The European Gaia-X initiative aims to enable data sharing in a secure, decentralized and sovereign manner. To achieve this, Gaia-X does not want to create a European cloud from scratch, but rather provide building blocks to organizations to build a secure data environment on top of existing infrastructure. We explain in plain language what this means in practice.
In 2019, German Minister of Economic Affairs Peter Altmaier and his then French counterpart Bruno Le Maire launched the Gaia-X initiative. The goal was the same then as it is today: to develop a secure, reliable, decentralized structure in which organizations can share data without giving up sovereignty over that data.
That is no simple task. Gaia-X was somewhat simplistically portrayed in the media as a European cloud, but the organization does not offer that at all: it leaves that to parties like OVHCloud. Instead, the non-profit with headquarters in Brussels provides an architecture and a set of standards that companies can use themselves.
- Gaia-X is a non-profit that wants organizations to be able to securely share data with each other. To this end, Gaia-X develops components and standards for an architecture that allows data exchange in a decentralized manner.
Data Spaces
That can be more concrete: Gaia-X builds code and standards that companies can use to build data spaces. The data space is central to Gaia-X’s approach. So Gaia-X is not a cloud or product, but a non-profit that develops and offers various components.
A data space is an ecosystem in which various participants offer and/or use data. Such an ecosystem in which data is shared can emerge around different topics. Think of a data space for agricultural data, from agricultural companies and environmental organizations in a country or even the entire EU, a data space in the chemical sector, or a specific data space for a very sector-specific ecosystem.
For example, Airbus and French nuclear plant builder EDF have both set up a data space in which their thousands of large and small suppliers can share their data together.
- To enable secure and decentralized data sharing, Gaia-X developed the concept of data spaces: connected ecosystems in which hundreds or thousands of companies large and small can securely share data with each other, in compliance with regulations and without giving up ownership of their data.
Participating in a Data Space
The standards that Gaia-X provides for this are reusable across sectors. A participant in one data space can therefore (technically) relatively easily register for another data space.
1. Identity
This works as follows: To participate in a data space, you as an organization must first create a secure digital identity. This happens through a provider, where a company ultimately receives a private cryptographic key with which it can identify itself.
- To participate in a data space, you need a verifiable digital identity.
2. Registration
The organization can then register with a data space. For example, a smart lighting provider can register with a smart city data space, where other participants offer data about traffic, temperature and air quality, among other things. Perhaps a government service responsible for road construction also participates in the data space.
- Organizations can register with existing data spaces when they are relevant to the data they can offer or want to use.
3. Rules
The data space was created on the initiative of some initial participants who took the lead. They have established the rules of the ecosystem. These rules concern, for example, who can participate, but also how secure data must be and with whom it can be shared. For EDF’s nuclear data space and Airbus’s supply chain data space, the requirements around data sovereignty are naturally very high. One or more parties have responsibility for managing the data space.
The new participant signs some documents and agrees to follow the rules, and can now participate in the data space with the obtained identity.
- Data spaces include hundreds of participants, but are governed by an organization that, in consultation with the founders, establishes the rules around participation, legislation and data sovereignty.
4. Connecting to the data space
The new party must then connect to the data. Either an organization offers new data, or it needs data from the data space. A combination is of course also possible. Data can be connected from where that data is located. A data space is not a centralized data server. The connection is established via connectors, dozens of which are available. Gaia-X does not build these itself, but they are available through various providers.
This is a small IT project, which ideally remains as simple as possible. Data spaces are generally designed for participation by SMEs with limited IT resources. Connectors ensure, for example, that your databases are usable by others, or that third-party data ends up in your ERP system.
- You connect to a data space using connectors. These are available in the market, but are not developed by Gaia-X itself.
A catalog exists in the data space. There, participants find what data is available, for whom, and under what conditions. The provider sets those conditions entirely themselves.
- The available data in a data space, and the associated conditions, are available through a catalog accessible to data space participants.
5. Compliance and sovereignty
Those who offer data must do so in a secure, compliant manner. Moreover, offering data does not have to be from your own server: it is perfectly possible to use cloud services. In both cases, Gaia-X provides certification that indicates how secure and sovereign a data source actually is.
Gaia-X provides four levels: Gaia-X Compliant, Level 1, Level 2 and Level 3. The lowest level only means that a service is compatible with the technical requirements of a data space, and can therefore be connected.
Level 3 services are at the other extreme and are completely sovereign. They can only be offered by providers with headquarters in the EU. There are currently five providers of Level 3 services in the EU, but that number will grow significantly. OVHCloud, for example, offers Level 3-certified services. You should not confuse this label with the sovereignty score that the EU itself has introduced, although Gaia-X maintains that the two systems correspond quite well.
read also
A Label for Sovereignty: First Gaia-X Level 3 Cloud Companies Listed in Catalog
A company that offers data in the data space from its own servers or infrastructure in a colocation data center is thus a provider and must also be certified. The Gaia-X labels are also available for such parties.
- Gaia-X provides a certification mechanism that indicates the extent to which a (cloud) service or data provider meets sovereignty requirements.
6. Gaia-X Digital Clearing Houses
Then there is the final piece: the Gaia-X Digital Clearing Houses (GXDCH). These are instances that (automatically) monitor participants in data spaces. The clearing houses verify, among other things, the identity obtained at the beginning. GXDCHs can test participants and data requests against numerous rules. Since the release of Gaia-X Danube, this involves not only EU rules, but also arbitrary international or sector-specific guidelines around data.
The Clearing Houses are therefore nodes that verify compliance. This happens automatically and through software. The nodes run the Gaia-X Trust Framework code, which is written by Gaia-X itself. A team of eight people, including CTO Christoph Strnadl, is behind this.
Currently, there are eleven Gaia-X-approved GXDCHs that offer such control nodes. Among others, CISPE, NTT Data, OVHCloud and Proximus have such Clearing Houses.
- Gaia-X Digital Clearing Houses are recognized instances that host control nodes with which they continuously check whether participants in a data space are who they claim to be (via digital identity), and whether data is offered in accordance with the rules of the ecosystem.
Gaia-X builds the framework
With all these components, organizations can set up a data space, participate in it and exchange data in it. A data space does not have to be completely sovereign, but Gaia-X does provide the tools to integrate and control compliance and sovereignty requirements. The Gaia-X Labels ensure that a data space can integrate cloud services that meet those requirements.
- In summary: Gaia-X provides the infrastructure to securely set up data spaces, participate in them and offer services in them. The Gaia-X Trust Framework code, the Gaia-X labels and the Gaia-X technical standards ensure that these data spaces share an architecture, so that organizations can ideally participate in multiple data spaces.
A World of Decentralized Data Spaces
Gaia-X hopes that a world of connected data spaces will emerge. The Trust Framework enables the technical connection of participants across different ecosystems.
That world of data spaces is completely decentralized, and therefore independent of one technology player. The components are open source. The architecture ensures that organizations can offer their data in a targeted manner and possibly for a fee. This way, companies can monetize their data without a central player in between.
Furthermore, data spaces are controlled sector-specific environments in which AI training can take place safely. A chemical sector data space could facilitate the creation of an LLM in which competitors share their data under conditions, to jointly arrive at a product from which they all benefit.
- Gaia-X hopes that a multitude of data spaces will emerge worldwide, in which companies sovereignly share and use data to create added value.
From PoC to Production
Do you want to participate in a Gaia-X data space? Then you should first look for a data space that is relevant to you. That is not yet obvious at the moment. Although organizations have already set up more than 150 Gaia-X data spaces, there are only about fifteen economically viable ecosystems that have moved beyond the proof of concept phase.
- All components for data spaces are ready for use, but the world of data spaces still needs to grow from PoC to a multitude of ecosystems in production.
Gaia-X is in that respect still a project in development. A better balance between data providers and users, with a fair economic model around data use, is key to this. Currently, Gaia-X mainly wants to convince as many organizations as possible, especially SMEs, to participate in data spaces. There must also be value in it for them. The architecture for securely and sovereignly sharing data is already completely ready.