Standards & Regulations

Requires high-risk AI systems to document the origin and quality of training, validation, and test data. In effect, Article 10 demands timestamped, automated evidence of when a standard was applied to which data in which pipeline — an evidentiary obligation that self-declared governance cannot satisfy.

provin generates and inherits a VC signature chain at every pipeline boundary, providing the cryptographic traceability that this obligation structurally requires.

A European data sovereignty and interoperability framework that defines the trust specifications.

provin positions itself as the operational substrate aligned with GAIA-X’s direction — an OSS implementation surface for data flow that meets the GAIA-X trust specifications.

A protocol specification for inter-organizational data sharing developed by the International Data Spaces Association. It builds on Usage Control + Web technologies to guarantee interoperability across data spaces.

provin complements the Dataspace Protocol as the provenance layer. Where the Dataspace Protocol defines how parties connect and negotiate, provin defines what is guaranteed about the data that flows.

Eclipse Dataspace Components (EDC) integration is implementable against provin’s Source / Sink extension-point contracts; edc-source / edc-sink adapters are planned as a separate repository.

Japan’s national data interoperability initiative led by METI and IPA, spanning companies, industries, and borders. The Open Data Spaces Reference Architecture Model (ODS-RAM) V2 was published in April 2026, moving the program into its real-world implementation phase.

provin is positioned as an OSS substrate aligned with the ODS-RAM reference architecture, providing the provenance layer that connects to Japan’s data-space initiatives.

Supply Chain Integrity, Transparency, and Trust — a transparency-log-based provenance standard focused primarily on intra-organizational supply chain integrity.

provin complements SCITT by forming VC signature chains across organizational boundaries. Together, intra-org (SCITT) + inter-org (provin) provide complete coverage.

provin issues provenance proofs in formats compliant with the W3C VC Data Model. DID resolution and VC verification rely on standard cryptographic primitives (Ed25519 et al.), making provin interoperable with the broader VC ecosystem.

A regulatory wave requiring per-product, electronic traceability across raw materials, manufacturing, and distribution. Starting with EU Battery Regulation and expanding to apparel, electronics, and construction materials.

The provin Pipeline Chain inherits provenance across “manufacturer → distributor → retailer” boundaries, forming a foundation for per-product DPP implementations.

US pharmaceutical supply chain regulation requiring traceability from manufacturer to pharmacy.

provin implements cross-organizational traceability as a VC signature chain, applicable as the data-coordination substrate among manufacturers, distributors, and dispensers.

Record-of-processing-activities requirement. Combined with the EU AI Act, this forces organizations to explain the processing path of AI training data in real time.

The provin registry plus signature chain serves as that recording substrate.

The Data & Trust Alliance’s data provenance metadata standards, now advancing toward a de jure standard at OASIS (sponsored by Cisco, IBM, Intel, Microsoft, and Red Hat). The vocabulary describes a dataset’s origin, rights, and privacy posture.

DPS defines what a provenance record says; provin defines who claims it and how it stays attributable — transport and signature. The spec is at committee-draft stage; adoption will take a profile / context extension on the provin side (a new subject schema), designed once the vocabulary settles.

The standard for media content provenance (images, video, audio), carried as a signed manifest embedded in the file — driven by Adobe, Google, Microsoft, and others, with ISO standardization underway.

C2PA covers provenance inside the asset; provin covers provenance across the pipeline between organizations. As a C2PA asset flows through a pipeline, provin fills in the continuity — who received it, what was done, what was passed on — so the point and the line meet.

The attestation standards of the software supply chain. Signing claims about “who built what, from what” is the same move provin makes — applied to builds.

Responsibilities split by artifact type: software (SLSA / in-toto) versus data (provin). Put side by side, all three lineages of an AI system — code, model, and data — get provenance.

The classic W3C standard for expressing provenance as an Entity / Activity / Agent graph, with implementations accumulated in academic and archival domains.

provin’s signature chain maps naturally onto the PROV model. It is the interop point with PROV-based tooling and research assets — and the reference point that places provin in the lineage of provenance representation.

The EU automotive industry dataspace, running in production on EDC — the EU-side counterpart of Japan’s Ouranos / ODS-RAM.

For data handed across the industry — parts traceability, CO2 accounting — provin functions as the provenance layer downstream of the EDC connection, and connects to Digital Product Passport requirements.

The EU regulation imposing access and sharing obligations on IoT product data — the turning point where sharing stops being goodwill and becomes duty.

The more sharing becomes an obligation, the more the provenance of what was handed over — and a tamper-evident record that it was handed over — is worth. provin contributes signed provenance and receipt evidence to that fulfillment trail — it does not claim to prove legal fulfillment itself.