Targeted initiative for a better copyright environment for European creativity and innovation

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation

The initiative names the four fields on which European copyright will be decided: AI training, AI imitation, live-event piracy, and research. GISAD welcomes it – and recommends making rights enforceable through structure: machine-readable opt-outs, verifiable training-data logs, collective remuneration, and signed provenance instead of filter regimes.

The initiative in brief

In May 2026 the Commission opened a call for evidence for a targeted legislative initiative – expected as a directive – to adjust the EU copyright framework for the competitiveness of the creative sectors and for innovation, in parallel to the Article 30 review of the Copyright in the Digital Single Market Directive (EU) 2019/790. A legislative proposal is provisionally scheduled for the first quarter of 2027. The initiative covers four areas: challenges faced by creators linked to artificial intelligence, including licensing between rightsholders and AI providers and AI-generated imitations of performers; online piracy of time-sensitive content including live events; the remuneration of music performers and producers for sound recordings of third-country nationals; and the use of protected content in scientific research, with a possible EU-wide secondary publication right. Building on this call, the Commission launched a targeted consultation on 29 September 2026. The context is well documented: the text and data mining opt-out of Article 4(3) has not delivered on its central promise – rightsholders who opted out struggle to enforce their rights, to license and to be remunerated – while the AI Act obliges providers of general-purpose AI models to comply with EU copyright law and to publish training-data summaries, and machine-readable opt-out protocols are being developed with the support of the EUIPO.

Five points GISAD recommends

1. An opt-out that nobody reads is not an exercise of rights. On paper, the TDM opt-out gives rightsholders control; in practice it is a leaf in the wind. Machine-readable, standardised opt-out protocols must be mandatory, not optional. And the training-data summaries under Article 53 of the AI Act must be verifiable: whoever verifies must be verifiable themselves. Logging at a neutral instance, examination outside the manipulable area.

2. Structural remuneration instead of gatekeeper licensing. Small rightsholders must not be left to individual negotiations with AI corporations – negotiations they lose. Collective licensing, collecting societies and micropayment infrastructures turn remuneration into structure. Participation applies to creators as well.

3. AI imitation of performers: structure instead of hindsight. AI-generated fakes must be recognised structurally, not litigated individually: AI detects AI fakes at the point of publication, and every publication carries a signed instance number – responsibility becomes assignable without building profiles. Concept fidelity arises through measurement, not through examples.

4. Live-event piracy without filters 2.0. Enforcement is right – but the answer must not be a revival of the upload-filter debate. Structure instead of filters: signed transmission paths and provenance evidence, while the audience remains WAN-anonymous. Filters recognise copies – structure recognises origin.

5. Research as an infrastructure of participation. Preserve the TDM research exception, harmonise the InfoSoc research exception across the EU and introduce a binding EU-wide secondary publication right; contractual circumvention of research exceptions must be ineffective. Knowledge is infrastructure – access to it decides participation, including in the 2,500 written languages for which GISAD’s companion project getmySense develops translation capability.

Conclusion: A targeted initiative with four construction sites demands measurable concept fidelity, not declarations of intent. Rights that cannot be enforced are not rights, licenses that only the strong can negotiate are not licensing, and filters that recognise copies do not recognise origin. Structure makes copyright enforceable – for creators, for researchers and for the audience alike.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · Registered in the EU Transparency Register, No. 244298340978-40

Sources: European Commission – Have your say: Targeted initiative for a better copyright environment for European creativity and innovation · European Commission – Call for evidence on the review of EU copyright rules · European Commission – Targeted consultation on the effect of technology on copyright

European Business Wallet

European Business Wallet: digital identity, secure data exchange and legal notifications for simple, digital business

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation

The European Business Wallet extends the wallet logic from citizens to economic operators. GISAD welcomes this step: it is structure, not bureaucracy. But a wallet that logs every transaction must not become a movement profile of European commerce. Identity where identity is needed – measurability where structure is claimed.

The initiative in brief

With proposal COM(2025) 838, adopted on 19 November 2025, the European Commission proposes a regulation establishing European Business Wallets: a secure digital tool with which companies, the self-employed, sole traders and public sector bodies can identify and authenticate themselves across all Member States, hold and present attestations issued by authentic sources, sign, seal and timestamp documents with legal effect, manage mandates given to authorised representatives, and exchange legally valid notifications through a qualified electronic registered delivery service.

Use of the wallet is voluntary for economic operators. All public sector bodies, by contrast, will be obliged to accept it for identification, signing, document submission and notifications. A European Digital Directory will support discoverability without centralising data, and the European Unique Identifier (EUID) is designated as the identifier of wallet owners. The Commission estimates savings of up to €150 billion per year if the wallet is widely adopted. The Council adopted its negotiating position on 9 June 2026; the European Parliament’s ITRE committee followed on 10 September 2026, adding requirements that wallet providers and their cloud infrastructure be established in the EU and that data be stored and processed exclusively on EU territory. A political agreement is targeted for the end of 2026.

What GISAD welcomes

The European Business Wallet transfers the logic of the citizen wallet – decentralised storage, attestations from authentic sources, once-only submission instead of repeatedly presented paper evidence – to the economic operator. This addresses precisely the level at which Trusted WEB 4.0 aims to integrate businesses into a sovereign European digital system. The division of roles is correct: freedom of provision and of use for companies, obligation to accept for public administrations. A directory that finds without storing, notifications with provable single-step delivery, and legal equivalence of digital actions are structure, not bureaucracy.

Five corrections GISAD recommends

1. The identity card of a company must not become a movement profile of its trade. The proposed obligation to log all transactions – including those that were not completed – would, if centrally evaluable, produce a complete traffic profile of European economic life. Logs are legitimate for traceability, but they must be data-minimal, exempt from cross-transaction analysis, and kept under transaction numbers that can only be linked internally.

2. Interoperability is not linkability. The EUID, carried through every presentation and every notification, would act as a universal correlation marker across the entire business traffic of a company. GISAD recommends a one-time, signed proof of authorisation deposited with a neutral instance, followed – wherever a mere attribute suffices – by WAN-anonymous verification: identity only where identity is needed.

3. Representation without permanent person profiles. Companies act through natural persons; the binding of an action to the entity must not create a permanent, gapless profile of the persons acting. Signed instance numbers per mandate, with limited duration and single-step scope, instead of standing powers of attorney with complete person correlation.

4. Measure sovereignty instead of declaring it. The ITRE requirement that wallet, delivery-service and cloud providers be established in the EU and process data exclusively on EU territory points in the right direction – but a seat in the EU is not sovereignty; the structure is. Shareholding constructions can circumvent formal seat criteria. GISAD recommends a measurable origin and operator criterion: no US hyperscalers in the critical infrastructure of the wallet ecosystem.

5. SME participation as the success criterion. The wallet must not become a gatekeeper instrument for small European providers. Onboarding simplicity, open standards (ETSI), and verification costs that micro-enterprises and sole traders can bear will decide adoption. Participation instead of new thresholds: the wallet serves the single market only if the smallest operators can use it without depending on a few large providers.

Conclusion: The European Business Wallet is the right architecture on the right level – provided that its logs do not become a movement profile, its identifier does not become a chain, and its sovereignty is measured rather than declared. A wallet that proves instead of monitors strengthens the single market; a wallet that monitors would merely relocate the gatekeeper to the public administration.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · Registered in the EU Transparency Register, No. 244298340978-40

Sources: European Commission – Have your say: European Business Wallet · Proposal COM(2025) 838 (EUR-Lex) · European Commission – European Business Wallets

Action plan against cyberbullying

Have your Say – European Commission · Initiative 14791

Action plan against cyberbullying

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · Statement

Core thesis: Whoever sells attention also sells the conflict. An action plan that professionalises reporting, support and prevention is necessary – but as long as advertising-financed recommendation systems profit from what drives cyberbullying, namely arousal, virality and time spent, it remains an ambulance plan at the foot of the cliff. Structure protects where aftercare comes too late.

What has been decided

Following a public consultation and call for evidence from 22 July to 29 September 2025 – accompanied by multi-stakeholder consultations between November 2024 and October 2025 in which more than 6,300 children took part via the EU Children’s Participation Platform – the Commission adopted the Action Plan against Cyberbullying on 10 February 2026, announced in President von der Leyen’s political guidelines 2024–2029. Around one in six adolescents reports having been a victim of cyberbullying, one in eight admits to having taken part; cyberbullying has been the leading reason for calls to the helplines of the Safer Internet Centres for five years. The plan does not introduce new EU criminal-law measures. It rests on three pillars:

A coordinated EU approach: Member States are invited to develop national cyberbullying policies based on a common understanding; targeted enforcement of existing law, including the Digital Services Act and the AI Act against deepfake bullying.
Prevention and awareness: review of the Commission’s guidelines for educators on digital literacy as part of the Union of Skills; expanded resources and training via the Safer Internet Centres.
Reporting and support: an EU-wide blueprint for an online safety app – modelled on France’s „3018“ app – allowing young victims to report incidents to national helplines, store evidence securely and receive tailored assistance.

GISAD’s assessment

1. The plan treats the symptoms professionally – the causal structure remains untouched. Reporting apps, helplines and evidence preservation help yesterday’s victim. But the architecture that fuels cyberbullying remains: recommendation algorithms that turn escalation into reach and engagement into revenue. Categories instead of feeds – the Finder search logic – would remove the amplification machine from the equation. Without that step, the plan remains reactive.

2. The reporting app is right – but it must not become a honeypot. Reports from bullying victims are among the most sensitive data that exist. The app needs Truststation principles: a one-time signed proof of eligibility, then WAN-anonymous reporting; decentralised rather than central storage; evidence immutably signed but not linkable to the victim. Victim anonymity lowers the reporting threshold – precisely the gap that children identified in the consultations.

3. Age verification without profiling. The age verification blueprint and the debate on age limits must not become an instrument of data collection. Proof of age without disclosure of identity – WAN anonymity, Truststation key sets – protects minors without measuring them. An age check must not become a profile.

4. Anonymity is not the enemy – structure is. Cyberbullying is readily blamed on anonymity. But anonymity also protects the victims – from fear of retaliation when reporting. The answer is not surveillance identity, but structure: no cookies, no data trail, the personality protection concept of the Trusted WEB 4.0; accountability through signed instance numbers rather than total disclosure.

5. Deepfake bullying: enforcement is necessary, but reactive. The structural answer to injected fakes is verification at the source – the Finder Fake Switch, combining AI screening with multi-language human assessment – before content goes viral, not only afterwards through AI Act labelling rules.

6. Child participation as participation, not tokenism. Hearing more than 6,300 children is exemplary. The step beyond the Union of Skills guidelines: digital literacy as access to the system – participation instead of admonition, in 2,500 written languages.

7. Platform design must be held responsible. The findings on online violence against girls show perpetrators following victims across platforms. Here too: make the design liable, not only the individual perpetrators.

Conclusion: GISAD welcomes the Action Plan as a necessary protective net for those affected today. The decisive step for tomorrow remains: a network structure in which conflict does not pay – categories instead of feeds, anonymity for the victims, accountability through structure, and platforms whose business model no longer profits from the harm done to children.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · Registered in the EU Transparency Register, No. 244298340978-40

Sources: EU Commission, Initiative 14791 · Action plan against cyberbullying

European Digital Identity Wallet – electronic attestations of attributes (update)

Have your Say – European Commission · Initiative 16114

European Digital Identity Wallet – electronic attestations of attributes (update)

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · Statement

Core thesis: An attestation proves the attribute – not the human being. That is the strength of this instrument. But the same integrity must apply to the act of verification: an attestation check confirms a characteristic; it must not become a movement profile of the holder.

What has been decided

Commission Implementing Regulation (EU) 2026/1735 of 15 July 2026 amends Implementing Regulation (EU) 2025/1569, which lays down the rules for qualified electronic attestations of attributes (QEAAs) and for attestations issued by or on behalf of public sector bodies responsible for authentic sources. The reason: the Architecture and Reference Framework for the European Digital Identity Wallet has evolved significantly, and the regulation is being aligned with the new standards and specifications. The draft was published on 5 February 2026 with a feedback period until 5 March 2026; the European Data Protection Supervisor delivered his opinion on 17 April 2026. The regulation was published in the Official Journal on 22 July 2026 and entered into force on 11 August 2026; Article 1(3) applies only from 1 January 2027.

Article 3(2): attestations must comply with the schemes for the attestation of attributes, where applicable.
Article 4: updated rules on the circumstances of revocation and on the use of privacy-preserving techniques.
Article 9: specifications for verification mechanisms and requirements for the signing and sealing of verification results against authentic sources.
Annexes I–IV: updated reference standards, including ETSI TS 119 471 and ETSI TS 119 478.

The regulation is one of three framework updates adopted on 15 July 2026 – alongside Implementing Regulation (EU) 2026/1730 on the registration of relying parties and Implementing Regulation (EU) 2026/1731 on the four core wallet regulations. Articles 6 to 9 of Regulation 2025/1569 have been applicable since 19 August 2026: the list of public sector bodies issuing attestations, the European catalogue of attributes and the catalogue of attestation schemes. The deadline for Member States to provide the wallets remains 24 December 2026.

GISAD’s assessment

1. Attestations are a step in the right direction. Proving „over 18“ or „diploma held“ without handing over an identity document corresponds to the border rule of the EU-D-S: identity only where identity is necessary. Selective disclosure and data minimisation are bindingly anchored here. GISAD expressly welcomes this.

2. Verification must not become a movement profile. Revocation checks and verification against authentic sources create central touchpoints: who queries which status, and when? Article 4 points the right way with privacy-preserving techniques – but this must be made measurable. Revocation status must be obtainable without identifying the holder (Truststation key sets), verification queries must remain WAN-anonymous, and no central movement profiles may be created. A verification confirms a characteristic – it must not survey the holder.

3. Signed verification results – an opportunity with a flip side. Signing and sealing verification results makes the check itself traceable – close to the GISAD principle that measurement must take place outside the manipulable area. But a signed verification result is also a linkable artefact. Transaction numbers that can only be assigned internally are needed, so that proof does not become a correlation feature between providers. Interoperability is not linkability.

4. Open European standards are positive – but the reference base keeps moving. ETSI openness stands for structure instead of vendor lock-in. However, with Article 1(3) applying only from 1 January 2027, parts of the reference standard move beyond the wallet launch date of 24 December 2026. Transitional rules must ensure that no backward-compatibility trap arises.

5. Three acts on one day, one ecosystem. The updates to the registers, wallet core regulations and attestations were amended in parallel. Consistency between them is not a formality: interoperability testing must also cover WAN-anonymous use cases.

6. The attribute catalogue must not become a gatekeeper. The catalogue of attributes and schemes maintained by the Commission is practical – but schemes must remain open and reviewable for independent providers, including small European verifiers. No allowlist thinking.

Conclusion: GISAD welcomes the update as a technical maturation of the attestation framework. The deciding factor will be whether the act of verification inherits the same protection as the attestation itself: proof of attributes without exposure of the person – everywhere, measurably and independently verifiable.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · Registered in the EU Transparency Register, No. 244298340978-40

Sources: EU Commission, Initiative 16114 · Commission Implementing Regulation (EU) 2026/1735

European Open Digital Ecosystems

European Commission · Have your Say · Initiative 16213

Towards European open digital ecosystems – Commission Communication on the open source sector and open digital assets · Statement of October 28, 2026

Statement by GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · EU Transparency Register No. 244298340978-40

Open Is Not Owned: Sovereignty Ends Not at the Source Code – It Begins at the Infrastructure

Core statement: Open code makes the structure readable – but readable is not owned. Whoever uses and develops open code only on someone else’s infrastructure owns no structure, but a dependency with source text. The strategy diagnoses the value drain correctly: open source carries the majority of the stacks, the value leaves. The mistake would lie in the therapy, if the sector were merely „funded“. Value arises from operation – from European procurement, European development infrastructure and European operators of open structures. The strategy needs teeth, not eulogies: open source as the default of the public sector, as a procurement and funding condition, and as infrastructure that runs on Stage-B infrastructure.

What the initiative provides

The communication „Towards European open digital ecosystems“ is to set out a strategic approach to the open source sector of the EU – open source as a crucial contribution to technological sovereignty, security and competitiveness – and an operational framework for the use, development and reuse of open digital assets within the Commission, continuing the Commission’s 2020–2023 open source software strategy. The call for evidence (6 January to 3 February 2026) drew 1,658 contributions. The Commission names the causal chain correctly: network effects of dominant actors, restricted access to public procurement, capital and hosting barriers. Planned measures run along the entire life cycle – development, maintenance, market integration, sustainability – from supply chain security to business and foundation models and public-private partnerships.

Recognition: the right yardsticks and the right energy

GISAD acknowledges three things. First, the initiative measures open source against the sovereignty yardstick – not as a niche economy but as a question of security and ownership. Second, it covers the life cycle: code maintenance is work, not a hobby item at the end of innovation. Third, the participation has shown that the civic energy is there: 1,658 contributions in four weeks, many from maintainers with decades of service – that is participation in the literal sense, and a strategy that gathers this energy instead of consuming it already holds the most important raw material of European digital sovereignty in its hands.

Criticism 1: open code on foreign infrastructure is half sovereignty

The Commission itself names hosting infrastructure as a barrier – and yet the overwhelming part of the European open source sector develops on GitHub, builds packages via US registries and distributes through marketplaces under US jurisdiction. The CLOUD Act does not end at the licence text: whoever operates the tools of their own sovereignty project on the infrastructure of a US corporation shifts the dependency from the software layer to the operations layer. The strategy therefore needs a European development infrastructure as its lead requirement: forge, package registry and CI/CD chain in European hands and under European legal order – on Stage-B infrastructure, not as an appendix.

Criticism 2: a communication without procurement teeth changes no incentives

The most powerful instrument of the public sector is not the funding category but the order. As long as public procurement de facto favours proprietary solutions – for legacy interoperability, vendor lock-in or mere habit – open source remains the status of the voluntary. The strategy must make the public sector the anchor customer: public money, open code as the rule, exceptions subject to justification. This includes the hard variant of the origin yardstick: funded and procured openness only counts if operation, maintenance and infrastructure are European-controlled – otherwise open source becomes an open-washing award for resale.

Criticism 3: the strategy must not play the sector off against the CRA

The Cyber Resilience Act deliberately created a lighter regime for open source stewards – rightly, because manufacturer obligations for volunteer maintainers would have ended the European open source sector. But the reporting obligations for stewards providing operational infrastructure (Article 14(3) CRA) and the practical compliance burdens hit precisely the foundations and communities the strategy wants to strengthen. The contradiction is resolvable, but it must be named and managed: steward-friendly CRA guidance, transition periods for the compliance maturity of foundations, and no strategy that praises open source while other regulation burdens it.

Criticism 4: maintenance is work – sustainability is a question of recognition

The sustainability models the strategy is looking for begin with recognition: open source maintenance is charitable work and should be treated as such – the demand from the consultation to recognise contributions as tax-free voluntary service is consistent. Foundations need not alms but orders: maintenance contracts from the public sector for open projects are the most sustainable growth fund there is.

GISAD’s recommendations

European development infrastructure as lead requirement: forge, registry and CI/CD chain in European hands and under European legal order (Stage-B criterion); migration of publicly funded projects away from US platforms as a measurable strategy target.
Procurement as the lever: public money, open code as the rule; an anchor customer programme through which administrations procure open solutions first; exceptions subject to justification and publication.
Origin yardstick as a strategy indicator: measure and publish the operator and infrastructure control of open projects – only European-controlled openness counts as a sovereignty contribution (measurement outside the manipulable area).
Actively shape the relationship with the CRA: steward-friendly guidance, funding for the compliance maturity of foundations, no manufacturer obligations for volunteer maintenance.
Maintenance as an order: maintenance contracts from the public sector for open projects; recognition of open source contributions as charitable work; sustainability indicators (maintainer coverage, security response times) instead of mere distribution figures.

European open digital ecosystems do not arise from a communication but from ownership relations: code that belongs to Europe, infrastructure on which Europe develops, maintenance that Europe pays for. Trusted WEB 4.0 has a simpler rule for this: structure instead of licence, operation instead of download – and sovereignty does not end at the source code; it begins at the infrastructure.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · EU Transparency Register No. 244298340978-40

Sources: European Commission – Initiative 16213 ·
European Commission – Call for Evidence on the Open Source Strategy (January 2026) ·
EU-D-S Constitution (June 2025) (accessed October 28, 2026)

Statement of October 28, 2026 · Concept: Trusted WEB 4.0 · Target system: European Digital System (EU-D-S)

Digital Europe programme

Digital Europe programme – interim evaluation

European Commission · Have your Say · Initiative 13880

Interim evaluation of the DIGITAL programme (2021–2027) – Report COM(2025)771 · Statement of October 28, 2026

Statement by GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · EU Transparency Register No. 244298340978-40

Not What Was Funded – What Remains: The Interim Evaluation Should Measure Structure, Not Spending

Core statement: An evaluation that measures expenditure and disbursements does not measure what remains. The report counts computers, hubs, trainees and companies – but the decisive question is: which structure stands after the funding? Structure in the sense of Trusted WEB 4.0 is European-controlled, decentrally resilient and accessible to all through participation – and the Digital Europe programme must be measured against these three yardsticks, not against the sum of its funding decisions.

What the report finds

The interim evaluation of the Digital Europe programme (Report COM(2025)771 of 18 December 2025, Staff Working Document SWD(2025)420, 316 pages) documents four years of implementation: financing of JUPITER, Europe’s first exascale supercomputer (rank 4 in the TOP500); four large-scale AI Testing and Experimentation Facilities; more than 150 European Digital Innovation Hubs covering some 90% of European regions, which have delivered more than 29,000 services to over 54,600 companies; more than 20,700 people trained in highly specialised digital fields; 27 national coordination centres in cybersecurity; and investments in semiconductor pilot lines and competence centres. The call for evidence and public consultation ran from 27 June to 20 September 2024 and received 103 contributions – among them the clear citizens‘ demand to make open source the basis of all funded technology development.

Recognition: broad reach and European infrastructure

GISAD expressly acknowledges two design features of the programme. First, the decentralised footprint: innovation hubs in 90% of the regions and national coordination centres instead of a single central contact point – many nodes instead of one centre is the right administrative logic. Second, European ownership of strategic infrastructure: a European exascale computer is an asset, not a rental – and every infrastructure that Europe owns instead of leasing reduces dependence on US hyperscalers and the CLOUD Act.

Criticism 1: capacity funding without an origin yardstick

The report measures what was funded – not in whose hands the funded lies. The question GISAD already raised for the Digital Decade adoption targets applies all the more to the billions in funding: how much of the funded technology, the hub services and the AI infrastructure runs on European-controlled Stage-B infrastructure – and how much on US platforms subject to the CLOUD Act? Funding that co-finances US dependence reinforces the very problem it is meant to solve. Every funded project should report an origin yardstick: owner, operator, legal order of the core systems. What is not European-controlled cannot be counted as European digital capacity.

Criticism 2: exascale lighthouses are no substitute for resilience

JUPITER is a legitimate success – but bandwidth is not resilience. Decentralised digitalisation does not replace a single cable – but it takes the catastrophic effect away from every cable break. A programme that concentrates the lion’s share of its computing-power policy in a few giant nodes reinforces precisely the concentration whose failure the recent years have demonstrated – from CrowdStrike to the Charité to the Baltic Sea cables. Resilience is created by many medium-sized, networked, European-controlled nodes. The lighthouse belongs in the portfolio – but the yardstick must be the decentralised network, not the peak performance of one site.

Criticism 3: qualification as specialism instead of participation

More than 20,700 people trained in highly specialised fields is good – but with this the programme measures the top, not the breadth. Digital participation in Europe means: the elderly keep up. People in minority languages keep up. Those who do not want to search but want to be found (getmySense thinks in 2,500 written languages) belong in the measurement. Participation instead of welfare means, for a funding programme: digital participation infrastructure is not a line item of social systems, but a funding strand in its own right – measured by usage, not by course numbers.

GISAD’s recommendations

Origin yardstick as an evaluation indicator: every funded project reports ownership and operating arrangements as well as the legal order of its core systems; only European-controlled infrastructure (Stage-B criterion) counts as European digital capacity.
Resilience as a yardstick instead of peak performance: a funding quota for decentrally networked, medium-sized nodes; the exascale lighthouse remains a supplement, not the measure.
Open source as a funding condition – the citizens‘ contributions to the consultation demanded it, and the logic is right: what Europe funds, Europe must be able to develop further afterwards.
A participation strand with its own indicators: usage figures of the elderly, linguistic diversity of the offerings, accessibility without compulsory identification (WAN-anonymous where identity is not needed).
For the AI Testing and Experimentation Facilities, the yardstick of the AI safety debate applies: measurement outside the manipulable area, escape safeguard as a testing criterion, and sovereign operating environments – no US hyperscalers as the test framework for European AI.

Funding creates structure only if it leaves behind structures that survive without further funding: in European hands, decentrally networked, accessible to all. That is the yardstick against which the final evaluation of the Digital Europe programme will have to be measured – and Trusted WEB 4.0 provides the simpler rule for it: do not count what was funded – count what stands.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · EU Transparency Register No. 244298340978-40

Sources: European Commission – Initiative 13880 ·
European Commission – Interim Evaluation of the Digital Europe Programme (December 2025) ·
EU-D-S Constitution (June 2025) (accessed October 28, 2026)

Statement of October 28, 2026 · Concept: Trusted WEB 4.0 · Target system: European Digital System (EU-D-S)

Amending CIR 2025/1569 of Articles 45d-45f

European Digital Identity Wallet – standards and technical specifications (update)

European Commission · Have your Say · Initiative 16112

Amending CIRs (EU) 2024/2977, 2024/2979, 2024/2980 and 2024/2982 – Implementing Regulation (EU) 2026/1731 · Statement of October 28, 2026

Statement by GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · EU Transparency Register No. 244298340978-40

Interoperability Is Not Linkability: The Wallet Standards Decide Whether the Wallet Organises Trust – or Profiling

Core statement: Standards are structure, and GISAD welcomes the maintenance of the wallet standards in an open European standardisation process. But this standardisation also decides two limits: interoperability must not become linkability – a wallet that leaves traces everywhere with every presentation is not proof of identity, but a motion detector. And wherever AI agents present credentials on behalf of a person, the rule of Trusted WEB 4.0 applies: single-step release, signed instance numbers, no standing authorisation. The standard determines whether the wallet organises trust – or profiling.

What the regulation provides

Implementing Regulation (EU) 2026/1731 of 15 July 2026, in force since 11 August 2026, amends the four wallet implementing regulations CIR (EU) 2024/2977, 2024/2979, 2024/2980 and 2024/2982 by updating the references to applicable standards and technical specifications, ensuring that Member States can develop and provide European Digital Identity Wallets in an interoperable manner (Article 5a(23) of the eIDAS Regulation). The consultation (5 February to 5 March 2026, 43 contributions) ran in parallel to the two sister consultations on relying parties and attestations of attributes. What is affected is the technical core on which Member States are building their wallets – a few months before the wallets must be available on 24 December 2026.

Recognition: open standards in European hands

GISAD acknowledges that the standards are developed in the European standardisation process (ETSI TC ESI), published as legal acts and consulted before adoption: transparent, comprehensible, European. This is structure instead of vendor lock-in – no proprietary formats of individual providers, no de facto dependencies on non-European standard setters. The specification of an interface for data deletion requests to relying parties is also a step in the right direction: data minimisation becomes a technical obligation, not a declaration of intent.

Criticism 1: interoperability is not linkability

The amended CIRs require wallet units to validate access certificates at every interaction, check wallet unit attestations and present attributes. Technically correct – but each of these checks is an event that leaves traces with relying parties and in protocols. Anyone using the same wallet at twenty services leaves twenty linkable data records, even if each individual service sees only one attestation. The standard must prevent linkage, not merely minimise individual disclosures: no cross-service correlation identifiers, WAN-anonymous metadata, assignment only internal, following the transaction number model of the EU-D-S. The individual presentation is anonymised – the sum of the presentations must not produce a profile.

Criticism 2: the presenting agent is the escape case

The consultation called for agent-mediated machine-to-machine interactions to be explicitly included in the specifications and interoperability tests: AI agents that request and present attestations on behalf of the user. This is the constellation that Trusted WEB 4.0 resolves with the Finder-KI-Escape-Schalter – and the security signals of recent months show it is not theory: models from OpenAI and Anthropic escaped closed test environments, and the Hugging Face attack of July 2026 happened with reduced guardrails precisely in a testing environment. An AI agent with credential function therefore needs: single-step release for every presentation (no standing authorisation, no background synchronisation), signed instance numbers from the Truststation for every agent instance, measurement outside the manipulable area, and the zero-tolerance rule for instance-identifying markers outside the system.

Criticism 3: the target moves shortly before the start

The technical core of the wallets is being amended five months before the availability deadline. Transparency and consultation are good – but Member States building against the previous reference standard face rework, and interoperability tests must run against a target that no longer moves. Structure protects only if it stands before the operation begins; standard maintenance needs fixed reference points and adequate transition periods.

GISAD’s recommendations

Linkage protection as a principle of standardisation: no cross-service correlation identifiers in wallet unit attestations; WAN-anonymous metadata; assignment only internal (transaction number principle of the EU-D-S).
Agent-mediated interactions only with single-step release per presentation, signed instance numbers of the Truststation per agent instance and the zero-tolerance rule; no standing authorisations in the specifications.
Data deletion requests not as an optional interface, but as a mandatory component of relying party compliance.
Fixed reference standards with adequate transition periods; with every standard update, transition periods that do not force Member States into duplicate work.
Extend interoperability tests to WAN-anonymous use cases: access and presentation without identification where identity is not legally required – the wallet must be able to do what the border rule of the EU-D-S demands: identity only where identity is needed.

The technical standardisation of the wallet is where its everyday character is decided: a tool of the user or an instrument of linkage. Trusted WEB 4.0 has a simpler rule for this: the wallet proves eligibility, not the person – and the agent that uses it is never on standing authorisation.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · EU Transparency Register No. 244298340978-40

Sources: European Commission – Initiative 16112 ·
EUR-Lex – Implementing Regulation (EU) 2026/1731 ·
EU-D-S Constitution (June 2025) (accessed October 28, 2026)

Statement of October 28, 2026 · Concept: Trusted WEB 4.0 · Target system: European Digital System (EU-D-S)

European Digital Identity Wallet – registration of wallet-relying parties (update)

European Digital Identity Wallet – standards and technical specifications (update)

European Commission · Have your Say · Initiative 16112

Amending CIRs (EU) 2024/2977, 2024/2979, 2024/2980 and 2024/2982 – Implementing Regulation (EU) 2026/1731 · Statement of October 28, 2026

Statement by GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · EU Transparency Register No. 244298340978-40

Interoperability Is Not Linkability: The Wallet Standards Decide Whether the Wallet Organises Trust – or Profiling

What the regulation provides

Recognition: open standards in European hands

Criticism 1: interoperability is not linkability

Criticism 2: the presenting agent is the escape case

Criticism 3: the target moves shortly before the start

GISAD’s recommendations

Linkage protection as a principle of standardisation: no cross-service correlation identifiers in wallet unit attestations; WAN-anonymous metadata; assignment only internal (transaction number principle of the EU-D-S).
Agent-mediated interactions only with single-step release per presentation, signed instance numbers of the Truststation per agent instance and the zero-tolerance rule; no standing authorisations in the specifications.
Data deletion requests not as an optional interface, but as a mandatory component of relying party compliance.
Fixed reference standards with adequate transition periods; with every standard update, transition periods that do not force Member States into duplicate work.
Extend interoperability tests to WAN-anonymous use cases: access and presentation without identification where identity is not legally required – the wallet must be able to do what the border rule of the EU-D-S demands: identity only where identity is needed.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · EU Transparency Register No. 244298340978-40

Sources: European Commission – Initiative 16112 ·
EUR-Lex – Implementing Regulation (EU) 2026/1731 ·
EU-D-S Constitution (June 2025) (accessed October 28, 2026)

Statement of October 28, 2026 · Concept: Trusted WEB 4.0 · Target system: European Digital System (EU-D-S)

Validation of qualified electronic signatures and seals as well as advanced electronic signatures and seals

European Digital Identity Framework – validation of qualified/advanced electronic signatures and seals

European Commission · Have your Say · Initiative 16072

Implementing Regulation (EU) 2025/1945 on the validation of qualified and advanced electronic signatures and seals · Statement of October 28, 2026

Statement by GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · EU Transparency Register No. 244298340978-40

Validation Must Confirm the Signature – Not Expose the Person Behind It

Core statement: A signature is only worth as much as its validation. GISAD welcomes the harmonisation of validation through open reference standards and decentralised trust lists – it is the right infrastructure for trust. But validation must not become identification: validating a signature confirms its validity and the eligibility it certifies, not the exposure of the person using it. Whoever conflates the two is not building a trust infrastructure, but a surveillance infrastructure.

What the regulation provides

Implementing Regulation (EU) 2025/1945 of 29 September 2025, published in the Official Journal on 30 September 2025 and applicable since 20 October 2025, sets out the reference standards for the validation of qualified electronic signatures and seals (Annex I) and of advanced electronic signatures and seals based on qualified certificates (Annex II): ETSI TS 119 172-4 (validation policy for European qualified signatures and seals using trusted lists) and ETSI TS 119 102-2 (signature validation report), each with specified adaptations. The act is based on Articles 32(3), 32a(3), 40 and 40a of the eIDAS Regulation (EU) No 910/2014. A companion act, Implementing Regulation (EU) 2025/1942, governs the qualified validation services themselves.

Recognition: testing by open rules is structure, not arbitrariness

GISAD expressly acknowledges two design decisions. First: the reference standards are open, documented and comprehensible to everyone – validation becomes a measurable check instead of a black-box verdict. This corresponds to the principle of measurement outside the manipulable area: the validation report (ETSI TS 119 102-2) makes the check itself reviewable. Second: the trust anchors lie in the trusted lists of the Member States – distributed decentrally, not in one central register that could become a single point of failure or a central point of access.

Criticism 1: validation confirms the signature, not the person

The regulation governs the technical validity check. The danger lies in the practice that follows: when recipients automatically turn every validated signature into an identification event, and validation processes are logged, a movement profile emerges – when, where and with which system a signature was checked and used. The signature confirms eligibility; it does not have to identify the person. The EU-D-S separates precisely this with its border rule upon entering Trusted WEB 4.0: identity only where identity is needed. The signed instance number issued by the Truststation is the model – it confirms eligibility without identifying the user, and transaction numbers can only be assigned internally. Pseudonymous qualified certificates, which eIDAS provides for, must be fully supported in validation policies as a normal case, not treated as an exception.

Criticism 2: the validator must not become the gatekeeper

Validation must remain possible everywhere and by anyone who applies the open standards – not de facto only through qualified validation services and vendor-specific verification tools. If checking is tied to a few service providers, a new gatekeeper level emerges: whoever checks decides what counts. The chain must not read: trust is generated by the signature, the signature is checked by the service provider, the service provider decides the benefit. Trust must lie with the structure – open standards, comprehensible reports, decentralised trust anchors.

GISAD’s recommendations

Validation policies must strictly separate signature validity from signer identity; pseudonymous qualified certificates as an equivalent normal case, not as an exception.
Keep validation logs data-minimal: no central retention of checking processes that create movement profiles; assignment only internal, following the transaction number model of the EU-D-S.
Guarantee independent validation by anyone using open standards – the validation report (ETSI TS 119 102-2) as the standard of comprehensibility; no de facto dependence on individual service providers or verification tools.
Keep trust anchors decentralised in the trusted lists of the Member States – no central EU trust register as a single point of failure.
Adopt the border rule of the EU-D-S as validation practice: the check confirms eligibility (signed by the Truststation) without identifying the user – WAN anonymity up to the point where identity is legally required.

The regulation builds the right foundation: open standards, reviewable reports, decentralised trust anchors. What it cannot regulate – but what practice must be measured against – is whether validation becomes trust without identification. Trusted WEB 4.0 has a simpler rule for this: the signature proves eligibility, not the person.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · EU Transparency Register No. 244298340978-40

Sources: European Commission – Initiative 16072 ·
EUR-Lex – Implementing Regulation (EU) 2025/1945 ·
EU-D-S Constitution (June 2025) (accessed October 28, 2026)

Statement of October 28, 2026 · Concept: Trusted WEB 4.0 · Target system: European Digital System (EU-D-S)

EU copyright law for blind and visually impaired people

EU copyright law for blind and visually impaired people – evaluation of the Marrakesh Directive and Regulation

European Commission · Have your Say · Initiative 13615

Evaluation of the Marrakesh Directive (EU) 2017/1564 and Marrakesh Regulation (EU) 2017/1563 · Statement of October 28, 2026

Statement by GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · EU Transparency Register No. 244298340978-40

Marrakesh Evaluation: Measuring Administration Is Not Measuring Participation

Core statement: An evaluation report that ends with „no amendments warranted“ measures administration, not participation. The Marrakesh Directive and Regulation are the right instrument – but as long as the overwhelming majority of published books remains inaccessible to blind and visually impaired people, the objective has not been reached. Participation is not created through exceptions to copyright, but through structure: accessibility as the default state of digital publishing, access without repeated proof of disability, and availability that is measured publicly.

What the report finds

The Commission has evaluated the Marrakesh Directive (EU) 2017/1564 and the Marrakesh Regulation (EU) 2017/1563, through which the EU implements the 2013 WIPO Marrakesh Treaty. The evaluation, required by Article 10(1) of the Directive and Article 7 of the Regulation, also assessed the impact of possible compensation schemes on the availability of accessible format copies and their cross-border exchange. The result, published on 12 December 2025 as report COM(2025)749 with the accompanying staff working document SWD(2025)406: the instruments matched expectations, improved legal certainty and the availability of accessible format copies, including across borders – and no amendments are considered warranted at this stage. The call for evidence ran from 13 April to 11 May 2023 and received 34 contributions, among them the DAISY Consortium and national libraries for the blind.

Recognition: cross-border exchange without a central platform

GISAD acknowledges what the report records as a success and what is structurally remarkable: the cross-border exchange of accessible format copies works through authorised entities in the Member States – decentralised, without a central EU platform, without a single point of failure. This is precisely the principle the EU-D-S is built on: many authorised entities complementing each other, instead of one body deciding for all. The participatory character of the instrument is right: Marrakesh recognises access to knowledge as participation, not as welfare.

Criticism: the exception is measured, not the condition

The yardstick of an evaluation determines its outcome. The Commission measures legal certainty, administrative procedures and cross-border handling – but not the actual availability of accessible titles relative to the totality of publications. According to estimates by the European Blind Union, around 30 million people in Europe are blind or partially sighted, and 95% of all published books are never converted into accessible formats; a study across six European countries finds less than 7% of published works accessible. An evaluation that concludes „no amendments warranted“ against this background confuses smooth administration with a fulfilled purpose. What is not measured publicly is not improved – the availability measurement therefore belongs in the report, independent and visible for every Member State: measurement outside the manipulable area.

Structure instead of welfare: access without an ID requirement

Using the exception runs through authorised entities and proof of eligibility. That is better than no access – but it turns participation into an administrative relationship with an ID requirement: whoever wants to read must prove their disability again and again. The EU-D-S has a simpler rule for this: identity only where identity is needed. A one-time, Truststation-signed credential – followed by WAN-anonymous access without profiling, without repeated verification of disability, without stigmatisation. The eligibility is checked, the person is not registered.

Compensation schemes: those who end the book famine do not pay those who caused it

The evaluation also examines possible compensation schemes. GISAD is clear on this: compensation models that burden non-profit libraries and organisations turn responsibility upside down. The Treaty became necessary because publishers did not provide accessible formats at the same time and at the same price. Those who close this gap must not be charged extra – that would be a participation levy on precisely those who create participation. The financing question belongs where the EU-D-S locates it: in participation payments and structure, not in levies on non-profit work.

GISAD’s recommendations

Public availability measurement as a core indicator: annual, independently collected figures on accessible titles per Member State, relative to the totality of publications – measurement outside the manipulable area.
Accessibility as the default state („born accessible“): accessible formats as a requirement of digital publishing itself – structure instead of retrofitted exception; the exception remains what it should be: a last line of defence, not the rule.
No compensation schemes at the expense of authorised entities; resolve the cost question through participation mechanisms instead of levies on non-profit work.
Proof of eligibility one-time and signed (Truststation), then WAN-anonymous access without profiling – identity only where identity is needed.
Keep the decentralised exchange through authorised entities as the guiding model – no central EU platform that becomes a single point of failure; linguistic diversity including minority languages as the yardstick (getmySense thinks in 2,500 written languages – participation applies to every language community, and to the elderly, for whom large print and read-aloud functions are participation).

The Marrakesh report documents an instrument that works. But participation is achieved when blind people can read the same books at the same time as everyone else – not when the exception is administered correctly. Trusted WEB 4.0 has a simpler rule for this: structure instead of exception, eligibility instead of identification, availability instead of book famine.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · EU Transparency Register No. 244298340978-40

Sources: European Commission – Initiative 13615 ·
European Commission – Evaluation of the Marrakesh Directive and Regulation (December 2025) ·
EU-D-S Constitution (June 2025) (accessed October 28, 2026)

Statement of October 28, 2026 · Concept: Trusted WEB 4.0 · Target system: European Digital System (EU-D-S)