Europe’s Next Digital Needs and How Ethereum Can Meet Them

Transcript

Hi. Good afternoon everyone. My name is Kelly and I'm sure you checked the program and you saw European aluminium is my organization and you thought what the hell? Well, so before I start, let me give you a quick intro. I've been working in Brussels on EU policy for the past 9 years translating what EU policy means in practice for the aluminium companies in Europe that need to implement it. I'm also a fellow at the European Decentralization Institute, which is fairly new think tank that looks into how decentralization can contribute to EU policy goals such as digital sovereignty. And what I've

realized over the past 9 years is this and this is kind of a hot take, right? That yes, we talk a lot about EU regulation, how it stifles innovation. The EU tends to to over regulate and that in many cases is true. But if you look at EU legislation closely, it can in some cases also be a product roadmap for what still needs to be built. So in Web 3, we ask a lot of times, how can we get institutions and enterprises to adopt Ethereum, to adopt permissionless blockchain?

So I will argue that because of legislation, this question in part is starting to answer itself. Because right now, the EU is forcing into existence through legislation with legal obligations and deadlines attached, entire new digital infrastructure. And today I will focus on three digital legislations across digital identity, supply chains and AI. And I will tell you the gaps they create, who needs them filled, and why the requirements these legislations create point to permissionless blockchain and Ethereum in particular. So, I'm not a technical

person, right? So, I leave the the technical solutions to the devs in this audience. But, I would say let's start with identity. Oh. So. So, under EIDAS 2.0, the EU is building a public identity layer. By the end of 2026, all 27 EU member states will be required to roll out a digital identity wallet to its roughly 450 million citizens. By the end of the year, public services are required to accept those wallets. And by the end of 2027, banks, telcos, and other private

services with strong authentication are also required to accept the digital identity wallet. And in this wallet are things like your university diploma, your driving license, your national ID, all issued as verifiable credentials. Now, the EU legislation requires all parties, so wallets providers, credential issuers, and verifiers, to ensure that there's no tracking possible of how and when users authenticate. But, the problem is that no one has quite

figured out how to enforce this technically. So, the the regulation, the EU credential formats that they've chosen let you select only part of your data, which is of course good, right? This is selective disclosure. It's very important for privacy. Um but the problem is it doesn't stop a determined actor from pieces from piecing everything together across different services. So, unlinkability is not guaranteed and that is a huge privacy concern because you can have someone um a malicious actor conspiring with services and kind of create a whole profile on you and then it becomes instead of a digital identity wallet

that is useful for citizens a mass surveillance tool. So, this is incredibly um important pitfall to avoid. So, um the EU has also uh recognized that unlinkability full unlinkability across all platforms requires cryptographic tools that aren't yet widely supported on the issuer side. So, these wallets are going live very soon. Platforms will need to accept them. Um but they'll have a no tracking obligation. They can't yet fully um comply to because the tools that exist there right now, they don't do that yet. So, it the wallets are going

live with a compliance hole, which is a little bit ridiculous. Right? Um so, what is missing is the layer between the platform and the wallets. Um In in the best case, the user presents a wallet to um a service platform and the platform um the wallet generates only a proof that proves the claim such as is this person 18 yes or no without sharing the personal uh identity and data underneath that claim. Right? So, this will prevent linkability across services. The platform only receives a check that this proof happens and no personal identifiable information is stored by

the platform and um this is very important and of course in in ethereum's ecosystem we have ZK tooling it's tested and used in ethereum more than anywhere else and you have already primitive such as polygon ID self protocol I know the EF PSC team is also looking at ZK SDKs also including for the digital identity wallets but right now there is not yet any SDK that is compliant with with this EID's regulation even though across the world other nations are working on it I'm sure

you've all heard last year about the example of Bhutan right that's could be a great model for Europe but we're not quite there yet and I think also what is important to note that the EU has many laws legislation and there's different pieces here and there that are kind of interlinked with the identity issues for example under the EU's digital services act very large platforms such as Tik Tok are under immense pressure to ensure that minors cannot access their platforms the European Commission wants them to put effective age assurance measures in place and they're backing

privacy preserving approaches of course very strongly so that could also be a use case for a ZK wallet based flow now my favorite topic digital product passport so I mean I'm representing the manufacturing industry in my full-time role right so I'm I'm closely involved with this so basically under the eco-design for sustainable products regulation as of February 2027 every electric vehicle battery placed on the EU market will need a digital product passport which is essentially a structured record of specific claims depending on which

sector which claims so for batteries it will be things like recycled content data the origin of the raw materials emissions associated to the production of those and so on and the intention under this regulation is that eventually nearly every product placed on the EU market will need to have a digital passport so like a physical identifier attached to the product like a QR code then you can scan it and you have the whole digital record of a product from across the entire life cycle there so the next wave will be after batteries textiles apparel furniture tires toys metals including aluminum and steel

electronics and so on so you can imagine just how many companies will need to comply with this because also EU importers will need to eventually have EU exporters so no sorry those exporting to the EU will eventually need a digital product passport now the issue with these product passports is not the logging of the claims right cuz this can be very easily done with a centralized enterprise solution but the the problem is a typical one that blockchain can solve it's the coordination problem between actors that do not trust each other because as you can see here on screen

one product can involve many actors dozens of actors from across the globe for a battery for example you can have several miners for each of the raw materials processors cell makers, and so on, all the way to the recycler. Uh and each of these actors need to add claims to the same record. And uh the problem is, of course, these actors uh don't always trust each other because they can also be competitors in in some markets.

Um so, I think what needs to be built instead uh first of all, uh ZK compliance claim uh API. So, where um a supply chain actor can submit a claim, it gets a receipt, and that can be anchored as a cryptographic commitment on Ethereum with a timestamp and a hash, uh so that someone who wants to check the claim, be it uh a regulator, be it an end-use consumer, can check uh the claim without having to go back to the original uh verifier. And of course, that claim cannot uh be altered. Now, um in supply chain traceability, there's also certain data

that is commercially too sensitive uh to share with your competitors, or you don't even want to share with end-use customers, but you might need to share it with regulators. Uh think about, for example, uh carbon uh calculations, carbon emission calculations, and so on. So, again here, uh you could think about having ZK proofs for those commercially sensitive issues. And the second uh product, if you will, is a a registry of supply chain actors. Uh the EU will build a central registry, but I think a decentralized registry that makes a lot of sense here, where you have uh verifiable um

identity for across the value chain. Um and also that this identity can be portable because it could very well be that you will need to comply also with um other regulations like the carbon border adjustment mechanism in which you need to prove uh how the carbon uh emissions of your product if you import it into the EU. Uh and this does not exist yet. And um of course, we have already Ethereum's attestation surface, uh which could be very well suited to this um to this product. And I think what is what is great is that there's already a lot of procurement happening across all

those industries that are in in scope in wave one, two, and three. Uh I know the aluminum industry is looking into it, and um there is of course permissioned blockchains being built by some big industrial companies, but also many companies are interested in permissionless alternatives, and um there's already people building on Ethereum. There is a company, for example, called Circularise that is in metals and mining that is uh making digital identity uh no no, sorry. Uh digital product passport solutions uh with CK built on Ethereum.

Uh I think this is a huge market, and it's one of the, I think, um applications of blockchain that's not often mentioned, but that could be huge. And then finally, um the EU AI Act, which is already in force, and as of August 2026, uh everyone that is categorized as high-risk AI must log everything over the entire system's lifetime. Uh that makes it easy to reconstruct what the system did when and based on what inputs.

Um and as you can see on screen, a lot of uh systems fall into high-risk categories, credit scoring, CV screening, and so on. It's a very um broad category. And there is no specification in the legislation for for how to best track uh, the system's lifetime, but um, tamper-evident logs are the most uh, are the best legally defensive way to do that. So, imagine what this means in practice. You have, for example, an HR uh, tech company uh, and and a decision um, like a

candidate contests a decision, right? 6 months later. And then the sys- they need the company needs to prove um, you know, what inputs it processed, which model version it used, what decision came out of that, and importantly, that the the record, the log, hasn't been touched since. And of course, normal enterprise logging does not give you this because anyone that runs the infra can uh, adjust the record. So, that's why I think a decentralized solution makes the most sense here. And um, what is also important to note is that um, many of these decisions made by these high-risk AI systems uh, will constitute of highly sensitive personal data, such as a

hiring decision, but also a loan outcome. And under the EU's GDPR Act, everyone has the right to ask their personal data to be erased under Article uh, 17. And this is of course, in direct tension with the tamper-evident logs that should not be editable under the EU AI Act. So, I think the most elegant solution uh, to solve that is to anchor only a cryptographic fingerprint of anonymized log data on chain, and never reveal the personal data itself. Uh, this will check both boxes, right? Both regulations, and the right to erase your will be satisfied.

Um so two products that can be built here, a compliance anchoring service which connects to existing enterprise logging structure because no one wants to rebuild the stack from scratch and anchors verifiable fingerprints to a shared neutral layer such as Ethereum and could also generate audit reports that regulators can verify. Again, you can look at EAS here. And second, a model version registry which can prove which AI model made which decision and that no single party can alter and this can be done on EAS with L2 which, you know, like base which

makes it also very cost-efficient. And I can imagine that such a model version registry will be very useful beyond AI compliance uh AI Act compliance. Think about um an AI agent accountability registry or training data provenance. And and before I close, I wanted to give a few words on how to make institutional and enterprise buyers say yes because I think an issue a lot of technically strong projects have is that they lead with the technical features when they first talk to procurement teams. And I think you have to always be mindful to use their

vocabulary not yours. And if you're talking to compliance teams about compliance solutions, talk in the regulations' language, right? So, instead of immediately saying, "Well, we use zero-knowledge proofs to preserve privacy." The compliance teams are not technical people. They will have no idea what it means. Say something like, "Our solution satisfies the unlikability requirements under eIDAS." And always describe first the why not the how, right? So, lead with the problem and show how your technology can solve the compliance issues they already have, and then the technical discussion will follow when they bring their tech people on board. But, for example, for

digital product passports, the first person you might speak to to present your solution could be the head of sustainability, and they have no interest in really knowing the the technical details. So, tell them the why, not the how first. And don't be a decentralization maxi, right? Let's let's leave that for our internal discussions, but show them rather how centralized solutions that they might have currently in place or that they are considering how they will not work. So, show them a compliance gap, like for example, there's no full unlinkability possible with a centralized solution, and so on. So, kind of make the case for

decentralization without mentioning even the word decentralization, right? Cuz that can scare them off a little bit. They don't need to believe in decentralization. They don't need to believe in Ethereum. They're looking for a solution to their compliance issue and something they can defend internally to their boss. So, be mindful of that. And I think when you do that, and and and I think what what we have seen over the over the past 20 minutes is that this is a little bit different from any other products built in this space in that no one needs convincing they have a problem, right?

There is already a a problem created by legislation that they have to solve with deadlines attached and with heavy fines up to 7% of their global turnover if they don't comply. So, that is kind of an easy way in, and the common requirements across all these three legislations that I've just mentioned is that they all require shared infrastructure in which multiple actors will use but no one should really be in charge of. So this is not an ideological preference, right? It's more of a procurement constraint. And of course they need something that is publicly verifiable, highly secure,

difficult to tamper with and this is exactly the kind of properties that Ethereum can provide. It is publicly verifiable, extremely hard to tamper with, no single vendor or institution is running it, it's securing billions in global value and it's maintained by a global ecosystem and has no time downtime since running. So I think the opportunity here in closing is to recognize where regulation is creating the requirements that Ethereum can can provide solutions to it. And then you will see I think that's often Ethereum is already structurally aligned with where the EU is going.

Thank you.