1 of 41

Join. Trust. Innovate.

Kantara Initiative

Work Group Summary

2 of 41

To participate in a Kantara Group: please complete the Group Participation Agreement

3 of 41

Kantara’s Wiki

4 of 41

User Managed Access

Work Group

5 of 41

User Managed Access (UMA)

In 2025, we said we would:

Provide a support channel for Implementers and existing Implementations.

In 2025, we delivered:

Published Security Notice with guidance relating to two disclosed vulnerabilities: Pass-the-permission ticket & Malicious Authorization Server.

6 of 41

UMA - 2026 Goals

Continue to support existing implementers and implementations.
Respond to new ideas from our community.

7 of 41

Anchored Notice and Consent Receipts Work Group

8 of 41

Anchored Notice and Consents Receipt (ANCR)

2025 Activity:

Published the Transparency Performance Indicators (TPIs) - A Kantara Recommendation.
Applied and demonstrated use of TPIs.

Valid and Legal Basis of Consent.

Cookies.
Privacy Policies.
Surveillance Notice.

Notice Controller Record (Appendix A).

Notice Controller Schema.
Demo Credential and Record.
Multi-framework legal and technical mappings: GDPR, CoE, 108+, NIST, W3C, and IEEE.

9 of 41

Anchored Notice and Consents Receipt (ANCR)

Transparency Performance Reporting:

Tools for people and regulators to control personal data use and understand risk.
Focuses on required notices and disclosures by PII Controllers.
Authority for people through interoperable open standards, laws, and regulations.
Does NOT require identification of PII Principal.

WG license excludes use for surveillance of PII Principal.

10 of 41

Publication of TPI paper by IEEE as part of International Symposium on Privacy Expectations.
New Product Solution Award TPI Layer YouTube
Transparency by Default: An Internet Transparency Code of Practice aligning with Council of Europe 108+ baseline in TPIs.

Speech to Computers, Privacy and Data Protection 2026

ANCR - 2026 Activities

11 of 41

TPI 1 - Timing of Notice:

Captures when the Controller’s legal entity and accountable Privacy Officer (digital identifiers) provide notice.

TPI 2 - Required Data Elements:

Captures the extent to which the required data elements for processing are available.

TPI 3 - Transparency Accessibility

Measures the performance of transparency accessibility by capturing availability of required information in TPI 2.

TPI 4 - Security Information Integrity

Captures the certificate or security keys to compare its meta-data against the required information in TPI 2.

ANCR - Transparency Performance Indicators (TPIs)

12 of 41

Next year, we will:

ISO TS 27560:2024 and ISO Liaison

Consent Record Information Structure (free to use due to inclusion and reference to Kantara Consent Receipt v1.1 license).

Promote and demonstrate TPIs

TPIs leverage open (free) technical standards and legal stack (ISO 29100, 27560, NIST 800-53).
Notice required across regimes, including AI.
Tool for Kantara frameworks and Assessors.
Map and assess onboarding as Kantara Member and WG Participant.

Build Community through Collaboration

Identiverse, IEEE, other Kantara WGs and Communities.

ANCR - 2026 Activity

13 of 41

Resilient Identifiers for Underserved Populations Work Group

14 of 41

Resilient Identifiers for Underserved Populations (RIUP)

In 2025, we said we would:

Publish Purpose and Consent Query Framework.
Begin work on Digital Identifier Inclusion Report v1.1.
Update Mobile Assurance Statement.
Continue outreach to national and local organizations to promote the DII and PCQ recommendations.

In 2025, we delivered:

Inclusive Purpose and Consent Query Framework (Q3 2025).
Subject Delegation of Authority (To be published in early 2026).
Promoted RIUP, DII and IPCQ.

Connected with Digital Identity Community of Practice as sponsored by the Digital Benefits Network (Quinny Sanchez joined RIUP).

15 of 41

Publish Inclusive Purpose and Consent Query (Q1 in queue for approval)
Publish Subject Delegation of Authority (Q1-Submitted for review).
Update Digital Identifier Inclusion Report (Q2).
Update Mobile Assurance Statement (Q3).
Continue outreach with tech policy organizations and state and local government and NGOs for use case development.
Prepare brief announcements of work group activities on an ongoing basis, featuring groups and organizations currently applying identity solutions for vulnerable populations.

Eg. Entidad was a recipient of the 2025 JMK Innovation Prize for Unmio app serving farm workers (Jorge Flores, RIUP member).

RIUP - 2026 Activities

16 of 41

Fig. 1 Wallet Boundaries

RIUP - 2026 Activities

Fig. 2 Verifier Boundaries

Subject Delegation of Authority

Inclusive Purpose Consent Query

17 of 41

Privacy Enhancing Mobile Credentials Work Group

18 of 41

Privacy Enhancing Mobile Credentials (PEMC)

2025 Activities:

Published Requirements for Privacy Enhancing Mobile Credentials - A Kantara Initiative Recommendation.
Began work on PEMC Conformance Testing.

19 of 41

For each requirement, the report provides the following elements:

An explanatory note to provide guidance to the assessor.
Applicability: What stakeholders need to address the requirement (e.g. Issuers, Verifiers, or Wallet/App Providers).
What functional pre-conditions are necessary to test the requirement.
What are the observations to be made.
Success Criteria.

PEMC - Conformance Testing

20 of 41

PEMC Requirements by Privacy Principle

21 of 41

Workstream 2 will start with developing the scope and goals for what happens when the privacy principles in PEMC 1.x are extended beyond in person presentations. This will include 18013-7 and we are discussing the impact of agentic AI in this space.

Workstream 1 is focused on updating PEMC requirements for in-person presentations based on Implementor feedback. The result will be PEMC Requirements 1.1 with the same scope as 1.0

PEMC - 2026 Activities & Results

Two Workstreams: PEMC Requirements 1.1 & PEMC Requirements 2.0

22 of 41

Blinding Identity Taxonomy Discussion Group (BIT)

23 of 41

Blinding Identity Taxonomy Discussion Group (BIT)

Purpose: To evolve and maintain the BIT as an informative taxonomy for identifying and managing personally identifiable information (PII) and quasi-identifiable information (QII).

Objective: To establish the BIT as a Kantara product by producing a BIT Report 2.0 and BIT Supplementary Report 2.0.

Status: Regular Meetings are taking place to review the draft BIT 2.0!

24 of 41

BIT - 2026 Activities

25 of 41

Shadow AI in the Workplace Discussion Group

(Shadow AI)

26 of 41

Shadow AI in the Workplace Discussion Group

(Shadow AI)

Purpose: To identify and explore the causes, risks and implications, and mitigation strategies related to Shadow AI (the sanctioned use of AI tools) in enterprise environments.

Output: To produce a Report that outlines the risks, organizational vulnerabilities, and practical countermeasures.

Status: Regular Meetings are taking place to develop a preliminary outline and workplan!

27 of 41

Chartered Nov 2025; developing governance guidance on Shadow AI
Unsanctioned employee use of AI tools - focused on risks, detection, and identity-rooted countermeasures
Transitioned from outline review to active drafting
Expanding participation via Kantara newsletter and LinkedIn outreach

Shadow AI - 2026 Activities & Results

28 of 41

Biometric Data Discussion Group (Biometrics)

29 of 41

Biometric Data Discussion Group (Biometrics)

Purpose: To address the management, security, and privacy of biometric data throughout its life-cycle by decoding and translating standards with a focus on practical application and GDPR compliance.

Output: To produce a set of recommendations and best practices for biometric data management for use alongside existing standards.

Status: Regular Meetings are taking place to develop a preliminary outline and workplan!

30 of 41

BDDG - 2026 Activities & Results

31 of 41

Digital Identity Risk Universe Discussion Group

(Risk Universe)

32 of 41

Digital Identity Risk Universe Discussion Group

(Risk Universe)

Purpose: To develop a holistic risk universe landing on trustworthiness (is the credential trustworthy?), privacy (what privacy risks are incurred when using the credential?), and security (what are the associated end-to-end security risks with the credential?).

Output: A report and accompanying risk map that explores the three risk domains in depth.

Status: Output is published and available on Kantara’s website!

33 of 41

DIRU - 2026 Activities & Results

34 of 41

Trusted Transaction Assurance Work Group (Trusted Transaction)

35 of 41

Trusted Transaction Assurance Work Group (Trusted Transaction)

Purpose: To address various market-level and downstream challenges associated with the release of NIST SP 800-63 v4, a modern and modular framework for identity proofing.

Output: To produce the necessary frameworks to unlock the potential of a componentized, high-assurance identify ecosystem.

Status: Regular Meetings are taking place to develop a preliminary workplan!

36 of 41

TTA - 2026 Activities

37 of 41

Thank you – get in touch!

+1 (571) 475-8895

www.kantarainitiative.org

@KantaraInitiative

hello@kantarainitiative.org

38 of 41

Work/Discussion Group Full Name

39 of 41

Full Work Group Name (Acronym)

In 2025, we said we would:

Bullet 1
Bullet 2
Bullet 3

In 2025, we delivered:

Bullet 1
Bullet 2
Bullet 3

40 of 41

Use this slide for 2025/2026 graphs/figures/images/other illustrations

WG Acronym

41 of 41

If space permits-include a quote/image/figure/etc

Next year, we will:

Bullet 1
Bullet 2
Bullet 3

WG Acronym - 2026 Goals