This time last year I predicted that 2025 would bring an acquisition wave reshaping the industry, and 2026 is now showing the effect of this.
IN Groupe has completed its acquisition of IDEMIA Smart Identity and describes itself as a global leader in end-to-end physical and digital identity solutions.
Crane NXT has also turned a series of transactions into a coherent security and authentication platform.
It acquired OpSec Security, the smart packaging assets of TruTag Technologies and De La Rue Authentication Solutions, then combined them with Crane Currency under a ‘Crane Authentication’ and ‘Security & Authentication Technologies’ structure focused on brand protection, product security and technologies for governmentissued identification documents.
At the same time, TOPPAN Holdings acquired HID’s Citizen Identity Solutions business, closing in early 2025, while TOPPAN Gravity’s earlier acquisition of Colombian card manufacturer Hogier Gartner strengthened its position in Latin America. Following this sale to TOPPAN, HID’s activities are centred around access control, credential management and related digital security services.
Looking ahead, I don’t expect the deal-making to stop but do expect it to change. The global players in identity and secure documents have now largely set out their stalls, with major groups combining enrolment, document production, authentication and digital identity services under one roof. This makes another wave of ‘blockbuster’ transactions less likely in the short term.
The larger groups will use mergers and acquisitions to plug specific gaps in their platforms: specialist biometric engines, document
security features tuned for automated inspection, remote onboarding and verification services, or regional production capacity.
I would have to be living in a cave not to acknowledge that AI is having an effect on all industries, and ID and secure documents are no exception. From a threat perspective, the change is not just about new attack types, but also about scale, speed and believability.
Generative models make it easy to create high-quality deepfakes and forged document images that can defeat remote onboarding systems.
These systems were built around ‘document plus selfie’ checks, and were never designed for AI-generated inputs.
For biometrics, AI improves both presentation and injection attacks.
Attackers can synthesise face and voice samples tuned to a specific system’s decision boundaries, rather than relying on crude photos or recordings. Without strong liveness and presentationattack detection, biometric checks will become a weak point rather than a strength.
AI also helps attackers analyse large, leaked datasets of document images or personal data, spotting patterns and then generating forgeries that fit these patterns. On top of that, language models industrialise social-engineering attacks, producing convincing emails that exploit real document formats and procedures around replacement of ‘lost or damaged’ credentials.
My prediction for 2026 is that AIenabled defence will shift from isolated pilots to standard practice, driven by a zeitgeist that only AI can credibly combat AI-driven fraud, forcing issuers and system integrators to show how they will embed AI into their defence strategies.
Although slightly behind AI on the Gartner Hype Cycle, post-quantum cryptography (PQC) is clearly moving from niche discussion to mainstream planning for passports and ID schemes.
Our industry is uniquely vulnerable to the PQC threat because, as I pointed out in the article ‘Survey Reveals Lack of Clear Regulations and Standards for PQC Adoption’ (IDN February 2025) there is a ‘time-bomb’ ticking: issuers continue to deploy 10-year documents using only classical cryptography, while acknowledging that encrypted data captured today may be decrypted in the future once quantum-capable systems emerge.
I don’t expect to see mass deployment of PQC algorithms in eMRTD chips in the short term, but crypto-agility and migration planning will become mandatory requirements in the coming year. Providers will increasingly have to demonstrate how their systems can transition to PQC within the validity period of documents being issued in 2026.
It is not within the remit of IDN to cover or comment on geopolitical trends, but I think it is fair to say that the global environment is unlikely to become more stable in 2026, and this will feed directly into how identity and citizenship are managed. Migration pressures are pushing governments to tighten border management and population registers, and to use ID systems more actively in security and immigration policy.
The result is that identity tools that were once seen as neutral infrastructure (passports, national ID cards, residence permits, digital identity wallets) are more likely to be used in the politics of migration and national security. This is already the case in the US and likely to be the case in other parts of the world.
In the UK, the government is arguing for tighter control over migration and access to public services through stronger identity checks.
I have to declare a vested interest here, as I plan to travel to North America for the FIFA World Cup in June 2026, and right now the lack of clarity around future visa requirements and entry conditions is already creating uncertainty. The real concern is not the inconvenience to millions of football fans, but that this level of uncertainty could easily become the norm for routine cross-border travel – with travellers expected to surrender additional personal and biometric data, pay additional processing charges (such as the newly introduced TSA ConfirmID fee in the US), and track shifting visa conditions.
For me, the point of making these predictions is not to be right on every detail, but to be clear about what to watch out for: how quickly PQC moves from conference slides into real project requirements, whether AI-based security can keep pace with AI-based fraud, how industry consolidation changes the shape of the industry, and how far politics creeps into the everyday business of proving who we are.
Even if all my predictions are spot-on (unlikely), the success of the sector will rest on its agility to handle the shocks I haven’t predicted!
