6. Gaia-X Compliance Criteria for General Digital Services¶

Note

We use the term ‘Provider’ throughout this section as the short denominator for the Digital Service Provider, i.e., the Gaia-X participant who provides Digital Service Offerings in the Gaia-X ecosystem. We use the term ‘Consumer’ in this section to denominate the digital service Consumer, i.e., the Gaia-X participant who consumes a Digital Service Offering from a Provider. The term ‘Consumer’ is equivalent to the term ‘Customer’ used in other parts of the document, but better reflects non-commercial relationships within Gaia-X ecosystems.

Note

We use the abbreviation ‘DSO’ throughout this section for the Digital Service Offering and related to the Gaia-X Credential describing the Digital Service Offering according to the Gaia-X Digital Service Offering Ontology. The Digital Service Offering class inherits all attributes from the Gaia-X Service Offering class . Wherever attributes are referenced in this section, the Digital Service Offering class is the authoritative reference.

Note

The compliance criteria in this section focus on the presence and validity of ontology attributes in the DSO Credential. Each criterion validates that a mandatory attribute is declared, resolvable, and conformant to the Gaia-X Ontology. The rationale for the mandatory character of each attribute is documented alongside the respective criterion, as these attributes constitute the minimal transparency, accountability, and interoperability baseline required for a trusted digital service in the Gaia-X ecosystem.

Note

The compliance criteria are listed using a hierarchical numbering system, prefixed by “DS” to indicate Digital Service targeted criteria. The hierarchical numbering allows to assign stable numbers to criteria, also when future additions or deletions are made.

Note

The name attribute is mandatory because it is the primary human-readable identifier of the Digital Service Offering. Without a name, a service cannot be unambiguously presented in catalogues, referenced in contracts, or distinguished by Consumers during service selection.

Note

The version attribute is mandatory because Digital Service Offerings evolve over time. A declared version number enables Consumers and the Compliance Engine to associate a compliance attestation with a specific, immutable state of the service description, and to detect when a re-assessment is required after a service changed. The version attribute also allows to link previous versions for comparision and detection of relevant changes. This is important for automated compliance checks.

Note

The declaration of an identifiable, legally registered and accountable Provider is the foundation of trust in the Gaia-X ecosystem. Without a verified Gaia-X Participant associated with the Digital Service Offering, no legal accountability, contractual capacity, or enforcement of the Gaia-X Terms & Conditions can be established. A name of the organization must be provided to allow the display of the name in catalogues.

Note

Contact information is mandatory to guarantee that Consumers, Federators, and supervisory bodies have a reachable point of contact for service inquiries, incident handling, and the exercise of legal rights. An unreachable Provider undermines the accountability principle of the Gaia-X ecosystem.

Note

The Terms and Conditions are mandatory because they constitute the contractual baseline between the Provider and the Consumer. The inclusion of a message digest allows verification of the referenced content at any later time, including in cases of dispute resolution.

Note

The separation of general, service-specific, and usage-specific Terms and Conditions enables Providers to differentiate between the contractual framework of the offering itself and the conditions governing its actual usage. Where no such differentiation exists, referencing the same document is explicitly permitted, so that the attributes remain machine-validatable without imposing artificial contractual fragmentation on the Provider and Consumer.

Note

The provision type is mandatory because it informs the Consumer about the fundamental delivery model of the service. As an enumerated value, it is directly machine-validatable and enables automated filtering and matching of Service Offerings in federated catalogues.

Note

The declared Personal Data Protection Regime is mandatory because it determines which legal framework governs the processing of personal data within the service. It is also the discriminating attribute for conditional criteria in this section (see DS1.4.4), and therefore a prerequisite for the machine executability of the compliance validation.

Note

The documentation of Data Protection Measures is mandatory to allow Consumers a transparent and educated assessment of the technical and organisational measures protecting their data, prior to ordering the service.

Note

The purpose of the Data Account Export declaration is to enable the participant ordering the service to assess the feasibility of exporting its personal and non-personal data out of the service. This export covers account data - e.g., account holder’s billing information, information on the PII held - but also data provided previously to the service by the user. This attribute is a cornerstone of data sovereignty and prevents Consumer lock-in.

Note

Data Portability is a right of the data subject under Article 20 GDPR. Where GDPR is the applicable regime, the declaration of the portability means is therefore not optional but a legal transparency obligation, and its presence is machine-validatable based on the declared regime.

Note

Semantic interoperability is the precondition for the machine executability of all criteria in this section. A DSO Credential referencing unresolvable, non-conformant, or unsigned credentials cannot be validated by the Gaia-X Compliance Engine and therefore cannot be trusted by any other participant in the Gaia-X ecosystem. This criterion is validated recursively over the full reference graph related to the DSO Credential.

Note

For General Digital Services only Gaia-X Standard Compliance is avaiable as of now. Additional Gaia-X Label can be developed by members to comply with specific regulations and permissable standard as it has been done for cloud services.

Note

These are the minimum criteria for the entry in the Gaia-X ecosystem of ecosystems. Mature services are expected to enable more transparency through the optional attributes of the Digital Service Offering Credential. For highly mature services or services in regulated environments further information on Provenance of data or Software Bills of Material (SBOM) can be expected.