About

This catalogue browses conformity schemes — EU regulatory texts (the Cyber Resilience Act, the NIS 2 Directive, the AI Act), compliance frameworks (the aDRI/IRN criteria set), and Gaia-X conformity labels (Standard Compliance, Label levels 1-3) — article by article, alongside the compliance criteria drafted for each. For every article or requirement, it shows which parts of the text are already mapped to a criterion, which are marked explicitly not applicable, and which still need mapping work, so reviewers can see coverage at a glance instead of cross-referencing spreadsheets by hand. Visitors can also assemble their own conformity scheme by picking individual chapters, articles, or paragraphs from the catalogue; custom schemes are built and kept in the browser, never on the server.

How to contribute

This catalogue is built for the Gaia-X Policy Rules Committee. Participation in the Committee — and so in drafting, reviewing, and shaping the criteria mapped here — is limited to members of the Gaia-X Association.

Service provider

This service is provided by the GAIA-X European Association for Data and Cloud AISBL (enterprise number 0762747721).

Disclaimer of liability

The service provider is not responsible for the custom conformity schemes users build with this service: they are assembled and stored in the user's own browser, never on the provider's infrastructure. Users are solely responsible for the content they build and must ensure it complies with applicable laws and does not infringe third-party rights.

The service provider shall not be liable for any interruption of service, malfunction, data loss, or system compromise — including those caused by or affecting third-party tools or services that integrate with or depend on this service. The service is provided on an "as-is" basis.

Subprocessors

The only third-party subprocessor of this service is sentry.io (application monitoring). Authentication is handled by the Gaia-X Association's own identity provider (Keycloak), which is not a third party.

Jurisdiction flags are Twemoji artwork by Twitter/Twemoji contributors, used under CC-BY 4.0.

Data location

Application and scheme data are stored exclusively within the European Economic Area (EEA). Application metadata (logs and stack traces) may be stored outside the EEA by sentry.io for monitoring purposes.

Data retention & deletion

Custom schemes built with the scheme builder are stored only in the user's browser (IndexedDB) and are never sent to or kept on the server. Deleting them under "My Schemes" is immediate and local — nothing remains anywhere else.

Privacy & GDPR

Browsing the catalogue and building custom schemes requires no online account creation: everything is stored locally in the user's browser. The "local account" mode stores no personal data and transmits no identity. Logging in with Gaia-X SSO processes the claims returned by the Gaia-X identity provider (name, email, membership groups) in a session cookie for the duration of the visit — they are not persisted server-side. Incidental personal data (such as IP addresses in application logs) is not linked to an individual identity by this service.

For any privacy concern, use the feedback channels below.

Feedback

Found an issue, or have a suggestion for the catalogue itself (not the criteria mappings)? Open an issue on the project's GitLab repository.