EU Posture

Updated

Asqav's EU posture is drawn from primary sources only: the enacted law on EUR-Lex and the cited standard editions. This page evaluates three candidate bindings. It claims no compliance status; each binding is a candidate until a release evidence record names the versions and clauses verified.

Primary sources

NIS2 logging and incident reporting as a candidate binding

The operative logging text is not in Article 21 (which contains no log word) but in Implementing Regulation (EU) 2024/2690, Annex 3.2, for the listed entity types: procedures and tools to monitor and log activities (3.2.1); maintained, documented, reviewed logs over a risk-assessed asset list (3.2.3); regular review with alarm thresholds and timely qualified response (3.2.4); retention, backup and tamper protection (3.2.5); synchronised time sources and redundant, independently-monitored logging systems (3.2.6).

Article 23 requires essential and important entities to notify significant incidents on a staged ladder: an early warning within 24 hours of awareness (malicious-act and cross-border flags; trust service providers notify within 24 hours under the Article 23(4) derogation), an incident notification within 72 hours (severity, impact, indicators of compromise), intermediate reports on request, and a final report within one month (description, threat or root cause, applied and ongoing mitigations, cross-border impact). Notification does not increase the notifying entity's liability.

Candidate binding: an Asqav incident receipt would carry the Article 23(4) fields (severity, impact, indicators of compromise, threat or root cause, mitigations), and an audit-pack export window would mirror the 24-hour / 72-hour / one-month ladder, so that a CSIRT notification could cite exact receipt bytes. Annex 3.2.5-3.2.6 retention, backup and time-sync practice would map to receipt-chain retention and anchor discipline.

eIDAS 2.0 wallet attestations for mandates

The precise mandate hook is Annex VI item 9 read with Article 45e: the minimum attribute list includes "Powers and mandates to represent natural or legal persons", and Member States must enable qualified trust service providers to verify that attribute against the national authentic source. Wallet provision (Articles 5a-5f) says nothing about agent authority and is not the hook. The wallet deadline is relative to the implementing acts, not a calendar year. Issuance follows Implementing Regulation (EU) 2024/2977: person identification data in ISO/IEC 18013-5 and W3C Verifiable Credentials 1.1, attestations per the Annex I standards of Implementing Regulation (EU) 2024/2979, with mandatory revocation policies.

Candidate binding: authorized_under_mandate in EU deployments would source to EUDI electronic attestations of the Annex VI item 9 attribute; the verifier side would use Article 5b relying-party authentication; selective disclosure would bound minimality claims. Honest limit: Annex VI item 9 covers a human's power to represent; extending it to an AI agent is our analogy, labelled as ours, never as something eIDAS provides for. No third-party mandate demo is asserted here.

OVERT identity

OVERT (Observable Verification Evidence for Runtime Trust, overt.is) publishes edition v1.1, dated 11 June 2026, as its current standard; its version index additionally lists v1.0.0, dated 25 March 2026. The maintainer is Glacis Technologies, Inc., a single company; shared stewardship is pending and not in effect. OVERT is a direct competitor surface in agent attestation: its receipt model, RFC 6962 transparency log and independent-notary trust plane resemble Asqav compliance receipts and the Asqav transparency log, which is why any comparison must name versions and never imply endorsement. Any Asqav citation would name the versioned edition, never an individual fascicle.

Verification

Each binding above is a candidate. A release evidence record identifies the exact versions and clauses verified for any particular release; until then this page is an evaluation, not a conformance claim.

References