Every digital interaction starts with a question:
Who, or what, am I dealing with?
A digitally signed document, credential or product record can prove it has not been altered and which issuer signed it. It cannot prove that the issuer should be trusted. Closing that gap is what trust infrastructure is for.
Is the engineer’s stamp on this design valid? Are this product’s components, and its origin, what they claim to be? Is this AI agent acting for who it claims? Each question comes down to the same thing: who may vouch, and can it be checked quickly?
Two pieces, two jobs
Trust anchor
Sets the rules
The authority everyone agrees to rely on. Its legitimacy comes from outside the system: legislation, a governance framework, a public mandate. Anchors change rarely.
Trust registry
Confirms who may vouch, right now
The live record of which issuers are authorized under those rules. Entries are added, suspended and revoked as circumstances change.
Think of a professional licence. In Canada, provincial legislation gives a regulator, such as an engineering association or order, the authority to license engineers. That legal mandate is the anchor. The registry confirms which regulators hold that authority. The engineer’s licence is the credential, and its status is checked with the regulator. When a licence is revoked, neither the mandate nor the registry changes. The licence simply stops checking out.
Keeping the pieces separate matters. Assurance depends on independence: the party that sets the rules, the party that keeps the registry, and the parties listed in it are distinct, so people have recourse when something goes wrong.
Registries list issuers, not people
- They record who may vouch, never the individuals or records those bodies vouch for.
- The source keeps the data. What travels is a signed proof derived from it.
- Checks reveal only what is needed, such as “yes, licensed” or “yes, over 25”.
This is about settling trust, not pooling data. Learn more about trusted data sharing.
The same pattern, everywhere
| Example | The question | Trust anchor (sets the rules) | Trust registry (confirms who may vouch) |
|---|---|---|---|
| Professional licence | Is this engineer licensed today? | The regulator’s legal mandate, set in provincial legislation | The regulators authorized to issue licences |
| Exporter Know your business | Is this company real and in good standing? | Business registration law | The business registries authorized to vouch for companies |
| Supply chain Know your supply chain | Can I trust where this product, and each of its components, came from? | Origin, safety and sustainability rules, and the conformity assessment bodies accredited to certify them | The certifiers accredited to vouch, at each step of the chain |
| AI agent Know your agent | Who built this agent, and what may it do? | Several competing approaches, with no shared rules yet | Early agent registries, not yet interoperable |
These checks can also be linked. A product record can carry verified claims about each of its components, each traceable to an accredited source, and be recognized by trading partners abroad.
Where anchors and registries fit
Anchors and registries work alongside three other pieces of trust infrastructure:
- Conformity assessment checks that issuers and their processes meet the required standards. Our assessments
- Trusted data sharing keeps data with its source while partners collaborate. The data stays with its source
- Recognition across borders lets other jurisdictions rely on Canadian anchors. Gaia-X Hub Canada
What we are working toward
Models already exist internationally, and as Gaia-X Hub Canada we can learn from what is working elsewhere.
This builds on our Pan-Canadian Trust Registry Community of Practice which, in 2023 and with support from CIRA, examined a registry of registries model that provides information rather than decisions and leaves each registry in charge of its own governance. The Trust Registries component of the Pan-Canadian Trust Framework offers a recognized Canadian reference.
Further reading: Pan-Canadian Trust Registry Community of Practice: Final Report · DIACC, PCTF Trust Registries (Final Recommendation)
Emerging work
Trust for AI agents
AI agents increasingly act for people and businesses: booking, buying, negotiating and sharing data. Before relying on one, you need to know who built it, who answers for it, what it is authorized to do, and whether that authority has been withdrawn. These are the same questions trust anchors and registries already answer for people and organizations. Shared ways to answer them for agents are still taking shape, and our earlier registry work gives us a starting point.
Where is trust costing your organization today?
We are convening a broader conversation on federated, secure and sovereign data infrastructure for Canada, one that enables trusted data exchange, protects privacy, and connects Canada globally. Whether you share data, rely on it, or set the rules it follows, we would welcome your perspective.