Skip to content

Guiding questions — Regulatory compliance#

Fork notice. The questions below are reproduced from the iSHARE Data Space Template page Regulatory compliance → Guiding questions — © iSHARE Foundation, used under the EUTwinLink Consortium Agreement (see Legal notices). The template's question text is carried over unchanged so this fork stays comparable to its upstream.

Everything between the LDT answer markers is the EUTwinLink instantiation — that is what partners fill in. Decisions already taken live on the block page: Regulatory compliance.

Building block L1 · owner(s) iSHARE legal + Cartagena + Almelo + FHC Corp + ERTICO · due 26 Sep 2026 · block status DRAFTED · see the Building-block register.

Answer provenance. Every answer below is tagged with where it comes from, because a governance scheme that cannot be traced is not a governance scheme:

  • Decided — already fixed by the Grant Agreement, the Consortium Agreement or a recorded decision elsewhere in this scheme. Change it only through the change procedure.
  • Proposed — a defensible default, derived from the iSHARE Trust Framework, the DSSC Blueprint and the decisions this scheme has already taken. Drafted for the owner to confirm, correct or reject at TIPS. It is not an agreed position until TIPS approves it.
  • Needs owner — cannot be answered without the named owner: a fact about their systems, their legal position or their commercial intent. The text states what is needed and why.

Open points across the whole scheme are collected in Open questions for partners.

Purpose: Identify and monitor all relevant EU and national laws to guarantee that operations remain legally sound.

  • Which EU and national regulations (e.g. GDPR, Data Act, competition law, sectoral directives) are directly relevant?
  • How should the governance authority keep track of evolving regulatory obligations?

LDT answer DRAFTED · owner: iSHARE legal + Cartagena + Almelo + FHC Corp + ERTICO · due 26 Sep 2026

Decided The frameworks already on the LDT's radar, per the block page:

Framework Relevance
eIDAS 2.0 wallets and verifiable credentials for organisations and representatives
GDPR citizen data in the LEZ and PED contexts — handled in PD1, cross-referenced
Data Governance Act / Data Act intermediation services, public-sector data reuse, B2B sharing terms
AI Act the agent stack and observer chatbot — classification and transparency duties
ITS Directive / mobility rules LEZ enforcement and mobility data
NL energy market rules PED flexibility and energy sharing
Non-EU transfer (Aruba) transfer mechanism and applicable law for airport data

Proposed Two additions the drafting suggests and the legal reviewers should confirm or strike: EPBD (the Aadorp PED makes building-energy performance directly relevant) and MiCA (flagged in the profile of the Marketplace of the EU LDT Toolbox against the reward-token design — if the token is not a crypto-asset, say why, in writing, once).

Needs owner iSHARE legal with Cartagena (ES), Almelo (NL), FHC (Aruba), reviewed by ERTICO — the 🧩 on the block page. National law is the gap: this table is almost entirely EU-level, and ES and NL administrative, procurement and open-data rules are not represented at all.

Tracking evolving obligations: the WP4 lead maintains this table, reviews it at TIPS quarterly, and legal reviewers flag changes in their jurisdiction. There is no automated horizon-scanning and PD4 should not imply there is.

2. Compliance Responsibilities#

Purpose: Clarify which compliance duties belong to the governance authority versus individual participants to ensure accountability.

  • What compliance obligations should rest with the data space authority versus the individual participants?
  • Should there be baseline legal compliance requirements for all participants before joining the initiative?
  • How can legal obligations be clearly communicated to all participants?
  • What support is needed to help participants meet compliance effectively?

LDT answer DRAFTED · owner: iSHARE legal + Cartagena + Almelo + FHC Corp + ERTICO · due 26 Sep 2026

Proposed The split follows what each party can actually see:

  • The scheme is responsible for not making compliance impossible, and for the obligations that attach to running a data space: lawful design of the trust and policy layer, DGA-relevant duties where the scheme acts as an intermediation service, the audit trail, and transparency about the agent stack under the AI Act.
  • The participant is responsible for the law applicable to its own data and processing: lawful basis, data-subject rights, sector rules, and its own records. The scheme cannot assess a municipality's administrative-law position for it and should not pretend to.

Proposed Baseline legal compliance as an entry condition: the LDT requires a declaration at onboarding (lawful basis per offering, GDPR posture, applicable sector regimes) rather than a verified compliance audit. Verification is reserved for what the scheme can test — identity, conformance, policy completeness. Requiring a compliance audit at entry would be unenforceable and would exclude exactly the smaller participants the scheme wants.

Communication of obligations happens through the accession agreement and its annexes, which attach per activity so a participant reads what it incurs rather than everything. Support: iSHARE legal advises on the model agreements; participants remain responsible for their own legal advice.

Needs owner iSHARE legal: whether the declaration should be a contractual warranty with consequences, or a statement of fact. The scheme currently assumes the former.

3. Risk and Liability#

Purpose: Establish a fair distribution of liability and safeguards to minimize legal and operational risks.

  • How should liability be distributed in case of breaches of regulatory obligations (e.g. data protection violations, misuse of data)?
  • What safeguards or monitoring mechanisms are necessary to minimize compliance risks?
  • How can compliance checks be automated to reduce manual effort?
  • Which tools help monitor ongoing regulatory adherence?

LDT answer DRAFTED · owner: iSHARE legal + Cartagena + Almelo + FHC Corp + ERTICO · due 26 Sep 2026

Proposed Liability follows control. A participant is liable for what it contributes and for how it uses what it receives; an operator is liable for operating its function per its service agreement; the scheme — having no legal personality during the pilot — distributes residual liability through the Consortium Agreement, which is why that document rather than this one governs the hard cases. Decided by the CA, not by this scheme.

Safeguards that reduce compliance risk, in descending order of how much they actually prevent:

  1. Policies enforced rather than promised — ODRL constraints checked at the PDP, so purpose limitation and aggregation floors are structural.
  2. Credential-gated access — revocation propagates automatically, so withdrawal of permission is one action.
  3. Audit trail — every policy decision leaves an entry, which is what makes a breach investigable at all.
  4. ITB-S conformance before production.

Automation: the first three are already automatic by design. What cannot be automated is the judgement — whether a declared purpose is lawful, whether an aggregation floor is high enough. Automated checks reduce manual effort on the mechanical questions and do nothing for the ones that matter most, and PD4 should say so rather than claiming automated compliance.

Decided The caps are set in the Consortium Agreement. No party is liable to another for indirect or consequential loss — lost profit, revenue or contracts — unless caused by a wilful act or a breach of confidentiality. For the remaining contractual liability, a party's aggregate liability towards the other parties collectively is capped at once its share of the total project costs, as identified in Annex 2 of the Grant Agreement, unless the damage was caused by a wilful act or gross negligence. Statutory liability is untouched, and each party is solely liable for damage it causes to third parties. (Source: LDT4SSC–EUTwinLink pilot Consortium Agreement, signed by all eleven parties.)

Needs owner iSHARE legal + ERTICO: insurance, and what replaces the "share of project costs" cap once there is no project to take a share of. Checked against both instruments: neither the Consortium Agreement nor the Pilot Grant Agreement mentions insurance anywhere, so this is not an omission from this page but an absence in the contract stack. Both are post-pilot questions and neither has an instrument behind it.

4. Certification and Assurance#

Purpose: Determine the most effective mechanisms for verifying ongoing compliance and trustworthiness of participants

  • Should compliance be verified through certification, attestation, or self-declaration?
  • How frequently should compliance checks or audits be carried out?

LDT answer DRAFTED · owner: iSHARE legal + Cartagena + Almelo + FHC Corp + ERTICO · due 26 Sep 2026

Decided Three distinct things, routinely conflated and kept separate here:

  • ITB-S conformance testing produces technical evidence. It is not certification.
  • iSHARE certification and the iSHARE-compliant designation are granted exclusively by iSHARE Foundation under its own scheme, and nothing in this repository confers them.
  • Self-declaration covers the legal posture at onboarding (see 2).

Proposed Frequency: ITB-S conformance evidence is refreshed when the participant changes an exchange path, when the scheme changes a normative standard version, and otherwise annually. Marketplace certified badges lapse when the evidence does, which gives the requirement teeth without needing a sanction.

Audits of the scheme itself (not of participants) follow the grant's own review cycle, with evidence retained for five years per grant rules.

Decided The re-testing policy is no longer missing or unassigned, and it is stricter than the annual cycle proposed above: PD4 §3 requires a passing conformance report before a component moves to APPROVED and before a participant goes live, re-run on every release, with reports stored per component in this repository. iLabs operates the ITB-S and the Scheme Owner decides on listing, so the policy has an owner on both sides. (Source: PD4 v1.0 §3 — text as in PD4 v0.96, 29 Oct 2026.)

Needs owner iLabs: what per-release re-testing costs and whether it is feasible at the expected participant count. The policy is fixed; the capacity behind it is not, and it is the input the revenue model in Intermediaries & operators prices against.

5. Sector-Specific Rules#

Purpose: Integrate sectoral requirements while ensuring alignment with overarching EU legal frameworke.

  • Are there additional environmental or sectoral regulations that need to be explicitly incorporated into participation rules?
  • How should conflicts between sector-specific rules and overarching EU frameworks be managed?

LDT answer DRAFTED · owner: iSHARE legal + Cartagena + Almelo + FHC Corp + ERTICO · due 26 Sep 2026

Proposed The sectoral rules that reach into participation conditions, by use case:

  • Mobility / LEZ (Cartagena) — ITS Directive and national LEZ enforcement rules; enforcement-related data is restricted-tier and city-only for a reason that is legal, not merely cautious.
  • Energy / PED (Almelo) — NL energy market rules, RED III energy communities, EPBD. The block page already notes these rules are in flux, which is a scheduling risk for PD4 as much as a legal one.
  • Aviation (Aruba) — operational and safety data regimes, plus the non-EU transfer question.
  • Environmental reporting — where CO₂ figures become claims, the methodology is auditable by design (LCMM / ISO 23795-1), because a sustainability claim without a method is a greenwashing exposure.

Proposed Conflict rule: where a sector rule and an EU framework conflict, the stricter obligation applies, and the conflict is recorded on the relevant use-case profile rather than resolved silently. This mirrors the scheme's general layering — use-case groups may be stricter than the baseline, never weaker.

Needs owner Cartagena, Almelo and FHC respectively. Each knows its sector; the scheme does not.

6. Enforcement Mechanisms#

Purpose: Define clear processes and authorities for addressing and resolving compliance breaches.

  • How should compliance breaches be addressed (warnings, sanctions, suspension, exclusion)?
  • What governance body or process will be responsible for handling non-compliance cases?

LDT answer DRAFTED · owner: iSHARE legal + Cartagena + Almelo + FHC Corp + ERTICO · due 26 Sep 2026

Proposed A graduated ladder, matching the suspension/termination distinction drawn in Participation management:

  1. Warning — recorded, with a remediation window, for breaches with no ongoing harm.
  2. Suspension — credential status change and listing withdrawal; reversible and fast. The default response where data is still flowing under a breached condition.
  3. Termination — removal from the registry, revocation, notification of counterparties. Final.
  4. Contractual and legal consequences — per the accession agreement and the Consortium Agreement, independent of the above.

Proposed Who handles non-compliance: the WP4 lead acts on the mechanical cases (lapsed credential, failed conformance, incomplete description) without convening anyone, because waiting a month to suspend an expired credential is itself a risk. TIPS decides anything involving judgement — whether a use was within its declared purpose, whether a methodology is sound, whether to terminate. Escalation beyond that follows the Consortium Agreement ladder.

Decided Checked, and the assumption is wrong. Neither instrument gives the WP4 lead a unilateral power to suspend. Under the Consortium Agreement the Coordinator gives formal notice of a breach and the General Assembly decides whether to declare a Defaulting Party and what follows — a collective decision, by two-thirds of votes cast, which the party concerned may not veto. Under the iSHARE Data Ecosystem Agreement the data space governance body applies warnings, suspension and exclusion in accordance with the procedures in the iSHARE Terms of Use, not at its own discretion. So the authority exists, but it is shared and procedural. (Sources: Consortium Agreement sections 4.2 and 6.2.3; iSHARE Data Ecosystem Agreement clause 5.6.)

Needs owner iSHARE legal: every page in this scheme that assumes a unilateral suspension needs rewriting to the two-step above, or the scheme has to argue for an emergency power and get it agreed. The second is defensible for a key compromise, where waiting for a General Assembly is not an option — but it has to be written, not assumed.