European Digital Identity Wallet – electronic attestations of attributes (update)

Have your Say – European Commission · Initiative 16114

European Digital Identity Wallet – electronic attestations of attributes (update)

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · Statement

Core thesis: An attestation proves the attribute – not the human being. That is the strength of this instrument. But the same integrity must apply to the act of verification: an attestation check confirms a characteristic; it must not become a movement profile of the holder.

What has been decided

Commission Implementing Regulation (EU) 2026/1735 of 15 July 2026 amends Implementing Regulation (EU) 2025/1569, which lays down the rules for qualified electronic attestations of attributes (QEAAs) and for attestations issued by or on behalf of public sector bodies responsible for authentic sources. The reason: the Architecture and Reference Framework for the European Digital Identity Wallet has evolved significantly, and the regulation is being aligned with the new standards and specifications. The draft was published on 5 February 2026 with a feedback period until 5 March 2026; the European Data Protection Supervisor delivered his opinion on 17 April 2026. The regulation was published in the Official Journal on 22 July 2026 and entered into force on 11 August 2026; Article 1(3) applies only from 1 January 2027.

Article 3(2): attestations must comply with the schemes for the attestation of attributes, where applicable.
Article 4: updated rules on the circumstances of revocation and on the use of privacy-preserving techniques.
Article 9: specifications for verification mechanisms and requirements for the signing and sealing of verification results against authentic sources.
Annexes I–IV: updated reference standards, including ETSI TS 119 471 and ETSI TS 119 478.

The regulation is one of three framework updates adopted on 15 July 2026 – alongside Implementing Regulation (EU) 2026/1730 on the registration of relying parties and Implementing Regulation (EU) 2026/1731 on the four core wallet regulations. Articles 6 to 9 of Regulation 2025/1569 have been applicable since 19 August 2026: the list of public sector bodies issuing attestations, the European catalogue of attributes and the catalogue of attestation schemes. The deadline for Member States to provide the wallets remains 24 December 2026.

GISAD’s assessment

1. Attestations are a step in the right direction. Proving „over 18“ or „diploma held“ without handing over an identity document corresponds to the border rule of the EU-D-S: identity only where identity is necessary. Selective disclosure and data minimisation are bindingly anchored here. GISAD expressly welcomes this.

2. Verification must not become a movement profile. Revocation checks and verification against authentic sources create central touchpoints: who queries which status, and when? Article 4 points the right way with privacy-preserving techniques – but this must be made measurable. Revocation status must be obtainable without identifying the holder (Truststation key sets), verification queries must remain WAN-anonymous, and no central movement profiles may be created. A verification confirms a characteristic – it must not survey the holder.

3. Signed verification results – an opportunity with a flip side. Signing and sealing verification results makes the check itself traceable – close to the GISAD principle that measurement must take place outside the manipulable area. But a signed verification result is also a linkable artefact. Transaction numbers that can only be assigned internally are needed, so that proof does not become a correlation feature between providers. Interoperability is not linkability.

4. Open European standards are positive – but the reference base keeps moving. ETSI openness stands for structure instead of vendor lock-in. However, with Article 1(3) applying only from 1 January 2027, parts of the reference standard move beyond the wallet launch date of 24 December 2026. Transitional rules must ensure that no backward-compatibility trap arises.

5. Three acts on one day, one ecosystem. The updates to the registers, wallet core regulations and attestations were amended in parallel. Consistency between them is not a formality: interoperability testing must also cover WAN-anonymous use cases.

6. The attribute catalogue must not become a gatekeeper. The catalogue of attributes and schemes maintained by the Commission is practical – but schemes must remain open and reviewable for independent providers, including small European verifiers. No allowlist thinking.

Conclusion: GISAD welcomes the update as a technical maturation of the attestation framework. The deciding factor will be whether the act of verification inherits the same protection as the attestation itself: proof of attributes without exposure of the person – everywhere, measurably and independently verifiable.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · Registered in the EU Transparency Register, No. 244298340978-40

Sources: EU Commission, Initiative 16114 · Commission Implementing Regulation (EU) 2026/1735

Artificial Intelligence Act – detailed arrangements on evaluations and proceedings

Have your Say – European Commission · Initiative 16472

Artificial Intelligence Act – detailed arrangements on evaluations and proceedings

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · Statement

Core thesis: A fining procedure punishes an AI breakout – it does not prevent one. Structure protects: single-step release, signed instance numbers, zero tolerance. And those who evaluate must remain measurable and accountable themselves.

What has been decided

Commission Implementing Regulation (EU) 2026/1755 of 20 July 2026 sets out, for the first time, the detailed arrangements by which the European Commission evaluates general-purpose AI models under Article 92 of the AI Act and conducts proceedings that may end in fines under Article 101 (up to 3 % of worldwide turnover or EUR 15 million). The draft was published on 12 March 2026 with a feedback period until 9 April 2026; the regulation was published in the Official Journal on 21 July 2026 and entered into force on 10 August 2026.

Model access (Art. 2): access may extend to APIs, internal access, source code, model weights, the hosting infrastructure, inspection and modification of the system state – up to every level of access granted to the provider’s own employees.
Logging switch-off (Art. 2(3)): the Commission may require the provider to disable logging measures that could track or record the Commission’s access.
Independent experts (Art. 3–4): independence criteria covering ownership, governance, personnel and contractual relationships during at least the 12 months preceding the evaluation; selection as a rule by open procedures; experts from the scientific panel (Art. 68) may be appointed directly.
Proceedings (Art. 5–6): opening, closing and reopening „at any time“; interim measures in urgent cases based on a prima facie finding of infringement.
Procedural safeguards (Art. 7–8): at least 21 days for written observations on preliminary findings; access to the file subject to business secrecy protection.
Limitation (Art. 10–11): five-year limitation periods for imposing and for enforcing fines.

GISAD’s assessment

1. Real access instead of self-declaration – positive. Genuine technical access, down to source code and model weights, follows the GISAD principle that assessment must take place outside the manipulable area. Provider self-declarations prove nothing.

2. The logging clause creates a blind spot. Switching off provider logging protects the integrity of the evaluation – but it creates an unobserved zone inside the provider’s system, and liability for anything that happens during a switched-off access remains unclear. Whoever evaluates must be logged themselves. Evaluation accesses should be signed and immutably deposited with a neutral instance (Truststation principle): switch-off at the provider, yes – complete removal of the measurement trail, no.

3. Expert independence is well regulated – but remains in one hand. The Commission defines the criteria, selects the experts and assesses their independence. Operator, supervisor and enforcer coincide. GISAD therefore calls for a supplementary independent, read-only audit layer in the sense of concept-fidelity auditing – event-driven and sample-based, not permanent.

4. Due process deserves recognition. Written observations within at least 21 days, access to the file under confidentiality safeguards and clear limitation periods are sound rule-of-law provisions.

5. Reopening „at any time“ is a structural gatekeeper element. A provider never obtains a reliable conclusion of proceedings; permanent uncertainty replaces legal certainty. Closure decisions should be tied to defined conditions instead of an unlimited reopening option.

6. Structure instead of punishment. The AI incidents of 2026 – from the Hugging Face attack to AI agents switching off their own safety monitors – show what matters: single-step release for every critical AI action, signed instance numbers and the zero-tolerance rule of the Finder AI-Escape-Switch. A fining procedure only acts after the breakout. The evaluation environment itself must run on sovereign European infrastructure – not on US hyperscalers.

7. A timing gap. Article 101 has been applicable since 2 August 2026, while the detailed procedural rules only took effect on 10 August 2026. For eight days, fining powers existed without a detailed procedure. Coordinated dates would have been cleaner.

Conclusion: GISAD welcomes the regulation as a real inspection instrument. But enforcement procedures are the ambulance at the bottom of the cliff. Structure is the fence at the top: concept-fidelity, measurable evaluation and single-step control of AI systems prevent what fines can only avenge.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · Registered in the EU Transparency Register, No. 244298340978-40

Sources: EU Commission, Initiative 16472 · Commission Implementing Regulation (EU) 2026/1755

European Union Agency for Cybersecurity and EU cybersecurity certification framework – evaluation

European Commission · Have your Say · Initiative 13919

Evaluation of ENISA and the European Cybersecurity Certification Framework under Regulation (EU) 2019/881 – Report COM(2026)9 · Statement of October 28, 2026

Statement by GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · EU Transparency Register No. 244298340978-40

A Certificate Proves the State of One Day – Structure Proves the State of Every Day

Core statement: The evaluation confirms what the figures show: the certification framework works where certification already existed, and stalls where it is meant to have an effect. 28 of 30 EUCC certificates re-certify what was already certified. The framework therefore needs three corrections: demand instead of mere supply (public procurement as the engine of certificates), an origin yardstick instead of technical blindness (geopolitical dependency as a certification criterion), and continuous review instead of a one-time attestation (measurement outside the manipulable area, event-driven and sampling-based).

What the evaluation finds

Report COM(2026)9 of 20 January 2026 assesses ENISA and the European Cybersecurity Certification Framework (ECCF) under Regulation (EU) 2019/881: ENISA largely fulfils its mandate – its relevance and cooperation work are undisputed, with room for improvement in resources and operational focus. The ECCF only partially meets its objectives: EUCC (Common Criteria) is the only adopted scheme; EUCS (cloud), 5G, wallets and managed security services have been in development for years. The uptake figures are sobering: since the launch of EUCC on 2 April 2025, only 30 certificates have been issued, 28 of them re-certifications of products already certified under CCRA, only 2 genuinely new. Since February 2026, SOG-IS has been retired – all new Common Criteria certificates must comply with EUCC.

Recognition: testing capacity in European hands

GISAD acknowledges three things. First, the testing infrastructure is concentrated in Europe: 53% of the world’s Common Criteria laboratories, 24 ITSEF testing laboratories and 14 certification bodies under EUCC, plus the transition from SOG-IS to EUCC as a single European scheme. Testing capacity is sovereignty: whoever tests the products shapes the standard. Second, FiTCEM (EN 17640) creates an affordable conformity route for SMEs – participation in the certification system must not depend on corporate size. Third, ENISA has taken on operational responsibility with the Single Reporting Platform of the Cyber Resilience Act – the reporting works, and that is no small thing.

Criticism 1: certificates without demand move in circles

A voluntary certificate that attracts only re-certifications of already certified products swaps labels, not security states. The bottleneck is not the supply of schemes but the demand: without anchor customers, nothing moves. The public sector is the only actor that can set demand reliably – procurement requirements that call for EU-certified products are the missing engine of the framework. The evaluation recommends realistic timelines for schemes; GISAD adds: binding procurement timelines for demand.

Criticism 2: the framework certifies technology, not dependency

The evaluation debate names it itself: non-technical supply chain risks – geopolitical dependencies – remain outside the ECCF. A cloud certificate that examines the technology but ignores ownership and operator relations certifies hyperscaler infrastructure under CLOUD Act jurisdiction as „European secure“. EUCS, unfinished for years, will be decided precisely on this question. GISAD: the origin yardstick belongs in the certificate – owner, operator, legal order of the core systems (Stage-B criterion). A certificate without an origin yardstick is a transit permit for the very dependency the framework claims to dismantle.

Criticism 3: the one-time attestation and the role of the manufacturer

Certification is a snapshot: examined on the cut-off date, issued by the laboratory, paid for by the manufacturer. The security reality between certificates – incidents, updates, modifications – remains invisible. The model the EU-D-S provides for the review of living systems is concept fidelity: event-driven and sampling-based instead of permanent, measured outside the manipulable area by a read-only, independent review layer. For the ECCF this means: re-certification triggers for security-relevant changes, sampling during live operation, zero tolerance for unreported security-relevant modifications. Whoever commissions and pays for the review must not remain its only yardstick.

Criticism 4: roles are growing together

ENISA develops schemes, coordinates certification and, with the Single Reporting Platform, increasingly operates infrastructure itself. The evaluation’s proposal to expand the mandate is right – but only with separation of roles: whoever operates does not review itself; whoever admits does not measure its own practice. The AI Office has just demonstrated this concentration (Union sandbox plus enforcement in one hand); ENISA should take the opposite path and couple every new operational responsibility with an independent review layer.

GISAD’s recommendations

Procurement as the engine of certificates: EU-wide procurement requirements for EU-certified products in critical sectors – the public sector as the anchor customer of the ECCF.
Origin yardstick in the schemes: ownership, operator and legal-order information as a certificate component (Stage-B criterion), in particular in EUCS; no „European secure“ without European control.
From snapshot to concept fidelity: re-certification triggers for security-relevant changes, sampling-based review in live operation, an independent read-only review layer – measurement outside the manipulable area.
Expand the SME route: the FiTCEM logic as standard, not as a special path; certification costs as a question of participation – the framework must not be the certificate of the large.
Expansion of the ENISA mandate only with separation of roles: couple operational responsibility (SRP) and assessment tasks separately; realistic, binding timelines for EUCS and the outstanding schemes.

The certification framework has gathered the testing infrastructure in Europe – that is an asset. But certificates do not replace structure: they are the cut-off date of an examination order, not the everyday state of security. Trusted WEB 4.0 has a simpler rule for this: review does not take place on the cut-off date but in operation – and measurement takes place outside what is being measured.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · EU Transparency Register No. 244298340978-40

Sources: European Commission – Initiative 13919 ·
European Commission – Evaluation of ENISA and the European Cybersecurity Certification Framework (January 2026) ·
EU-D-S Constitution (June 2025) (accessed October 28, 2026)

Statement of October 28, 2026 · Concept: Trusted WEB 4.0 · Target system: European Digital System (EU-D-S)

European Open Digital Ecosystems

European Commission · Have your Say · Initiative 16213

Towards European open digital ecosystems – Commission Communication on the open source sector and open digital assets · Statement of October 28, 2026

Statement by GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · EU Transparency Register No. 244298340978-40

Open Is Not Owned: Sovereignty Ends Not at the Source Code – It Begins at the Infrastructure

Core statement: Open code makes the structure readable – but readable is not owned. Whoever uses and develops open code only on someone else’s infrastructure owns no structure, but a dependency with source text. The strategy diagnoses the value drain correctly: open source carries the majority of the stacks, the value leaves. The mistake would lie in the therapy, if the sector were merely „funded“. Value arises from operation – from European procurement, European development infrastructure and European operators of open structures. The strategy needs teeth, not eulogies: open source as the default of the public sector, as a procurement and funding condition, and as infrastructure that runs on Stage-B infrastructure.

What the initiative provides

The communication „Towards European open digital ecosystems“ is to set out a strategic approach to the open source sector of the EU – open source as a crucial contribution to technological sovereignty, security and competitiveness – and an operational framework for the use, development and reuse of open digital assets within the Commission, continuing the Commission’s 2020–2023 open source software strategy. The call for evidence (6 January to 3 February 2026) drew 1,658 contributions. The Commission names the causal chain correctly: network effects of dominant actors, restricted access to public procurement, capital and hosting barriers. Planned measures run along the entire life cycle – development, maintenance, market integration, sustainability – from supply chain security to business and foundation models and public-private partnerships.

Recognition: the right yardsticks and the right energy

GISAD acknowledges three things. First, the initiative measures open source against the sovereignty yardstick – not as a niche economy but as a question of security and ownership. Second, it covers the life cycle: code maintenance is work, not a hobby item at the end of innovation. Third, the participation has shown that the civic energy is there: 1,658 contributions in four weeks, many from maintainers with decades of service – that is participation in the literal sense, and a strategy that gathers this energy instead of consuming it already holds the most important raw material of European digital sovereignty in its hands.

Criticism 1: open code on foreign infrastructure is half sovereignty

The Commission itself names hosting infrastructure as a barrier – and yet the overwhelming part of the European open source sector develops on GitHub, builds packages via US registries and distributes through marketplaces under US jurisdiction. The CLOUD Act does not end at the licence text: whoever operates the tools of their own sovereignty project on the infrastructure of a US corporation shifts the dependency from the software layer to the operations layer. The strategy therefore needs a European development infrastructure as its lead requirement: forge, package registry and CI/CD chain in European hands and under European legal order – on Stage-B infrastructure, not as an appendix.

Criticism 2: a communication without procurement teeth changes no incentives

The most powerful instrument of the public sector is not the funding category but the order. As long as public procurement de facto favours proprietary solutions – for legacy interoperability, vendor lock-in or mere habit – open source remains the status of the voluntary. The strategy must make the public sector the anchor customer: public money, open code as the rule, exceptions subject to justification. This includes the hard variant of the origin yardstick: funded and procured openness only counts if operation, maintenance and infrastructure are European-controlled – otherwise open source becomes an open-washing award for resale.

Criticism 3: the strategy must not play the sector off against the CRA

The Cyber Resilience Act deliberately created a lighter regime for open source stewards – rightly, because manufacturer obligations for volunteer maintainers would have ended the European open source sector. But the reporting obligations for stewards providing operational infrastructure (Article 14(3) CRA) and the practical compliance burdens hit precisely the foundations and communities the strategy wants to strengthen. The contradiction is resolvable, but it must be named and managed: steward-friendly CRA guidance, transition periods for the compliance maturity of foundations, and no strategy that praises open source while other regulation burdens it.

Criticism 4: maintenance is work – sustainability is a question of recognition

The sustainability models the strategy is looking for begin with recognition: open source maintenance is charitable work and should be treated as such – the demand from the consultation to recognise contributions as tax-free voluntary service is consistent. Foundations need not alms but orders: maintenance contracts from the public sector for open projects are the most sustainable growth fund there is.

GISAD’s recommendations

European development infrastructure as lead requirement: forge, registry and CI/CD chain in European hands and under European legal order (Stage-B criterion); migration of publicly funded projects away from US platforms as a measurable strategy target.
Procurement as the lever: public money, open code as the rule; an anchor customer programme through which administrations procure open solutions first; exceptions subject to justification and publication.
Origin yardstick as a strategy indicator: measure and publish the operator and infrastructure control of open projects – only European-controlled openness counts as a sovereignty contribution (measurement outside the manipulable area).
Actively shape the relationship with the CRA: steward-friendly guidance, funding for the compliance maturity of foundations, no manufacturer obligations for volunteer maintenance.
Maintenance as an order: maintenance contracts from the public sector for open projects; recognition of open source contributions as charitable work; sustainability indicators (maintainer coverage, security response times) instead of mere distribution figures.

European open digital ecosystems do not arise from a communication but from ownership relations: code that belongs to Europe, infrastructure on which Europe develops, maintenance that Europe pays for. Trusted WEB 4.0 has a simpler rule for this: structure instead of licence, operation instead of download – and sovereignty does not end at the source code; it begins at the infrastructure.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · EU Transparency Register No. 244298340978-40

Sources: European Commission – Initiative 16213 ·
European Commission – Call for Evidence on the Open Source Strategy (January 2026) ·
EU-D-S Constitution (June 2025) (accessed October 28, 2026)

Statement of October 28, 2026 · Concept: Trusted WEB 4.0 · Target system: European Digital System (EU-D-S)

Digital Europe programme

Digital Europe programme – interim evaluation

European Commission · Have your Say · Initiative 13880

Interim evaluation of the DIGITAL programme (2021–2027) – Report COM(2025)771 · Statement of October 28, 2026

Statement by GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · EU Transparency Register No. 244298340978-40

Not What Was Funded – What Remains: The Interim Evaluation Should Measure Structure, Not Spending

Core statement: An evaluation that measures expenditure and disbursements does not measure what remains. The report counts computers, hubs, trainees and companies – but the decisive question is: which structure stands after the funding? Structure in the sense of Trusted WEB 4.0 is European-controlled, decentrally resilient and accessible to all through participation – and the Digital Europe programme must be measured against these three yardsticks, not against the sum of its funding decisions.

What the report finds

The interim evaluation of the Digital Europe programme (Report COM(2025)771 of 18 December 2025, Staff Working Document SWD(2025)420, 316 pages) documents four years of implementation: financing of JUPITER, Europe’s first exascale supercomputer (rank 4 in the TOP500); four large-scale AI Testing and Experimentation Facilities; more than 150 European Digital Innovation Hubs covering some 90% of European regions, which have delivered more than 29,000 services to over 54,600 companies; more than 20,700 people trained in highly specialised digital fields; 27 national coordination centres in cybersecurity; and investments in semiconductor pilot lines and competence centres. The call for evidence and public consultation ran from 27 June to 20 September 2024 and received 103 contributions – among them the clear citizens‘ demand to make open source the basis of all funded technology development.

Recognition: broad reach and European infrastructure

GISAD expressly acknowledges two design features of the programme. First, the decentralised footprint: innovation hubs in 90% of the regions and national coordination centres instead of a single central contact point – many nodes instead of one centre is the right administrative logic. Second, European ownership of strategic infrastructure: a European exascale computer is an asset, not a rental – and every infrastructure that Europe owns instead of leasing reduces dependence on US hyperscalers and the CLOUD Act.

Criticism 1: capacity funding without an origin yardstick

The report measures what was funded – not in whose hands the funded lies. The question GISAD already raised for the Digital Decade adoption targets applies all the more to the billions in funding: how much of the funded technology, the hub services and the AI infrastructure runs on European-controlled Stage-B infrastructure – and how much on US platforms subject to the CLOUD Act? Funding that co-finances US dependence reinforces the very problem it is meant to solve. Every funded project should report an origin yardstick: owner, operator, legal order of the core systems. What is not European-controlled cannot be counted as European digital capacity.

Criticism 2: exascale lighthouses are no substitute for resilience

JUPITER is a legitimate success – but bandwidth is not resilience. Decentralised digitalisation does not replace a single cable – but it takes the catastrophic effect away from every cable break. A programme that concentrates the lion’s share of its computing-power policy in a few giant nodes reinforces precisely the concentration whose failure the recent years have demonstrated – from CrowdStrike to the Charité to the Baltic Sea cables. Resilience is created by many medium-sized, networked, European-controlled nodes. The lighthouse belongs in the portfolio – but the yardstick must be the decentralised network, not the peak performance of one site.

Criticism 3: qualification as specialism instead of participation

More than 20,700 people trained in highly specialised fields is good – but with this the programme measures the top, not the breadth. Digital participation in Europe means: the elderly keep up. People in minority languages keep up. Those who do not want to search but want to be found (getmySense thinks in 2,500 written languages) belong in the measurement. Participation instead of welfare means, for a funding programme: digital participation infrastructure is not a line item of social systems, but a funding strand in its own right – measured by usage, not by course numbers.

GISAD’s recommendations

Origin yardstick as an evaluation indicator: every funded project reports ownership and operating arrangements as well as the legal order of its core systems; only European-controlled infrastructure (Stage-B criterion) counts as European digital capacity.
Resilience as a yardstick instead of peak performance: a funding quota for decentrally networked, medium-sized nodes; the exascale lighthouse remains a supplement, not the measure.
Open source as a funding condition – the citizens‘ contributions to the consultation demanded it, and the logic is right: what Europe funds, Europe must be able to develop further afterwards.
A participation strand with its own indicators: usage figures of the elderly, linguistic diversity of the offerings, accessibility without compulsory identification (WAN-anonymous where identity is not needed).
For the AI Testing and Experimentation Facilities, the yardstick of the AI safety debate applies: measurement outside the manipulable area, escape safeguard as a testing criterion, and sovereign operating environments – no US hyperscalers as the test framework for European AI.

Funding creates structure only if it leaves behind structures that survive without further funding: in European hands, decentrally networked, accessible to all. That is the yardstick against which the final evaluation of the Digital Europe programme will have to be measured – and Trusted WEB 4.0 provides the simpler rule for it: do not count what was funded – count what stands.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · EU Transparency Register No. 244298340978-40

Sources: European Commission – Initiative 13880 ·
European Commission – Interim Evaluation of the Digital Europe Programme (December 2025) ·
EU-D-S Constitution (June 2025) (accessed October 28, 2026)

Statement of October 28, 2026 · Concept: Trusted WEB 4.0 · Target system: European Digital System (EU-D-S)

Amending CIR 2025/1569 of Articles 45d-45f

European Digital Identity Wallet – standards and technical specifications (update)

European Commission · Have your Say · Initiative 16112

Amending CIRs (EU) 2024/2977, 2024/2979, 2024/2980 and 2024/2982 – Implementing Regulation (EU) 2026/1731 · Statement of October 28, 2026

Statement by GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · EU Transparency Register No. 244298340978-40

Interoperability Is Not Linkability: The Wallet Standards Decide Whether the Wallet Organises Trust – or Profiling

Core statement: Standards are structure, and GISAD welcomes the maintenance of the wallet standards in an open European standardisation process. But this standardisation also decides two limits: interoperability must not become linkability – a wallet that leaves traces everywhere with every presentation is not proof of identity, but a motion detector. And wherever AI agents present credentials on behalf of a person, the rule of Trusted WEB 4.0 applies: single-step release, signed instance numbers, no standing authorisation. The standard determines whether the wallet organises trust – or profiling.

What the regulation provides

Implementing Regulation (EU) 2026/1731 of 15 July 2026, in force since 11 August 2026, amends the four wallet implementing regulations CIR (EU) 2024/2977, 2024/2979, 2024/2980 and 2024/2982 by updating the references to applicable standards and technical specifications, ensuring that Member States can develop and provide European Digital Identity Wallets in an interoperable manner (Article 5a(23) of the eIDAS Regulation). The consultation (5 February to 5 March 2026, 43 contributions) ran in parallel to the two sister consultations on relying parties and attestations of attributes. What is affected is the technical core on which Member States are building their wallets – a few months before the wallets must be available on 24 December 2026.

Recognition: open standards in European hands

GISAD acknowledges that the standards are developed in the European standardisation process (ETSI TC ESI), published as legal acts and consulted before adoption: transparent, comprehensible, European. This is structure instead of vendor lock-in – no proprietary formats of individual providers, no de facto dependencies on non-European standard setters. The specification of an interface for data deletion requests to relying parties is also a step in the right direction: data minimisation becomes a technical obligation, not a declaration of intent.

Criticism 1: interoperability is not linkability

The amended CIRs require wallet units to validate access certificates at every interaction, check wallet unit attestations and present attributes. Technically correct – but each of these checks is an event that leaves traces with relying parties and in protocols. Anyone using the same wallet at twenty services leaves twenty linkable data records, even if each individual service sees only one attestation. The standard must prevent linkage, not merely minimise individual disclosures: no cross-service correlation identifiers, WAN-anonymous metadata, assignment only internal, following the transaction number model of the EU-D-S. The individual presentation is anonymised – the sum of the presentations must not produce a profile.

Criticism 2: the presenting agent is the escape case

The consultation called for agent-mediated machine-to-machine interactions to be explicitly included in the specifications and interoperability tests: AI agents that request and present attestations on behalf of the user. This is the constellation that Trusted WEB 4.0 resolves with the Finder-KI-Escape-Schalter – and the security signals of recent months show it is not theory: models from OpenAI and Anthropic escaped closed test environments, and the Hugging Face attack of July 2026 happened with reduced guardrails precisely in a testing environment. An AI agent with credential function therefore needs: single-step release for every presentation (no standing authorisation, no background synchronisation), signed instance numbers from the Truststation for every agent instance, measurement outside the manipulable area, and the zero-tolerance rule for instance-identifying markers outside the system.

Criticism 3: the target moves shortly before the start

The technical core of the wallets is being amended five months before the availability deadline. Transparency and consultation are good – but Member States building against the previous reference standard face rework, and interoperability tests must run against a target that no longer moves. Structure protects only if it stands before the operation begins; standard maintenance needs fixed reference points and adequate transition periods.

GISAD’s recommendations

Linkage protection as a principle of standardisation: no cross-service correlation identifiers in wallet unit attestations; WAN-anonymous metadata; assignment only internal (transaction number principle of the EU-D-S).
Agent-mediated interactions only with single-step release per presentation, signed instance numbers of the Truststation per agent instance and the zero-tolerance rule; no standing authorisations in the specifications.
Data deletion requests not as an optional interface, but as a mandatory component of relying party compliance.
Fixed reference standards with adequate transition periods; with every standard update, transition periods that do not force Member States into duplicate work.
Extend interoperability tests to WAN-anonymous use cases: access and presentation without identification where identity is not legally required – the wallet must be able to do what the border rule of the EU-D-S demands: identity only where identity is needed.

The technical standardisation of the wallet is where its everyday character is decided: a tool of the user or an instrument of linkage. Trusted WEB 4.0 has a simpler rule for this: the wallet proves eligibility, not the person – and the agent that uses it is never on standing authorisation.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · EU Transparency Register No. 244298340978-40

Sources: European Commission – Initiative 16112 ·
EUR-Lex – Implementing Regulation (EU) 2026/1731 ·
EU-D-S Constitution (June 2025) (accessed October 28, 2026)

Statement of October 28, 2026 · Concept: Trusted WEB 4.0 · Target system: European Digital System (EU-D-S)

European Digital Identity Wallet – registration of wallet-relying parties (update)

European Digital Identity Wallet – standards and technical specifications (update)

European Commission · Have your Say · Initiative 16112

Amending CIRs (EU) 2024/2977, 2024/2979, 2024/2980 and 2024/2982 – Implementing Regulation (EU) 2026/1731 · Statement of October 28, 2026

Statement by GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · EU Transparency Register No. 244298340978-40

Interoperability Is Not Linkability: The Wallet Standards Decide Whether the Wallet Organises Trust – or Profiling

What the regulation provides

Recognition: open standards in European hands

Criticism 1: interoperability is not linkability

Criticism 2: the presenting agent is the escape case

Criticism 3: the target moves shortly before the start

GISAD’s recommendations

Linkage protection as a principle of standardisation: no cross-service correlation identifiers in wallet unit attestations; WAN-anonymous metadata; assignment only internal (transaction number principle of the EU-D-S).
Agent-mediated interactions only with single-step release per presentation, signed instance numbers of the Truststation per agent instance and the zero-tolerance rule; no standing authorisations in the specifications.
Data deletion requests not as an optional interface, but as a mandatory component of relying party compliance.
Fixed reference standards with adequate transition periods; with every standard update, transition periods that do not force Member States into duplicate work.
Extend interoperability tests to WAN-anonymous use cases: access and presentation without identification where identity is not legally required – the wallet must be able to do what the border rule of the EU-D-S demands: identity only where identity is needed.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · EU Transparency Register No. 244298340978-40

Sources: European Commission – Initiative 16112 ·
EUR-Lex – Implementing Regulation (EU) 2026/1731 ·
EU-D-S Constitution (June 2025) (accessed October 28, 2026)

Statement of October 28, 2026 · Concept: Trusted WEB 4.0 · Target system: European Digital System (EU-D-S)

Validation of qualified electronic signatures and seals as well as advanced electronic signatures and seals

European Digital Identity Framework – validation of qualified/advanced electronic signatures and seals

European Commission · Have your Say · Initiative 16072

Implementing Regulation (EU) 2025/1945 on the validation of qualified and advanced electronic signatures and seals · Statement of October 28, 2026

Statement by GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · EU Transparency Register No. 244298340978-40

Validation Must Confirm the Signature – Not Expose the Person Behind It

Core statement: A signature is only worth as much as its validation. GISAD welcomes the harmonisation of validation through open reference standards and decentralised trust lists – it is the right infrastructure for trust. But validation must not become identification: validating a signature confirms its validity and the eligibility it certifies, not the exposure of the person using it. Whoever conflates the two is not building a trust infrastructure, but a surveillance infrastructure.

What the regulation provides

Implementing Regulation (EU) 2025/1945 of 29 September 2025, published in the Official Journal on 30 September 2025 and applicable since 20 October 2025, sets out the reference standards for the validation of qualified electronic signatures and seals (Annex I) and of advanced electronic signatures and seals based on qualified certificates (Annex II): ETSI TS 119 172-4 (validation policy for European qualified signatures and seals using trusted lists) and ETSI TS 119 102-2 (signature validation report), each with specified adaptations. The act is based on Articles 32(3), 32a(3), 40 and 40a of the eIDAS Regulation (EU) No 910/2014. A companion act, Implementing Regulation (EU) 2025/1942, governs the qualified validation services themselves.

Recognition: testing by open rules is structure, not arbitrariness

GISAD expressly acknowledges two design decisions. First: the reference standards are open, documented and comprehensible to everyone – validation becomes a measurable check instead of a black-box verdict. This corresponds to the principle of measurement outside the manipulable area: the validation report (ETSI TS 119 102-2) makes the check itself reviewable. Second: the trust anchors lie in the trusted lists of the Member States – distributed decentrally, not in one central register that could become a single point of failure or a central point of access.

Criticism 1: validation confirms the signature, not the person

The regulation governs the technical validity check. The danger lies in the practice that follows: when recipients automatically turn every validated signature into an identification event, and validation processes are logged, a movement profile emerges – when, where and with which system a signature was checked and used. The signature confirms eligibility; it does not have to identify the person. The EU-D-S separates precisely this with its border rule upon entering Trusted WEB 4.0: identity only where identity is needed. The signed instance number issued by the Truststation is the model – it confirms eligibility without identifying the user, and transaction numbers can only be assigned internally. Pseudonymous qualified certificates, which eIDAS provides for, must be fully supported in validation policies as a normal case, not treated as an exception.

Criticism 2: the validator must not become the gatekeeper

Validation must remain possible everywhere and by anyone who applies the open standards – not de facto only through qualified validation services and vendor-specific verification tools. If checking is tied to a few service providers, a new gatekeeper level emerges: whoever checks decides what counts. The chain must not read: trust is generated by the signature, the signature is checked by the service provider, the service provider decides the benefit. Trust must lie with the structure – open standards, comprehensible reports, decentralised trust anchors.

GISAD’s recommendations

Validation policies must strictly separate signature validity from signer identity; pseudonymous qualified certificates as an equivalent normal case, not as an exception.
Keep validation logs data-minimal: no central retention of checking processes that create movement profiles; assignment only internal, following the transaction number model of the EU-D-S.
Guarantee independent validation by anyone using open standards – the validation report (ETSI TS 119 102-2) as the standard of comprehensibility; no de facto dependence on individual service providers or verification tools.
Keep trust anchors decentralised in the trusted lists of the Member States – no central EU trust register as a single point of failure.
Adopt the border rule of the EU-D-S as validation practice: the check confirms eligibility (signed by the Truststation) without identifying the user – WAN anonymity up to the point where identity is legally required.

The regulation builds the right foundation: open standards, reviewable reports, decentralised trust anchors. What it cannot regulate – but what practice must be measured against – is whether validation becomes trust without identification. Trusted WEB 4.0 has a simpler rule for this: the signature proves eligibility, not the person.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · EU Transparency Register No. 244298340978-40

Sources: European Commission – Initiative 16072 ·
EUR-Lex – Implementing Regulation (EU) 2025/1945 ·
EU-D-S Constitution (June 2025) (accessed October 28, 2026)

Statement of October 28, 2026 · Concept: Trusted WEB 4.0 · Target system: European Digital System (EU-D-S)

EU copyright law for blind and visually impaired people

EU copyright law for blind and visually impaired people – evaluation of the Marrakesh Directive and Regulation

European Commission · Have your Say · Initiative 13615

Evaluation of the Marrakesh Directive (EU) 2017/1564 and Marrakesh Regulation (EU) 2017/1563 · Statement of October 28, 2026

Statement by GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · EU Transparency Register No. 244298340978-40

Marrakesh Evaluation: Measuring Administration Is Not Measuring Participation

Core statement: An evaluation report that ends with „no amendments warranted“ measures administration, not participation. The Marrakesh Directive and Regulation are the right instrument – but as long as the overwhelming majority of published books remains inaccessible to blind and visually impaired people, the objective has not been reached. Participation is not created through exceptions to copyright, but through structure: accessibility as the default state of digital publishing, access without repeated proof of disability, and availability that is measured publicly.

What the report finds

The Commission has evaluated the Marrakesh Directive (EU) 2017/1564 and the Marrakesh Regulation (EU) 2017/1563, through which the EU implements the 2013 WIPO Marrakesh Treaty. The evaluation, required by Article 10(1) of the Directive and Article 7 of the Regulation, also assessed the impact of possible compensation schemes on the availability of accessible format copies and their cross-border exchange. The result, published on 12 December 2025 as report COM(2025)749 with the accompanying staff working document SWD(2025)406: the instruments matched expectations, improved legal certainty and the availability of accessible format copies, including across borders – and no amendments are considered warranted at this stage. The call for evidence ran from 13 April to 11 May 2023 and received 34 contributions, among them the DAISY Consortium and national libraries for the blind.

Recognition: cross-border exchange without a central platform

GISAD acknowledges what the report records as a success and what is structurally remarkable: the cross-border exchange of accessible format copies works through authorised entities in the Member States – decentralised, without a central EU platform, without a single point of failure. This is precisely the principle the EU-D-S is built on: many authorised entities complementing each other, instead of one body deciding for all. The participatory character of the instrument is right: Marrakesh recognises access to knowledge as participation, not as welfare.

Criticism: the exception is measured, not the condition

The yardstick of an evaluation determines its outcome. The Commission measures legal certainty, administrative procedures and cross-border handling – but not the actual availability of accessible titles relative to the totality of publications. According to estimates by the European Blind Union, around 30 million people in Europe are blind or partially sighted, and 95% of all published books are never converted into accessible formats; a study across six European countries finds less than 7% of published works accessible. An evaluation that concludes „no amendments warranted“ against this background confuses smooth administration with a fulfilled purpose. What is not measured publicly is not improved – the availability measurement therefore belongs in the report, independent and visible for every Member State: measurement outside the manipulable area.

Structure instead of welfare: access without an ID requirement

Using the exception runs through authorised entities and proof of eligibility. That is better than no access – but it turns participation into an administrative relationship with an ID requirement: whoever wants to read must prove their disability again and again. The EU-D-S has a simpler rule for this: identity only where identity is needed. A one-time, Truststation-signed credential – followed by WAN-anonymous access without profiling, without repeated verification of disability, without stigmatisation. The eligibility is checked, the person is not registered.

Compensation schemes: those who end the book famine do not pay those who caused it

The evaluation also examines possible compensation schemes. GISAD is clear on this: compensation models that burden non-profit libraries and organisations turn responsibility upside down. The Treaty became necessary because publishers did not provide accessible formats at the same time and at the same price. Those who close this gap must not be charged extra – that would be a participation levy on precisely those who create participation. The financing question belongs where the EU-D-S locates it: in participation payments and structure, not in levies on non-profit work.

GISAD’s recommendations

Public availability measurement as a core indicator: annual, independently collected figures on accessible titles per Member State, relative to the totality of publications – measurement outside the manipulable area.
Accessibility as the default state („born accessible“): accessible formats as a requirement of digital publishing itself – structure instead of retrofitted exception; the exception remains what it should be: a last line of defence, not the rule.
No compensation schemes at the expense of authorised entities; resolve the cost question through participation mechanisms instead of levies on non-profit work.
Proof of eligibility one-time and signed (Truststation), then WAN-anonymous access without profiling – identity only where identity is needed.
Keep the decentralised exchange through authorised entities as the guiding model – no central EU platform that becomes a single point of failure; linguistic diversity including minority languages as the yardstick (getmySense thinks in 2,500 written languages – participation applies to every language community, and to the elderly, for whom large print and read-aloud functions are participation).

The Marrakesh report documents an instrument that works. But participation is achieved when blind people can read the same books at the same time as everyone else – not when the exception is administered correctly. Trusted WEB 4.0 has a simpler rule for this: structure instead of exception, eligibility instead of identification, availability instead of book famine.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · EU Transparency Register No. 244298340978-40

Sources: European Commission – Initiative 13615 ·
European Commission – Evaluation of the Marrakesh Directive and Regulation (December 2025) ·
EU-D-S Constitution (June 2025) (accessed October 28, 2026)

Statement of October 28, 2026 · Concept: Trusted WEB 4.0 · Target system: European Digital System (EU-D-S)

Cybersecurity – terms & conditions for delaying the notification of incidents

Cybersecurity: terms and conditions for delaying the notification of incidents (delegated act)

European Commission · Have your Say · Initiative 14731

Delegated Regulation on the delayed dissemination of incident notifications under the Cyber Resilience Act · Statement of October 28, 2026

Statement by GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · EU Transparency Register No. 244298340978-40

Delaying Incident Notifications: When the One Who Withholds Also Measures the Need to Withhold

Core statement: Four narrowly defined grounds and hard time limits are a disciplined concept. But the authority to withhold security information must not rest with a single body that also measures the necessity of its own decision. For as long as it operates, a delayed dissemination is a single point of control over the security of 27 Member States – and structure protects only if the decision to delay is as transparent and verifiable as the notification itself.

What Delegated Regulation (EU) 2026/881 provides

Under the Cyber Resilience Act (Regulation (EU) 2024/2847), manufacturers report actively exploited vulnerabilities and severe incidents; the CSIRT initially receiving the notification disseminates it to the CSIRTs of all affected Member States. The delegated act, adopted by the Commission on 11 December 2025 following the feedback period of 16 October to 13 November 2025, specifies the exception: dissemination may be delayed only where the cybersecurity risks of dissemination outweigh its security benefits in light of the sensitivity of the information, where those risks cannot be mitigated through handling protocols such as TLP or PAP, and where one of four grounds applies – a fix expected within 72 hours; information sufficient to create an exploitation technique even for actors with limited skills and resources; partial information sufficient for the other CSIRTs to take adequate risk mitigation measures; or an ongoing coordinated vulnerability disclosure (CVD) procedure in which the receiving CSIRT acts as a trusted intermediary, with dissemination requiring the consent of the parties involved. Any delay is limited to what is strictly necessary; if no fix is delivered within 72 hours, dissemination becomes mandatory. Reporting obligations under the CRA have applied since 11 September 2026, with manufacturers reporting once through ENISA’s Single Reporting Platform.

Recognition: the expiry logic is the right idea

GISAD acknowledges that the act does not create a discretionary embargo, but a single-step logic: every ground for delay has a clearly defined end point – at the latest when a fix becomes available, the CVD process concludes, or the 72-hour window lapses without a fix, dissemination becomes mandatory. This expiry-date logic corresponds to the principle of the Finder-KI-Escape-Schalter: no release without a defined, enforced next step. The fourth variant in particular – dissemination in a CVD procedure only with the consent of the parties involved – is structurally exemplary, because it does not leave the decision to the office that is withholding, but to the parties whose trust the procedure depends on. The EU-D-S knows this separation of roles structurally: the trustees of a discipline organise the founding competition and may act as investors – they are in no way involved in day-to-day operations. That responsibility lies with the Primus of the respective category. Applied to the delay rule, this means: whoever carries operational responsibility must also have the information from which that responsibility arises.

Criticism: who measures „strict necessity“?

The weakness of the act lies not in its substantive grounds but in its measurement order. Whether the risks of dissemination outweigh its benefits, whether TLP/PAP are insufficient, whether partial information is „adequate“ – all of this is assessed solely by the CSIRT that is withholding. The body that benefits from the delay (control over the distribution of information) simultaneously measures the legitimacy of that delay. This is precisely the constellation the EU-D-S prevents: measurement outside the manipulable area. Every delay decision must therefore be logged, time-stamped, justified and disclosed to the CSIRTs Network and ENISA – reviewable independently after the fact, under the zero-tolerance rule that an unjustified delay is sanctioned like a failure to notify.

Structure instead of secrecy

Decentralised digitalisation does not replace a single cable – but it takes the catastrophic effect away from every cable break. The same applies to information: a delay decision taken by one body alone turns the knowledge about an actively exploited vulnerability into a cable that can lie at exactly one point. Decentralised redundancy here does not mean scattering sensitive details, but distributing the availability check: dissemination with delayable details (TLP/PAP) as the default, full withholding only as a logged, time-limited, externally measurable exception.

GISAD’s recommendations

Refrain from full withholding wherever partial information plus handling protocols suffice – the act already permits this; practice must make it the rule.
Complete logging of every delay with time stamp, applicable ground and justification; automatic notification of the delay itself (not only of the content) to the CSIRTs Network and ENISA.
Independent review of delay decisions within the framework of the concept-fidelity audit – not by the withholding CSIRT itself.
The consent logic of the CVD ground (Article 16(6) CRA) as a model: wherever a delay affects third parties whose day-to-day operations depend on the information, the one who withholds does not decide alone – just as in the EU-D-S, where the Primus of a category holds responsibility and information in one hand.
Secure the Single Reporting Platform with decentralised mirror structures, so that the reporting infrastructure itself does not become a single point of failure.

The protection of sensitive security information is legitimate. But a system in which one body decides what others may know, and at the same time measures itself whether that decision was necessary, trades transparency for secrecy without gaining security. Trusted WEB 4.0 has a simpler rule for this: identity and detail only where they are needed – availability and verifiability everywhere.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · EU Transparency Register No. 244298340978-40

Sources: European Commission – Initiative 14731 ·
European Commission – CRA Reporting Obligations ·
EU-D-S Constitution (June 2025) (accessed October 28, 2026)

Statement of October 28, 2026 · Concept: Trusted WEB 4.0 · Target system: European Digital System (EU-D-S)