will be protected.

But trust is not built through security standards and government announcements alone.

It is shaped by everyday experiences.

How long does someone wait at an enrolment centre? Are staff helpful and respectful? What happens when biometric capture fails? Can the person actually use the credential to access the services they need?

These interactions may seem like minor operational details, but for citizens, they often define their perception of the entire programme.

2. Institutional trust

A national identity credential becomes truly valuable when institutions are willing to rely on it.

Banks, mobile operators, healthcare providers, government agencies and other service providers need confidence that the identity system is accurate, reliable and suitable for their processes.

Consider a citizen who presents a national digital ID at a bank but is still asked to provide several additional documents to prove their identity.

The credential may be technically secure, but if the bank does not trust it enough to simplify its own procedures, much of its potential value is lost.

Institutional acceptance is therefore just as important as citizen enrolment.

3. International trust

National identity systems increasingly support services that extend beyond national borders.

Travel documents, cross-border digital services and European frameworks such as eIDAS depend on confidence between countries and institutions.

This confidence is built through compliance with recognised standards, independent audits, transparent governance and consistent operational performance.

It also depends on how effectively authorities respond when something goes wrong.

A technically advanced system does not automatically earn international recognition. That recognition must be supported by credible processes and institutions.

Where trust is built, and where it can be lost

One of the lessons I have learned is that trust is not established at the official launch of a programme.

It develops gradually through the decisions made during design, implementation and daily operation.

And it can be damaged much faster than it is built.

The legal framework must come first.

Launching an identity programme without an adequate legal and data protection framework creates unnecessary risks.

Kenya's Huduma Namba initiative provides an important example. In 2021, the High Court ruled that the rollout had proceeded without the required data protection impact assessment.

The issue was not simply whether the technology worked. It was whether the programme had followed the necessary legal and procedural safeguards.

This is an important distinction.

Governments may feel pressure to accelerate implementation, but moving ahead of the legal framework can create problems that are far more difficult to resolve later.

Enrolment is more than a technical process.

For many citizens, visiting an enrolment centre will be their first direct experience with a national identity programme.

Long queues, unclear instructions, unsuccessful biometric captures and poorly trained staff can quickly undermine confidence.

This is particularly important for elderly people, manual workers and others whose fingerprints may be difficult to capture.

A technically sophisticated system means little to someone who has spent hours waiting only to leave without completing their enrolment.

Enrolment should therefore be treated as a public service, not simply as a data collection exercise.

Inclusion must be part of the design.

People who lack birth certificates, live in remote communities or have difficulty providing biometric data are often among those who would benefit most from a reliable identity system.

Yet they can also face the greatest barriers to enrolment.

A programme may achieve impressive registration numbers while still excluding vulnerable groups.

That raises an important question: are we measuring the number of people enrolled, or are we measuring whether the system is accessible to everyone who needs it?

The two are not necessarily the same.

Governance needs to be visible.

Citizens are more likely to trust an identity system when they understand who can access their information, why it is being used and what safeguards exist against misuse.

Independent oversight, clear restrictions on data use, transparent audit processes and mechanisms for citizens to exercise their rights all contribute to confidence.

These are not administrative details to be addressed after implementation.

They should be considered from the beginning.

The response to incidents matters as much as prevention.

No large technology system is completely immune to vulnerabilities.

In 2017, Estonia, widely recognised for its advanced digital identity infrastructure, identified a cryptographic vulnerability affecting hundreds of thousands of ID cards.

The authorities responded publicly, introduced measures to address the problem and communicated with affected users.

The incident demonstrated an important principle: trust does not depend on pretending that problems will never occur.

It also depends on how openly and effectively those problems are handled.

In many cases, the response to a crisis reveals more about the maturity of a programme than its original technical specifications.

What governments and suppliers should do differently

If we accept that national identity programmes are fundamentally about trust, this should influence how they are planned, procured and delivered.

Several priorities stand out.

• Establish the legal framework before implementation. Data protection legislation, clear rules for processing personal information and effective independent oversight should be in place before enrolment begins.
• Measure outcomes, not just technical performance. Matching accuracy, system availability and card production capacity matter, but so do adoption, inclusion, institutional acceptance and actual use.
• Treat enrolment as a public service. Accessibility, staff training, clear communication and procedures for handling exceptional cases deserve the same attention as technical infrastructure.
• Make transparency part of the system. Citizens should understand how their information is used, who can access it and what rights and safeguards are available to them.
• Involve institutions early. Banks, telecommunications providers, healthcare organisations and public agencies should contribute to the programme's design so that the resulting credentials meet real operational needs.
• Prepare for incidents from the beginning. Security response procedures, credential revocation, replacement capabilities and communication plans should be established before the system becomes operational.

For technology suppliers, this also requires a broader understanding of our responsibilities.

Delivering a system that meets the contractual specifications is essential, but it should not be the only measure of success.

A national identity programme may remain operational for decades, long after the original implementation contract has ended.

The institutions, governance processes and operational capabilities supporting that system must be able to evolve and remain effective throughout its lifetime.

In my view, this is where suppliers can provide real long-term value: not only by delivering reliable technology, but also by helping governments establish the capabilities needed to operate and maintain it successfully.

The real measure of success

None of this means that technology is less important.

Security, accuracy, reliability and availability are fundamental requirements. Without them, a national identity programme cannot function effectively, let alone earn public trust.

But technical excellence should be the starting point, not the final measure of success.

A successful programme is one that citizens are confident using, institutions are willing to rely on and other countries can recognise within appropriate legal and technical frameworks.

It should make everyday interactions easier, improve access to services and protect the personal information entrusted to it.

Achieving that requires more than good engineering.

It requires effective governance, clear communication, operational discipline and a genuine understanding of the people who will use the system.

Having worked on identity programmes across different markets, I believe one of the biggest mistakes we can make is to focus so heavily on delivering the technology that we underestimate the importance of building confidence in it.

Because, ultimately, the success of a national identity programme is not measured only by how many credentials are issued or how accurately the system verifies an identity.

It is measured by whether people and institutions trust it enough to use it, and whether that trust can be sustained over time.

Technology makes digital identity possible. Trust makes it work.