Catena-X
Operating Model

Released October 16, 2023
Released Version 2.1

Your Automotive Network

Table of contents
01 Why: Introduction
1.1

04

Relevance04

1.2

Executive Summary

04

		
		
		
1.3

1.2.1 Introduction
1.2.2 Objectives
1.2.3 Scope
Document Updates

04
04
05
05

02 Why: Understanding the Catena-X Data Space

06

2.1

Conceptual Foundations of the Catena-X Data Ecosystem

06

2.2

The Catena-X Data Ecosystem Architecture07

03 Who: Roles in the Catena-X Ecosystem

10

3.1

Overview of Roles

11

3.2

Detailed Description of Each Role

11

3.2.1
3.2.2
3.2.3
3.2.4
3.2.5
3.2.6
3.2.7
3.2.8
3.2.9

12
13
14
15
16
17
18
19
20

		
		
		
		
		
		
		
		
		

Core Service Provider A
Core Service Provider B
Onboarding Service Provider
Enablement Service Provider
Business Application Provider
Advisory Provider
Data Provider/Consumer
Catena-X Association
Conformity Assessment Body

04 What: Service Map

21

4.1

Enablement Services

22

4.2

Core Services

22

4.3

Onboarding Services

23

4.4

Use Cases

23

4.4.1 KITs – Keep It Together
4.4.2 New Use Cases and Direct Collaboration

23
25

		
		

05 How: Data Space Operations

26

5.1

General Onboarding

26

5.2

Gaia-X Compliance

27

5.3

SSI Issuer Concept

27

5.4

Data Exchange based on SSI

28

5.5

EDC Deployment and Usage Premises

302

06 How: Data Space Governance
6.1

31Standardization

31

		
		
		
6.2

6.1.1
Why do we standardize?
6.1.2 What do we standardize?
6.1.3 How do we standardize?
Conformity Assessment

31
31
31
32

		
		
		
		
		
6.3

6.2.1 Why do we certify?
6.2.2 What do we certify?
6.2.3 How do we certify?
6.2.4 Catena-X Labels
6.2.5 Exceptions & Timeline for Release 23.09
Nomination Process for unique Roles (e.g. CSP-B)

32
32
33
34
34
36

Qualification Process

37

6.4.1 Why do we qualify?
6.4.2 Who do we qualify?
6.4.3 How do we qualify?
Regulatory Framework

37
38
38
39

6.4
		
		
		
6.5

07 How: Life Cycle Management40

08 Outlook

41

8.1

Industry Core

41

8.2

Increase Decentralization of Core Services

41

8.3

Further Integration of SSI Technologies

43

8.4

Data Space Interoperability

43

8.5

Backward Compatibility

43

8.6

Sanctions44

09 Glossary

45

10 Appendix

46

10.1 Role Relationships

46

10.2 Data Exchange based on SSI - Next Steps

48

11 Change Log49

3

01 – Why:
Introduction
1.1 Relevance
The Catena-X Operating Model Whitepaper is a normative
document of the Catena-X Association. Normative
documents outline rules, guidelines, and characteristics
for activities and results for all participants within the
Catena-X eco­system. The Catena-X ecosystem includes
Governance, Standardization, Certification, Development
and Operations. These are established by consensus

among the working groups and approved by the executive
board of the Catena-X Association. As part of the Catena-X
regulatory framework, this document is binding for allparticipants of the Catena-X ecosystem. This normative
document is a foundational building block, allowing
all participants to collaborate within a global ecosystem.

1.2 Executive Summary
1.2.1 Introduction
With Catena-X, the automotive industry is creating targets
a trustworthy, collaborative, open, and secure data space
to enable a data-driven value chain for their relevantbusiness processes. All participants can be connectedin business process-centric end-to-end value chains,
where everyone operates on an equal playing field,
has sovereign control over their data and no lock-in

1.2.2 Objectives
This document defines the operating model and processes
required within the Catena-X ecosystem. The operating
model is linked to the concepts and values of Gaia-X and theInternational Data Space Association (IDSA) to create thefirst open and collaborative data ecosystem for the automotive value chain. Thereby, Catena-X applies these concepts
and extends them by integrating automotive-specificeffects occur. Thereby, the digitalization of intercompany
processes and value chains, especially those of small
and medium-sized companies, can be performed on a
cost effective, timely and lasting basis. Further, it securesthat market participants and competitors collaborate in
a compliant and trusted way.

requirements for compliance, interoperability, and security.
The operating model lays the foundation and is the pre­requisite for further standardization, certification, implementation, and operations of software components andpartners in the Catena-X data space. The operating model ­iscontinuously updated to reflect the evolution of business andregulatory requirements, as well as emerging technologies.

4

01 – Why: Introduction

1.2.3 Scope
The Catena-X operating model describes the entire­Catena-X ecosystem, focusing on the operating environment and its roles, processes, and solutions, and how
they interact. Since Catena-X is under continuous

development, the document refers, where appropriate,
to dynamic ­content that can be found on the website of theCatena-X Association.

1.3 Document Updates
The Catena-X Association releases updates to its ope­­rating model in regular intervals to always guarantee
a well-­­functioning, up-to-date framework for its data
space operations. Updates are developed within theframework regulations of the Catena-X Association andrequire approval from the Association’s executive board.

Every update of this operating model will automaticallybe applied to all Catena-X initiatives, existing participants,
as well pro­­spects, without further notice and individual
approval. An update will be communicated in due time
via the Catena-X Association.

5

02 –Why:
Understanding theCatena-X Data Space
2.1 Conceptual Foundations of
the Catena-X Data Ecosystem
The Catena-X data ecosystem consists of three areas:
the Catena-X Automotive Network e. V., the development
environment, and the operating environment.

To comprehend the components that comprise theCatena-X operating model, it is necessary to have a basic
understanding of the fundamental concepts that makeup the Catena-X data ecosystem (see Figure 1).

Catena-X Automotive Network e.V.

External
Input

Standardization | Certification | Neutral Governance | Transfer

Application forStandardization

Governance

Development Environment

28 initial
partners to
kick-start theecosystem

Certification

Operating Environment

Tractus-X
Open Source Project

Proprietary
Applications

License& Service
Agreements

Services

Figure 1 Catena-X Data Ecosystem602 – Why: Understanding the Catena-X Data Space

The Catena-X Automotive Network e. V. (in the following
called “Catena-X Association” or “the Association”) is
responsible for standardization, certifications, andgover­nance of the Catena-X ecosystem. Members canparticipate in committees, working groups, and expert
groups to actively shape the Catena-X ecosystem.
The Catena-X Association publishes standards withthe goal of enabling interopera­bility, data-sovereignty,
and security for all participants in the data space. The
ecosystem participants must comply with the standards
published by the Catena-X Association to work with thedata space. Catena-X standards build on Gaia-X/International Data Space Association (IDSA) concepts andprinciples, industry standards, and best practices, among
others, and extends these by automotive domain and use
case-specific requirements. By certifying ecosystem
parti­ci­pants and software components, the Catena-X
Association ensures transparency and trust in the ecosystem. A certifi­cation testi­fies, for example, that asoftware component is interoperable, data sovereign, andsafe to use in the Catena-X data space.
The Association is complemented by the development
environment. The focus of the development environmentis on the one hand on the creation of standardization
candidates that can be submitted into the standardization
process of the association. And on the other hand, thedevelopment of open-source reference implementations
and other implementations for the data space.
In the operating environment, the various open-source
and commercial services and business applications areoperated by different providers. A detailed description of
the provider roles and the associated software components
can be found in Chapter 3 and Chapter 4. All threecomponents jointly make up the Catena-X data ecosystem.
In the following chapters, the roles, responsibilities, andfunctions of these components are described in detail.

2.1 The Catena-X Data
Ecosystem Architecture
Underlining the Catena-X data ecosystem’s conceptual
foundations are its individual data space components.
Together, these building blocks serve as the architectureof the Catena-X data space, where each building blockserves a dedicated purpose in one or several of the abovementioned conceptual elements. An overview is depicted
in Figure 2 followed by a short description of the mainbuilding blocks.

7

02 – Why: Understanding the Catena-X Data Space

Collaborations

Data Space GovernanceCatena-X
e.V.
promotes,
coordinates,& manages

Normative
Documents

Standardization
Framework

Architecture
Guardrails

May
influence

Standards

Regulatory
Framework

Use,
integrate,
adapt

Conformity Assessment
Framework
Certification Catalog& Handbook

Basis
for

Trust Partners

Test Procedures
Feedback,
shape

Certificates

Operating
Model

Gaia-X
Trust Framework/Clearing
House

International Data
Spaces Association(IDSA)

Life Cycle Management

Ensuring compatibility & applicability

Data Space Protocol

Sponsors,
promotes, &coordinates

Sets mandatory
Requirements &Standards

Providefeedback & new
requirements

Delegates
conformity assessment
CAB

Eclipse Foundation
AdherestoOpen Source

Certifies

Development
Environment

Operating
Environment

Data Space Operating System& Building Blocks
100% OSS

KITs

Eclipse
Tractus-X
Project

Enables open
collaboration& development

The different roles offer:

Utilizes

Based on,useCore Services (A/B)

Industrializes,
operates,
services

Commercial Business
Applications

Industry Core
(coming soon)

Utilizes
Enablement
Services
Integrate

Onboarding Services

Core/
Onboarding
Services

Scalability/Interoperability
Partners
Industrial Digital Twin
Association (IDTA)
Asset Administration
Shell

World BusinessCouncil for Sustainable
Development (WBCSD),
Global Battery Alliance(GBA) ...

Enablement Services
Advisory Services

Figure 2 The Catena-X Data SpaceThe global Catena-X data space is built on
5 mission-critical pillars:•a dedicated role concept covering all data space participants (see Chapter 3),•

a Service Map of foundational software services, building blocks, and standards
that form the Catena-X Operating System and Business Foundation (see Chapter 4),•

procedures, processes, and building blocks for a trusted, scalable, and compliant
data space operation (see Chapter 5),•

effective data space governance incl. standards, legal frameworks, (flight models)and certification (see Chapter 6)•

an integrated and holistic life cycle management ensuring compliance,interoperability, and compatibility (see Chapter 7).

8

02 – Why: Understanding the Catena-X Data SpaceTo promote adoption and collaboration, the Catena-X data
space is built upon open-source principals, under theumbrella of the Eclipse Foundation. All Catena-X reference
implementations and KITs are licensed under Apache 2.0
and CY BB 4.0. In order to structure and guide the development in open-source, Catena-X installed Organizational
Elements (e.g., committees in the Catena-X Association),created a working group and project in Eclipse Tractus-X
and defined a scalable structure for a business-oriented
development and adoption of relevant artifacts andSW codes:•Enablement Services•

Core Services•

Industry Core•and use case KITs

With regard to standardization, the Catena-X Association
promotes, sponsors and coordinates the overarchingrequirements of the Eclipse Tractus-X project. Standards
are always linked, structured, and offered within thosefour elements.
Catena-X offers use case KITs to enable a multi-vendereco­system of software solutions and services for eachCatena-X use case. Solution and Service providers cancreate interope­rable and data sovereign solutions andtrusted services based on the Catena-X KITs and offer
them on trusted marketplaces within the Catena-X Data
Space (-> Core Service Provider A). The marketplaces are
certified marketplaces that offer interoperable solutions
from different solutions providers. The Core Services aswell as market­places are part of the cxOS and are operated
by certified opera­ting companies (see Figure 4). With thiscomprehensive solution portfolio, players in the automotive
value chain can create business value by establishingdata-driven use cases and data chains.

Trust and conformity (of Services, Offers, and potentially other non-automotive data spaces) are fundamental for
Catena-X’s acceptance, scalability, and value creation. Therefore, Catena-X chose and installed various neutral
governance bodies – covering development and operation. The following partnerships and components in sum ensure
a global data space built by best-in-class experts on trusted principles:1
Gaia-X is the basis for our overarching Trust Frameworkand forms the foundation for a federated, interoperable
data space with trusted identities.
2
The International Data Space Association (IDSA) provides
architecture principles that enable sovereign data exchange.

4
The Catena-X Association provides industry-specificgovernance for the ecosystem that equally reflects
the diverse interest groups within the automotive industry
to serve common business needs. It also defines thevision, mission, and guiding principles for the Catena-X
data space through the governance framework basedon the Catena-X Statutes.

3
The Eclipse Foundation hosts the official open-source deve­lopment project of the Catena-X ecosystem and follows
the Eclipse Foundation’s trusted development process.

More specifically, in the Catena-X operating environment,
the Catena-X Regulatory Framework for Data Space opera­
tions acts as a reliable mutual foundation to ensure trust,interoperability and therefore scalability. Catena-X’s
success largely depends on trust that every participant
plays by the same, commonly set rules. By standardizing
many of the relationships and agreements necessary fordata exchange and bringing Catena-X use cases to life,
data space parti­cipants can put their focus largely on theirindividual business needs rather than individual contract
negotiation between business partners. Throughcollectively approved guide­lines and templates, dataexchanges on Catena-X can be seamlessly executed andoperated without friction.

9

03 – Who:
Roles in the
Catena-X Ecosystem
The Catena-X ecosystem operates on the principle of multiple distinct roles, designed tocreate an appealing and functional data space (see Figure 3). Participants can take on one
or more roles in any combination, and multiple participants can fulfill the same role except
for the CSP-B role. The CSP-B role can only exist once in the data space due to complexity
and technical reasons. Provider roles receive a label through a certification or qualification
process to demonstrate that they are trusted partners (see Chapter 7).

10

03 – Who: Roles in the Catena-X Ecosystem

3.1 Overview of Roles
Catena-X Association

IAM-Sync/Integration

IAM-Sync

Onboard (M)/Integration (O)IAM-Sync/Onboarding

Core Service Provider A 1

Advisory Provider 1,3

IAM-Sync/
Integration

Enablement Service Provider 1

Onboard (M)/Integration (M/O)

Core Service Provider B 1,2,4
Business Application Provider 1
IAM-Sync/
Integration

IAM-Sync
Onboard (M)/Integration (M)Onboarding Service Provider 1
Integration

Data Provider/Consumer

Use

Certification
Certification

1

Receives Catena-X label after certification

2

Nominated by Catena-X Association

3

Qualification by Catena-X Association

4

Issuer defined by Catena-X Association

Conformity Assessment Body 2

Certification

Optional

Mandatory

Figure 3 Role Overview and Relationships

3.2 Detailed Description of Each Role
Below, each role that a participant can assume in the
Catena-X data spaces is described in detail, along with its
assigned description, responsibilities, relationships, pre­requisites, and complements. Please refer to Chapter 10.1.

for a comprehensive overview of the relationships between
these roles as well as a definition of the relationship type
and Chapter 4 for an overview of the Service Map.

11

03 – Who: Roles in the Catena-X Ecosystem

3.2.1 Core Service Provider A
Role

Core Service Provider A (CSP-A)

Description/
Responsibilities

A CSP-A is responsible for deploying, operating, and maintaining core services
A according to Catena-X standards. Core Services A provide common business
functionalities for all data space participants (e.g., managing marketplace offers,
semantic models, or searching for business partner information).
A CSP-A can operate various bundles of Core Services A, whereby the operationof an IAM and a marketplace is mandatory. Note that the synchronization of market­­place offers is at the discretion of a provider, who may submit and list its offer on
multiple marketplaces. The CSP-A role can be taken on by multiple participants.
For smooth operations, the CSP-A must provide comprehensive technical docu­
mentation, along with first, second, and third level support to facilitate integration
with its services. Each CSP-A has freedom of choice regarding their businessmodel towards their potential customers.

Relationships

Prerequisites

Limitations Release
23.09

•

A CSP-A must implement an IAM synchronization and must integrate withother CSP-As.

•

A CSP-A must implement an IAM synchronization with an OSP.

•A CSP-A must integrate with the CSP-B to be able to offer and operate its
services. This includes implementing IAM synchronization and integratingwith required Core Services B.

•

A CSP-A must use the services of one of the OSPs to register and onboard
itself to the data space (e.g., registration service).

•

A CSP-A must accept any certified solution that wants to be listed on
its marketplace in accordance with its respective terms and conditions,
without discriminating against individual organisations.

•A CSP-A and its services must be certified by a CAB.

•A CSP-A must accept and comply with the Catena-X regulatory frameworkduring onboarding via one of the OSPs.

Due to technical limitations, the CSP-A role currently cannot be fully assumed
and executed more than once. Further details can be found in Chapter 8.2 or canbe requested during the conformity assessment.

12

03 – Who: Roles in the Catena-X Ecosystem

3.2.2 Core Service Provider B
Role

Core Service Provider A (CSP-B)

Description/
Responsibilities

The CSP-B is responsible for deploying, operating, and maintaining all core services
section B according to Catena-X standards. Core Services B include identity andcommon accessibility and discoverability functionalities for all data space participants.
The CSP-B operates all Core Services B as one bundle to enable trusted participationand sovereign data exchange across all data space participants. The CSP-B role
can only be taken on by one participant and is nominated by the Catena-X Association
to operate and further develop the services on their behalf.
For smooth operations, the CSP-B must provide comprehensive technical docu­
mentation, along with first, second, and third level support to facilitate integration
with its services.
Due to its special role, the CSP-B is responsible for:Relationships

Prerequisites

Limitations Release
23.09

•

providing non-discriminatory access to Core Services Section B for all data
space participants.

•

coordinating the release management of Core Services B in the data space (withaffected participants) based on Catena-X Association and Tractus-X releases.

•

marketing Core Services B and managing contractual partners.

•

issuing and revoking access of BPNs to the data space based on the country
clearance list by the Catena-X Association.

•

temporarily executing the trust anchor role and issuing verifiable credentials.

•

The CSP-B must support the integration of all other data space participants
to the Core Services B.

•

A CSP-B must implement an IAM synchronization with CSP-As and OSPs.

•

A CSP-B must be nominated by the Catena-X Association.

•

A CSP-B must be a Catena-X Association member.

•

A CSP-B and its services must be certified by a CAB.

•A CSP-B must accept and comply with the Catena-X regulatory
framework via an MoU with the Association.

To ensure complete functionality of the data space, the CSP-B must also operate
the relevant services of both the CSP-A and OSP roles.
Further details can be found in Chapter 8.2. how Catena-X foster competition.

13

03 – Who: Roles in the Catena-X Ecosystem

3.2.3 Onboarding Service Provider
Role

Onboarding Service Provider (OSP)

Description/
Responsibilities

An OSP is responsible for deploying, operating, and maintaining onboarding services
according to Catena-X standards. The onboarding services enable and support data
space participants to register and onboard and offboard to Catena-X data space.
This includes organizational registration and technical integration (see Chapter 5.1),
after which an organization can fully participate in the data space. An OSP can enable
new prospects and/or their existing customer base in terms of network-of-networks.
To ensure maximum trust in the data space during the onboarding process, the OSP
must establish a connection with the Gaia-X Digital Clearing House (GXDCH).
For smooth operations, the OSP must provide comprehensive technical documentation,
along with first, second, and third level support to facilitate integration with its services.

Relationships

Prerequisites

Limitations Release
23.09

•

An OSP must implement an IAM synchronization with CSP-As, the CSP-B,
and OSPs to provide its customers with access to the data space.

•

An OSP must integrate and use CSP-B services to access their identity(e. g., identity wallet) and enable data exchange.

•

An OSP must integrate and use the GAIA-X Digital Clearing House to validate
e. g., the Legal Person Self-Description.

•

An OSP and its services must be certified by a CAB.

•An OSP must integrate and use CSP-B services to access its identity(e. g., identity wallet)•

An OSP must accept and comply with the Catena-X regulatory frameworkduring onboarding via one of the other OSPs.

•

An OSP must use the dedicated GAIA-X Clearing House Service nominatedby the Catena-X Association.

Due to technical limitations, the OSP role currently cannot be fully assumed andexecuted more than once. Further details can be found in Chapter 8.2 or can berequested during the conformity assessment. Offboarding will be included within
the upcoming releases.

14

03 – Who: Roles in the Catena-X Ecosystem

3.2.4 Enablement Service Provider
Role

Enablement Service Provider (ESP)

Description/
Responsibilities

An ESP is responsible for deploying, operating, and maintaining enablement services
according to Catena-X standards.
An ESP can operate various bundles of decentralized services that enable sovereign
participation and data exchange for data providers and consumers in the Catena-X
data space. An ESP can decide on the scope of its enablement service and whether
to offer them on one or multiple of the marketplaces.
In addition, ESPs can also offer non-standardized services such as automated data
mapping, in which data is extracted from company systems and converted into
Catena-X semantic models.

Relationships

Prerequisites

Limitations Release
23.09

•

An ESP can use one or more CSP-A services (e. g., semantic hub).

•An ESP must integrate and use CSP-B services to access its identity(e. g., identity wallet) and enable data exchange.

•

An ESP must use the services of one of the OSPs to register and onboard
itself to the data space (e. g., registration service).

•

An ESP and its services must be certified by a CAB.

•An ESP must accept and comply with the Catena-X regulatory frameworkduring onboarding via one of the OSPs.

n/a

15

03 – Who: Roles in the Catena-X Ecosystem

3.2.5 Business Application Provider
Role

Business Application Provider (BAP)

Description/
Responsibilities

A BAP is responsible for deploying, operating, and maintaining business applications
to Catena-X standards. Business applications enable data providers and consumers
to leverage different use cases and data-driven processes to solve a specific industry
problem (e.g., PCF) and create business value, by using KITs and Standards for aninteroperable and trusted data exchange.
A BAP can decide on the scope of its business applications and whether to offer
them on one or multiple of the marketplaces.

Relationships

Prerequisites

Limitations Release
23.09

•

A BAP can use one or more CSP-A services (e. g., semantic hub).

•

A BAP must integrate and use CSP-B services to access his identity(e. g., identity wallet) and enable data exchange.

•

A BAP must use the services of one of the OSPs to register and onboard
itself to the data space (e. g., registration service).

•

A BAP and its services must be certified by a CAB.

•A BAP must list its solution on a marketplace provided by a CSP-A.

•

A BAP must accept and comply with the Catena-X regulatory frameworkduring onboarding via one of the OSPs.

n/a

16

03 – Who: Roles in the Catena-X Ecosystem

3.2.6 Advisory Provider
Role

Advisory Provider (AP)

Description/
Responsibilities

An AP offers advisory services in various areas, from strategy to operations totechnology or business use cases for those interested in the Catena-X data space.
Providing advisory services includes topics such as onboarding guidance, businessvalue assessment, organizational and technical enablement, but do not include theoperation of technical services.

Relationships•

An AP can use one or more CSP-As if it intends to utilize specific CSP-A
services such as listing an offer on a marketplace.

•

An AP can integrate and use CSP-B services to access the Core Services B.

•

An AP must use the services of one of the OSPs to register and onboard
itself to the data space (e. g., registration service).

•

An AP must be qualified by the Catena-X Association.

•

An AP must accept and comply with the Catena-X regulatory frameworkduring onboarding via one of the OSPs.

Prerequisites

Limitations Release
23.09

n/a

17

03 – Who: Roles in the Catena-X Ecosystem

3.2.7 Data Provider/Consumer
Role

Data Provider and Consumer (DPC)

Description/
Responsibilities

A DPC provides, consumes, and processes data to collaborate with other data
space participants to solve a specific industry problem und create business value.
This includes both standardized use cases and direct collaboration.

Relationships•

A DPC can use the services of a CSP-A (e.g., marketplace).

•

A DPC must integrate and use CSP-B services to access his identity(e. g., identity wallet) and enable data exchange.

•

An DPC must use the services of one of the OSPs to register and onboard itself
to the data space (e.g., registration service). This can be delegated to a BAP or ESP•

A DPC must connect with another DPC to exchange data and create value.

•

A DPC can use advisory services from a qualified AP.

•

A DPC can use certified enablement services from a commercial ESP (e.g., SaaS
solution). Alternatively, a DPC can certify and operate its own enablement services.

•

A DPC can use certified business applications from a commercial BAP (e.g., SaaS
solution). Alternatively, a DPC can certify and operate its own business application.

•

A DPC must use certified enablement services or business applications.
Alternatively, a DPC must certify its own enablement services and/or businessapplications by one of the CABs (as outlined in Chapter 7.2).

•

A DPC must accept and comply with the Catena-X regulatory framework during
onboarding via one of the OSPs.

Prerequisites

Limitations Release
23.09

n/a

In addition to the roles in the data space, there are independent roles such as the Catena-X Association or Conformity
Assessment Bodies (CABs) to ensure neutral, trustworthy, and secure operation of the Catena-X data space.

18

03 – Who: Roles in the Catena-X Ecosystem

3.2.8 Catena-X Association
Role

Data Provider and Consumer (DPC)

Description /Responsibilities

The Association is responsible for the neutral governance of the Catena-X ecosystem
including the execution of nomination, standardization, qualification, and certification
processes. It promotes and facilitates working groups, committees, and expert groups
to discuss and align on, standards, KITs, and requirements for open-source reference
implementation for the Catena-X operating system and use cases. In addition, it provides various informational resources to interested parties and Association members.

Relationships•

The Association nominates the CSP-B and CABs.

•

The Association delegates the certification of data space participants to CABs.

•

The Association defines the Issuer of verifiable credentials.

•

The Association qualifies APs.

•

The Association promotes, sponsors, and coordinates the overlying requirementsof the Eclipse Tractus-X Project with a view to standardization.

Prerequisites

n/aLimitations Release
23.09

For the upcoming releases there will be a dedicated issuer concept in place. As of now
the Association defines the Issuer (CSP-B). Further details can be found in Chapter 5.3.
An outlook can be found in Chapter 8.3.

19

03 – Who: Roles in the Catena-X Ecosystem

3.2.9 Conformity Assessment Body
Role

Conformity Assessment Body (CAB)

Description /Responsibilities

A CAB carries out the conformity assessment process in accordance with the Catena-X
Certification Framework on behalf of the Catena-X Association. The Certification
Framework consists of the certification manual and the certification catalog (derived
from the Catena-X standards ). A CAB is nominated by the Catena-X Association
to ensure an independent, trustworthy, and secure conformity assessment process.
A CAB is responsible for:•creating offers for the conformity assessments.

•

carrying out the conformity assessment process for various certification objects(e.g., provider, solutions).

•

informing the Catena-X Association and the certification candidate about thecertification results.

•

issuing, reissuing, and revoking of certificates on behalf of the Catena-X
Association.

Relationships

The CAB must carry out the conformity assessment for all affected data spaceparticipants and their IT solutions.

Prerequisites•

A CAB must be nominated by the Catena-X Association and comply with theCatena-X certification framework.

•

Business model supporting adoption and offering a non-discriminating access,esp. by small and medium business.

Limitations Release
23.09

n/a

20

04 – What:
Service Map
The architecture of the Catena-X Operating System (cxOS) is derived from the referencearchitectures of Industrial Data Space Association (IDSA) and Gaia-X. The cxOS consists ofthree areas: Core, Onboarding, and Enablement Services shown in Figure 4.
Hier steht das Kapitel

Deployment View Rel. 23.09 V3

Use Cases

Business
Business
Business
Applications
Applications
Application(Commercial)(Commercial)(Commercial)Business
Business
Business
Applications
Applications
Application(Commercial)(Commercial)(OSS)

Business
Business
Business
Applications
Applications
Application(Commercial)(Commercial)(LocalDevelopment)

Catena-X Operating System (cxOS)
KITs
Core Services
Core Services A

Onboarding Services
Core Services B

Marketplace

Identity Provider(User)

Discovery
FinderPartner
Network UI

Identity Provider(Clients)

Data Space
Discovery

Semantic HubGolden Record
Service & API

BPN
Discovery

Business Partner
Number Issuer

Managed Identity
WalletSD-Factory

Enablement Services
Connector

Onboarding Services
Registration

Connection to External
Onboarding Services
Connection
GXDCH

Data Space
ProtocolContract
Management

Identity
Check

PolicyManagement

Digital Twin Context
Digital Twin
Registry

Item Relationship
Service

AAS-Server

Simple Data
Exchanger

Figure 4 Service Map (Deployment View)21

04 – What: Service Map

The cxOS is the technical foundation enabling business use cases to operate in a network-enabled manner acrosscompany boundaries. The operating system offers various capabilities:

4.1 Enablement Services
The Enablement Services are a bundle of decentral services
that enable participation in the Catena-X data space. Eachparticipant must deploy and use the enablement services
to connect to the data space and enable standardized
interactions based on the requirements of the respective
use case. They ensure the strategic value proposition oftechnical/semantic interoperability and (data) sovereignty.
The connector (e.g., EDC) based on the data space protocol
and the identity wallet form the mandatory basis of enable­
ment services enabling standardized technical connectivity
and sovereign data exchange. All participants can use themto establish a basic connection to the data space, indepen­
dent of the business use case.

In addition to generic data-exchange capabilities, enabling
services include context-specific service offerings. Examples
are the Asset Administration Shell (AAS) as harmonizedaccess layer for digital twins, the Decentral Digital Twin
Registry (DDTR) for local discoverability of digital twins indecentral organized data spaces or the Item Relationship
Service (IRS) for building data chains and iterating througha tree structure of digital twins.
Please note that there are various options for running ena­ble­­ment services, ranging from leveraging software-asa-service solutions to local deployments of open-source
reference implementations. Further information on deploy­ment and usage premises can be found in Chapter 5.5.

4.2 Core Services
In contrast to Enablement Services, Core Services are provided and operated by Core Service providers A/B. Core services
provide common accessibility and discoverability functionalities for data space participants. Examples include BPN issuer
for maintaining business partner numbers, and participant information, IAM solutions for identity and access management,
and discovery services to localize the address of assets in decentral organized registries across the data space. The Core
Services can be divided into two areas:

Core Services A lists Core Services that can be
operated “n” times in the Catena-X data space.

Core Services B lists Core Services that can only
be operated once in the Catena-X data space due
to business reasons or technical limitations andare therefore tendered via the nomination processof the Association.

Some of the Core Services, such as the Managed Identity Wallet, are by nature Enablement Services, but becauseof technical reasons they are considered Core Services B as an interim solution.

22

04 – What: Service Map

4.3 Onboarding Services
The Onboarding Services are provided and operated by OSPs. Onboarding Services enable participants to onboard
into the Catena-X data space. As shown in Chapter 8.2, the scope of Onboarding Services will change over time.
The Onboarding Services can be divided into two areas:

Onboarding Services list the services that
ensure a standardized and compliant Catena-X
onboarding process (e.g., registration process).

External Onboarding Services list the services
that OSPs must integrate and use to implementa trusted onboarding process but are developed
and operated by an external initiative or provider.

4.4 Use Cases
The goal of a Catena-X use case is to solve a specific business problem and to create value for data providers andconsumers. To do this, the Catena-X Association demands and promotes that use cases create Standards and KITs toenable a multi-vendor ecosystem of interoperable and compatible business applications (see: business application).
Achieving network effects in the Catena-X ecosystem is critical to success and depends on the active participationof users and the creation of appealing business apps, especially for SMEs.

4.4.1 KITs – Keep It Together
KIT, short for Keep It Together, bundles all necessary
resources and technical documentation designed to adopt
a Catena-X use case for all data space participants(see Figure 5).
A KIT is always structured in the same way and supports
the individual journey of a company joining the Catena-X
data space. To ensure interoperability and data sovereignty
in Catena-X use cases, adherence to a minimum set ofelements is required, including semantic models fordata integration and understanding, logic and schemas
for value calculation, API implementation for technicalcommunication, and access and usage policies tomaintain data sovereignty. A KIT consists of various
other artifacts in addition to the minimum set. A com­­prehensive overview of the artefacts can be found on
the Tractus-X project website .

23

04 – What: Service Map

Our KITs Toolbox

ion

t

op

Ad

Vision/MissionBusiness
Value(s)Tutorials/
VideosWhitepaper(e.g., Context)

Scope for Standardization/Certification

n

tio

p
do

A

t
en
pm

lo
ve
De

Logic/
SchemaBusiness
Processes

Access &Usage Policies

API
Specifications

Protocols

SampleData

Reference
Implementation

Architecture

Conformity Assessment Criteria

n

tio

ra
pe

O

Semantic
Models

Quick
Setup Guide

Deployment
Scripts

Figure 5 KITs Toolbox

DPCs that are part of the automotive value chain andstrive to participate in a Catena-X use case require tech­nical support, specifications, and tutorials. For instance,a production company may need to exchange productcarbon footprint data with its partners. KITs consolidate
the necessary software components, standards, accessand usage policies, and code examples, ensuring thesecompanies have everything required to successfully
participate in a Catena-X use case.

BAPs interested in offering a business application for a
specific use case on one of the Catena-X marketplaces.
These companies need to align their existing solutions
with Catena-X requirements. Within a KIT, they receive
guide­lines and the technical support necessary foradapting their solu­tions to meet Catena-X conformity
based on our five steps to Catena-X: Inform, connect,
boost, adapt, utilize. KITs are the way forward to createa valuable multi-vendor ecosystem to promote seamless
interoperability between different commercial solutions.

24

04 – What: Service Map

4.4.2 New Use Cases and Direct Collaboration
In addition to the first 10 use cases that have been initially developed in the Catena-X Consortium and are now
governed by the Association Committees (e.g., Sustainability Committee), data space participants have the following
scenarios for collaboration:

Initiate new use case

Direct collaboration (no multi-tier approach)

Any Catena-X Association member can initiate a
new use case by creating a working in the Catena-X
Association or expand an existing committee(whatever suits the purpose best, the final judge­
ment is made by the Board of the Association).
The goal of a committee or working group is to
discuss and define a common vision, roadmap,
standards, KITs, and other open-source artefacts
for the use cases with focus on interoperability
and data sovereignty to create multi-tier value
chains for a dedicated business process.

The Catena-X data space also enables secure andsovereign data exchange for direct collaboration
between data provider and consumer. In this sce­­na­rio, the data provider and consumer are responsible for defining a bilateral semantic model, as
well as appropriate usage and access policies.
Alternatively, they can make use of existing usage
and access policy that meets their needs. The
goal of the Catena-X data space remains to always
create interoperable use cases with consistent
data chains. Note that direct collaboration without standards provides only limited interoperability and cannot be certified and thus not be listed
on one of the marketplaces.

To validate the value proposition or technical spe­cifications, a new use case can be tested in future
either in a sandbox environment of the CSP-B or in
the test environments of the Catena-X Association.
Note that new uses cases without standards pro­­vide only limited interoperability, require individual
use case policies, and cannot be certified andthus not be listed on one of the marketplaces andare therefore not supported and trusted.

25

05 – How:
Data Space Operations
This chapter outlines the overarching processes and premises to onboard and exchange
data in the Catena-X data space. This includes the general onboarding process that all
participants must complete to join the Catena-X data space. It involves registration andtechnical integration, as well as compliance with the regulatory framework and verification
through the Gaia-X Digital Clearing House. The introduction of Self Sovereign Identities (SSI)in Tractus-X Release 23.09 updates the process for offering, exchanging, and using data,
while the chapter also covers EDC deployment and usage premises and available support
options for participants.

5.1 General Onboarding
To participate in the data space, all participants must complete the general registration process,which involves registration and can be extended by the technical integration (see Figure 6).

Onboarding Process
Step 1
Registration

Step 2
Technical Integration

Create BPN

Technical User

- Provide/Consume Data

Connector Registration- Applications or Services

Create Wallet

Optional- Purchase/Manage Business- Manage Semantic Models

Add
Company DataGXDCH Check

AcceptRegulatory Framework- Use Business Partner Functions

Create SD

GXDCH
Notarization Service

Figure 6 General Onboarding Process

Compliance Service26

05 – How: Data Space Operations

During registration, all participants must fill out theircompany data, select their data space role, and agree tothe regulatory framework via one of the OSPs (see Chapter
3.2.3). A BPNL (if not yet existing) as well as a Managed
Wallet Tenant with BPNL Credential and CX membership
Credential are created as part of the registration approval
process, which is owned/managed by the operation com­pany. Each participant can collect their identity proofs,
certificates and other verifiable information, rights, orservices in its identity wallet.
During technical integration, the technical user creation
and registration of the connectors are essential to enable

the company communication with the data space. The
technical user enables the customer company to connect
the connector with the wallet and the connector registration is needed to ensure that the connector can get foundby other data space members.
The self-descriptions of newly registered legal entities andconnectors are validated by the GXDCH (see Chapter 5.2).
This involves signing and issuing credentials to the identity
wallet of a DPC, providing proof of Gaia-X complianceand legal entity notarization. Detailed information about
the Standard CX-0006 in the Standard Library of theCatena-X Association.

5.2 Gaia-X Compliance
The Gaia-X Digital Clearing House (GXDCH) is an external
service that maximizes trust within the Catena-X data
space and interoperability with other data space initiatives
based on the Gaia-X Trust Framework. The GXDCH enables
the validation of legal entities, ensures Gaia-X compliance,and creates an eIDAS conform digital signature (SelfDescription) for all data space participants. There is one

GXDCH provider for the Catena-X data space, which
is nominated and managed by the Catena-X Association.
To ensure compliance with the Catena-X onboarding
process, every OSP must connect to the GXDCH.
OSP candidates can request more information duringconformity assessment.

5.3 SSI Issuer Concept
The Tractus-X Release 23.09 initiates the introduction

technical framework. With the 23.09. Release the CSP-B

of Self Sovereign Identities (SSI), replacing the Dynamic
Attribute Provisioning Service (DAPS). The current releaseand version of SSI allows only one issuer and one centrally
managed identity wallet operated by the CSP-B (seeChapter 4). This also includes the revocation of issued
certificates. This is done in cooperation with the Catena-X
Association e.g., in case of conscious violation of legal andis the single issuer authority of Catena-X credentials.
Multi-issuer concept is planned in the following releases.
The BPNL can be found on the Catena-X Association
website and the portal of the CSP-B. This concept will
evolve in future releases, the details of which can be foundin Chapter 8.3.

27

05 – How: Data Space Operations

5.4 Data Exchange based on SSIWith the introduction of Self Sovereign Identities (SSI) in the Tractus-X Release 23.09, the processes to participate
in a use case as well as offer, exchange, and use data are updated as follows (see Figure 7):

Data space

OpCoManaged Wallets
Administration
Service(s)Registration Service(s)

2

DP

DC

Etc.

OpCo

Issuer (operator) validates request
and issues credential
Participant signs Use Case
Policy and requests Credential

1

3

Requests VC and VP Summary Credential(via KC tech user token) – 2 calls

Data Provider

A

Register data & create dataoffers with Use Case Policy(access or/and usage)

Data Consumer

4

EDC

Logging
Agreement log

Query catalog/
Offers & Providers VP

5Submit catalog

8

Contract Negotiation

EDC

6

Offer Policies(Individual)
Purpose defined?

No

9

Contract Closure/Success

10

Data Transfer

Logging
Agreement log

Yes

If data contract is
acceptable for the specificdata request proceed with
the negotiation

7

ExamplePurpose: „Data_
Usage_Contract_
VehicleData_1.2.0“Manually Checkindividual data contract
policies/rules
Data Usage
Contract
VehicleData 1.2.0
Individual Usage
Right #1
Individual Usage
Right #2…

Figure 7 Data Exchange Process1
Participant signs pre-defined use case framework
conditions and requests credential via CSP-B
The data consumer must sign and upload the respective
use case framework conditions to request the use caseparticipation credential.

2
Issuer validates request and issues credential
The request from the participant (e.g., data consumer) issent to the issuer (operator) for validation (frame version
and existing signature) and confirmation, which triggers
the creation of the VC.

28

05 – How: Data Space Operations

3&4
Requests credential & query catalogue/offers
The customer EDC calls the MIW to retrieve the verified
summary credentials, requests the signature and retrieves
the verified presentation with the summary credential.
With the query of the data provider catalog, the consumer
EDC submits the request with the VP in the request header.
Upon successful validation, the issuer generates theverified credential using the MIW component and storesit in the wallet tenant of the customer company wallet.
is recreated containing both the previous credentials
and the newly added credential.

5
Submit catalog
The received offer catalog request and the submitted
customer VP are validated by the provider EDC. All dataoffers where the data access policies set by the provider
match the verified credentials owned by the data consumer
are sent to the customer. Any data offers that require verified
credentials that the data consumer does not have will not
be sent/published to the data consumer.

6
Manual checking of data offering policies
Configured data offer policies must be manually checkedby the data consumer.
•

If a purpose is specified, the purpose must be validated internally by the data consumer. The purpose
may refer to an individual contract concluded
between the data consumer and the data provider.
The data consumer must review the contract anddecide whether the policies are acceptable for the
specific data offering based on the establishedpolicies (see next step 7).

•

If no purpose is specified, the negotiation can start
immediately, as the access and usage policies areauto­matically technically enforced and validated by
the EDCs.

7
Decision on the purpose of the data offer
Based on step 6 individual data contract validation, thedata consumer must decide whether to proceed with thenegotiation or whether to disagree with the individual
purpose. If there is disagreement, the negotiation should
not be started. If there is consent, the data consumer
can start the negotiation.

8
Contract negotiation
The data consumer starts the contract negotiation bysending a request for an agreement/contract.

9
Contract conclusion/success
The EDC of the data provider receives the negotiation
requests, validates the access and usage policies of thespecific data offer requested by the data provider, andmatches it with the VP of the data consumer. If the data
consumer has all relevant credentials, the agreement
is successfully concluded, and an agreement log is stored
in both EDCs.

10
Data transfer
Data transmission/access by the data consumer can takeplace as long as the contract is active.

29

05 – How: Data Space Operations

5.5 EDC Deployment
and Usage Premises
Each data space participant has its own organizational
structure, consisting of different legal entities and/or
subsidiaries. Depending on the organizational structures,
data space participants must consider how to organize•

the representation of their organization in the Catena-X
data space. This includes considerations for setting up
connector instances regarding organizational, technical,
and legal conditions. The following premises apply:

The data exchange always takes place between two legal entities, as only their representatives can signlegally binding contracts.

•

Legal entities must be registered and known in the data space.

•

To represent a legal entity in the data space, an associated business partner number (BPNL) is required.

•

The deployment and use of at least one connector (e.g., EDC) per legal entity for data exchange is mandatory.

•

The connector negotiates data usage between endpoints (data plane) by synchronizing access and usage
policies between data providers and data consumers.

•

There is no data processing or reviewing of data within the connector itself.

•

Data usage takes place instead at the endpoints of the data providers or data consumers, respectively.

•

Data usage with respect to location and assignment to computer instances/platforms is independentof the runtime environment of the connector itself.

There are various options for organizational structures anddata exchange scenarios such as “one legal entity and onesite in one country”, “one legal entity and multiple sites in
one country” or “one legal entity and multiple sites in different
countries”. For more details on possible connector usage
scenarios, please refer to our Initial Onboarding Guide .
This includes also the different options to obtain a connector,
e.g., it can be acquired via an ESP, it can be self-developed

or adapted from open-source, or it can be part of a businessapplication from a BAP. If the data exchange does not takeplace between several legal entities within Catena-X as
defined above, no EDC is required. An example would be
the connection of the OSP to the GXDCH. For this connection
no connector is needed, because this is not an exchangeof data between two legal entities within Catena-X.

30

06 – How:
Data Space Governance
6.1 Standardization
6.1.1 Why do we standardize?
The success of the digital transformation of the automotive industry critically depends on multilateral collaboration between all stakeholders along the automotive
value chain. Our growing Catena-X ecosystem will enable
enormous amounts of data to be integrated and collaboratively harnessed.

6.1.2 What do we standardize?
The standards of our Catena-X data ecosystem define how
the exchange of data and information in our network works.
They are the basis for ensuring that the technologies,
components, policies, and processes used are developed
and operated according to uniform rules. All standards
developed for the Catena-X data ecosystem are based on
the technological and industry-specific requirements of
the automotive industry.

6.1.3 How do we standardize?
Based on Catena-X’s Intellectual Property (IP)-Regulations
and in compliance with applicable antitrust law, theCatena-X standardization process aims to develop andimplement uniform standards for networking and data

However, this vision is complex: companies at various
stages of the automotive value chain, such as production,delivery, or logistics, often have their own IT systems
to manage their data. To ensure that these complex
data volumes can be sent, received, and processedsmoothly across all stages of the value chain, we need
one language for all players: common standards andframeworks.

The Catena-X Association publishes standards for genericcore and enabling services as well as for domain-specificbusiness applications (see KITs Chapter 4.4.1). Thesestandards and artifacts form the basis for the development and operation of software components in the
Catena-X network to ensure interoperability and data
sovereignty between different software components andproviders. All relevant standards are accessible in the
Catena-X standard library .

exchange in the automotive sector. A general overview
of the process is depicted in Figure 8:31

06 – How: Data Space Governance

Figure 8 Catena-X Standardization Process

The Catena-X standardization policy provides a detailed description of how Catena-X standards are being
developed including everyone involved and their respective responsibilities.

6.2 Conformity Assessment
6.2.1 Why do we certify?
Cross company interactions highly rely on mutual trust.
Our certifications provide trust via transparency andreliability based on our Catena-X standards. By setting
up a certification process, we guarantee that our major
principles are considered in every component of the
network. From the core service providers to the data

6.2.2 What do we certify?
Catena-X certification is done in a modular, role-based way,
to fulfill different requirements of participants in our
ecosystem, whether IT application providers, service
providers or onboarding partners. The modularity allows
high flexibility and lowers the efforts and redundancies
for all parties involved.

connectors and every single application in the network,
a consistent framework was created to ensure beneficial
participation for all participants in the network. A chain is
only as strong as its weakest link, and to gain trust we needto ensure that all links are as strong as possible.

Catena-X standards become mandatory for certification
as soon as they have been integrated into the certification
framework. The Catena-X Association aims to release an
update of its certification framework simultaneously with
newly released standards. The most current version canalways be found on the Catena-X website .

32

06 – How: Data Space Governance6.2.3 How do we certify?
An overview of the certification process is depicted in Figure 9.

Figure 9

Catena-X Certification Process

The Catena-X Conformity Assessment Framework Handbook provides a detailed descriptionof how Catena-X conducts conformity assessment through Conformity Assessment Bodies.

33

06 – How: Data Space Governance6.2.4 Catena-X Labels
Catena-X issues four different labels to help customers find suitable and legitimate providers for their needs.
Each label is issued to the relevant role after achieving successful certification and/or qualification.
Labels are associated with the offered services of the provider.

Certified Operating Company (CSP-A/CSP-B)

Certified Provider (e.g., BAP, ESP, OSP)

Certified Solution (e.g., Business App, Service….)

Qualified Advisor (Advisory Provider)

Each label is obtained after successful completion of the Catena-X certification or qualification process.
Details on pathways to be added.

6.2.5 Exceptions & Timeline for Release 23.09
Release 23.09 is the official GoLive Release of the Catena-X data ecosystem. For the first time, all major componentsof the Catena-X data ecosystem will be available to the vast majority of the automotive value chain. To fulfil this promise
to all our stakeholders while some areas of Catena-X are still under development, certain exceptions are made during
this transitional period:34

06 – How: Data Space Governance#145-day grace period to obtain valid certification
after Release 3.2 (23.09)

Catena-X will release a standard update (Release 3.2) on
Sept. 28, 2023, on the Catena-X Association website. This
release will include “breaking changes” as defined in
the Semantic Versioning .
The GoLive of the Catena-X data ecosystem (productive
environment) will be exclusively on Release 3.2. This
will be accompanied by an update of the certification
framework (“which role needs to have which components
certified”) for release 3.2.
Each partner needs to ensure conformity to the newstandards to be active in the data space. To this end, thefollowing procedure applies: Every participant in the data
space has 45 days after Sept. 28 (grace period) to complete
their certification via a CAB or, in case of an existing certification, via free self-assessment. Deadline is Nov. 12, 2023
(Sept. 28 + 45 days).

#2

Cofinity-X will allow data space registration of a partnerfrom GoLive Oct. 16 after consultation with the Association,subject to the proviso that certification must becompleted by the Nov. 12 deadline. If the certificate is
not proven within the 45 days, Partners must be removed
from the data space at the direction of the Catena-X
Association.
Data space participants and their solutions that werealready certified for Release 3.0/3.1 can use the 45-day
grace period to prove their compliance to the Association
via a free self-assessment and thus confirm the validityof their certificate even after release updates (up to a
maximum of 12 months after initial issue). A corresponding
form including confirmation of conformity with eachstandard required for the certificate can be requested
from info@catena-x.net . This does not apply to a CSP-B.

Certification of business applications vs. internal systems that fallunder the definition of a Catena-X business application*

A business application provides specific logic and schemas
defined in a Catena-X use case (e. g., data processing, transformation functions) that is applied to input data to produce
an expected output. This includes the transformationof data from an input format into an output format using
Catena-X semantic models (semantic interoperability)
as well as the technical data exchange using standardized
protocols and API-specifications (technical interoperability).
This does not apply to internal systems of an organization,such as internal databases, data lakes, data pipelines(ETL) or source systems. To become operational on the

Catena-X data space, a business application must comply
with the corresponding standards (see Chapter 7.2).
Companies connected to Catena-X might want to connect
certain internal systems including company-internalbusiness applications to the Catena-X network. It remains,
however, crucial that all participants can rely on a standardized data exchange that guarantees stable data chainsbuilt on data sovereignty and interoperability.

Consequently, the following two principles apply:

Everything that is necessary to uphold a stable data
chain is required to follow Catena-X standards andhas to be certified by a CAB.

All business applications that are either associatedwith the Catena-X brand and/or are offered on a
Catena-X marketplace are required to follow
Catena-X standards and have to be certified bya CAB.

If an internal system fulfills one of these two criteria, a Catena-X certification is mandatory.
* For future reference, to provide a scalable way of certification, additional technical and partially automated solutionsof assessing conformity are currently under assessment. (10 votes for, 0 against à also Steve vote for publication)35

06 – How: Data Space Governance#3

No Catena-X Business Applications without listing
on a certified CX Marketplace

Catena-X is built on trust. Consequently, certified
Catena-X marketplaces (CSP-A) are checking, whether
services provided are coming with verified credentials
to ensure that the listed offer is trustworthy and conformto Catena-X standards.
To further anchor this trust, all Catena-X related businessapplications and services require a listing on a Catena-X

certified marketplace. Catena-X does not permit operatinga Catena-X solution outside of a certified Catena-X market
place.
As noted in Chapter 8.2, as of release 23.12, Catena-X will
provide the technical possibility for multiple CSP-A
providers. This will foster multiple verifiers of credentials.

6.3 Nomination Process forunique Roles (e.g., CSP-B)
The nomination process is intended to ensure neutrality
and trustworthy execution of selected roles and tasks
within the Catena-X ecosystem. The Catena-X Associationis responsible for the execution of the nomination processincluding partner selection.
The various rights and obligations of the provider are described in the Request for Tender (RFT). This is, for example,

the license for operation, which can also be withdrawn
in case of unfair behavior. This ensures fair awarding andsafe operation of the various components. Tasks include,for example, the operation of Core Services - Section B
by Core Service Providers or the certification of providers
and solutions by CABs. An overview of the nomination
process is depicted in Figure 10.

Figure 10 Catena-X Nomination Process36

06 – How: Data Space Governance

The process steps of the nomination process are described in detail below.

Process Step

Description

Create Request for Tender(RfT)

The Catena-X Associationis responsible for thecreation of the Request
for Tender (RfT) document(e.g., for Core Services section B)

Publish RfT on Website

The Catena-X Associationis responsible for the
publication and distri­bution of the RfT Docu­ment on the website .

RfT Document(s)RfT Document(s)RfT Event incl. Timeline
RfT Template

Create and Submit Tenderfor selected Core Service(s)A provider can createand submit a tender forthe published RfT.

RfT Document
RfT EventRfT Template

TenderReceive and Review
Submissions

The CX Associationcompares the tender(s),regarding the fulfillmentof the nomination criteria
and creates a short list of
candidates for the board.

Tender(s)Short List of Provider
Candidates

Select Provider

The board of the Asso­
ciation elects a provider
with an absolute majority
vote.

Short List of Provider
Candidates

Nomination of Provider

Inform Providers

The CX Association
informs all provider(s)about the result of thenomination process.

Table 1

Input

OutputRfT Document(s)Nomination Process Steps

6.4 Qualification Process
6.4.1 Why do we qualify?
On the way to creating value with Catena-X, companies may
be dependent on advisory services. The quality of theseadvisory services is decisive for the success of the participation and thus for the success of Catena-X. Catena-X canonly be successful if it succeeds in integrating large partsof the automotive value chain. We assume that this will leadto a high demand for advisory services, which must be met.
These advisory services must cover the needs of small andmedium-sized companies as well as the needs of large
companies, which have extended integration requirements.

37

06 – How: Data Space Governance

Advisory services are hard, if not impossible, to standardize.
Consequently, conformity assessment of qualified advisory
services cannot take place through certification. To maintain a consistent level of quality among advisory service
providers in the Catena-X data space, the Catena-X Association thus offers a qualification process that is mandatory
for all advisory service providers that want to get listed ina marketplace.

6.4.2 Who do we qualify?
Catena-X invites advisory service providers of all kinds
to support the successful onboarding of data spaceparticipants, SMEs in particular. One of the few prerequisites is the binding commitment to provide high-quality

6.4.3 How do we qualify?
There are two ways to become a Catena-X qualified
advisory service provider.
1 Qualification through training
2 Qualification through existing experience

Advisory service providers, like all other participants activeon the Catena-X data space, must adhere to the Catena-X
regulatory framework and thereby confirm their full andunconditional support of our data ecosystem including its
mission and standards.

consulting at fair and reasonable costs. Catena-X supports
this endeavor with information and predefined content aswell as a qualification system to prove appropriate support
and consulting competencies.

to advisory service providers that have gained experienceby actively contributing to the Catena-X ecosystem either
by directly accompanying companies within the Catena-X
beta phase or contributing directly to the Catena-X kickstarter consortium as a listed member. An overview of thequalification process is de-picted in Figure 11.

For most advisory service providers, the first option applies.
Qualification through existing experience is a path offeredFigure 11

Catena-X Qualification Process

As of the Operating Model White Paper v.2.1, the process
for qualification through training has yet to be established.
It will be released on the Catena-X website as soon as it isavailable. Qualification through experience applies to alladvisory service providers that registered for and part­
icipated in the Catena-X beta phase.

If a company is interested in qualification and/or the proofof qualification, the first step is to contact the Catena-X
Association via info@catena-x.net . Further information
and a first questionnaire to collect basic information about
the company will then be made accessible.

38

06 – How: Data Space Governance

6.5 Regulatory Framework
The Catena-X Regulatory Framework for data space
operations outlines the requirements and responsibilities for all stakeholders involved in the Catena-X data
ecosystem. It includes detailed information on data
sovereignty, mandatory use case requirements, andother regulatory considerations that are relevant andmandatory to our activities.

The Regulatory Framework is made up of individualcomponents that each govern a specific layer of ourdata space operations. To understand the layersof our Regulatory Framework, Catena-X uses flightlevels as a metaphor (see Figure 12):The 30,000 ft level provides the overall framework,

20,000 ft is for specific use cases,

10,000 ft for individual data offerings,
and 5,000 ft for automated contract negotiations.

Figure 12

Catena-X Governance Framework flight levels

Each higher-level cascades into the lower ones, and thelower levels align with those above. Each level comes withspecific guidelines and resources but also responsibilities
for participants in our data space. This Operating Model falls
under the 30,000 ft level and is thus mandatory for all data
space participants.

Maintaining and updating our Regulatory Framework fordata space operations lies within the responsibility of
the Catena-X Association. All resources and normative
documents included in the regulatory framework are listedon the Catena-X website .

39

07 – How: Life Cycle
Management
Managing versions and changes of different artifacts infederated data spaces is critical to ensure compatibility,interoperability, and security. The life cycle manageHier steht das Kapitel­­ment of the Catena-X ecosystem is coordinated by the
Catena-X Association and includes the releases in the
Catena-X Association and in the Eclipse Tractus-X Project(see Figure 14). It is planned to provide quarterly releases

Versioning

including one major and three minor releases per year.
Both releases follow calendar versioning (see CalVer),
whereas their artifacts such as standards, normative
documents, products, and KITs follow semantic versioning(see SemVer). To ensure backward compatibility in the
future (see Chapter 8.5), versioning and passing of predefined test cases of each individual artifact is mandatory.

Catena-X Association
Coordinates

Commercial / SelfDeveloped Solutions
Own Versioning
SchemeCatena-X
ReleaseCalVerComplies with

Other
Normative
Documents
SemVerFigure 13

Sponsors, Promotes & Coordinates

Tractus-X
ReleaseCalVerComplies with

Link
to

Standards
SemVer

KITs
SemVer

Prodcuts
SemVerOverview Life Cycle Management

The Catena-X Association release includes all binding
and certification-relevant artifacts such as standards(e. g., API-specifications, semantic models) and normative
documents for all data space participants. The Tractus-X
release contains all open-source products (including
services or helm charts) of the cxOS and businessapplications as well as KITs. In addition, there are various
commercial or self-developed solutions for businessapplications and services following individual release
cycles and versioning schemes.

Both the Tractus-X release and any commercial or selfdeveloped solutions must adhere to Catena-X standards
and other relevant normative documents.
4Open-source products are required to fulfill the Tractus-X
release guideline (TRGs) and take part in our integration
tests to be part of a quarterly Tractus-X release. For criticalissues (e. g., security issues), hot fixes may be released
to fix a bug in the active Catena-X operating system thatinterrupts the normal release cycle.

40

08 – Outlook
The Catena-X Operating Model is a normative document within the regulatory framework,
which is binding for all participants in the Catena-X data space. It describes the status of ourdata space artifacts, including roles, services, and processes along with their respective
roadmaps. As Catena-X is an ongoing journey, all of these artifacts will continuously evolve
to promote broader adoption and scalability, ensuring maximum interoperability, and (data)
sovereignty.

8.1 Industry CoreThe Industry Core aims to reduce the complexity of multitier connections within the decentralized Catena-X data
space and to act as an enabler for data-driven use cases
like tracking a product carbon footprint (PCF) value or
circular economy. Reusing common components andstandards (especially data provisioning of digital twins ofparts) across different use cases promotes efficiency andinteroperability. To enable onboarding for corporations thathave different legal entities, concepts for a corporate BPNL
are also created. This enables a simple participation via acompany-group-wide BPNL. The industry core fosters therealization of seamless data chains, with one use casebenefiting from another. As a result, cross-domain network
effects and n-tier use cases become possible.

8.2 Increase Decentralizationof Core Services
Catena-X follows a business-oriented decentralization
approach that aims to achieve interoperability and data
sovereignty while balancing manageability of complexity,
and technical maturity. Therefore, Core Services B will

gradually transition into onboarding services or Core
Services A, if appropriate. Please find below the timeline
for the upcoming decentralization of Core Services B(see Figure 14).

41

08 – Outlook

Rel
23.09
23.09
RelRel
23.09
Rel
23.09
Core
Services
Core
Core
Services
Services
B
Core
Services
B BB

Rel
23.12
Rel
23.12
Rel
23.12
Rel
23.12
11 1 1

Identity
Provider(User)
Identity
Provider(User)
Identity
Provider(User)
Identity
Provider(User)
Identity
Provider(TechnicalUser)
Identity
Identity
ProviderProvider(Technical(Technical
User)
User)
Identity Provider (Technical User)
GoldenRecordService& API
GoldenRecordService& API
GoldenRecordService& API
Golden Record Service & API
Business
PartnerNumberIssuerBusiness
PartnerNumberIssuerBusiness
PartnerNumberIssuerBusiness Partner Number Issuer​
Discovery
Finder
Discovery
Finder
Discovery
Finder
Discovery Finder
Data
Space
Discovery
Data
Space
Discovery
Data
Space
Discovery
Dataspace Discovery
BPN
Discovery
BPN
Discovery
BPN
Discovery
BPN Discovery
SSISSI- SSIManaged- Managed
Identity
Identity
WalletWallet- Managed
Identity
Wallet
SSI - Managed Identity Wallet
SD-FactorySD-FactorySD-FactorySD-Factory
Core
Services
Core
Core
Services
ServicesA AACore Services A
Marketplace
Marketplace
Marketplace
Marketplace
Partner
NetworkUI UIUI
Partner
Network
Partner
Network
Partner Network UI
Semantic
Hub
Semantic
Hub
Semantic
Hub
Semantic Hub
On-Boarding
Services
On-Boarding
On-Boarding
Services
Services
On-Boarding Services
Registration
Registration
Registration
Registration
Connection
GXDCH
Connection
toto
GXDCH
Connection
to GXDCH
Connection to GXDCH

Rel 23.09
Rel 23.09 Core Services B

1

Core
Core
Services
Services
BB B BCore
Services
Core
Services
Identity
Provider(User)
Identity
Provider(User)
Identity
Provider(User)
Identity Provider (User)

2024
2024
2024
2024
11 1 1

Identity
Provider(TechnicalUser)
Identity
Provider(TechnicalUser)
Identity
Provider(TechnicalUser)
Identity
Provider(TechnicalUser)

11 1 1CoreCore
Services
Services
Core
Services
BB B BCore
Services
Identity
Provider(User)
Identity
Provider(User)
Identity
Provider(User)
Identity Provider (User)

Mandatory
Mandatory
Mandatory
Mandatory

Identity
Provider(TechnicalUser)
Identity
Provider(TechnicalUser)
Identity
Provider(TechnicalUser)
Identity
Provider(Technical
User)

GoldenRecordService& API
GoldenRecordService&&API
GoldenRecordService& API
GoldenRecordService
API

GoldenRecordService&
API
GoldenRecordService&&API
GoldenRecordService& API
GoldenRecordServiceAPI

Business
PartnerNumberIssuerBusiness
PartnerNumberIssuerBusiness
PartnerNumberIssuerBusiness Partner Number Issuer​
Discovery
Finder
Discovery
Finder
Discovery
Finder
Discovery Finder
Data
Space
Discovery
Data
Space
Discovery
Data
Space
Discovery
Dataspace Discovery
BPN
BPN
Discovery
Discovery
BPN
Discovery
BPN
Discovery

Business
PartnerNumberIssuerBusiness
PartnerNumberIssuerBusiness
PartnerNumberIssuerBusiness
PartnerNumberIssuer​Policy&Credential
Hub
Policy&&Credential
Hub
Policy& Credential
Hub
PolicyCredential
Hub

Policy& Credential
Hub
Policy& Credential
Hub
Policy& Credential
Hub
Policy & Credential Hub- Managed
Identity
WalletSSISSI- SSIManaged
Identity
Wallet- Managed
Identity
Wallet
SSI - Managed Identity Wallet
SD-FactorySD-FactorySD-FactorySD-Factory
IssuerService
IssuerService
IssuerService
Issuer Service

Identity
Provider(User)
Identity
Provider(User)
Identity
Provider(User)
Identity Provider (User)
Marketplace(s)Marketplace(s)Marketplace(s)Marketplace(s)SD-FactorySD-FactorySD-FactorySD-FactoryPartner
Network
Partner
Network
Partner
NetworkUI UIUI
Partner Network UI
Semantic
Hub
Semantic
Hub
Semantic
Hub
Semantic Hub
Discovery
Finder
Discovery
Finder
Discovery
Finder
Discovery Finder
Data
Space
Discovery
Data
Space
Discovery
Data
Space
Discovery
Dataspace Discovery
BPN
Discovery
BPN
Discovery
BPN
Discovery
BPN Discovery

On-Boarding
Services
On-Boarding
On-Boarding
Services
Services
Core
Core
Services
Services
Core
Services
A AA
On-Boarding
ServicesCore Services A

On-Boarding
On-Boarding
Services
On-Boarding
Services
Core
Core
Core
Services
Services
Services
AServicesAA
On-Boarding
ServicesCore Services
A
Identity
Provider(User)
Identity
Provider(User)
Identity
Provider(User)
Identity Provider (User)
Marketplace(s)Marketplace(s)Marketplace(s)Marketplace(s)Partner
Network
Partner
Network
Partner
NetworkUI UIUI
Partner Network UI
Semantic
Hub
Semantic
Hub
Semantic
Hub
Semantic Hubn nnnOn-Boarding
Services
On-Boarding
Services
On-Boarding
Services
On-Boarding
Services
On-Boarding
Services
On-Boarding
Services
On-Boarding
Services
On-Boarding
Services
Identity
Provider(User)
Identity
Provider(User)
Identity
Provider(User)
Identity Provider (User)
Registration
Registration
Registration
Registration
Connection
to GXDCH
Connection
GXDCH
Connection
toto
GXDCH
Connection to GXDCHSD-FactorySD-FactorySD-FactoryRel 23.12 SD-Factory
IssuerService
IssuerIssuerService
Service
IssuerRel 23.12 Core Services
B Service 1n nnnOn-Boarding
On-Boarding
On-Boarding
Services
Services
Services
On-Boarding
Services
On-Boarding
On-Boarding
Services
Services
On-Boarding
Services
On-Boarding
Services

2024

ProviderProviderProviderProviderOptional
Optional
Optional
Optional
min.1
min.1
min.1
min.1

n nn
n

n nn
n

Identity
Provider(User)
Identity
Provider(User)
Identity
Provider(User)
Identity Provider (User)
Registration
Registration
Registration
Registration
Connection
GXDCH
Connection
toto
GXDCH
Connection
to GXDCH
Connection to GXDCH- Managed
Identity
WalletSSISSI- SSIManaged
Identity
Wallet- Managed
Identity
Wallet
SSI - Managed Identity Wallet
SD-FactorySD-FactorySD-Factory
2024 SD-Factory
IssuerService
IssuerIssuerService
Service
Issuer Service 1
ProviderCore Services B

Identity Provider (User)
Identity Provider (User)
Mandatory
Provider1
1
Rel 23.12 Core Services
2024 Core Services
B
B
Optional
Identity Provider(Technical User)
Identity Provider(TechnicalUser)
Identity (User)
ProviderUser)
Identity
Identity
Mandatory
Providerdentity
1
1
1 14 (Technicalmin.1
Core Services
B Provider (User)
Services
B Provider (User)
ces B Provider
FigureTimeline forCore
further
Decentralization
RecordService & API
RecordService & API Optional
RecordService & Identity
API
Identity (User)
Provider Golden(TechnicalUser)
Identity (User)
Provider Golden(TechnicalUser)yr (User)
Provider Golden(Technical
User)
ProviderIdentity Provider
Mandatory
min.1
Business
Partner
Issuer​Business
PartnerNumber Issuer​
Business
Partner
Issuer​RecordService& API Number
RecordService& API OptionaldenRecordService& API Number
Identity
Provider Golden(TechnicalUser)
Identity Provider Golden(TechnicalUser)
chnicalUser)
min.1
Policy & Credential Hub
Discovery Finder
Discovery FinderGolden Record
Business
PartnerBusiness
Partner
ess
Partner
Service& API Number Issuer​
Golden Record
Service& API Number Issuer​
rvice& API Number Issuer​
Dataspace Discovery
Policy &Issuer​
Credential Hub
Dataspace Discovery
Discovery
Discovery
Business Partner Number
Issuer​Finder
Business Partner Number
umber
Issuer​Finder
On-Boarding
Services
BPN
Discoveryv23.12 (planned)nReleasev23.09Release
CoreReleases
Services A 2024 (planned)
BPN
Discovery
Dataspace
Discovery
Policy & Credential Hub
Dataspace
Discovery
Discovery Finder
nder
Due
to
organizational
and
With
the
introduction
of
With
an
increasing
decenPolicy&
Credential
Hub
On-BoardingIdentity
Services
BPN Discoveryn
SSI - Managed Identity Wallet
Core Services A Provider (User)
BPN Discovery
Dataspace Discovery
coverytechnical
limitations, the Policy & Credential
newidentity
synchronization
tralizationof services, Core
SSI - Managed
Identity
WalletSD-Factory
Hub
Marketplace(s)On-BoardingIdentity
Services
BPN DiscoverynManaged Identity Wallet
Core Services A Provider (User)
very
services associated withfunctions,multiple
CSP-A
ServicesB
are shifted step by
SSI - Managed
WalletHub Identity SD-FactoryMarketplace(s) SD-FactoryCore Services A Policy & Credential
ntity SD-Factory
WalletIdentity Provider(User)
steptoCoreServices A andthe CSP-A and OSP roles
and
OSP
can
operatetheIssuer Service
SSI - Managed Identity SD-Factory
WalletSD-FactoryPartner Network UI
ry Core Services A
Marketplace
Marketplace(s)the decentralized portfolio of
can only be operated oncecorresponding services
Hub
Partner NetworkSemantic
UI
SD-Factory Issuer Service and collaborate. InSD-FactoryPartner
UI
Onboarding Service Provider
and Network
must therefore
addition,
Marketplace
ces A
On-Boarding
ServicesnDiscovery Finder
Core Services A
Hub
Issuer Service
Partner
NetworkSemantic
UI
Hub be offered
likewise increases. For future
temporarily
bythere will be new
CSP-B
Partner NetworkSemantic
UIce
Identity
Provider(User)
Dataspace
Discovery
On-Boarding
ServicesnDiscovery FinderCore
ServicesA
Semantic
Hub
releases, committees, expert,
services such as the Policy
Hub the nominated CSP-B.
orkSemantic
UI
Marketplace(s)BPN Discovery
Identity
Dataspace Discovery
On-Boarding Services On-Boarding
Servicesn and Credential Hub.
Discovery Finder
Core Services
A Provider (User)and working groups will be
HubPartner
Network
UI
Marketplace(s)BPNDiscovery
Identity Provider (User)
Dataspace Discovery
coordinated to develop a deOn-Boarding Services
Registration
HubnPartner NetworkSemantic
UI
On-Boarding
Services
tailedServices
decentralization
roadMarketplace(s)BPNDiscovery
Connection
to
GXDCH
On-Boarding
Services
Registration
Hub
n
map
under
the
supervisionofPartner NetworkSemantic
UI
On-Boarding Services
Connection
to GXDCHn On-Boarding Services
Identity Provider (User)
On-BoardingServices
Serviceson
On-Boarding
Semantic Hubn the Catena-X Association.
On-Boarding Services
Registration
GXDCHn On-Boarding Services
Identity Provider (User)
On-BoardingIdentity
Services
Provider (User)
On-Boarding
Services
Connection to GXDCHRegistrationnRegistration
Identity Provider (User)
On-BoardingIdentity
Services
Provider (User)
On-Boarding
Services
SSI - Managed Identity Wallet
Connection to GXDCHConnection to GXDCHRegistration
Registration
Identity Provider (User)
SD-Factory
SSI
Managed Identity Wallet
SD-Factory
Connection to-GXDCHConnection to GXDCHRegistration
SD-Factory Issuer Service
SD-Factory Issuer Service SSI - Managed Identity Wallet
Connection to GXDCHSD-Factory Issuer Service
SD-Factory Issuer Service
Issuer Service
Issuer Service

Identity
1
09 Core Services
B Provider (User)42

08 – Outlook

8.3 Further Integration of
SSI Technologies
To realize the Catena-X vision of a decentralized data space,
we will further develop our SSI technologies. Future releases
will enable the use of both managed identity wallets andself-provisioned identity wallets. To enable the technicalenforcement of policies, it is planned to introduce a policy
hub and policy code templates to also provide the information transparently to the participants. This also includes
the decentralization of the issuer service and logging
functionality for agreements. To further strengthen trustin the data space, we will introduce the option to define

various root trust anchors (e.g., the Catena-X Association).
This will also allow the identity wallet to be decentralized
and allow multiple issuers. In addition, a chain of trust willbe established to prove that a given credential comes froma trusted source according to the Catena-X Governance
Framework. The concept is still under development and will
be released in one of the next versions (by May 2024).
While developing this concept, the concepts of the Policy
Hub and the Certifications Hub will also be concretized.
An illustration of this can be found in Chapter 10.2.

8.4 Data Space Interoperability
The Catena-X Association is committed to promote andengage in various initiatives that focus on creating common
guidelines and standards to ensure interoperability withother data space initiatives. Initiatives such as the Data

different industry sectors. Furthermore, the Catena-X
Association will drive technical initiatives, such as the
Eclipse Tractus-X project and the Eclipse Dataspace
Working Group (EDWG), which aim to align a commonSpace Support Centre (DSSC) and Manufacturing-X will
help establish an interoperable data space acrosstechnical foundation, certification procedures and test/
security requirements.

8.5 Backward Compatibility
The vision of the Catena-X data space is to provide seamlessdata access and creation of data chains across multi-tiervalue chains. Initially, the data space can be operated andevolved by deployment of dedicated, synchronized releases(see Chapter 6). While initially, dedicated, synchronized
releases (see Chapter 6) may suffice, our goal of involving

thousands of partners makes it impossible to maintain thesame technical components across the board. To overcome
this challenge, we must ensure that the release and upgradeof dedicated components can be executed independently,
without causing disruptions in the network connectivity
and data chains.

43

08 – Outlook

To achieve this in areas such as APIs, semantic models, and procedural specifications, the Catena-X Association
promotes and supports adherence to the following principles:Continuous revising ofstandards to ensure compatibility between different versions
and releases.

Developing technicalspecifications and reference
implementations in Eclipse
Tractus-X that follow the required
standards to lay the technicalfoundation.

Coordinating closely withdifferent operators to execute
rollout and implementation of thedifferent versions and releases.

8.6 Sanctions
Following its GoLive, the Catena-X data space will growin participants and complexity. Consequently, ensuring
compliance of all participants with established rules,
regulations, and standards becomes increasingly relevant.
Moving forward, concepts of imposing restrictions or
penalties on individuals, organizations, or entities thatengage in actions or behaviors that are deemed harmful,illegal, or unethical within the context of data management,
privacy, and security will be evaluated and developed.
These sanctions will aim to deter, correct, or punish noncompliant behavior, thereby safeguarding data integrity,protecting individual rights, and maintaining the trustand credibility of the data ecosystem.

44

09 – Glossary
AAS

Asset Administration Shell

AP

Advisory Provider

API

Application Programming Interfaces

BAP

Business Application Provider

BPN(BPNL, BPNA, BPNS)

Business Partner Number(Legal Entities, Addresses, Sites)

CAB

Conformity Assessment Body

CAC

Conformity Assessment Criteria

COTS

Commercial-off-the-Shelf (Software)

CSP-ACore Service Provider A

CSP-B

Core Service Provider B

cxOS

Catena-X Operating System

DAPS

Dynamic Attribute Provisioning Service

DDTR

Decentralized Digital Twin Registry

DSSC

Data Space Support Center

EDC

Eclipse Data Space Components

EDWG

Eclipse Data Space Working GroupETL

Extract, Transform, Load (Process)

GXDCH

Gaia-X Digital Clearing House

IAM

Identity and Access Management

IDSA

International Data Spaces Association

IRS

Item Relationship Service

MIW

Managed Identity Wallet

PCF

Product Carbon Footprint

RfT

Request for Tender

SaaS

Software-as-a-Service

SSI

Self-Sovereign Identity

TRG

Tractus-X Release Guideline

OSP

Onboarding Service Provider

VC

Verifiable Credential

VP

Verifiable Presentation45

10 – Appendix
10.1 Role Relationships
Overview of mandatory (M) and optional (O) relationships between roles (release 23.09)
CSP-A

CSP-B

OSP

DPC

ESP

BAP

AP

CAB

C-X

CSP-A

M

M

M

–

–

–

–

M

–

CSP-B

M

–

M

–

–

–

–

M

M

OSP

M

M

M

–

–

–

–

M

–

DPC

O

M

M

M

O

O

O

M

–

ESP

O

M

M

–

–

–

–

M

–

BAP

O

M

M

–

–

–

–

M

–

AP

O

O

M

–

–

–

–

–

M

CAB

–

–

–

–

–

–

–

–

M

Overview of mandatory and optional relationships between roles.

Relationship

Description

IAM-Sync

The IdP is a service responsible for storing and verifying user identities. Its objective
is to enable user access to all IAMs of Catena-X operators as soon as they onboard
themselves and receive a user in an IAM. Achieving this requires synchronization ofeach IAM with every other one, a process known as Identity-Sync, which involves
both regular users and technical clients.

46

10 – Appendix

Relationship

Description

Integration

Technical integration is required to use Core Services Section B of the CSP-B. The otherparties must have access to the services to be able to offer their services. The technicalintegration refers to an API. This includes documentation, access data, definition ofcommercial aspects and SLAs.
To fully utilize Core Services B of the CSP-B, it is required to perform technicalintegration with the related APIs. This integration is necessary for enabling otherdata space participants to access the services to provide their own services. This
also includes to provide documentation, access credentials, and define commercial
aspects and SLAs for other related services to ensure smooth functionality.

Onboarding

The onboarding enables either existing customers in other networks or interested
parties to access the Catena-X data space (Trusted Access Point). This is the technicalconnection and registration of the participants. With the successful completion of theonboarding, the participant is part of Catena-X and can use the network.

Certification

When certified by a CAB, the party is audited against the Catena-X standards.
These independent third parties ensure security and in-teroperability.

Nomination

The nomination process is designed to ensure neutrality and trustworthy executionof selected roles and tasks within the Catena-X ecosystem. The various rights andobligations of the operator are described in the Request for Tender (RFT).

Qualification

With the qualification, the Catena-X Association ensures that there is a uniform
level of quality and service of the various providers. This creates security and trust
for the users of the services.

Trademark Rights

With the different qualifications and certifications, the respective parties receive
different Catena-X labels. With these they can identify themselves and use themfor illustration. The Catena-X Association holds the trademark rights to the labels
and Catena-X itself.

Use

Within Catena-X, a participant can use different offers from service providers (AP, ESP,
BAP). These are certified applications. Alternatively, they can certify and operate themby themselves, but then it would not use services. The offers can be SaaS solutions or
local deployments.

47

10 – Appendix

10.2 Data Exchange basedon SSI - Next Steps
Catena-X Policies as part of the Data Exchange(please note the image below covers own as well as managed Wallet solutions;the credential request flow is not displayed since no changes are planned so far)

Data SpaceOpCoManaged Wallets
Administration
Service(s)Policy Hub

Registration Service(s)

DP

DC

OpCo

1

Data Provider

3

Policy HubIssuerComponent

Certificate Hub

Retrieve OTT managed
Wallet or own Wallet

Data Consumer

Query VP via OTP

Own WalletA

Own Wallet

Register data & create dataoffers with UseCase Policy(access or/and usage)

2

EDC
4

Query Catalog/
Offers & Provides OTT

EDC

6Offer Policies

Verify VP
5Submit catalog

8

Contract Negotiation

9

Logging
Agreement log

10(Individual)
Purpose defined?

No

Yes

Contract Closuer/Success

Data Transfer

Logging
Agreement log

If data contract is
acceptable for the specificdata request proceed with
the negotiation

7

ExamplePurpose: „Data_
Usage_Contract_
VehicleData_1.2.0“Manually Checkindividual data contract
policies/rules
Data Usage
Contract
VehicleData 1.2.0
Individual Usage
Right #1
Individual Usage
Right #2…

Figure 15

Further development of the data exchange based on SSI

48

11 – Change Log
Version 2.1 - 09.10.2023

Added
•
•
•

•

•

Role: Catena-X Automotive Network e.V.
Service Map: Onboarding Service Category
Data Space Operations: Providing information, guidelines, and premises on how toparticipate and exchange data in the data space:• General Onboarding Process• Gaia-X Compliance• SSI Issuer Concept• Data Exchange based on SSI• EDC Deployment and Usage PremisesLife Cycle Management:• Versioning• Backward Compatibility
Data Space Governance:• Qualification Process• Exceptions

Changed/Updated
•
•

•
•
•
•
•

Introduction: clarity and readability improvements
Roles:• Re-naming of consulting provider to advisory provider• Detailing the description of all roles with responsibilities, respective
relationships, prerequisites, and complements
Service Map: Update of service map according to Tractus-X release 23.09
Standardization process: reference provided to standardization policy that details
the Catena-X standardization process further
Certification process: reference provided to Conformity Assessment Framework thatdetails the Catena-X certification process further
Labels: Removed distinguishing factors between Certified Operating Company
and Certified Partner
Outlook: updated according to release 23.09

Unchanged•

Nomination Process49Catena-X Automotive Network e.V.
Reinhardtstr. 58, 10117 Berlin
Germany
Tel: +49. 030.5360.7799
E-Mail: info[@]catena-x[.]net
Register of associations at the district court Berlin(Charlottenburg) Nr D1537
Authorized representatives of the board:
Oliver Ganser (Chairman)
Prof Dr. Boris Otto (Vice Chairman)
Claus Cremers (Treasurer)