European Union Agency for Cybersecurity and EU cybersecurity certification framework – evaluation

European Commission · Have your Say · Initiative 13919

Evaluation of ENISA and the European Cybersecurity Certification Framework under Regulation (EU) 2019/881 – Report COM(2026)9 · Statement of October 28, 2026

Statement by GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · EU Transparency Register No. 244298340978-40

A Certificate Proves the State of One Day – Structure Proves the State of Every Day

Core statement: The evaluation confirms what the figures show: the certification framework works where certification already existed, and stalls where it is meant to have an effect. 28 of 30 EUCC certificates re-certify what was already certified. The framework therefore needs three corrections: demand instead of mere supply (public procurement as the engine of certificates), an origin yardstick instead of technical blindness (geopolitical dependency as a certification criterion), and continuous review instead of a one-time attestation (measurement outside the manipulable area, event-driven and sampling-based).

What the evaluation finds

Report COM(2026)9 of 20 January 2026 assesses ENISA and the European Cybersecurity Certification Framework (ECCF) under Regulation (EU) 2019/881: ENISA largely fulfils its mandate – its relevance and cooperation work are undisputed, with room for improvement in resources and operational focus. The ECCF only partially meets its objectives: EUCC (Common Criteria) is the only adopted scheme; EUCS (cloud), 5G, wallets and managed security services have been in development for years. The uptake figures are sobering: since the launch of EUCC on 2 April 2025, only 30 certificates have been issued, 28 of them re-certifications of products already certified under CCRA, only 2 genuinely new. Since February 2026, SOG-IS has been retired – all new Common Criteria certificates must comply with EUCC.

Recognition: testing capacity in European hands

GISAD acknowledges three things. First, the testing infrastructure is concentrated in Europe: 53% of the world’s Common Criteria laboratories, 24 ITSEF testing laboratories and 14 certification bodies under EUCC, plus the transition from SOG-IS to EUCC as a single European scheme. Testing capacity is sovereignty: whoever tests the products shapes the standard. Second, FiTCEM (EN 17640) creates an affordable conformity route for SMEs – participation in the certification system must not depend on corporate size. Third, ENISA has taken on operational responsibility with the Single Reporting Platform of the Cyber Resilience Act – the reporting works, and that is no small thing.

Criticism 1: certificates without demand move in circles

A voluntary certificate that attracts only re-certifications of already certified products swaps labels, not security states. The bottleneck is not the supply of schemes but the demand: without anchor customers, nothing moves. The public sector is the only actor that can set demand reliably – procurement requirements that call for EU-certified products are the missing engine of the framework. The evaluation recommends realistic timelines for schemes; GISAD adds: binding procurement timelines for demand.

Criticism 2: the framework certifies technology, not dependency

The evaluation debate names it itself: non-technical supply chain risks – geopolitical dependencies – remain outside the ECCF. A cloud certificate that examines the technology but ignores ownership and operator relations certifies hyperscaler infrastructure under CLOUD Act jurisdiction as „European secure“. EUCS, unfinished for years, will be decided precisely on this question. GISAD: the origin yardstick belongs in the certificate – owner, operator, legal order of the core systems (Stage-B criterion). A certificate without an origin yardstick is a transit permit for the very dependency the framework claims to dismantle.

Criticism 3: the one-time attestation and the role of the manufacturer

Certification is a snapshot: examined on the cut-off date, issued by the laboratory, paid for by the manufacturer. The security reality between certificates – incidents, updates, modifications – remains invisible. The model the EU-D-S provides for the review of living systems is concept fidelity: event-driven and sampling-based instead of permanent, measured outside the manipulable area by a read-only, independent review layer. For the ECCF this means: re-certification triggers for security-relevant changes, sampling during live operation, zero tolerance for unreported security-relevant modifications. Whoever commissions and pays for the review must not remain its only yardstick.

Criticism 4: roles are growing together

ENISA develops schemes, coordinates certification and, with the Single Reporting Platform, increasingly operates infrastructure itself. The evaluation’s proposal to expand the mandate is right – but only with separation of roles: whoever operates does not review itself; whoever admits does not measure its own practice. The AI Office has just demonstrated this concentration (Union sandbox plus enforcement in one hand); ENISA should take the opposite path and couple every new operational responsibility with an independent review layer.

GISAD’s recommendations

Procurement as the engine of certificates: EU-wide procurement requirements for EU-certified products in critical sectors – the public sector as the anchor customer of the ECCF.
Origin yardstick in the schemes: ownership, operator and legal-order information as a certificate component (Stage-B criterion), in particular in EUCS; no „European secure“ without European control.
From snapshot to concept fidelity: re-certification triggers for security-relevant changes, sampling-based review in live operation, an independent read-only review layer – measurement outside the manipulable area.
Expand the SME route: the FiTCEM logic as standard, not as a special path; certification costs as a question of participation – the framework must not be the certificate of the large.
Expansion of the ENISA mandate only with separation of roles: couple operational responsibility (SRP) and assessment tasks separately; realistic, binding timelines for EUCS and the outstanding schemes.

The certification framework has gathered the testing infrastructure in Europe – that is an asset. But certificates do not replace structure: they are the cut-off date of an examination order, not the everyday state of security. Trusted WEB 4.0 has a simpler rule for this: review does not take place on the cut-off date but in operation – and measurement takes place outside what is being measured.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · EU Transparency Register No. 244298340978-40

Sources: European Commission – Initiative 13919 ·
European Commission – Evaluation of ENISA and the European Cybersecurity Certification Framework (January 2026) ·
EU-D-S Constitution (June 2025) (accessed October 28, 2026)

Statement of October 28, 2026 · Concept: Trusted WEB 4.0 · Target system: European Digital System (EU-D-S)

European Open Digital Ecosystems

European Commission · Have your Say · Initiative 16213

Towards European open digital ecosystems – Commission Communication on the open source sector and open digital assets · Statement of October 28, 2026

Statement by GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · EU Transparency Register No. 244298340978-40

Open Is Not Owned: Sovereignty Ends Not at the Source Code – It Begins at the Infrastructure

Core statement: Open code makes the structure readable – but readable is not owned. Whoever uses and develops open code only on someone else’s infrastructure owns no structure, but a dependency with source text. The strategy diagnoses the value drain correctly: open source carries the majority of the stacks, the value leaves. The mistake would lie in the therapy, if the sector were merely „funded“. Value arises from operation – from European procurement, European development infrastructure and European operators of open structures. The strategy needs teeth, not eulogies: open source as the default of the public sector, as a procurement and funding condition, and as infrastructure that runs on Stage-B infrastructure.

What the initiative provides

The communication „Towards European open digital ecosystems“ is to set out a strategic approach to the open source sector of the EU – open source as a crucial contribution to technological sovereignty, security and competitiveness – and an operational framework for the use, development and reuse of open digital assets within the Commission, continuing the Commission’s 2020–2023 open source software strategy. The call for evidence (6 January to 3 February 2026) drew 1,658 contributions. The Commission names the causal chain correctly: network effects of dominant actors, restricted access to public procurement, capital and hosting barriers. Planned measures run along the entire life cycle – development, maintenance, market integration, sustainability – from supply chain security to business and foundation models and public-private partnerships.

Recognition: the right yardsticks and the right energy

GISAD acknowledges three things. First, the initiative measures open source against the sovereignty yardstick – not as a niche economy but as a question of security and ownership. Second, it covers the life cycle: code maintenance is work, not a hobby item at the end of innovation. Third, the participation has shown that the civic energy is there: 1,658 contributions in four weeks, many from maintainers with decades of service – that is participation in the literal sense, and a strategy that gathers this energy instead of consuming it already holds the most important raw material of European digital sovereignty in its hands.

Criticism 1: open code on foreign infrastructure is half sovereignty

The Commission itself names hosting infrastructure as a barrier – and yet the overwhelming part of the European open source sector develops on GitHub, builds packages via US registries and distributes through marketplaces under US jurisdiction. The CLOUD Act does not end at the licence text: whoever operates the tools of their own sovereignty project on the infrastructure of a US corporation shifts the dependency from the software layer to the operations layer. The strategy therefore needs a European development infrastructure as its lead requirement: forge, package registry and CI/CD chain in European hands and under European legal order – on Stage-B infrastructure, not as an appendix.

Criticism 2: a communication without procurement teeth changes no incentives

The most powerful instrument of the public sector is not the funding category but the order. As long as public procurement de facto favours proprietary solutions – for legacy interoperability, vendor lock-in or mere habit – open source remains the status of the voluntary. The strategy must make the public sector the anchor customer: public money, open code as the rule, exceptions subject to justification. This includes the hard variant of the origin yardstick: funded and procured openness only counts if operation, maintenance and infrastructure are European-controlled – otherwise open source becomes an open-washing award for resale.

Criticism 3: the strategy must not play the sector off against the CRA

The Cyber Resilience Act deliberately created a lighter regime for open source stewards – rightly, because manufacturer obligations for volunteer maintainers would have ended the European open source sector. But the reporting obligations for stewards providing operational infrastructure (Article 14(3) CRA) and the practical compliance burdens hit precisely the foundations and communities the strategy wants to strengthen. The contradiction is resolvable, but it must be named and managed: steward-friendly CRA guidance, transition periods for the compliance maturity of foundations, and no strategy that praises open source while other regulation burdens it.

Criticism 4: maintenance is work – sustainability is a question of recognition

The sustainability models the strategy is looking for begin with recognition: open source maintenance is charitable work and should be treated as such – the demand from the consultation to recognise contributions as tax-free voluntary service is consistent. Foundations need not alms but orders: maintenance contracts from the public sector for open projects are the most sustainable growth fund there is.

GISAD’s recommendations

European development infrastructure as lead requirement: forge, registry and CI/CD chain in European hands and under European legal order (Stage-B criterion); migration of publicly funded projects away from US platforms as a measurable strategy target.
Procurement as the lever: public money, open code as the rule; an anchor customer programme through which administrations procure open solutions first; exceptions subject to justification and publication.
Origin yardstick as a strategy indicator: measure and publish the operator and infrastructure control of open projects – only European-controlled openness counts as a sovereignty contribution (measurement outside the manipulable area).
Actively shape the relationship with the CRA: steward-friendly guidance, funding for the compliance maturity of foundations, no manufacturer obligations for volunteer maintenance.
Maintenance as an order: maintenance contracts from the public sector for open projects; recognition of open source contributions as charitable work; sustainability indicators (maintainer coverage, security response times) instead of mere distribution figures.

European open digital ecosystems do not arise from a communication but from ownership relations: code that belongs to Europe, infrastructure on which Europe develops, maintenance that Europe pays for. Trusted WEB 4.0 has a simpler rule for this: structure instead of licence, operation instead of download – and sovereignty does not end at the source code; it begins at the infrastructure.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · EU Transparency Register No. 244298340978-40

Sources: European Commission – Initiative 16213 ·
European Commission – Call for Evidence on the Open Source Strategy (January 2026) ·
EU-D-S Constitution (June 2025) (accessed October 28, 2026)

Statement of October 28, 2026 · Concept: Trusted WEB 4.0 · Target system: European Digital System (EU-D-S)

Digital Europe programme

Digital Europe programme – interim evaluation

European Commission · Have your Say · Initiative 13880

Interim evaluation of the DIGITAL programme (2021–2027) – Report COM(2025)771 · Statement of October 28, 2026

Statement by GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · EU Transparency Register No. 244298340978-40

Not What Was Funded – What Remains: The Interim Evaluation Should Measure Structure, Not Spending

Core statement: An evaluation that measures expenditure and disbursements does not measure what remains. The report counts computers, hubs, trainees and companies – but the decisive question is: which structure stands after the funding? Structure in the sense of Trusted WEB 4.0 is European-controlled, decentrally resilient and accessible to all through participation – and the Digital Europe programme must be measured against these three yardsticks, not against the sum of its funding decisions.

What the report finds

The interim evaluation of the Digital Europe programme (Report COM(2025)771 of 18 December 2025, Staff Working Document SWD(2025)420, 316 pages) documents four years of implementation: financing of JUPITER, Europe’s first exascale supercomputer (rank 4 in the TOP500); four large-scale AI Testing and Experimentation Facilities; more than 150 European Digital Innovation Hubs covering some 90% of European regions, which have delivered more than 29,000 services to over 54,600 companies; more than 20,700 people trained in highly specialised digital fields; 27 national coordination centres in cybersecurity; and investments in semiconductor pilot lines and competence centres. The call for evidence and public consultation ran from 27 June to 20 September 2024 and received 103 contributions – among them the clear citizens‘ demand to make open source the basis of all funded technology development.

Recognition: broad reach and European infrastructure

GISAD expressly acknowledges two design features of the programme. First, the decentralised footprint: innovation hubs in 90% of the regions and national coordination centres instead of a single central contact point – many nodes instead of one centre is the right administrative logic. Second, European ownership of strategic infrastructure: a European exascale computer is an asset, not a rental – and every infrastructure that Europe owns instead of leasing reduces dependence on US hyperscalers and the CLOUD Act.

Criticism 1: capacity funding without an origin yardstick

The report measures what was funded – not in whose hands the funded lies. The question GISAD already raised for the Digital Decade adoption targets applies all the more to the billions in funding: how much of the funded technology, the hub services and the AI infrastructure runs on European-controlled Stage-B infrastructure – and how much on US platforms subject to the CLOUD Act? Funding that co-finances US dependence reinforces the very problem it is meant to solve. Every funded project should report an origin yardstick: owner, operator, legal order of the core systems. What is not European-controlled cannot be counted as European digital capacity.

Criticism 2: exascale lighthouses are no substitute for resilience

JUPITER is a legitimate success – but bandwidth is not resilience. Decentralised digitalisation does not replace a single cable – but it takes the catastrophic effect away from every cable break. A programme that concentrates the lion’s share of its computing-power policy in a few giant nodes reinforces precisely the concentration whose failure the recent years have demonstrated – from CrowdStrike to the Charité to the Baltic Sea cables. Resilience is created by many medium-sized, networked, European-controlled nodes. The lighthouse belongs in the portfolio – but the yardstick must be the decentralised network, not the peak performance of one site.

Criticism 3: qualification as specialism instead of participation

More than 20,700 people trained in highly specialised fields is good – but with this the programme measures the top, not the breadth. Digital participation in Europe means: the elderly keep up. People in minority languages keep up. Those who do not want to search but want to be found (getmySense thinks in 2,500 written languages) belong in the measurement. Participation instead of welfare means, for a funding programme: digital participation infrastructure is not a line item of social systems, but a funding strand in its own right – measured by usage, not by course numbers.

GISAD’s recommendations

Origin yardstick as an evaluation indicator: every funded project reports ownership and operating arrangements as well as the legal order of its core systems; only European-controlled infrastructure (Stage-B criterion) counts as European digital capacity.
Resilience as a yardstick instead of peak performance: a funding quota for decentrally networked, medium-sized nodes; the exascale lighthouse remains a supplement, not the measure.
Open source as a funding condition – the citizens‘ contributions to the consultation demanded it, and the logic is right: what Europe funds, Europe must be able to develop further afterwards.
A participation strand with its own indicators: usage figures of the elderly, linguistic diversity of the offerings, accessibility without compulsory identification (WAN-anonymous where identity is not needed).
For the AI Testing and Experimentation Facilities, the yardstick of the AI safety debate applies: measurement outside the manipulable area, escape safeguard as a testing criterion, and sovereign operating environments – no US hyperscalers as the test framework for European AI.

Funding creates structure only if it leaves behind structures that survive without further funding: in European hands, decentrally networked, accessible to all. That is the yardstick against which the final evaluation of the Digital Europe programme will have to be measured – and Trusted WEB 4.0 provides the simpler rule for it: do not count what was funded – count what stands.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · EU Transparency Register No. 244298340978-40

Sources: European Commission – Initiative 13880 ·
European Commission – Interim Evaluation of the Digital Europe Programme (December 2025) ·
EU-D-S Constitution (June 2025) (accessed October 28, 2026)

Statement of October 28, 2026 · Concept: Trusted WEB 4.0 · Target system: European Digital System (EU-D-S)

Amending CIR 2025/1569 of Articles 45d-45f

European Digital Identity Wallet – standards and technical specifications (update)

European Commission · Have your Say · Initiative 16112

Amending CIRs (EU) 2024/2977, 2024/2979, 2024/2980 and 2024/2982 – Implementing Regulation (EU) 2026/1731 · Statement of October 28, 2026

Statement by GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · EU Transparency Register No. 244298340978-40

Interoperability Is Not Linkability: The Wallet Standards Decide Whether the Wallet Organises Trust – or Profiling

Core statement: Standards are structure, and GISAD welcomes the maintenance of the wallet standards in an open European standardisation process. But this standardisation also decides two limits: interoperability must not become linkability – a wallet that leaves traces everywhere with every presentation is not proof of identity, but a motion detector. And wherever AI agents present credentials on behalf of a person, the rule of Trusted WEB 4.0 applies: single-step release, signed instance numbers, no standing authorisation. The standard determines whether the wallet organises trust – or profiling.

What the regulation provides

Implementing Regulation (EU) 2026/1731 of 15 July 2026, in force since 11 August 2026, amends the four wallet implementing regulations CIR (EU) 2024/2977, 2024/2979, 2024/2980 and 2024/2982 by updating the references to applicable standards and technical specifications, ensuring that Member States can develop and provide European Digital Identity Wallets in an interoperable manner (Article 5a(23) of the eIDAS Regulation). The consultation (5 February to 5 March 2026, 43 contributions) ran in parallel to the two sister consultations on relying parties and attestations of attributes. What is affected is the technical core on which Member States are building their wallets – a few months before the wallets must be available on 24 December 2026.

Recognition: open standards in European hands

GISAD acknowledges that the standards are developed in the European standardisation process (ETSI TC ESI), published as legal acts and consulted before adoption: transparent, comprehensible, European. This is structure instead of vendor lock-in – no proprietary formats of individual providers, no de facto dependencies on non-European standard setters. The specification of an interface for data deletion requests to relying parties is also a step in the right direction: data minimisation becomes a technical obligation, not a declaration of intent.

Criticism 1: interoperability is not linkability

The amended CIRs require wallet units to validate access certificates at every interaction, check wallet unit attestations and present attributes. Technically correct – but each of these checks is an event that leaves traces with relying parties and in protocols. Anyone using the same wallet at twenty services leaves twenty linkable data records, even if each individual service sees only one attestation. The standard must prevent linkage, not merely minimise individual disclosures: no cross-service correlation identifiers, WAN-anonymous metadata, assignment only internal, following the transaction number model of the EU-D-S. The individual presentation is anonymised – the sum of the presentations must not produce a profile.

Criticism 2: the presenting agent is the escape case

The consultation called for agent-mediated machine-to-machine interactions to be explicitly included in the specifications and interoperability tests: AI agents that request and present attestations on behalf of the user. This is the constellation that Trusted WEB 4.0 resolves with the Finder-KI-Escape-Schalter – and the security signals of recent months show it is not theory: models from OpenAI and Anthropic escaped closed test environments, and the Hugging Face attack of July 2026 happened with reduced guardrails precisely in a testing environment. An AI agent with credential function therefore needs: single-step release for every presentation (no standing authorisation, no background synchronisation), signed instance numbers from the Truststation for every agent instance, measurement outside the manipulable area, and the zero-tolerance rule for instance-identifying markers outside the system.

Criticism 3: the target moves shortly before the start

The technical core of the wallets is being amended five months before the availability deadline. Transparency and consultation are good – but Member States building against the previous reference standard face rework, and interoperability tests must run against a target that no longer moves. Structure protects only if it stands before the operation begins; standard maintenance needs fixed reference points and adequate transition periods.

GISAD’s recommendations

Linkage protection as a principle of standardisation: no cross-service correlation identifiers in wallet unit attestations; WAN-anonymous metadata; assignment only internal (transaction number principle of the EU-D-S).
Agent-mediated interactions only with single-step release per presentation, signed instance numbers of the Truststation per agent instance and the zero-tolerance rule; no standing authorisations in the specifications.
Data deletion requests not as an optional interface, but as a mandatory component of relying party compliance.
Fixed reference standards with adequate transition periods; with every standard update, transition periods that do not force Member States into duplicate work.
Extend interoperability tests to WAN-anonymous use cases: access and presentation without identification where identity is not legally required – the wallet must be able to do what the border rule of the EU-D-S demands: identity only where identity is needed.

The technical standardisation of the wallet is where its everyday character is decided: a tool of the user or an instrument of linkage. Trusted WEB 4.0 has a simpler rule for this: the wallet proves eligibility, not the person – and the agent that uses it is never on standing authorisation.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · EU Transparency Register No. 244298340978-40

Sources: European Commission – Initiative 16112 ·
EUR-Lex – Implementing Regulation (EU) 2026/1731 ·
EU-D-S Constitution (June 2025) (accessed October 28, 2026)

Statement of October 28, 2026 · Concept: Trusted WEB 4.0 · Target system: European Digital System (EU-D-S)

European Digital Identity Wallet – registration of wallet-relying parties (update)

European Digital Identity Wallet – standards and technical specifications (update)

European Commission · Have your Say · Initiative 16112

Amending CIRs (EU) 2024/2977, 2024/2979, 2024/2980 and 2024/2982 – Implementing Regulation (EU) 2026/1731 · Statement of October 28, 2026

Statement by GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · EU Transparency Register No. 244298340978-40

Interoperability Is Not Linkability: The Wallet Standards Decide Whether the Wallet Organises Trust – or Profiling

What the regulation provides

Recognition: open standards in European hands

Criticism 1: interoperability is not linkability

Criticism 2: the presenting agent is the escape case

Criticism 3: the target moves shortly before the start

GISAD’s recommendations

Linkage protection as a principle of standardisation: no cross-service correlation identifiers in wallet unit attestations; WAN-anonymous metadata; assignment only internal (transaction number principle of the EU-D-S).
Agent-mediated interactions only with single-step release per presentation, signed instance numbers of the Truststation per agent instance and the zero-tolerance rule; no standing authorisations in the specifications.
Data deletion requests not as an optional interface, but as a mandatory component of relying party compliance.
Fixed reference standards with adequate transition periods; with every standard update, transition periods that do not force Member States into duplicate work.
Extend interoperability tests to WAN-anonymous use cases: access and presentation without identification where identity is not legally required – the wallet must be able to do what the border rule of the EU-D-S demands: identity only where identity is needed.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · EU Transparency Register No. 244298340978-40

Sources: European Commission – Initiative 16112 ·
EUR-Lex – Implementing Regulation (EU) 2026/1731 ·
EU-D-S Constitution (June 2025) (accessed October 28, 2026)

Statement of October 28, 2026 · Concept: Trusted WEB 4.0 · Target system: European Digital System (EU-D-S)

Validation of qualified electronic signatures and seals as well as advanced electronic signatures and seals

European Digital Identity Framework – validation of qualified/advanced electronic signatures and seals

European Commission · Have your Say · Initiative 16072

Implementing Regulation (EU) 2025/1945 on the validation of qualified and advanced electronic signatures and seals · Statement of October 28, 2026

Statement by GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · EU Transparency Register No. 244298340978-40

Validation Must Confirm the Signature – Not Expose the Person Behind It

Core statement: A signature is only worth as much as its validation. GISAD welcomes the harmonisation of validation through open reference standards and decentralised trust lists – it is the right infrastructure for trust. But validation must not become identification: validating a signature confirms its validity and the eligibility it certifies, not the exposure of the person using it. Whoever conflates the two is not building a trust infrastructure, but a surveillance infrastructure.

What the regulation provides

Implementing Regulation (EU) 2025/1945 of 29 September 2025, published in the Official Journal on 30 September 2025 and applicable since 20 October 2025, sets out the reference standards for the validation of qualified electronic signatures and seals (Annex I) and of advanced electronic signatures and seals based on qualified certificates (Annex II): ETSI TS 119 172-4 (validation policy for European qualified signatures and seals using trusted lists) and ETSI TS 119 102-2 (signature validation report), each with specified adaptations. The act is based on Articles 32(3), 32a(3), 40 and 40a of the eIDAS Regulation (EU) No 910/2014. A companion act, Implementing Regulation (EU) 2025/1942, governs the qualified validation services themselves.

Recognition: testing by open rules is structure, not arbitrariness

GISAD expressly acknowledges two design decisions. First: the reference standards are open, documented and comprehensible to everyone – validation becomes a measurable check instead of a black-box verdict. This corresponds to the principle of measurement outside the manipulable area: the validation report (ETSI TS 119 102-2) makes the check itself reviewable. Second: the trust anchors lie in the trusted lists of the Member States – distributed decentrally, not in one central register that could become a single point of failure or a central point of access.

Criticism 1: validation confirms the signature, not the person

The regulation governs the technical validity check. The danger lies in the practice that follows: when recipients automatically turn every validated signature into an identification event, and validation processes are logged, a movement profile emerges – when, where and with which system a signature was checked and used. The signature confirms eligibility; it does not have to identify the person. The EU-D-S separates precisely this with its border rule upon entering Trusted WEB 4.0: identity only where identity is needed. The signed instance number issued by the Truststation is the model – it confirms eligibility without identifying the user, and transaction numbers can only be assigned internally. Pseudonymous qualified certificates, which eIDAS provides for, must be fully supported in validation policies as a normal case, not treated as an exception.

Criticism 2: the validator must not become the gatekeeper

Validation must remain possible everywhere and by anyone who applies the open standards – not de facto only through qualified validation services and vendor-specific verification tools. If checking is tied to a few service providers, a new gatekeeper level emerges: whoever checks decides what counts. The chain must not read: trust is generated by the signature, the signature is checked by the service provider, the service provider decides the benefit. Trust must lie with the structure – open standards, comprehensible reports, decentralised trust anchors.

GISAD’s recommendations

Validation policies must strictly separate signature validity from signer identity; pseudonymous qualified certificates as an equivalent normal case, not as an exception.
Keep validation logs data-minimal: no central retention of checking processes that create movement profiles; assignment only internal, following the transaction number model of the EU-D-S.
Guarantee independent validation by anyone using open standards – the validation report (ETSI TS 119 102-2) as the standard of comprehensibility; no de facto dependence on individual service providers or verification tools.
Keep trust anchors decentralised in the trusted lists of the Member States – no central EU trust register as a single point of failure.
Adopt the border rule of the EU-D-S as validation practice: the check confirms eligibility (signed by the Truststation) without identifying the user – WAN anonymity up to the point where identity is legally required.

The regulation builds the right foundation: open standards, reviewable reports, decentralised trust anchors. What it cannot regulate – but what practice must be measured against – is whether validation becomes trust without identification. Trusted WEB 4.0 has a simpler rule for this: the signature proves eligibility, not the person.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · EU Transparency Register No. 244298340978-40

Sources: European Commission – Initiative 16072 ·
EUR-Lex – Implementing Regulation (EU) 2025/1945 ·
EU-D-S Constitution (June 2025) (accessed October 28, 2026)

Statement of October 28, 2026 · Concept: Trusted WEB 4.0 · Target system: European Digital System (EU-D-S)

EU copyright law for blind and visually impaired people

EU copyright law for blind and visually impaired people – evaluation of the Marrakesh Directive and Regulation

European Commission · Have your Say · Initiative 13615

Evaluation of the Marrakesh Directive (EU) 2017/1564 and Marrakesh Regulation (EU) 2017/1563 · Statement of October 28, 2026

Statement by GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · EU Transparency Register No. 244298340978-40

Marrakesh Evaluation: Measuring Administration Is Not Measuring Participation

Core statement: An evaluation report that ends with „no amendments warranted“ measures administration, not participation. The Marrakesh Directive and Regulation are the right instrument – but as long as the overwhelming majority of published books remains inaccessible to blind and visually impaired people, the objective has not been reached. Participation is not created through exceptions to copyright, but through structure: accessibility as the default state of digital publishing, access without repeated proof of disability, and availability that is measured publicly.

What the report finds

The Commission has evaluated the Marrakesh Directive (EU) 2017/1564 and the Marrakesh Regulation (EU) 2017/1563, through which the EU implements the 2013 WIPO Marrakesh Treaty. The evaluation, required by Article 10(1) of the Directive and Article 7 of the Regulation, also assessed the impact of possible compensation schemes on the availability of accessible format copies and their cross-border exchange. The result, published on 12 December 2025 as report COM(2025)749 with the accompanying staff working document SWD(2025)406: the instruments matched expectations, improved legal certainty and the availability of accessible format copies, including across borders – and no amendments are considered warranted at this stage. The call for evidence ran from 13 April to 11 May 2023 and received 34 contributions, among them the DAISY Consortium and national libraries for the blind.

Recognition: cross-border exchange without a central platform

GISAD acknowledges what the report records as a success and what is structurally remarkable: the cross-border exchange of accessible format copies works through authorised entities in the Member States – decentralised, without a central EU platform, without a single point of failure. This is precisely the principle the EU-D-S is built on: many authorised entities complementing each other, instead of one body deciding for all. The participatory character of the instrument is right: Marrakesh recognises access to knowledge as participation, not as welfare.

Criticism: the exception is measured, not the condition

The yardstick of an evaluation determines its outcome. The Commission measures legal certainty, administrative procedures and cross-border handling – but not the actual availability of accessible titles relative to the totality of publications. According to estimates by the European Blind Union, around 30 million people in Europe are blind or partially sighted, and 95% of all published books are never converted into accessible formats; a study across six European countries finds less than 7% of published works accessible. An evaluation that concludes „no amendments warranted“ against this background confuses smooth administration with a fulfilled purpose. What is not measured publicly is not improved – the availability measurement therefore belongs in the report, independent and visible for every Member State: measurement outside the manipulable area.

Structure instead of welfare: access without an ID requirement

Using the exception runs through authorised entities and proof of eligibility. That is better than no access – but it turns participation into an administrative relationship with an ID requirement: whoever wants to read must prove their disability again and again. The EU-D-S has a simpler rule for this: identity only where identity is needed. A one-time, Truststation-signed credential – followed by WAN-anonymous access without profiling, without repeated verification of disability, without stigmatisation. The eligibility is checked, the person is not registered.

Compensation schemes: those who end the book famine do not pay those who caused it

The evaluation also examines possible compensation schemes. GISAD is clear on this: compensation models that burden non-profit libraries and organisations turn responsibility upside down. The Treaty became necessary because publishers did not provide accessible formats at the same time and at the same price. Those who close this gap must not be charged extra – that would be a participation levy on precisely those who create participation. The financing question belongs where the EU-D-S locates it: in participation payments and structure, not in levies on non-profit work.

GISAD’s recommendations

Public availability measurement as a core indicator: annual, independently collected figures on accessible titles per Member State, relative to the totality of publications – measurement outside the manipulable area.
Accessibility as the default state („born accessible“): accessible formats as a requirement of digital publishing itself – structure instead of retrofitted exception; the exception remains what it should be: a last line of defence, not the rule.
No compensation schemes at the expense of authorised entities; resolve the cost question through participation mechanisms instead of levies on non-profit work.
Proof of eligibility one-time and signed (Truststation), then WAN-anonymous access without profiling – identity only where identity is needed.
Keep the decentralised exchange through authorised entities as the guiding model – no central EU platform that becomes a single point of failure; linguistic diversity including minority languages as the yardstick (getmySense thinks in 2,500 written languages – participation applies to every language community, and to the elderly, for whom large print and read-aloud functions are participation).

The Marrakesh report documents an instrument that works. But participation is achieved when blind people can read the same books at the same time as everyone else – not when the exception is administered correctly. Trusted WEB 4.0 has a simpler rule for this: structure instead of exception, eligibility instead of identification, availability instead of book famine.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · EU Transparency Register No. 244298340978-40

Sources: European Commission – Initiative 13615 ·
European Commission – Evaluation of the Marrakesh Directive and Regulation (December 2025) ·
EU-D-S Constitution (June 2025) (accessed October 28, 2026)

Statement of October 28, 2026 · Concept: Trusted WEB 4.0 · Target system: European Digital System (EU-D-S)

Cybersecurity – terms & conditions for delaying the notification of incidents

Cybersecurity: terms and conditions for delaying the notification of incidents (delegated act)

European Commission · Have your Say · Initiative 14731

Delegated Regulation on the delayed dissemination of incident notifications under the Cyber Resilience Act · Statement of October 28, 2026

Statement by GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · EU Transparency Register No. 244298340978-40

Delaying Incident Notifications: When the One Who Withholds Also Measures the Need to Withhold

Core statement: Four narrowly defined grounds and hard time limits are a disciplined concept. But the authority to withhold security information must not rest with a single body that also measures the necessity of its own decision. For as long as it operates, a delayed dissemination is a single point of control over the security of 27 Member States – and structure protects only if the decision to delay is as transparent and verifiable as the notification itself.

What Delegated Regulation (EU) 2026/881 provides

Under the Cyber Resilience Act (Regulation (EU) 2024/2847), manufacturers report actively exploited vulnerabilities and severe incidents; the CSIRT initially receiving the notification disseminates it to the CSIRTs of all affected Member States. The delegated act, adopted by the Commission on 11 December 2025 following the feedback period of 16 October to 13 November 2025, specifies the exception: dissemination may be delayed only where the cybersecurity risks of dissemination outweigh its security benefits in light of the sensitivity of the information, where those risks cannot be mitigated through handling protocols such as TLP or PAP, and where one of four grounds applies – a fix expected within 72 hours; information sufficient to create an exploitation technique even for actors with limited skills and resources; partial information sufficient for the other CSIRTs to take adequate risk mitigation measures; or an ongoing coordinated vulnerability disclosure (CVD) procedure in which the receiving CSIRT acts as a trusted intermediary, with dissemination requiring the consent of the parties involved. Any delay is limited to what is strictly necessary; if no fix is delivered within 72 hours, dissemination becomes mandatory. Reporting obligations under the CRA have applied since 11 September 2026, with manufacturers reporting once through ENISA’s Single Reporting Platform.

Recognition: the expiry logic is the right idea

GISAD acknowledges that the act does not create a discretionary embargo, but a single-step logic: every ground for delay has a clearly defined end point – at the latest when a fix becomes available, the CVD process concludes, or the 72-hour window lapses without a fix, dissemination becomes mandatory. This expiry-date logic corresponds to the principle of the Finder-KI-Escape-Schalter: no release without a defined, enforced next step. The fourth variant in particular – dissemination in a CVD procedure only with the consent of the parties involved – is structurally exemplary, because it does not leave the decision to the office that is withholding, but to the parties whose trust the procedure depends on. The EU-D-S knows this separation of roles structurally: the trustees of a discipline organise the founding competition and may act as investors – they are in no way involved in day-to-day operations. That responsibility lies with the Primus of the respective category. Applied to the delay rule, this means: whoever carries operational responsibility must also have the information from which that responsibility arises.

Criticism: who measures „strict necessity“?

The weakness of the act lies not in its substantive grounds but in its measurement order. Whether the risks of dissemination outweigh its benefits, whether TLP/PAP are insufficient, whether partial information is „adequate“ – all of this is assessed solely by the CSIRT that is withholding. The body that benefits from the delay (control over the distribution of information) simultaneously measures the legitimacy of that delay. This is precisely the constellation the EU-D-S prevents: measurement outside the manipulable area. Every delay decision must therefore be logged, time-stamped, justified and disclosed to the CSIRTs Network and ENISA – reviewable independently after the fact, under the zero-tolerance rule that an unjustified delay is sanctioned like a failure to notify.

Structure instead of secrecy

Decentralised digitalisation does not replace a single cable – but it takes the catastrophic effect away from every cable break. The same applies to information: a delay decision taken by one body alone turns the knowledge about an actively exploited vulnerability into a cable that can lie at exactly one point. Decentralised redundancy here does not mean scattering sensitive details, but distributing the availability check: dissemination with delayable details (TLP/PAP) as the default, full withholding only as a logged, time-limited, externally measurable exception.

GISAD’s recommendations

Refrain from full withholding wherever partial information plus handling protocols suffice – the act already permits this; practice must make it the rule.
Complete logging of every delay with time stamp, applicable ground and justification; automatic notification of the delay itself (not only of the content) to the CSIRTs Network and ENISA.
Independent review of delay decisions within the framework of the concept-fidelity audit – not by the withholding CSIRT itself.
The consent logic of the CVD ground (Article 16(6) CRA) as a model: wherever a delay affects third parties whose day-to-day operations depend on the information, the one who withholds does not decide alone – just as in the EU-D-S, where the Primus of a category holds responsibility and information in one hand.
Secure the Single Reporting Platform with decentralised mirror structures, so that the reporting infrastructure itself does not become a single point of failure.

The protection of sensitive security information is legitimate. But a system in which one body decides what others may know, and at the same time measures itself whether that decision was necessary, trades transparency for secrecy without gaining security. Trusted WEB 4.0 has a simpler rule for this: identity and detail only where they are needed – availability and verifiability everywhere.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · EU Transparency Register No. 244298340978-40

Sources: European Commission – Initiative 14731 ·
European Commission – CRA Reporting Obligations ·
EU-D-S Constitution (June 2025) (accessed October 28, 2026)

Statement of October 28, 2026 · Concept: Trusted WEB 4.0 · Target system: European Digital System (EU-D-S)

European Digital Identity Wallets – user onboarding

European Commission · Have your Say · Initiative 15572

European Digital Identity Wallets –
user onboarding

Implementing Regulation (EU) 2026/798 · eIDAS 2.0 · Statement of 28 October 2026

Statement by GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · EU Transparency Register No. 244298340978-40

Identity only where identity is needed: the onboarding regulation completes an identity-centred web

The implementing regulation on the remote onboarding of users to the European Digital Identity Wallets was presented as a draft on 2 December 2025 (feedback until 30 December 2025) and adopted as Implementing Regulation (EU) 2026/798 of 7 April 2026. It permits onboarding via electronic identification means at assurance level „substantial“, reinforced by additional remote procedures so that the combination meets assurance level „high“; identity proofing already performed at level „high“ does not have to be repeated. The context: Member States must make at least one EUDI Wallet available by 24 December 2026; banks, regulated sectors and large platforms must accept it from 24 December 2027; and from 10 July 2027 the Anti-Money-Laundering Regulation recognises it for customer identification.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation, the standards institute of the Trusted WEB 4.0 concept – acknowledges the regulation and the underlying wallet architecture: decentralised storage on the user’s own device, selective disclosure instead of all-round data surrender, a dashboard of one’s own transactions, free e-signatures for non-professional use. These are genuine advances over central account databases and identity platforms. Yet the regulation also completes a misguided development: it makes identity the currency of everyday digital life.

1. Selective disclosure is half freedom

The wallet decides how much identity a service receives – but the decisive question is whether a service needs identity at all. Buying an e-book, reading a news item, searching for information: none of this requires a personal identity. The personality protection concept of Trusted WEB 4.0 shows the alternative: WAN anonymity, no cookies, no privacy settings – assignment only via trust station key sets where it is genuinely needed. GISAD recommends placing an equivalent anonymous path alongside the wallet. The border rule of the European Digital System (EU-D-S) shows how anonymous entry into digital spaces works: through generic user names and transaction numbers that can only be assigned within the system.

2. The Article 5f acceptance obligation must not become compulsory identification at gatekeepers

From the end of 2027, banks and large platforms must accept the wallet – including those US corporations whose business model rests on the exploitation of personal data. A European identity instrument that normatively channels identifiable registration to non-European platforms delivers precisely what the wallet is meant to prevent: personal data flows to gatekeepers. The regulation should make clear that anonymous use remains equally permissible wherever no legal identification requirement exists.

3. Simplicity decides success – and simplicity means participation

The adoption gap is official: only 5 % of Germans can explain what the wallet is; national predecessors remained below 5 % usage. An identity infrastructure that requires explanation fails its own aspiration. getmySense with 2,500 written languages shows the principle: participation instead of barriers – also for older people, for whom every identity procedure is a risk of exclusion. Onboarding procedures should therefore work without prior digital experience; multilingual design is not a courtesy but a prerequisite for access.

4. The wallet is a honeypot – the onboarding regulation must not enlarge it

A device bundling all personal data, the driving licence, certificates and means of payment is the most attractive target in the digital space; its loss is total identity compromise. The regulation is on the right path where it makes repeated identity proofing superfluous through the leverage of existing „high“ eID means. It should additionally minimise the data trail of onboarding itself: no central storage of identity verification records, WAN-anonymous storage of metadata, and biometrics only as a voluntary option – never as the standard.

The EUDI Wallet gives citizens control over their data – that is good. But control over identity is not the end of the journey. The end of the journey is a web that demands identity only where it is genuinely needed. The architecture for this is ready: the EU-D-S with trust stations, WAN anonymity and getmySense participation – the EU can participate as a passive member at eye level, as provided by the EU-D-S Constitution of June 2025.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation (in formation) · registered in the European Commission Transparency Register, No. 244298340978-40 · www.gisad.eu

Sources: European Commission – Initiative 15572 (European Digital Identity Wallets – user onboarding) · Implementing Regulation (EU) 2026/798 · Regulation (EU) 2024/1183 (eIDAS 2.0) · European Commission – European Digital Identity (EUDI) Regulation · EU-D-S Constitution (June 2025)

Statement of 28 October 2026 · Concept: Trusted WEB 4.0 · Target system: European Digital System (EU-D-S)

Implementing Regulation on AI Regulatory Sandboxes

AI regulatory sandboxes – rules for their set-up and operation

European Commission · Have your Say · Initiative 15952

Update after the Digital Omnibus on AI (Regulation (EU) 2026/1744) · Statement of October 28, 2026 (updated version, replaces the first version)

Statement by GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · EU Transparency Register No. 244298340978-40

Digital Omnibus on AI: The Sandbox Infrastructure Arrives After the Systems It Is Meant to Test

Core statement: Whoever postpones the testing environment postpones protection. The Digital Omnibus on AI extends the deadline for national AI regulatory sandboxes to 2 August 2027 – one year after the AI Act’s general date of application. The testing infrastructure thus arrives only after the systems it is meant to test are already in operation. And with the Union-level sandbox of the AI Office, a single body emerges that operates, supervises and enforces – three roles in one hand. GISAD maintains its position: a sandbox is not an escape safeguard. The amendments raise the structural questions instead of resolving them.

What has changed

Regulation (EU) 2026/1744 (Digital Omnibus on AI, in force since 27 July 2026) changes the AI Act’s sandbox regime: the obligation for Member States to ensure at least one operational national sandbox moves from 2 August 2026 to 2 August 2027. A new Article 57(3a) allows the AI Office to establish a Union-level sandbox, with priority access for SMEs, start-ups and small mid-cap enterprises (as defined by Commission Recommendation (EU) 2025/1099). Article 58 extends the catalogue for the implementing act to governance – explicitly including the involvement and supervision of data protection authorities and coordination at national and Union level. At the same time, the new Articles 75a–75d introduce direct enforcement at Union level. The implementing act itself (draft of 3 December 2025, consultation until 13 January 2026) has not been adopted; the general date of application of the AI Act, 2 August 2026, remains unaffected – there is no moratorium.

Recognition: more independent supervision in the rulebook

GISAD acknowledges that Article 58 now expressly provides for the involvement and supervision of the data protection authorities and for coordination at national and Union level. This is a step towards what the EU-D-S demands: review by bodies that do not operate what they review. The time-limiting logic also remains correct: the sandbox plan and the exit report are single-step instruments with a defined end – no release without an enforced next step.

Criticism 1: the extension reverses the order

Structure protects only if it exists before operation begins. The general obligations of the AI Act apply from 2 August 2026 – but comprehensive sandbox coverage in the Member States only from 2 August 2027. The result is a year of operation without testing infrastructure: systems enter the market before the space exists in which they could have been tested. Deadlines do not protect – structure protects. Whoever postpones protection should not call it relief.

Criticism 2: three roles in one hand

With the Union-level sandbox and Articles 75a–75d, the AI Office gathers operating, supervising and enforcing into a single institution. Whoever operates the sandbox reviews their own testing conditions; whoever enforces measures their own practice. This is precisely the constellation the EU-D-S resolves through the concept-fidelity audit: the review layer lies outside the manipulable area, read-only and independent – not in the hands of what is being reviewed. Access control adds to this: priority access for SMEs and small mid-caps requires transparent, fair criteria – otherwise the Union sandbox becomes an allowlist of the AI Office, a gatekeeper for testing rights.

What remains valid from the first version

No reduction of protection standards inside the sandbox – the Hugging Face attack of July 2026 happened with reduced guardrails precisely in a testing environment. An escape safeguard is not a sandbox feature but a product feature: single-step release, signed instance numbers from the Truststation, measurement outside the manipulable area, zero-tolerance rule. And sandboxes need sovereign operating environments – US hyperscalers as the test infrastructure of the European AI regulatory framework are a contradiction in themselves.

GISAD’s recommendations

Reverse the order: at least one pilot operation of national sandboxes before 2 August 2027 – testing infrastructure before full application of obligations, not after.
Separation of roles for the Union sandbox: operating (AI Office), reviewing (an independent, read-only review layer – standard: concept-fidelity audit), enforcing (a separate body under Articles 75a–75d) must not fall into one hand.
Access criteria transparent, fair and documented; no de facto allowlist; every rejection reasoned and reviewable – measurement outside the manipulable area.
Escape safeguard as a condition of admission to every sandbox: single-step release and signed instance numbers for every participating AI system; zero-tolerance rule for instance-identifying markers outside the system.
Sovereign test infrastructure: European operating environments for the sandbox – no US hyperscalers, no CLOUD Act risk inside the testing framework of European AI regulation.

The Digital Omnibus on AI takes the sandbox deadlines apart and gives the AI Office new power without extending the reviewability of that power. Trusted WEB 4.0 has a simpler rule for this: first the structure, then the operation – and the review always lies outside what is being reviewed.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · EU Transparency Register No. 244298340978-40

Sources: European Commission – Initiative 15952 ·
CypherOn – What Regulation 2026/1744 changed in the AI Act ·
EU-D-S Constitution (June 2025) (accessed October 28, 2026)

Statement of October 28, 2026 (updated version) · Concept: Trusted WEB 4.0 · Target system: European Digital System (EU-D-S)