Guiding Questions

Purpose: Identify and monitor all relevant EU and national laws to guarantee that operations remain legally sound.

1. Applicable Legal Frameworks

• Which EU and national regulations (e.g. GDPR, Data Act, competition law, sectoral directives) are directly relevant?

• How should the governance authority keep track of evolving regulatory obligations?

Purpose: Clarify which compliance duties belong to the governance authority versus individual participants to ensure accountability.

1. Compliance Responsibilities

• What compliance obligations should rest with the data space authority versus the individual participants?

• Should there be baseline legal compliance requirements for all participants before joining the initiative?

• How can legal obligations be clearly communicated to all participants?

• What support is needed to help participants meet compliance effectively?

Purpose: Establish a fair distribution of liability and safeguards to minimize legal and operational risks.

1. Risk and Liability

• How should liability be distributed in case of breaches of regulatory obligations (e.g. data protection violations, misuse of data)?

• What safeguards or monitoring mechanisms are necessary to minimize compliance risks?

• How can compliance checks be automated to reduce manual effort?

• Which tools help monitor ongoing regulatory adherence?

Purpose: Determine the most effective mechanisms for verifying ongoing compliance and trustworthiness of participants

1. Certification and Assurance

• Should compliance be verified through certification, attestation, or self-declaration?

• How frequently should compliance checks or audits be carried out?

Purpose: Integrate sectoral requirements while ensuring alignment with overarching EU legal frameworke.

1. Sector-Specific Rules

• Are there additional environmental or sectoral regulations that need to be explicitly incorporated into participation rules?

• How should conflicts between sector-specific rules and overarching EU frameworks be managed?

Purpose: Define clear processes and authorities for addressing and resolving compliance breaches.

1. Enforcement Mechanisms

• How should compliance breaches be addressed (warnings, sanctions, suspension, exclusion)?

• What governance body or process will be responsible for handling non-compliance cases?