The UK’s Digital Verification Services framework is starting to progress at pace. The government published the pre‑release of Version 1.0 on 6 March 2026. This is the first revised statutory trust framework under the Data (Use & Access) Act, and it replaces the earlier “UK Digital Identity & Attributes Trust Framework” (DIATF).

On 9 June 2026, the Department of Science, Industry and Technology (DSIT) published the full statutory release of Version 1.0 and stated that it is expected to come into force on 1 September 2026, which will open the door for certification to begin. Kantara is well placed to meet this timeline, with the processes, expertise, and assessor capacity ready to support providers as soon as the framework becomes formally available for certification.

How Version 1.0 Relates to the Data (Use & Access) Act 2025

The Data (Use & Access) Act 2025 is the legislation that brought DVS onto a statutory footing. Part 2 of the Act came into force on 1 December 2025, formally moving the DVS pilot into a legally regulated environment.

Key links between the Act and Version 1.0:

• The Act establishes the statutory role of the DVS Trust Framework — Version 1.0 is the first publication written explicitly to align with this legal basis.
• The Act enabled the creation of a statutory register of certified DVS providers.
• The Act underpins the governance, oversight, and enforcement mechanisms that Version 1.0 now builds upon.

What is to be introduced in Version 1.0:

• A fully aligned statutory name — now formally the UK Digital Verification Services Trust Framework, matching the terminology in the Act.
• New rules for Orchestration and Holder Service Providers, including requirements to share metadata about identity confidence, authentication methods, and provenance.
• Support for modern authentication, including guidance on passkeys and syncable authenticators.
• The new UK CertifID Trust Mark, which providers certified to Version 1 will be able to display.

What Does This All Mean?

Certification is already mandatory for DBS digital identity checks. Looking ahead, it’s widely expected that certification for Digital Right to Work checks, Holder Service Providers (wallets), Attribute Service Providers, and Orchestration Service Providers may also become mandatory, possibly followed by requirements in areas such as Age Assurance, Smart Data schemes, and for identity providers accessing certain government services.

Regardless of these future changes, only certified providers will be eligible to appear on the statutory register — a major trust signal for the market. As of this point in time, ONLY Kantara can add providers to the register.

For organisations already certified under Gamma (0.4), this is the moment to begin preparing for the uplift to Version 1.0. For organisations not yet certified, this is the moment to get in touch for us to guide you through the certification process.

Following approval in late 2025, five new Groups officially launched between January and March 2026. Each addresses a priority area within digital identity:

Trusted Transaction Assurance Work Group (Trusted Transaction)

Bridging the gap between identity proofing and authorization, this group is developing frameworks that bind verified digital identities to legally significant actions — such as signing a mortgage, granting durable consent for care, or approving a wire transfer. It also aims to reduce market confusion around certifications and ease component integration for Credential Service Providers. The group is currently meeting regularly to develop its preliminary work plan.

Digital Identity Risk Universe Discussion Group (DIRU)

Already delivering: the DIRU DG has published a major community resource — the Digital Identity Risk Universe – 2026 and an accompanying methodology report, both freely available to the public. See the Publication section below for details. (Note: John is also exploring a video walkthrough of the Risk Universe as a marketing asset.)

Shadow AI in the Workplace Discussion Group (Shadow AI)

The rapid adoption of generative AI tools — ChatGPT, GitHub Copilot, and others — without IT approval creates real enterprise risk. Chartered in November 2025, this group has moved quickly: it has developed a preliminary outline and is now actively drafting its report, which will map causes, implications, and practical countermeasures, with a particular focus on identity-rooted detection and response.

Blinding Identity Taxonomy Discussion Group (BIT)

The BIT DG evolves and maintains a taxonomy for identifying and managing PII and quasi-identifiable information (QII) — supporting privacy-preserving data handling and enabling use cases such as filtering data unsuitable for AI training. The group is well into active development: a draft BIT Report 2.0 is already under review, with regular meetings focused on expanding and refining the taxonomy.

Biometric Data Discussion Group (Biometrics/BDDG)

Addressing the management, security, and privacy of biometric data from collection to destruction, this group will produce practical recommendations and best practices that translate complex existing standards into accessible, real-world guidance — with a focus on GDPR compliance. The group has developed a preliminary outline and is actively expanding its work plan.

To participate in any of Kantara’s Groups, complete Kantara's Group Participation Agreement (GPA).

The Digital Identity Risk Universe Discussion Group (DIRU DG) has formally published a major new community resource:

• The Digital Identity Risk Universe – 2026 (DIRU): A comprehensive spreadsheet mapping risks across the full credential lifecycle — from creation and enrollment through holder management and verification. It introduces a specialized taxonomy for emerging AI Agent/Agentic Identity risks.
• The Accompanying Report: Explains the methodology behind the framework and serves as a practical guide for risk management teams building their own internal Risk Registers.

Both files are published under Kantara's Non-Assertion Covenant IPR and are freely available to the public. Download both files here.

Editor: John Fiske

The Anchored Notice and Consent Receipts (ANCR) Work Group's Transparency Performance Indicators (TPIs) — a Kantara Recommendation developed under the leadership of Work Group Chair and Kantara Member Salvatore D'Agostino of IDmachines — have been published in IEEE Xplore following their presentation at the 2025 IEEE Symposium on Privacy Expectations (ISoPE). The paper proposes a methodology for measuring PII Controller compliance using consent record structures mapped to both technical and legal frameworks (ISO/IEC 27560:2023, GDPR, Council of Europe 108+, and others).

But the TPIs haven't stopped at publication — they're already being put to work, and recognized at the highest levels.

At CPDP 2026 (Computers, Privacy and Data Protection), one of the most significant annual gatherings in the global privacy community, Kantara Member and ANCR Work Group Editor Mark Lizar joined a distinguished panel — including the UN Special Rapporteur on the Right to Privacy — to present Transparency by Default: An Internet Transparency Code of Practice. The panel highlighted the urgent need for operational transparency frameworks that make accountability inspectable before identification is demanded and data begins to flow. Lizar's presentation drew directly on the Kantara TPI Recommendation as the foundation for exactly this kind of internet-scale transparency infrastructure — grounded in Council of Europe Convention 108+, a framework covering 2.5 billion people. It was a powerful call to action: the work Kantara's community has been quietly building is now being named as the solution the world needs.

Meanwhile, the TPIs are also finding their way into award-winning commercial products. IDmachines, in partnership with Ones Technology (Ankara, Turkey) and Intel RealSense, applied the TPI framework to add a notice and consent layer to a real-world biometric credentialing and access control deployment. The result — the BioAffix Vision Platform — earned an Honorable Mention in the Biometrics category at the 2026 SIA New Products and Solutions Awards at ISC West in Las Vegas.

Publication. Standards recognition. A UN-level call to action. Commercial deployment. This is what it looks like when Kantara Work Group outputs reach deeply into the world.

DOI: 10.1109/ISoPE67098.2025.00019 | Publisher: IEEE