Automated Compliance

Executive summary

Gaia-X's Compliance by Design sprint, launched by the Policy Rules Committee in November 2025 and endorsed by the Board of Directors, treats reducing time-to-compliance as strategically as important as reducing time-to-market. As federated data spaces scale, manual certification — still largely issued as static PDFs — becomes slow, costly, and unsustainable. The Gaia-X Trust Framework answers with machine-readable compliance data carried by every digital product and service, like a digital passport attesting to its trustworthiness. The Gaia-X Digital Clearing Houses (GXDCHs), the compliance engines of the Trust Framework, verify declared attributes automatically against pre-defined rule sets, cutting time-to-compliance and making assurance scalable. Compliance is also composable and inheritable: labels propagate across the whole digital supply chain, from infrastructure to applications, so a product's overall compliance reflects every underlying component. One precision matters: the GXDCH verifies conformity with Gaia-X rules that are modelled on regulatory texts — it does not certify legal compliance itself, and every requirement needs an accepted Trust Service Provider as its trust anchor to be verifiable at all.

The sprint works from a pragmatic premise: help federated data space participants lower both the time and cost of complying and the time and cost of proving compliance. Three regulatory sources are taken as concrete ground — the Data Act, eIDAS 2.0 and the Cyber Resilience Act — and the work proceeds in three steps:

1. establish the list of requirements, and the criteria attached to them, that ecosystem participants will have to meet;
2. work out how each criterion is proven in a certification or declaration context, and where Conformity Assessment Bodies come in;
3. assess how automatable each criterion's assessment is, and then compliance across the whole requirement framework.

The criteria mapping Policy Hub exposes is the first step's output, and the mapping's coverage is what makes the second and third measurable. The sprint's deliverable is a Domain Extension Kit meant to serve as the basis of standard mechanisms for domain extensions across sectors, due before the Gaia-X Tech & Market Event 2026, with progress reported back to the Policy Rules Committee.

What this page shows

Below is the roster of conformity schemes Gaia-X has started to map its criteria against — regulatory acts and Gaia-X's own compliance labels — each worked through article by article, criterion by criterion, in Policy Hub. Every row links to the scheme's criteria view, where the mapping and its coverage can be inspected. The roster grows automatically as more acts are mapped.

Which schemes Gaia-X has taken on mapping is itself part of the paid Gaia-X membership tier: the roster is visible to members only, while this introduction is public.