Legal and compliance

Outline. The material of this module is being written by the Showcase and Certification Working Group. The objectives, outline and assessment below are the agreed scope for program version 2026.1.

6 class hours. Assessed by: exam and case.

Learning objectives

After this module you can:

1. Explain how a governance framework allocates liability among ecosystem, validators, issuers, verifiers and holders.
2. Assess a deployment against GDPR: data minimization, what is on chain, what is personal data, roles of controller and processor.
3. Position Verifiable Trust against eIDAS 2: qualified and non-qualified attestations, trusted lists, wallets, the gaps.
4. Explain the licensing of the specifications and software, and the token considerations an organization must take into account.

Prerequisites

C1, C2, C3.

Outline

1. Governance frameworks as contracts

Binding participants; the digest as evidence; versioning; dispute clauses; slashing as liquidated damages.

2. GDPR

Nothing personal on chain; digests and pseudonymity; wallets as data subjects' tools; controller and processor mapping for issuers, verifiers and the registry; retention.

3. eIDAS 2

QEAA, EAA, PuB-EAA; trusted lists versus ecosystems; wallet requirements; third countries; where Verana complements and where it does not apply.

4. Licensing

CC BY-SA for specifications; Apache 2.0 for software; what a contributor signs; trademark policy.

5. Tokens

The native coin as a utility; fees and deposits as costs, not investments; accounting and tax questions to ask counsel; sanctions and travel-rule touchpoints.

Assessment

Knowledge exam and a case: a GDPR and liability review of a deployment described by the certificator.

Reading list

Verana Council governance framework templates. GDPR articles 4, 5, 25, 26, 28. eIDAS 2 regulation (EU 2024/1183). Foundation legal pages.