Digital Twins Under EU Law: A Unified Compliance Framework Across Smart Cities, Industry, Transportation, and Energy Systems

Abstract

Digital Twins are becoming central enablers of Europe’s digital and green transitions, yet their data-intensive and autonomous nature exposes them to one of the most complex regulatory environments in the world. This article presents a comprehensive scoping review of how six principal European digital laws—the General Data Protection Regulation, Data Governance Act, Data Act, Artificial Intelligence Act, NIS2 Directive, and Cyber Resilience Act—jointly govern the design, deployment, and operation of Digital Twin systems. Building on the PRISMA-ScR methodology, the study constructs a Unified Digital Twin Compliance Framework (UDTCF) that consolidates overlapping obligations across data governance, privacy, cybersecurity, transparency, interoperability, and ethical responsibility. The framework is operationalised through a Digital Twin Compliance Evaluation Matrix (DTCEM) that enables qualitative assessment of compliance maturity in research and innovation projects. Applying these tools to representative European cases in Smart Cities, Industrial Manufacturing, Transportation, and Energy Systems reveals strong convergence in data governance, security, and interoperability, but also persistent gaps in the transparency, explainability, and accountability of AI-driven components. The findings demonstrate that European digital legislation forms a coherent yet fragmented ecosystem that increasingly requires integration through compliance-by-design methodologies. The article concludes that Digital Twins can act not only as regulated technologies but also as compliance infrastructures themselves, embedding legal, ethical, and technical safeguards that reinforce Europe’s vision for trustworthy, resilient, and human-centric digital transformation.

1. Introduction

The Digital Twin has emerged as one of the most transformative concepts in the digitalisation of physical systems. Originally formulated within product lifecycle management and aerospace engineering, it was conceived as a virtual representation of a physical asset that remains continuously synchronised through data exchange [1]. Early articulations defined the twin as a high-fidelity virtual counterpart capable of mirroring a product or system throughout its lifecycle, assimilating sensor data and simulation models to support monitoring, diagnostics, and predictive decision-making [2]. This concept evolved into a general paradigm for the integration of cyber-physical systems, combining virtual models, real-time data, and control mechanisms to enable intelligent management of complex infrastructures [3].

In this paradigm, a Digital Twin is understood as a persistent, data-driven virtual counterpart of a physical entity, process, or system. It maintains a bidirectional connection with its physical counterpart through sensing, communication, and control. The twin ingests data from the physical world, updates internal models, and generates predictions and decisions that can be enacted in the physical system [4]. This continuous feedback loop allows the twin to support design optimisation, operational efficiency, maintenance forecasting, and end-of-life management. Digital twins integrate hybrid modelling techniques that combine physics-based and machine-learning approaches, semantic data layers that ensure interoperability across domains, and uncertainty quantification that provides confidence in predictions and automated decisions [5]. The resulting systems span multiple levels of complexity, from product and process twins to large-scale system twins representing factories [6], transportation networks [7], power grids [8], and cities [9].

The technological architecture of a Digital Twin typically comprises five interrelated layers: the physical asset instrumented with sensors and actuators; a communication layer that enables secure and reliable data exchange; a virtual layer containing physics-based and data-driven models; a synchronisation layer that maintains alignment between physical and virtual states in time and context; and a service layer providing analytics, visualisation, and control functionalities [4]. Through this architecture, Digital Twins transform raw data into actionable knowledge, enabling real-time decision support, optimisation, and increasingly autonomous operation. As their fidelity and autonomy increase, they evolve from descriptive models to predictive and prescriptive systems that interact directly with the physical world.

These characteristics make Digital Twins powerful enablers of digital transformation across all major sectors of the European economy. In smart cities, they enable planners to simulate urban planning [10], integrate renewable energy [11], and improve mobility systems [12]. In industry, they support production-line optimisation [13], predictive maintenance [14], and supply-chain resilience [15]. In mobility and transportation, they underpin connected and autonomous vehicles that continuously exchange data with cloud-based models [16]. In energy systems, they facilitate integration of renewable resources [17], real-time grid balancing [18], and distributed energy management [19]. The convergence of these capabilities creates a foundational infrastructure for Europe’s data-driven, sustainable, and resilient economy.

However, the same data-intensive and autonomous features that define Digital Twins also make them exceptionally sensitive to the European Union’s comprehensive framework of digital legislation [20]. Each component of a Digital Twin corresponds to specific legal domains that regulate how data and intelligent systems are designed and operated. The General Data Protection Regulation [21] governs personal data collected through sensors, logs, and user interactions, establishing principles of lawful processing, transparency, and individual control. The Data Governance Act [22] and the Data Act [23] define how industrial and public data can be shared, reused, and exchanged under fair and transparent conditions. The Artificial Intelligence Act [24] introduces obligations for trustworthy and human-centric AI systems that underpin learning-enabled twins. The NIS2 Directive [25] establishes cybersecurity and resilience requirements for networked infrastructures, while the Cyber Resilience Act [26] mandates security-by-design principles for software and hardware components. Together, these instruments form an integrated yet fragmented legal environment that profoundly shapes the design, deployment, and operation of Digital Twin systems within the European Union.

The interaction between technical architectures and legal frameworks gives rise to a multidimensional compliance challenge. A single Digital Twin may simultaneously be subject to multiple regulatory obligations depending on its data sources, modelling methods, and connectivity patterns. Managing these overlapping requirements demands a unified approach that links the technical, organisational, and legal dimensions of system development. Compliance-by-design becomes not only a regulatory necessity but also a technical discipline that ensures accountability, interoperability, and trustworthiness throughout the lifecycle of the Digital Twin.

Against this background, this article provides a comprehensive review of how European digital regulations affect the development and deployment of Digital Twins across four key domains: smart cities, industry, mobility, and energy systems. It analyses how each legal instrument addresses specific challenges such as pervasive data collection, algorithmic decision-making, data sharing, and cybersecurity. Real-world examples illustrate both the benefits of Digital Twin technology and the compliance measures required for lawful and ethical operation. The article further proposes a unified compliance framework that aligns the requirements of the main EU legal acts with the technical architecture of Digital Twins, offering a structured pathway towards trustworthy and regulation-aligned innovation. By clarifying how Digital Twins intersect with the European legal order, the discussion contributes to advancing their responsible adoption as central enablers of Europe’s digital and green transitions. While previous studies typically analyse EU digital regulations in isolation, no existing work integrates the GDPR, DGA, Data Act, AI Act, NIS2, and CRA into a unified compliance model capable of guiding Digital Twin system design across domains. This article addresses this gap by proposing the first cross-sector, article-level legal-to-technical synthesis that links EU regulatory obligations directly to Digital Twin architecture, lifecycle governance, and evaluation criteria. To demonstrate the framework’s empirical validity, the study applies and evaluates it across four strategic sectors, Smart Cities, Industrial Manufacturing, Mobility and Transportation, and Energy Systems, thereby providing a cross-domain analysis of how compliance maturity manifests within the European Digital Single Market. Throughout this demonstration, the term ‘Digital Twin’ is generally used in its established technical meaning as a virtual counterpart continuously synchronised with a physical system through bidirectional data exchange, without any further distinction between different variants such as digital models, digital shadows, or digital threads.

The remainder of this article is structured as follows. Section 2 presents the research design and methodological framework employed in the study. Section 3 examines the European Union’s principal digital laws and their implications for Digital Twin systems. Section 4 introduces the integrated compliance framework and its evaluation matrix, which together form the conceptual foundation of the analysis. Section 5, Section 6, Section 7 and Section 8 apply these tools across the selected sectors, while Section 9 discusses cross-sectoral insights. Finally, Section 10 concludes the article with key findings and directions for future research and policy development.

2. Methodology

This study employs a multi-phase methodological design that integrates legal scoping analysis, framework development, and cross-sectoral evaluation. The approach combines the systematic mapping principles of the Preferred Reporting Items for Systematic Reviews and Meta-Analyses extension for Scoping Reviews (PRISMA-ScR) with design-science reasoning. The objective was to construct and validate a unified compliance framework that consolidates obligations from six principal European digital laws and operationalises them as actionable principles for Digital Twin design and governance. The methodology comprises three interdependent phases: (1) legal scoping and knowledge synthesis, (2) framework development, and (3) framework validation through case application.

2.1. Research Design and Objectives

The methodological architecture was designed to capture both the legal and technical dimensions of Digital Twin compliance under European law. The first phase systematically mapped the Union’s legislative corpus governing data protection, artificial intelligence, data sharing, and cybersecurity.

The second phase synthesised these findings into a conceptual and operational framework defining the principal compliance domains for Digital Twin systems. The third phase applied and evaluated this framework across representative European cases to test its interpretive robustness and cross-sectoral relevance. The study was guided by four research questions:

1.

Which European legal instruments collectively regulate Digital Twin systems within and across the selected sectors?

2.

How do the provisions of these instruments interact to create cumulative or overlapping compliance obligations?

3.

What unified framework can support lawful, secure, and interoperable Digital Twin implementation within the European Digital Single Market?

4.

How can the proposed framework be validated through cross-sectoral case application to assess its interpretive robustness and practical effectiveness?

This design positions the study not only as a scoping review of European digital regulation but also as an integrated research and development process culminating in the construction and empirical validation of the Unified Digital Twin Compliance Framework (UDTCF).

2.2. Phase 1: Legal Scoping and Knowledge Synthesis

The first research phase applied a structured scoping-review methodology based on the PRISMA-ScR guidelines. Its purpose was to map and synthesise the European Union’s digital legislative corpus that regulates the design, deployment, and operation of Digital Twin systems. The analysis identified, classified, and interpreted legal instruments that collectively define the normative, technical, and organisational foundations for lawful and trustworthy Digital Twin innovation within the European Digital Single Market.

2.2.1. Eligibility Criteria and Conceptual Boundaries

Eligibility criteria ensured inclusion of legally binding and technologically relevant instruments. The review considered EU regulations, directives, and legislative proposals adopted, published, or under final negotiation between 2016 and 2025, the period in which Europe’s digital-governance architecture consolidated after adoption of the GDPR. Documents were included if they

• Regulated or substantively influenced the collection, sharing, processing, or protection of digital data and intelligent systems.
• Contained provisions affecting cross-sectoral data governance, artificial-intelligence oversight, or cybersecurity of digital infrastructures.
• Were published in consolidated form on EUR-Lex or in official repositories of the European Commission or ENISA.
• Were applicable across multiple sectors, including smart cities, industry, mobility, and energy systems.

Excluded were repealed legislation, national measures, non-binding communications, soft-law instruments, or technical standards lacking direct regulatory authority. The temporal and thematic boundaries ensured comprehensive coverage of the six flagship legislative acts defining the EU’s digital legal order.

2.2.2. Information Sources and Search Strategy

Primary legal texts were retrieved from the following authoritative sources:

• EUR-Lex: for consolidated EU regulations, directives, and legislative proposals.
• ENISA (European Union Agency for Cybersecurity): for cybersecurity-related directives and technical guidelines.
• CORDIS and the Publication Office of the European Union: for interpretative reports, policy evaluations, and impact assessments complementing legal texts.

The search strategy combined controlled and free-text terms to capture all relevant instruments. Search expressions used Boolean combinations such as “data protection regulation” OR “GDPR” AND “Digital Twin”, “data governance act” OR “data act”, “artificial intelligence act” OR “AIA”, “network and information security directive” OR “NIS2”, and “cyber resilience act”. To ensure comprehensive coverage, each query was further refined with contextual keywords (“smart city”, “industry”, “mobility”, “energy system”) and executed in English and official EU languages. Searches were performed between January and July 2025 and limited to official EU documents to ensure authenticity and legal validity. The study included legal texts from EUR-Lex and ENISA alongside academic literature to ensure the scoping review captured both regulatory substance and interpretive scholarship.

2.2.3. Source Selection and Screening Procedure

Source selection followed the PRISMA-ScR four-stage workflow: identification, screening, eligibility, and inclusion.

• Identification: An initial pool of 910 records was retrieved from the databases listed above.
• Screening: Titles and abstracts were reviewed for thematic relevance to Digital Twin governance and EU digital-law domains, reducing the corpus to 114 documents.
• Eligibility: Full-text analysis assessed legal status, scope, and relevance to cross-sectoral data, AI, or cybersecurity governance. Documents failing to meet these criteria (e.g., national implementations or purely technical standards) were excluded.
• Inclusion: Six principal instruments met all criteria and constitute the analytical core of this study:

  ○

  General Data Protection Regulation (GDPR, Regulation (EU) 2016/679)

  ○

  Data Governance Act (DGA, Regulation (EU) 2022/868)

  ○

  Data Act (DA, Regulation (EU) 2023/2854)

  ○

  Artificial Intelligence Act (AIA, Regulation (EU) 2024/1689)

  ○

  NIS2 Directive (Directive (EU) 2022/2555)

  ○

  Cyber Resilience Act (CRA, Regulation (EU) 2024/XXXX)

The selection process is summarised in Figure 1, which presents the PRISMA-ScR flow diagram adapted for legal-document reviews. The diagram details the number of records identified, screened, excluded, and retained for qualitative synthesis, thereby ensuring transparency and reproducibility of the review process. The following counts reflect document flow through each stage: 910 records identified; 910 screened after duplicates removed; 129 reports sought for retrieval; 114 assessed for eligibility; 6 primary legal instruments analysed and included.

Figure 1. PRISMA-ScR flow diagram for EU regulations related to Digital Twins.

2.2.4. Analytical Coding and Synthesis

Each included instrument was examined using a structured coding and charting scheme. Articles, recitals, and annexes were coded according to objectives, obligations, and implications for seven thematic dimensions: data governance, privacy, cybersecurity, accountability, interoperability, transparency, and ethics. Coded data were recorded in a comparative matrix noting article number, legal objective, compliance obligation, and technical implication. Thematic synthesis identified overlaps, complementarities, and inter-dependencies among the six acts. This cross-law synthesis generated a comprehensive matrix of obligations that served as the empirical foundation for developing the Unified Digital Twin Compliance Framework (UDTCF) described in Phase 2.

2.2.5. Literature Scoping for Methodological Novelty

In parallel with the legal mapping, a targeted literature scoping established whether comparable methodological frameworks had been proposed in peer-reviewed articles. This complementary search ensured that the UDTCF developed here represents a novel contribution rather than a reformulation of existing approaches. The literature scoping followed the same procedural discipline as the legal review but focused exclusively on academic sources addressing compliance or governance methodologies for Digital Twin systems under EU law.

Searches covered Scopus, Web of Science, IEEE Xplore, ScienceDirect, and SpringerLink, spanning 2018–2025 to capture the period when Digital Twin research matured alongside the evolution of EU digital legislation. Combined search terms included “Digital Twin”, “compliance framework”, “data governance”, “AI Act”, “GDPR”, “Data Act”, and “EU regulation”.

Results were screened by title, abstract, and keywords to identify studies proposing conceptual or operational frameworks for regulatory compliance in Digital Twins or related cyber-physical systems. Exclusions covered papers confined to technical architectures or sector-specific use without regulatory analysis. The final corpus comprised 9 publications showed in Table 1.

Table 1. Related literature covering comparable methodological frameworks.

EU Law	Sources
General Data Protection Regulation (GDPR)	[20,27,28,29,30]
Data Governance Act (DGA)	[20,31,32]
Data Act (DA)	[20,31,32,33]
Artificial Intelligence Act (AIA)	[20,32]
NIS2 Directive	[32,33,34]
Cyber Resilience Act (CRA)	[32,33]

The analysis of the article in Table 1 showed that existing studies treat individual legal instruments in isolation, most often the GDPR or Data Act, without integrating the six major EU laws into a single, cross-sectoral compliance model. Hence, existing frameworks address individual domains and lack a comprehensive legal–technical synthesis applicable across sectors. This confirmed the methodological novelty of both the UDTCF and its companion instrument, the Digital Twin Compliance Evaluation Matrix (DTCEM), establishing the study’s unique contribution to legal scholarship and Digital Twin research.

2.3. Phase 2: Framework Development

Building on the regulatory corpus identified through the PRISMA-ScR process, the second phase developed a unified framework translating complex and overlapping EU obligations into an integrated compliance model for Digital Twin systems. This phase applied a design-science logic, combining deductive legal synthesis with inductive conceptual modelling to derive a normative, technical, and organisational framework relevant across multiple domains of deployment.

2.3.1. Conceptual Modelling Process

The framework development process began with a comparative analysis of the six legal instruments identified in Phase 1: the General Data Protection Regulation (GDPR), the Data Governance Act (DGA), the Data Act (DA), the Artificial Intelligence Act (AIA), the NIS2 Directive, and the Cyber Resilience Act (CRA). Each act was decomposed in phase 1 into coded provisions corresponding to specific legal obligations and governance principles. Cross-law analysis then identified convergent themes and dependencies, such as data-access governance, privacy-by-design, risk management, cybersecurity resilience, and transparency of artificial intelligence systems. Through iterative synthesis, these recurring themes were abstracted into seven meta-categories representing the fundamental compliance domains for Digital Twin systems:

• Data Governance and Access Control
• Data Protection and Privacy
• Cybersecurity and Resilience
• Accountability and Risk Management
• Transparency and Trust
• Interoperability and Standardisation
• Ethical and Social Responsibility

Together, these meta-categories form the Unified Digital Twin Compliance Framework (UDTCF), which establishes a consolidated structure linking legal requirements to the architectural, procedural, and ethical dimensions of Digital Twin design and operation.

2.3.2. Framework Structuring and Operationalisation

Once the seven meta-categories were defined, their constituent legal and technical obligations were mapped against the functional architecture of Digital Twin systems, data acquisition, modelling, communication, synchronisation, and service layers, to establish direct correspondence between regulatory provisions and system components. This mapping ensured that each compliance domain could be operationalised through measurable technical and organisational mechanisms.

To facilitate systematic evaluation, the UDTCF was translated into a structured analytical instrument, the Digital Twin Compliance Evaluation Matrix (DTCEM). The DTCEM converts each meta-category into a set of qualitative indicators and defines a four-level compliance scale: Non-Compliant, Partially Compliant, Compliant, and Fully Compliant, enabling assessment of compliance maturity in research and innovation projects. This operationalisation bridges normative legal interpretation and practical engineering implementation, creating a replicable framework for assessing lawful and trustworthy Digital Twin design.

2.4. Phase 3: Framework Validation Through Case Application

The interpretive validity and practical relevance of the UDTCF and DTCEM were tested on representative European Digital Twin initiatives across four sectors: Smart Cities, Industrial Manufacturing, Mobility and Transportation, and Energy Systems. Case identification followed a transparent, multi-source procedure drawing from the CORDIS database, the Smart Cities Marketplace, and institutional or industrial repositories. Supplementary searches covered national and regional innovation portals such as the European Energy Research Alliance and the Digital Europe Programme directory. A total of 45 candidates were identified and screened against four inclusion criteria:

• A clearly defined Digital Twin concept with public documentation;
• Association with one of the four target sectors;
• Availability of sufficient legal, organisational, and technical evidence for DTCEM assessment;
• Explicit alignment with EU digital-policy objectives.

Twelve cases, three per sector, fulfilled all criteria and together represent a balanced cross-section of European Digital Twin practice. Each case was evaluated against the seven meta-categories of the DTCEM using the four-level scale. Evidence derived from project deliverables, institutional reports, and policy frameworks. To ensure analytical consistency, all assessments were independently reviewed by both authors, providing cross-validation of interpretation and reducing subjectivity in qualitative scoring. This validation procedure confirmed that the UDTCF offers a coherent structure for integrating overlapping EU requirements into the technical and organisational lifecycle of Digital Twins. The results of this evaluation are presented in Section 5, Section 6, Section 7 and Section 8, which detail sector-specific compliance assessments.

2.5. Rationale for the Multi-Phase Approach

The three-phase methodology: legal scoping, framework development, and empirical evaluation, captures the multidisciplinary nature of Digital Twin research at the intersection of law, governance, and cyber-physical engineering. The scoping phase establishes a verifiable regulatory corpus through the PRISMA-ScR procedure, ensuring transparency, completeness, and traceability. The framework-development phase transforms this corpus into a structured compliance model bridging legal norms and technical design, thereby advancing the field of compliance-by-design. The evaluation phase verifies the framework’s empirical relevance by applying it to real-world cases across Europe’s strategic digital and green-transition sectors. Together, these phases form a continuous methodological cycle linking normative governance with practical engineering. The approach extends beyond conventional legal analysis by providing a reproducible pathway for designing, testing, and validating compliance frameworks within the European digital ecosystem.

3. EU Laws and Digital Twins

In the European Union, a robust and evolving framework of laws governs data protection, artificial intelligence, data sharing, and cybersecurity, all of which directly impact the design and operation of digital twin systems. The multidimensional architecture of Digital Twins—spanning data acquisition, model-based analytics, connectivity, and actuation—means that each functional layer intersects with a specific area of legal oversight. The General Data Protection Regulation (GDPR) safeguards personal data and privacy, while the Data Governance Act and the Data Act define conditions for secure, fair, and interoperable data sharing across organisations and sectors. The Artificial Intelligence Act introduces obligations for transparency, risk management, and accountability of AI-driven components. The NIS2 Directive and the Cyber Resilience Act impose requirements for cybersecurity, system integrity, and secure product design. Together, these instruments create an interdependent compliance landscape that digital twin developers and adopters must navigate. European regulators aim to ensure transparency, privacy, safety, and security in these emerging technologies, yet organisations often face uncertainty in interpreting how general legal principles apply to the novel context of digital twins, from questions of data ownership and consent to liability for algorithmic decisions. The following sections examine these six legal instruments in detail, outlining how their provisions collectively shape the lawful and trustworthy deployment of digital twin systems within the European Union.

3.1. General Data Protection Regulation (GDPR)

The General Data Protection Regulation (Regulation (EU) 2016/679) establishes the legal framework for the protection of personal data and the free movement of such data within the European Union. It replaces Directive 95/46/EC and constitutes a binding legal instrument directly applicable in all Member States. The Regulation aims to ensure a consistent and high level of protection of natural persons with regard to the processing of personal data while safeguarding the fundamental rights and freedoms enshrined in the Charter of Fundamental Rights of the European Union. It further seeks to harmonise the conditions for lawful data processing across the Union and to strengthen the principles of accountability, transparency, and individual control over personal information.

The Regulation is structured into eleven chapters that set out the principles, rights, and obligations governing the processing of personal data. Its provisions define the responsibilities of controllers and processors, specify the legal bases for processing, and establish mechanisms for supervisory oversight and enforcement. The Regulation also outlines the rights of data subjects, including access, rectification, erasure, and portability, and introduces safeguards for automated decision-making and data transfers beyond the Union.

Although the General Data Protection Regulation contains ninety-nine articles in total, certain provisions constitute its essential core. These define the scope, fundamental principles, and lawful grounds for processing, as well as the mechanisms ensuring compliance, accountability, and protection of data subjects’ rights. The most important articles can be grouped according to their regulatory function: general provisions defining the scope and applicability of the Regulation; substantive provisions articulating the principles and conditions of lawful processing; procedural provisions detailing data subject rights and controller obligations; and enforcement provisions establishing governance, remedies, and penalties.

Table 2 presents a structured overview of these key articles, outlining their titles, central obligations, and relevance within the overall regulatory framework. To enhance the practical applicability of this overview, a third column summarises the implications for compliance in research and innovation projects that involve complex data processing environments, such as those applying Digital Twins, artificial intelligence, or advanced information systems. This integrated presentation links the legal principles of the Regulation with the operational and technical considerations essential for ensuring conformity in data-driven research and innovation activities.

Table 2. Overview of the most important articles of the General Data Protection Regulation (EU) 2016/679 and their implications for compliance in research and innovation projects.

Article	Key Obligation	Implications for Compliance in Research and Innovation Projects (Digital Twins)
Art. 1–3—Subject-matter, Scope, and Territorial Application	Defines who and what the GDPR applies to, including EU and non-EU entities offering goods, services, or monitoring individuals within the Union.	Research consortia and digital twin platforms must assess jurisdictional applicability and ensure compliance across all project partners handling personal data.
Art. 4—Definitions	Provides legal definitions such as personal data, processing, controller, processor, and consent.	Clarifies roles and responsibilities among project partners and data-handling entities within the digital twin environment.
Art. 5—Principles Relating to Processing of Personal Data	Establishes core principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity/confidentiality, and accountability.	Digital twin data pipelines must be designed to enforce minimisation, accuracy, and accountability throughout the lifecycle.
Art. 6—Lawfulness of Processing	Specifies lawful bases for processing (consent, contract, legal obligation, vital interests, public interest, legitimate interests).	Each processing activity within the digital twin must be mapped to a lawful basis to ensure documented and verifiable compliance.
Art. 7—Conditions for Consent	Defines criteria for valid consent (freely given, specific, informed, unambiguous, and withdrawable).	Consent must be explicit, easily withdrawn, and clearly documented for all data processed within digital twin systems.
Art. 9–10—Processing of Special Categories and Criminal Data	Restricts processing of sensitive data and mandates safeguards for criminal data.	Sensitive categories require specific risk assessments and explicit safeguards integrated into digital twin workflows.
Art. 12–14—Transparent Information and Communication	Requires clear and accessible information for data subjects on data collection and use.	Project participants must ensure transparency through accessible, verifiable, and standardised information formats.
Art. 15—Right of Access	Grants individuals the right to obtain copies of their data and processing details.	Digital twin architectures must provide secure mechanisms for individuals to access and review personal data related to them.
Art. 16–18—Rectification, Erasure, and Restriction	Establishes rights to correct, delete, or restrict processing of personal data.	Systems must include features enabling correction, deletion, or restriction of personal data across datasets and simulations.
Art. 20—Right to Data Portability	Allows individuals to obtain and reuse personal data in structured, interoperable formats.	Data formats and interfaces in digital twin systems should support machine-readable exports to facilitate portability.
Art. 21–22—Right to Object and Automated Decision-Making	Grants individuals rights to object to processing and restrict automated decisions or profiling.	Automated modelling and decision-making functions must incorporate human oversight and safeguard mechanisms.
Art. 24–25—Responsibility of Controller; Data Protection by Design and Default	Requires controllers to implement technical and organisational measures embedding privacy in system design.	Privacy-by-design principles must be integrated into digital twin architectures to limit exposure and ensure accountability.
Art. 30—Records of Processing Activities	Requires maintaining records of processing operations for accountability.	Full records of data sources, purposes, and flows must be maintained and periodically updated within digital twin environments.
Art. 32–34—Security and Breach Notification	Mandates security measures and breach notifications within seventy-two hours.	Digital twin infrastructures must incorporate encryption, incident response procedures, and continuous monitoring capabilities.
Art. 35–36—Data Protection Impact Assessment and Prior Consultation	Requires risk assessment for high-risk processing and consultation with authorities when necessary.	High-risk projects must conduct DPIAs before deployment to identify and mitigate privacy risks.
Art. 37–39—Data Protection Officer	Establishes requirements for appointing or consulting a DPO and defines related responsibilities.	Projects engaging in large-scale data processing should designate a DPO to oversee compliance and advise on risk management.
Art. 44–50—International Data Transfers	Regulates transfers of personal data outside the EU and defines safeguards.	International collaborations must adopt appropriate transfer mechanisms, such as Standard Contractual Clauses or adequacy decisions.
Art. 51–59—Supervisory Authorities	Defines the powers and cooperation mechanisms of national data-protection authorities.	Partners must align data-handling practices with the competent supervisory authority and maintain audit readiness.
Art. 77–82—Remedies, Liability, and Compensation	Provides individuals with rights to lodge complaints and claim damages; defines controller and processor liability.	Roles and contractual arrangements among partners must allocate responsibility and liability for non-compliance.
Art. 83–84—Administrative Fines and Penalties	Establishes rules and criteria for imposing administrative fines.	Non-compliance with GDPR obligations can result in severe penalties, reinforcing the need for proactive governance.
Art. 99—Entry into Force and Application	Defines the Regulation’s entry into force and applicability date (25 May 2018).	All data-driven projects must demonstrate full GDPR conformity from inception.

The synthesis presented in Table 2 illustrates how the General Data Protection Regulation forms an integrated legal and operational framework for data governance, connecting principles of lawfulness, transparency, and accountability to technical and procedural practices. To further support the implementation of these principles in digital and data-driven research contexts, Table 3 extends this overview by summarising the technical compliance requirements that are particularly relevant to system architecture, data interfaces, interoperability, and cloud portability. This complementary table translates the legal provisions into actionable design and deployment criteria for developing and maintaining compliant data processing environments.

Table 3. Key regulatory requirements of the General Data Protection Regulation (EU) 2016/679 and their implications for Digital Twin system design.

Article	Regulatory Requirement	Implication for Digital Twin Design
Art. 5—Principles of Processing	Implement the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, and accountability through technical and organisational measures.	System architecture must support strict data minimisation, traceability, and verifiable accountability across all lifecycle stages of the digital twin.
Art. 6—Lawfulness of Processing	Ensure every processing activity is based on a lawful ground and properly documented.	Data provenance metadata must record the lawful basis for each processing task to ensure verifiability and auditability.
Art. 7—Consent Management	Obtain, store, and allow withdrawal of consent in a demonstrable and user-controlled way.	Integrate consent management interfaces and APIs enabling transparent consent tracking and withdrawal at any point in the data lifecycle.
Art. 9—Special Category Data	Apply enhanced protection measures when processing sensitive or special category data.	Incorporate strict segregation, encryption, and pseudonymisation layers for sensitive data streams within digital twin environments.
Art. 12–14—Transparency and Information	Provide clear, accessible, and machine-readable information about data processing activities.	Design systems with embedded transparency functions, including metadata endpoints or privacy dashboards for data subjects.
Art. 15—Right of Access	Enable individuals to access personal data and processing details in a structured, usable format.	Include secure, user-authenticated data retrieval interfaces supporting standard data exchange formats.
Art 16–18—Rectification, Erasure, Restriction	Enable correction, deletion, or restriction of processing of personal data upon request.	Implement mechanisms to propagate corrections or deletions across interconnected simulation models and mirrored environments.
Art. 20—Data Portability	Ensure the right to obtain and transfer personal data in structured, interoperable formats.	Support export functions in open formats (e.g., JSON, XML, CSV) to guarantee interoperability and cloud portability.
Art. 21–22—Objection and Automated Decision-Making	Provide safeguards against automated decision-making and profiling that affect individuals.	Embed human-in-the-loop review options, model transparency tools, and explainability mechanisms within automated simulation processes.
Art. 24–25—Accountability and Privacy by Design	Integrate privacy and data protection by design and by default into all processing activities.	Embed privacy features such as pseudonymisation, minimal data retention, and secure default configurations within the digital twin architecture.
Art. 30—Records of Processing	Maintain detailed records of all data processing operations.	Automate the recording of data flows, transformations, and access logs for continuous compliance documentation.
Art. 32—Security of Processing	Implement appropriate technical and organisational measures to ensure confidentiality, integrity, and availability of data.	Apply encryption, strong authentication, secure communication channels, and resilient system recovery mechanisms.
Art. 33–34—Breach Notification	Establish procedures to detect, assess, and report data breaches within 72 h.	Integrate incident detection, alerting, and response systems capable of automated breach assessment and notification logging.
Art. 35—Data Protection Impact Assessment (DPIA)	Conduct risk assessments for processing operations likely to pose high risks to individuals’ rights.	Perform DPIAs for new digital twin components or integrations, addressing data flow, AI models, and external APIs.
Art. 37–39—Data Protection Officer	Designate or consult a DPO for oversight of compliance and risk management.	Provide system-level monitoring and reporting dashboards to facilitate DPO supervision of data flows and compliance metrics.
Art. 44–50—International Data Transfers	Ensure lawful transfer of personal data outside the EU through appropriate safeguards.	Employ region-aware data storage and standard contractual clauses, ensuring controlled and auditable cross-border transfers.
Art. 83—Administrative Fines	Maintain demonstrable compliance to mitigate exposure to sanctions.	Implement compliance-by-design documentation, continuous auditing, and traceable evidence of applied safeguards.

The combination of Table 2 and Table 3 provides a coherent view of the General Data Protection Regulation from both legal and technical perspectives. It links the normative foundations of data protection law to concrete architectural, procedural, and governance requirements, supporting a systematic approach to compliance-by-design in complex, data-intensive research and innovation environments.

3.2. Data Governance Act (DGA)

The Data Governance Act (Regulation (EU) 2022/868) constitutes one of the principal legal instruments of the European Union’s data strategy, establishing a harmonised framework for the secure, fair, and transparent exchange and re-use of data across Member States. The Regulation aims to increase trust in data sharing mechanisms, enhance the availability of data for economic, scientific, and public interest purposes, and strengthen the Union’s capacity to build a competitive and human-centric data economy. By setting common rules for data intermediation, data altruism, and the re-use of protected public sector data, the Act introduces a governance architecture that ensures lawful, ethical, and traceable data flows within the internal market while safeguarding fundamental rights and data protection.

The Regulation does not create new obligations to share data but provides a consistent governance framework to facilitate voluntary and responsible data exchange. It complements the General Data Protection Regulation and the Data Act by operationalising the principles of transparency, neutrality, accountability, and interoperability in data use. The Act’s provisions ensure that both personal and non-personal data are shared in a trustworthy environment, mediated through neutral intermediaries and safeguarded by strong institutional oversight.

The core provisions of the Data Governance Act can be grouped according to their objectives and relevance for data governance and compliance. These include the re-use of protected public sector data (Articles 3–9), the regulation of data intermediation services (Articles 10–15), the framework for data altruism (Articles 16–25), the designation of competent authorities (Articles 26–28), the establishment of the European Data Innovation Board (Articles 29–30), and the safeguards for international data transfers (Article 31). Collectively, these provisions form a structured and enforceable foundation for transparent data governance across the Union, promoting interoperability and trust in cross-border data transactions.

Table 4 provides a structured summary of the most important Articles of the Data Governance Act. It outlines the title, key obligations, and relevance of each Article while including an additional column that summarises their implications for compliance in research and innovation projects such as those involving digital twins, artificial intelligence, or smart data ecosystems.

Table 4. Summary of the most important Articles of the Data Governance Act (Regulation (EU) 2022/868) and their implications for compliance in research and innovation projects.

Article	Key Obligation	Implications for Compliance in Research and Innovation Projects
Art. 1—Subject matter and scope	Establishes objectives for data re-use, data intermediation, data altruism, and coordination through the European Data Innovation Board.	Projects must ensure alignment with the DGA when re-using or integrating public and private datasets within EU frameworks.
Art. 2—Definitions	Provides harmonised terminology for data, re-use, data holder, data user, data intermediation, and data altruism.	Terminology alignment is essential when defining data models, sharing protocols, and governance documentation.
Art. 3—Categories of data	Identifies data protected by confidentiality, statistical, intellectual property, or personal data rights.	Data used in projects must be classified and handled according to its protection level, with appropriate safeguards.
Art. 4—Prohibition of exclusive arrangements	Forbids exclusive data re-use agreements except when justified for public interest.	Projects must ensure open and non-exclusive access to data re-used under public sector provisions.
Art. 5—Conditions for re-use	Requires anonymisation, secure processing environments, and protection of third-party rights.	Data pipelines must include anonymisation procedures and controlled processing environments.
Art. 6—Fees	Allows cost-based fees for data re-use with possible reductions for research and SMEs.	Budgeting for data acquisition must ensure transparent justification of costs under DGA provisions.
Art. 7—Competent bodies	Mandates Member States to designate technical bodies to support access, anonymisation, and secure processing.	Projects can rely on designated bodies for guidance on compliance and data processing requirements.
Art. 8—Single information points	Requires a unified interface for re-use requests and information exchange.	Facilitates the discovery and lawful access of data resources through national single information points.
Art. 9—Procedure for requests for re-use	Defines procedural rights, time limits, and appeal mechanisms.	Access procedures must follow national guidelines and maintain documentation for traceability and auditability.
Art. 10–12—Data intermediation services	Set obligations for neutrality, transparency, and non-discrimination of data intermediaries.	Projects using brokers must ensure that intermediaries are registered and compliant under DGA oversight.
Art. 13–14—Competent authorities for intermediation	Assign supervisory powers to independent national authorities.	Partners must verify the regulatory status of intermediaries and maintain auditable data-sharing records.
Art. 16–19—Data altruism framework	Enable voluntary data sharing for objectives of general interest and establish registration of recognised data altruism organisations.	Projects may use altruistically shared data if consent and permissions meet EU standards.
Art. 20–21—Transparency and safeguards	Require record-keeping, annual reporting, and transparent communication with data subjects and holders.	Documentation of data provenance, usage, and consent must be maintained for audits and funding evaluations.
Art. 22—Rulebook for data altruism	Mandates the Commission to develop a harmonised rulebook on governance, security, and interoperability.	Projects must align their data-sharing governance structures with the EU rulebook when adopted.
Art. 25—European data altruism consent form	Introduces a standardised EU consent form for altruistic data sharing.	Consent management systems must integrate or be compatible with the EU model form.
Art. 26–28—Competent authorities and judicial remedies	Define the independence, impartiality, and enforcement powers of competent authorities.	Projects must include procedures for cooperation with competent authorities during compliance reviews.
Art. 29–30—European Data Innovation Board	Establish a coordination body for interoperability, data standards, and cross-sector governance.	Projects should monitor and adopt evolving technical and interoperability guidelines from the Board.
Art. 31—International access and transfer	Restricts unlawful foreign access to EU non-personal data.	Cloud-hosted or externally accessed data must comply with EU transfer restrictions and contractual safeguards.
Art. 34—Penalties	Requires Member States to define proportionate and dissuasive penalties for non-compliance.	Projects must maintain internal compliance checks to avoid administrative or financial sanctions.
Art. 35—Evaluation and review	Mandates a periodic review of DGA implementation.	Project governance frameworks should anticipate updates and adapt to regulatory revisions.
Art. 38—Entry into force and application	Applies from 24 September 2023.	All project activities initiated after this date must ensure conformity with DGA provisions.

While Table 4 presents the structural and legal interpretation of the Regulation, Table 5 translates these legal requirements into a set of technical compliance measures relevant for data-intensive system architectures. It highlights the specific technical dimensions of compliance such as interoperability, secure data interfaces, cloud portability, and auditability that must be incorporated into digital infrastructures to ensure conformity with the Act.

Table 5. Technical compliance requirements derived from the Data Governance Act and their implications for Digital Twin system design.

Article	Regulatory Requirement	Implication for Digital Twin Design
Article 5—Conditions for re-use	Establish Secure Processing Environments (SPEs) ensuring controlled access, data integrity verification, and traceable processing.	Digital Twin platforms must implement controlled compute environments with strict access control, audit logging, and validation mechanisms for data processing integrity.
Article 5—Conditions for re-use	Apply anonymisation and disclosure control measures to protect personal and confidential data before re-use.	Data pipelines must include automated anonymisation and masking stages, ensuring privacy-preserving model training and data analysis.
Article 7—Competent bodies	Ensure technical support and state-of-the-art methods for anonymisation, pseudonymisation, and secure data structuring.	Adopt modular privacy-preserving libraries and compliance frameworks that maintain dataset interoperability and traceability across the Digital Twin system.
Article 7—Competent bodies	Promote the use of open APIs and interoperable data structures.	Employ open standards and machine-readable APIs that enable secure and efficient data exchange between system modules and external repositories.
Article 8—Single information points	Maintain electronic and searchable data asset catalogues.	Integrate internal metadata catalogues documenting datasets, schemas, and access conditions to support discoverability and audit readiness.
Articles 10–12—Data intermediation services	Require neutrality, transparency, security, and comprehensive logging for data intermediaries.	Separate data brokerage functions from system operations, implement secure data exchange protocols, and maintain verifiable transaction logs.
Article 12(d), 12(i), 12(l), 12(o)—Data intermediation services	Enforce interoperability through open standards, data portability, encryption, and comprehensive security measures.	Design architecture around open data models, end-to-end encryption, and structured logging to support cross-platform interoperability and long-term portability.
Article 12(n)—Data intermediation services	Specify consent and jurisdictional restrictions for data use and transfer.	Integrate consent registries and jurisdictional control within access management systems to ensure lawful processing and compliance with EU data residency rules.
Articles 29–30—European Data Innovation Board	Align system interoperability and standardisation with evolving EU guidance.	Implement continuous compliance monitoring and adopt emerging interoperability and data format standards recommended by the European Data Innovation Board.
Article 31—International access and transfer	Prevent unlawful third-country access to EU data and ensure data sovereignty.	Implement EU-based data residency policies, encryption key management, and contractual safeguards within cloud and hybrid infrastructures.
Article 5(9)–(13)—Conditions for re-use	Require contractual and technical safeguards for third-country data transfers.	Embed data export controls, model clauses, and automated transfer validation mechanisms within Digital Twin data governance workflows.

Together, these tables provide an integrated overview of the Data Governance Act’s legal and technical dimensions. They illustrate how the Regulation establishes not only a governance framework for lawful data exchange but also a set of architectural and procedural benchmarks for trustworthy, transparent, and interoperable data systems within the European digital ecosystem.

3.3. Data Act (DA)

The Data Act (Regulation (EU) 2023/2854) establishes a comprehensive legal framework for ensuring fairness, transparency, and accountability in the access to and use of data within the European Union. Adopted in December 2023, it complements the existing EU digital regulatory architecture by introducing harmonised rules that define rights and obligations related to data sharing, interoperability, and the protection of lawful access. The Regulation seeks to promote a balanced data economy in which data generated by connected products and related services can be accessed and reused under fair, reasonable, and non-discriminatory conditions, thereby enhancing innovation while safeguarding legitimate interests such as data protection, trade secrets, and cybersecurity.

The Regulation applies horizontally across sectors and covers both personal and non-personal data. It defines the roles of users, data holders, and data recipients, establishes mechanisms for public sector access to privately held data in cases of exceptional need, and sets principles for switching between data processing services. Furthermore, it provides technical and organisational requirements to guarantee interoperability between systems, ensure lawful international data transfers, and introduce safeguards against unfair contractual practices in data-related agreements.

The most significant provisions of the Data Act can be grouped according to their thematic focus and regulatory intent. The general provisions (Articles 1–2) define the scope of application and establish key terminology that underpins the legal interpretation of the Regulation. The data access and sharing provisions (Articles 3–7) introduce the principle of data accessibility by design and outline the rights of users to access, use, and share data generated by connected products and services. The business-to-business fairness rules (Articles 8–13) require that data be shared on fair, reasonable, and non-discriminatory terms and prohibit the imposition of unfair contractual conditions. The public-interest data access provisions (Articles 14–21) permit the use of privately held data by public authorities and EU institutions under specific and proportionate conditions in situations of exceptional need.

The rules on data processing and cloud switching (Articles 23–31) establish obligations for providers of data processing services to remove technical and contractual barriers to data portability and to ensure functional equivalence following service migration. The interoperability and international access provisions (Articles 32–36) introduce safeguards against unlawful access to non-personal data by third countries, define interoperability requirements for data exchange and common data spaces, and prescribe essential conditions for smart contracts used in automated data sharing. Finally, the implementation and enforcement framework (Articles 37–50) mandates Member States to designate competent authorities, defines cooperation mechanisms, introduces proportionate penalties for non-compliance, and sets timelines for the gradual application of the Regulation from September 2025 onward.

Together, these provisions form the foundation of the European Union’s data governance regime by delineating clear responsibilities among data actors, ensuring interoperability of digital infrastructures, and fostering trust in the lawful and equitable use of data.

The following Table 6 provides an overview of the most important articles, grouped according to their legal function and relevance for compliance. It highlights the regulatory purpose of each provision and identifies its implications for research and innovation projects relying on data-driven technologies such as digital twins and artificial intelligence.

Table 6. Key Articles of the EU Data Act and Implications for Compliance in Research and Innovation Projects.

Article	Key Obligation/Provision	Implications for Compliance in Research and Innovation Projects
Art. 1–2—General Provisions	Establish harmonised rules for fair access, use, and sharing of data; define key legal terms such as data, connected product, data holder, data recipient, smart contract, and interoperability.	Projects must align data handling, terminology, and governance structures with these definitions to ensure consistency and compliance across collaborative environments.
Art. 3–7—Data Access and Sharing	Introduce the principle of data accessibility by design; grant users rights to access, use, and share data generated by connected products and services under fair, reasonable, and non-discriminatory (FRAND) conditions.	Systems must implement mechanisms for lawful and secure data retrieval, enable user-driven data sharing with third parties, and maintain auditable access controls.
Art. 8–13—Business-to-Business Fairness	Require data to be shared on FRAND terms and prohibit unilaterally imposed or unfair contractual clauses regarding access, use, or liability.	Collaboration agreements must ensure equitable data access and transparent cost structures. All data-sharing contracts should undergo legal review to eliminate restrictive or discriminatory terms.
Art. 14–21—Public-Interest Data Access	Allow public authorities and EU institutions to access privately held data in situations of exceptional need, subject to proportionality and confidentiality safeguards.	Projects must establish procedures for lawful disclosure of data to public entities and ensure that any such data transfer is secure, logged, and justified under the Regulation’s conditions.
Art. 23–31—Data Processing and Cloud Switching	Mandate providers of data processing services to remove technical and contractual barriers to switching, ensure data portability, and maintain functional equivalence after migration.	Projects must design architectures that enable interoperability and migration between digital infrastructures without disrupting functionality or data integrity.
Art. 32–36—Interoperability and International Access	Introduce safeguards against unlawful access to non-personal data by third countries; define interoperability requirements for data exchange, common data spaces, and smart contracts.	Projects must ensure compliance with EU data sovereignty principles, use interoperable data models and APIs, and apply audit and termination controls in automated data transactions.
Art. 37–50—Implementation and Enforcement	Require Member States to designate competent authorities and data coordinators; define cooperation mechanisms, establish penalties for non-compliance, and set the Regulation’s application timeline (2025–2027).	Projects must maintain complete documentation, designate responsible data officers, and ensure readiness for audits and compliance inspections by national or EU authorities.

While Table 6 defines the legal and governance framework of the Data Act, effective compliance depends on its translation into technical system design and operational processes. Table 7 summarises the technical compliance requirements that arise from the Regulation’s provisions, focusing on data accessibility, interoperability, portability, and lawful use within digital infrastructures. It identifies the system-level mechanisms, architectural decisions, and procedural controls necessary to operationalise the Regulation’s principles within research and innovation environments that rely on distributed data and computational resources.

Table 7. Technical Compliance Requirements for Digital Twin Systems under the EU Data Act.

Article	Regulatory Requirement	Implication for Digital Twin Design
Art. 3–5—Data Accessibility and Retrieval	Connected products must provide secure, real-time, and user-controlled access to the data they generate. Users must be able to share this data with authorised third parties.	Digital twin systems must incorporate “data by design” principles, enabling lawful and secure data retrieval through standardised interfaces and auditable access controls. APIs should support machine-readable, structured, and real-time data exchange while preserving data integrity and traceability.
Art. 4–6—User Data Control and Sharing	Users may share their data with third parties, and data holders must ensure that such sharing occurs under fair, transparent, and secure conditions.	Digital twin architectures must include mechanisms for consent management, data governance policies, and traceable access records that enforce purpose limitation and ensure data sharing occurs only under agreed conditions.
Art. 4(6–8), 5(9–11)—Trade Secret Protection and Confidentiality	Trade secrets must be preserved, and data holders may restrict disclosure when serious economic harm is demonstrable.	Systems must integrate encryption, anonymisation, and confidentiality-preserving computation techniques. Access to sensitive data should be restricted by multi-level security protocols and fine-grained permission models.
Art. 23, 25, 29, 30—Data Portability and Cloud Switching	Providers must remove barriers to switching and ensure data export in open, machine-readable formats.	Digital twin platforms must ensure portability of models and data between environments by using interoperable formats and modular architecture. Cloud and edge infrastructures should be designed for vendor independence and seamless migration.
Art. 23–25, 30(1), 35(1)(c)—Functional Equivalence after Switching	Systems must maintain comparable functionality following migration to another service or infrastructure.	Digital twin environments must ensure functional continuity during and after migration by employing containerisation, version control, and reproducible configuration management.
Art. 33, 35—Interoperability of Data and Systems	Common standards must ensure interoperability of data, interfaces, and services across platforms.	Data models and communication protocols within digital twins must follow harmonised European interoperability standards and open ontologies to support cross-system data integration and reuse.
Art. 33(1)(a–b)—Metadata and Contextual Data	Datasets must include machine-readable metadata that describe their content, quality, and use conditions.	Digital twin frameworks must implement metadata schemas aligned with FAIR principles, ensuring each dataset is contextualised, discoverable, and reusable within interoperable data ecosystems.
Art. 23–31—Cloud and Edge Computing Governance	Cloud service providers must facilitate switching, avoid lock-in, and ensure technical interoperability.	Digital twin infrastructures should adopt hybrid or multi-cloud deployment strategies and open orchestration tools that allow transparent workload distribution and migration.
Art. 11, 32—Security and Access Management	Data holders may apply protection measures against unauthorised access, and EU data must be protected from unlawful foreign access.	Systems must enforce strong authentication, encryption, and access control consistent with EU cybersecurity standards. Hosting should prioritise EU-based data storage to maintain data sovereignty and compliance.
Art. 36—Smart Contract Governance	Smart contracts used for automated data sharing must include safety, auditability, and termination mechanisms.	Automated transactions in digital twin environments must employ verifiable smart contracts with clear execution limits, human override capabilities, and immutable audit logs.
Art. 8, 9, 13, 25—Transparency and Contractual Fairness	Contractual terms governing data access and sharing must be fair, transparent, and non-discriminatory.	Data-sharing agreements for digital twin platforms must reflect FRAND principles, define equitable cost structures, and document rights and obligations to ensure balanced data governance.
Art. 37, 40—Compliance and Governance	Member States must designate competent authorities to enforce compliance and apply proportionate penalties for infringements.	Digital twin operators must maintain complete compliance documentation, designate a responsible data officer, and conduct regular audits to verify adherence to legal, technical, and interoperability obligations.

This integrated presentation of Table 6 and Table 7 provides a complete conceptual and technical foundation for interpreting and applying the Data Act in data-intensive research and innovation environments.

3.4. Artificial Intelligence Act (AIA)

The Artificial Intelligence Act (Regulation (EU) 2024/1689) establishes a harmonised legal framework governing the development, placement on the market, and use of artificial intelligence within the European Union. The Act represents the first comprehensive regulatory instrument addressing the opportunities and risks associated with artificial intelligence, ensuring that its deployment is consistent with the Union’s fundamental values, human rights, and principles of transparency, accountability, and safety. Its objective is to create the conditions for trustworthy and human-centric artificial intelligence that fosters innovation while safeguarding public interests and the integrity of the internal market.

The structure of the regulation follows a risk-based approach that differentiates obligations according to the level of potential harm associated with an artificial intelligence system. It defines the categories of unacceptable, high, limited, and minimal risk and establishes specific requirements for each. The most significant provisions concern the identification of high-risk artificial intelligence systems, the establishment of technical and organisational safeguards, and the introduction of transparency and oversight obligations to ensure responsible design, development, and deployment.

Core obligations under the Act encompass the establishment of comprehensive risk management frameworks, the implementation of data governance and documentation requirements, and the enforcement of standards for transparency, accuracy, robustness, and human oversight. The regulation further defines the responsibilities of all actors in the artificial intelligence value chain, including providers, importers, distributors, and deployers, and sets out conformity assessment procedures to verify compliance before systems are placed on the market. It also introduces governance structures at both national and Union levels through the creation of the European Artificial Intelligence Board and the AI Office, which coordinate oversight, guidance, and enforcement.

In addition, the Act introduces specific provisions for general-purpose artificial intelligence models, mandates the establishment of regulatory sandboxes to support innovation under supervision, and defines a consistent penalty regime proportionate to the severity of non-compliance. Collectively, these elements form the legal foundation for the trustworthy and responsible integration of artificial intelligence across applications and contexts within the European Union.

To clarify the structure of the regulation and its key obligations, Table 8 presents a detailed overview of the most important articles of the Artificial Intelligence Act. The table groups the articles according to their objectives and relevance for compliance, governance, and risk management, while the final column identifies the implications for compliance in research and innovation projects involving artificial intelligence, digital twins, or other advanced system architectures. This extended interpretation allows for a deeper understanding of how the regulation informs the design and documentation of intelligent digital systems developed within research and innovation frameworks.

Table 8. Summary of Core Articles of the Artificial Intelligence Act and Implications for Research and Innovation Compliance.

Article	Key Obligation	Implications for Research and Innovation Compliance
Art. 1—Subject Matter	Establishes harmonised EU rules for placing on the market, use, and governance of AI systems.	Research must align with human-centric and trustworthy AI principles and demonstrate societal benefit and safety.
Art. 2—Scope	Specifies applicability to all AI systems and general-purpose models in the EU market, including those from third countries.	Projects involving AI components must assess whether experimental systems fall under regulatory scope or research exemptions.
Art. 3—Definitions	Provides core definitions (AI system, provider, deployer, high-risk AI, general-purpose AI model).	Projects must use consistent definitions to ensure clear documentation and compliance alignment across partners.
Art. 5—Prohibited AI Practices	Bans AI systems using manipulative techniques, social scoring, biometric categorisation, and untargeted facial scraping.	Systems integrating AI must exclude manipulative or profiling functions that could undermine autonomy or privacy.
Art. 6—Classification of High-Risk AI Systems	Defines when an AI system is high-risk and refers to Annex III.	Research using AI for decision support must determine risk level early to guide compliance-by-design processes.
Art. 8–15—Requirements for High-Risk AI Systems	Mandates compliance with seven key requirements: risk management, data governance, documentation, record-keeping, transparency, human oversight, and robustness.	Research must implement transparent data governance, risk management, and human oversight within system design and validation.
Art. 16–29—Obligations of Operators	Outlines duties for providers, importers, distributors, and deployers of high-risk AI systems.	Research consortia must define partner roles and document responsibilities for lifecycle management and traceability.
Art. 43–48—Conformity Assessment and CE Marking	Requires conformity assessments before market placement and the use of CE marking to demonstrate compliance.	Prototypes evolving into deployable solutions must integrate conformity assessment procedures into development roadmaps.
Art. 49—Registration	Requires high-risk AI systems and their providers to register in the EU database.	Projects producing high-risk systems must prepare for registration and documentation as part of pre-deployment compliance.
Art. 50—Transparency Obligations	Requires disclosure when users interact with AI, encounter emotion recognition, or see AI-generated content.	Interfaces must include clear disclosure mechanisms when AI-driven outputs influence decision-making.
Art. 51–55—General-Purpose AI Models	Establishes obligations for providers of foundation models, including documentation, copyright compliance, and risk mitigation.	Projects using pretrained models must assess copyright compliance and document model provenance and limitations.
Art. 56—Codes of Practice	Encourages voluntary codes to implement transparency, risk mitigation, and ethical AI principles.	Research initiatives can adopt voluntary codes to ensure consistent ethical and technical governance.
Art. 57—AI Regulatory Sandboxes	Mandates Member States to create at least one AI sandbox by 2026 for supervised innovation and testing.	Prototypes can be tested in AI sandboxes to validate performance and compliance under supervision.
Art. 64–66—Governance and the AI Office	Establishes the AI Office and the European AI Board to coordinate and monitor enforcement.	Projects should monitor guidance from the AI Office for updates, standards, and evaluation frameworks.
Art. 72–73—Post-Market Monitoring and Incident Reporting	Requires providers to monitor deployed AI systems and report serious incidents to national authorities.	Research transitioning to operational phases must include mechanisms for monitoring and reporting.
Art. 79–83—Risk and Enforcement Procedures	Describes procedures when AI systems present risks or fail to comply with the regulation.	Research outputs integrated into operational systems must include traceability and fallback strategies.
Art. 85–86—Rights of Individuals	Grants affected persons the right to lodge complaints and obtain explanations for high-risk AI-based decisions.	Systems supporting automated reasoning must ensure explainability and justification of AI outcomes.
Art. 88–94—Supervision of General-Purpose AI	Gives the AI Office investigatory and enforcement powers over foundation model providers.	Research using general-purpose AI must be prepared to demonstrate compliance documentation.
Art. 99–101—Penalties	Sets fines up to €35 million or 7% of global turnover for severe breaches.	Projects involving commercialisation must integrate compliance assurance and risk mitigation to avoid exposure.
Art. 111–113—Evaluation, Review, and Entry into Force	Establishes review timelines and staggered implementation dates.	Research planning should align project timelines with regulatory implementation and allocate resources for adaptation.

To further support digital twin developers in interpreting and operationalising the Artificial Intelligence Act, Table 9 reformulates the same key provisions into a condensed format that emphasises compliance awareness and practical implementation. The table is designed to guide development teams, research consortia, and system architects in understanding how each article translates into procedural and technical responsibilities during the design, testing, and deployment of digital twin systems that incorporate artificial intelligence components. It thereby serves as a pedagogical and organisational tool for integrating regulatory compliance into the full lifecycle of digital twin development and innovation.

Table 9. Regulatory Requirements of the Artificial Intelligence Act and Their Implications for Digital Twin Design.

Article	Regulatory Requirement	Implication for Digital Twin Design
Art. 1—Subject Matter	Establishes harmonised EU rules for the governance, placement on the market, and use of AI systems.	Digital Twin architectures integrating AI must ensure design transparency, accountability, and adherence to the principles of trustworthy and human-centric AI.
Art. 2—Scope	Defines the applicability of the Act, including AI systems and general-purpose models, and specifies exemptions.	Digital Twin developers must assess whether their AI components fall within the regulatory scope and document justifications for any research or innovation exemptions.
Art. 5—Prohibited Practices	Prohibits manipulative, discriminatory, or exploitative AI practices posing unacceptable risk.	Digital Twin systems must exclude functionalities that could manipulate users or compromise individual rights within their simulation or control environments.
Art. 6—Classification of High-Risk Systems	Identifies high-risk AI applications and mandates compliance with specific safeguards.	Developers must determine whether Digital Twin applications qualify as high-risk and implement corresponding design and testing safeguards.
Art. 8–15—Requirements for High-Risk Systems	Establish mandatory requirements for risk management, data governance, documentation, human oversight, accuracy, and robustness.	Digital Twin systems must incorporate structured data pipelines, risk management protocols, transparent documentation, and human supervision mechanisms.
Art. 16–29—Obligations of Operators	Define the responsibilities of providers, importers, distributors, and deployers in the AI lifecycle.	Project partners must document their specific roles and compliance responsibilities for the Digital Twin system across its development and operational stages.
Art. 50—Transparency Obligations	Requires disclosure when users interact with AI or encounter AI-generated content.	Digital Twin interfaces must clearly inform users when system outputs or interactions are AI-driven to ensure transparency and trust.
Art. 51–55—General-Purpose AI Models	Impose transparency, documentation, and copyright obligations on providers of foundation models.	Developers must record the provenance, licensing, and data sources of any embedded AI models within the Digital Twin environment.
Art. 57—AI Regulatory Sandboxes	Encourages testing of AI systems in controlled, supervised regulatory environments.	Digital Twin prototypes can be validated within AI sandboxes to assess compliance, risk mitigation, and system reliability under realistic conditions.
Art. 64–66—Governance and Enforcement	Establish oversight mechanisms through the AI Office and the European Artificial Intelligence Board.	Developers should align Digital Twin design processes with technical guidance, standards, and monitoring requirements issued by EU governance bodies.
Art. 99–101—Penalties	Define administrative fines and corrective measures for non-compliance.	Compliance documentation for the Digital Twin system must be comprehensive and auditable to avoid regulatory exposure.
Art. 111–113—Review and Implementation	Specify review procedures and phased entry into force of the Act.	Project timelines and technical roadmaps should align with implementation milestones and review updates issued by the European Commission.

Together, these tables provide a structured foundation for understanding the Artificial Intelligence Act. They collectively bridge the regulatory text and its operational interpretation, offering both analytical depth for researchers and practical guidance for educators and compliance practitioners.

3.5. NIS 2 Directive (Network and Information Systems Security Directive)

The Directive (EU) 2022/2555 of the European Parliament and of the Council, known as the NIS 2 Directive, establishes a comprehensive framework for achieving a high common level of cybersecurity across the European Union. It replaces the original NIS Directive (EU) 2016/1148 and introduces a harmonised and more stringent regulatory regime designed to strengthen the resilience of network and information systems that underpin essential and important services within the internal market. The Directive defines the legal and organisational foundations for national cybersecurity governance, extends its scope to a broader range of entities, and reinforces supervisory and enforcement mechanisms to ensure consistent implementation among Member States.

The NIS 2 Directive is structured around several fundamental objectives that collectively ensure a unified and risk-based approach to cybersecurity management. It first establishes the general provisions, scope, and definitions that determine its applicability, classification of entities, and relationship with other Union legal instruments. It then defines the national and Union-level governance architecture, requiring Member States to adopt cybersecurity strategies, designate competent authorities, and establish computer security incident response teams (CSIRTs) to coordinate preparedness and response activities. Furthermore, it sets out harmonised cybersecurity risk-management measures and detailed incident-reporting obligations, providing a consistent procedural and technical framework for compliance. At the Union level, it enhances cooperation through structured mechanisms such as the Cooperation Group, the CSIRTs network, and the European Cyber Crisis Liaison Organisation Network (EU-CyCLONe). Finally, it reinforces supervision, enforcement, and sanctioning powers, ensuring accountability and uniform application of cybersecurity requirements across the Union.

Table 10 summarises the most important Articles of the NIS 2 Directive, grouped by their objectives and regulatory significance. Each Article is accompanied by its title, key obligation, relevance, and implications for compliance in research and innovation contexts such as digital twin platforms, artificial intelligence systems, and smart building infrastructures. The table provides a concise reference for understanding how the Directive’s legal requirements translate into compliance obligations for organisations engaged in the design, development, and deployment of digital technologies.

Table 10. Summary of Key Articles in the NIS 2 Directive and their Relevance for Digital Twin Research and Innovation.

Article	Key Obligation	Implications for Compliance in Digital Twin Research and Innovation
Art. 1—Subject Matter	Establishes measures to ensure a high common level of cybersecurity across the Union.	Digital Twin platforms must align their security design and governance with EU-wide cybersecurity principles from the outset of development.
Art. 2—Scope	Applies to essential and important entities in critical sectors and services.	Projects must determine whether the Digital Twin platform or consortium partners qualify as essential or important entities and apply compliance requirements accordingly.
Art. 3—Essential and Important Entities	Requires Member States to identify and list entities based on criticality and sector.	Research infrastructures hosting Digital Twin systems may need to register and demonstrate compliance proportional to their classification and size.
Art. 4—Sector-Specific Union Legal Acts	Ensures consistency with existing EU cybersecurity frameworks such as DORA or the Cybersecurity Act.	Projects integrating Digital Twins with other regulated technologies must ensure alignment with parallel EU cybersecurity frameworks.
Art. 6—Definitions	Provides harmonised definitions for cybersecurity-related terms.	Digital Twin research must use the Directive’s definitions for incidents, threats, and risk to ensure consistency in documentation and compliance reporting.
Art. 7—National Cybersecurity Strategy	Obligates each Member State to adopt a national cybersecurity strategy with objectives and governance mechanisms.	Digital Twin research activities must align with the host country’s national cybersecurity strategy and coordinate with national competent authorities.
Art. 8—Competent Authorities and Single Points of Contact	Requires Member States to designate authorities and contact points for coordination and oversight.	Research consortia must identify relevant contact points for reporting and compliance communication regarding Digital Twin security.
Art. 9–12—Cyber Crisis Management Framework, CSIRTs and Vulnerability Disclosure	Establishes Computer Security Incident Response Teams and coordinated vulnerability disclosure procedures.	Digital Twin projects must integrate CSIRT-compatible processes and vulnerability disclosure protocols into their platform design and data-exchange architecture.
Art. 14–16—Cooperation Group, CSIRTs Network and EU-CyCLONe	Creates EU-level coordination bodies for strategic and operational cooperation.	Projects developing cross-border Digital Twin infrastructures should be interoperable with EU-level coordination mechanisms and information-sharing standards.
Art. 19—Peer Reviews	Introduces voluntary mutual evaluations among Member States.	Digital Twin research involving public entities may be assessed through national peer reviews; compliance evidence should be prepared accordingly.
Art. 20—Governance	Holds management bodies accountable for approving and overseeing cybersecurity measures.	Project leadership must formally approve cybersecurity risk-management plans and be accountable for compliance within Digital Twin system governance.
Art. 21—Cybersecurity Risk-Management Measures	Mandates proportionate technical, operational and organisational measures to manage cybersecurity risks.	Digital Twin development must incorporate systematic risk assessment, secure data handling, access control, and resilience measures in design and operation.
Art. 23—Reporting Obligations	Establishes timelines for early warning, incident notification, and final reporting.	Digital Twin systems must implement automated logging, incident detection, and reporting mechanisms aligned with NIS 2 timelines and formats.
Art. 24–25—Certification and Standards	Promotes the use of European cybersecurity certification schemes and international standards.	Digital Twin platforms should adopt certified components and recognised standards to demonstrate compliance and build trust among stakeholders.
Art. 26–28—Jurisdiction, Registry and Domain Name Databases	Defines jurisdiction, registration, and lawful access to domain-name and service provider data.	International Digital Twin collaborations must ensure clear jurisdictional responsibility and maintain accurate registration data for secure service management.
Art. 29–30—Information Sharing and Voluntary Notification	Enables voluntary information sharing on threats and incidents.	Digital Twin ecosystems should participate in trusted information-sharing frameworks to improve situational awareness and resilience across partners.
Art. 31–33—Supervision and Enforcement	Defines supervisory and enforcement mechanisms for essential and important entities.	Digital Twin projects must maintain auditable compliance records and facilitate inspections or audits by competent authorities.
Art. 34—Administrative Fines	Sets penalties for non-compliance (up to EUR 10 million or 2% of global turnover).	Research entities developing or hosting Digital Twin systems must include compliance assurance and liability management in their governance structure.
Art. 37—Mutual Assistance	Requires Member States to cooperate in cross-border supervision and enforcement.	Cross-national Digital Twin consortia should design joint compliance and reporting procedures recognising multi-jurisdictional oversight.
Art. 40–46—Final Provisions	Establishes review cycles, transposition deadlines, and repeal of the original NIS Directive.	Digital Twin projects must monitor updates to national transposition laws and adjust compliance strategies to remain aligned with evolving EU cybersecurity requirements.

Table 10 provides a regulatory overview that links each Article of the NIS 2 Directive to its operational significance for research and innovation environments. While the table emphasises Digital Twin development as a representative domain, its implications extend to any complex digital system architecture subject to the Directive’s provisions.

Building on this, Table 11 translates the legal and organisational provisions of the NIS 2 Directive into specific technical compliance requirements relevant to system architecture, data exchange, interoperability, and cloud portability. It serves as a practical mapping between the Directive’s legal obligations and the technical design principles that ensure conformity within distributed and data-driven digital infrastructures.

Table 11. Technical Compliance Requirements of the NIS 2 Directive Relevant to Digital Twin System Architecture.

Article	Regulatory Requirement	Implication for Digital Twin Design
Art. 6 & 21—System Security and Architecture	Ensure the confidentiality, integrity, availability, and authenticity of network and information systems through proportionate technical and organisational measures.	Embed security-by-design principles in data pipelines, interfaces, and middleware; apply encryption, secure APIs, authentication, and redundancy to protect real-time data synchronisation.
Art. 7—National Cybersecurity Strategy	Align organisational and technical measures with the Member State’s national cybersecurity strategy and reference frameworks.	Adopt national baseline controls and recognised cybersecurity architecture frameworks when designing and deploying Digital Twin infrastructures.
Art. 21 (2a–2f)—Cybersecurity Risk-Management Measures	Conduct risk analysis and implement measures for incident handling, vulnerability management, and business continuity.	Integrate continuous monitoring, automated patch management, and version control of digital models to secure lifecycle management and ensure operational resilience.
Art. 21 (2d)—Supply Chain Security	Assess and manage cybersecurity risks in supply chains and among external service providers.	Evaluate suppliers and cloud providers for compliance, include contractual cybersecurity clauses, and verify secure interoperability of external APIs and middleware.
Art. 21 (2e)—Secure Development and Maintenance	Apply secure coding practices, vulnerability disclosure, and software assurance procedures.	Implement DevSecOps pipelines with vulnerability scanning, code signing, and controlled software updates for all Digital Twin components.
Art. 21 (2h–2j)—Cryptography and Access Control	Use cryptography, multi-factor authentication, and secured communication channels.	Restrict and audit user access, employ encrypted identity tokens, and enforce strong communication protocols such as TLS 1.3.
Art. 23—Reporting Obligations	Fulfil incident-reporting requirements, including early warning within 24 h and formal notification within 72 h.	Deploy telemetry, logging, and alerting systems that support rapid detection and automated reporting consistent with CSIRT procedures.
Art. 24–25—Certification and Standards	Use EU cybersecurity certification schemes and harmonised technical standards.	Integrate certified hardware, software, and cloud services; adopt interoperable frameworks such as ISO/IEC 27000 series [35] or ISO 23247 for Digital Twin systems.
Art. 26 & 27—Jurisdiction and Registration	Define jurisdiction, maintain accurate registration, and clarify accountability for cross-border operations.	Maintain registries of nodes, data sources, and hosting sites with verifiable metadata and traceable ownership to demonstrate accountability and compliance.
Art. 29–30—Information Sharing and Threat Intelligence	Facilitate voluntary exchange of cyber-threat and incident information among trusted stakeholders.	Implement secure data-exchange interfaces (e.g., STIX/TAXII) to connect with national or sectoral intelligence platforms and enable collaborative vulnerability sharing.
Art. 31–33—Supervision and Enforcement	Support supervisory inspections, technical audits, and compliance verification by competent authorities.	Maintain comprehensive documentation of architecture, configuration, and cybersecurity controls to allow reproducible verification and traceability.
Art. 34—Administrative Fines and Penalties	Ensure continuous compliance monitoring and acknowledge sanctions for non-conformity.	Establish internal audit processes, compliance dashboards, and governance routines to sustain conformity across the Digital Twin system lifecycle.

Together, Table 10 and Table 11 provide a structured understanding of the NIS 2 Directive as both a legal and a technical instrument for cybersecurity governance. They demonstrate how regulatory provisions are operationalised within digital infrastructures, supporting the systematic alignment of organisational processes, data governance, and system design with the Directive’s overarching objective of ensuring a common and resilient cybersecurity posture across the European Union.

3.6. Cyber Resilience Act (CRA)

The Cyber Resilience Act (Regulation (EU) 2024/XXXX) constitutes a cornerstone of the European Union’s cybersecurity legislation, aiming to ensure a uniformly high level of cyber resilience across all products with digital elements made available on the Union market. It introduces harmonised requirements that apply to both hardware and software throughout their entire lifecycle, from design and development to production, maintenance, and end-of-life. By establishing common obligations for manufacturers, importers, and distributors, the Regulation seeks to safeguard the internal market against systemic digital vulnerabilities and to enhance the overall trustworthiness of the digital ecosystem.

The Regulation applies to a broad spectrum of products with digital elements and defines mandatory cybersecurity requirements based on the principles of security-by-design and security-by-default. These principles ensure that security considerations are integrated from the earliest stages of product conception and continuously maintained through vulnerability management and post-market monitoring. The Cyber Resilience Act introduces a structured governance model that defines responsibilities for all economic operators in the supply chain. Manufacturers are required to conduct risk assessments, implement secure development processes, and ensure conformity before products are placed on the market. Importers and distributors must verify compliance and cooperate with supervisory authorities.

To ensure proportionality and coherence, the Act differentiates between products according to their risk level and establishes corresponding conformity assessment procedures. This tiered approach balances the need for high security assurance with the importance of promoting innovation and reducing administrative burdens. National authorities are empowered to conduct audits, enforce corrective measures, and impose sanctions in cases of non-compliance, while the European Commission and the European Union Agency for Cybersecurity (ENISA) coordinate the implementation of technical standards and regulatory updates. Through this structure, the Act combines preventive security design with enforceable oversight mechanisms to strengthen cyber resilience across the Union.

The most significant provisions of the Cyber Resilience Act can be grouped according to their regulatory objectives and implementation focus. Table 12 presents an overview of the Regulation’s most important articles, highlighting their main obligations, relevance, and specific implications for compliance in research and innovation projects involving digital technologies such as digital twins, artificial intelligence, or intelligent systems.

Table 12. Summary of the Most Important Articles of the Cyber Resilience Act.

Article	Key Obligation	Implications for Compliance in Research and Innovation Projects
Art. 1—Subject matter and objectives	Establishes uniform rules for the cybersecurity of products with digital elements throughout their life cycle.	Digital Twin platforms integrating digital elements must be designed under harmonised cybersecurity principles to ensure secure-by-design compliance from conception to deployment.
Art. 2—Scope	Applies to all products with digital elements, including software and hardware components, except those covered by specific sectoral legislation.	Digital Twin environments incorporating connected devices, software modules, or analytical engines fall within the CRA if they are placed or made available on the EU market.
Art. 3—Definitions	Provides definitions such as “product with digital elements,” “cybersecurity risk,” and “vulnerability.”	Digital Twin components must be clearly categorised within these definitions to determine applicable cybersecurity requirements and conformity obligations.
Art. 8—Essential cybersecurity requirements	Establishes baseline cybersecurity requirements for design, development, production, and maintenance.	Digital Twin architectures must incorporate secure design principles, risk-based protection measures, and lifecycle security controls consistent with CRA Annex I requirements.
Art. 9—Vulnerability handling and security updates	Requires manufacturers to establish and maintain processes for vulnerability management and security updates.	Continuous monitoring and patch management must be embedded in Digital Twin development workflows, including disclosure processes and version control of digital components.
Art. 10—Conformity of products	Mandates conformity of products with cybersecurity requirements prior to market placement and throughout their operational life.	Digital Twin software and infrastructure must undergo conformity assessment prior to deployment, ensuring that all integrated digital elements comply with EU cybersecurity standards.
Art. 11—Obligations of manufacturers	Requires comprehensive risk assessment, conformity documentation, EU declaration of conformity, and CE marking.	Developers of Digital Twin systems act as manufacturers and must document the cybersecurity risk management processes, testing outcomes, and conformity evidence for integrated components.
Art. 12—Reporting of exploited vulnerabilities and incidents	Mandates reporting of exploited vulnerabilities or security incidents within 24 h to ENISA.	Digital Twin research infrastructures must include incident detection and reporting procedures to ensure timely notification of security breaches affecting interconnected digital assets.
Art. 13–17—Obligations of importers and distributors	Require verification that products meet cybersecurity and conformity requirements before distribution.	Collaborative Digital Twin ecosystems must ensure that all partners distributing software modules or data interfaces verify conformity before integration.
Art. 18–24—Conformity assessment procedures	Establishes proportional, risk-based conformity assessment methods depending on the product’s risk classification.	Digital Twin components classified as high-risk must undergo third-party conformity assessments; lower-risk elements may follow internal evaluation processes aligned with CRA standards.
Art. 25–32—Notified bodies and EU declaration of conformity	Defines designation, supervision, and withdrawal criteria for notified bodies; sets documentation and marking rules.	Digital Twin research consortia using external certification must engage only accredited notified bodies and maintain traceable technical documentation demonstrating conformity.
Art. 40–44—Market surveillance and enforcement	Obligates Member States to monitor, withdraw, or recall non-compliant products and enforce corrective actions.	Research prototypes and demonstrators of Digital Twins released to market or public use must be compliant and subject to recall if vulnerabilities compromise security integrity.
Art. 45–49—Cooperation and information exchange	Establishes coordination mechanisms among Member States, ENISA, and the European Commission.	Digital Twin consortia must align national compliance reporting and data exchange practices with EU coordination frameworks to facilitate secure interoperability.
Art. 50–52—Delegated and implementing acts	Authorises the Commission to define technical standards and certification procedures.	Digital Twin systems must anticipate evolving technical standards and maintain design flexibility to incorporate future certification requirements.
Art. 53–56—Penalties	Establishes financial penalties up to €15 million or 2.5% of annual worldwide turnover for severe infringements.	Non-compliance in Digital Twin research leading to the release of insecure digital components can incur substantial penalties, reinforcing the necessity of robust cybersecurity-by-design governance.
Art. 57–58—Final and transitional provisions	Sets timelines for application and transitional arrangements for compliance.	Digital Twin projects must align their development roadmaps with CRA transition periods, ensuring readiness for conformity assessment and market entry compliance.

Beyond the legal and procedural aspects, the Cyber Resilience Act also establishes technical compliance requirements that define how cybersecurity must be implemented in complex digital architectures. These requirements are particularly relevant to systems that integrate interconnected components, distributed data infrastructures, and cloud-based environments. They cover interoperability, data integrity, secure communication, cloud portability, and resilience across system interfaces. Table 13 presents a structured synthesis of the Act’s technical compliance dimensions, linking specific articles to the architectural and engineering considerations that underpin cybersecurity-by-design in advanced digital systems.

Table 13. Technical Compliance Requirements under the Cyber Resilience Act Relevant to Digital Twin System Architecture.

Article	Regulatory Requirement	Implication for Digital Twin Design
Art. 8—Essential cybersecurity requirements	Requires implementation of secure-by-design and secure-by-default principles throughout the design, development, and maintenance of digital products, including the use of strong access control, encryption, and secure communication protocols.	Digital Twin architectures must integrate security measures at every design layer, ensuring authenticated, encrypted, and integrity-verified data exchange between all system components.
Art. 9—Vulnerability handling and security updates	Establishes obligations for continuous monitoring, coordinated vulnerability disclosure, and provision of timely security updates across distributed components.	Digital Twin environments must incorporate automated vulnerability detection, patch management, and update pipelines capable of maintaining interoperability while mitigating risks in real time.
Art. 10—Conformity of products	Requires technical documentation demonstrating compliance with the essential cybersecurity requirements set out in Annex I and the maintenance of transparent design and testing records.	Digital Twin developers must produce verifiable technical documentation detailing architecture, interfaces, and data-handling mechanisms to support conformity assessment and certification.
Art. 11—Obligations of manufacturers	Mandates comprehensive risk assessment, lifecycle security management, and conformity assurance for all digital components placed on the market.	Digital Twin systems must embed structured risk management and interoperability testing across their lifecycle, ensuring secure data flows and component integrity throughout operation.
Art. 12—Reporting of exploited vulnerabilities and incidents	Requires immediate reporting of exploited vulnerabilities or incidents that compromise product security to ENISA and relevant authorities.	Digital Twin platforms must integrate real-time incident detection, monitoring, and reporting capabilities to ensure regulatory compliance and system resilience.
Art. 18–24—Conformity assessment procedures	Introduces risk-based conformity assessment mechanisms, distinguishing between self-assessment and third-party evaluation depending on the product’s criticality.	Digital Twin systems deployed across federated or multi-cloud environments must ensure that all modules and interfaces meet the applicable conformity class and maintain certification-ready documentation.
Art. 21(2)(a–j)—Cybersecurity risk-management measures	Defines minimum organisational and technical measures including risk analysis, incident handling, supply chain security, and business continuity planning.	Digital Twin design must incorporate secure communication protocols, standardised data exchange formats, and resilience mechanisms to maintain system integrity under operational disturbances.
Art. 24—Use of European cybersecurity certification schemes	Promotes the use of certified ICT products, services, and processes under recognised European cybersecurity certification frameworks.	Digital Twin components, such as data connectors and simulation modules, should rely on certified technologies and services to ensure cross-system trust and secure interoperability.
Art. 25–32—Notified bodies and conformity documentation	Requires the maintenance of auditable technical documentation and compliance evidence for independent verification by notified bodies.	Digital Twin developers must maintain detailed architectural documentation, including interface mappings, cloud dependencies, and security configurations, to facilitate external audits.
Art. 40–44—Market surveillance and enforcement	Establishes mechanisms for monitoring, auditing, and enforcement by national authorities, including corrective measures and product withdrawal.	Digital Twin operators must ensure audit trails and data provenance records are maintained across all system interfaces to support traceability and post-incident investigation.
Art. 45–49—Cooperation and information exchange	Mandates information-sharing procedures between Member States, ENISA, and economic operators to harmonise incident reporting and compliance monitoring.	Digital Twin consortia must adopt standardised compliance reporting interfaces and metadata structures compatible with ENISA requirements to facilitate EU-wide coordination.
Annex I—Essential cybersecurity requirements (technical annex)	Specifies detailed technical controls for configuration management, access restriction, secure data exchange, and resilience against manipulation.	Digital Twin systems must support configurable security parameters, apply interoperable encryption and authentication standards, and ensure verifiable integrity of all transmitted and stored data.

Together, these two tables illustrate how the Cyber Resilience Act provides both a regulatory foundation and a technical framework for ensuring the cybersecurity of digital systems. The Regulation establishes legal obligations for conformity, accountability, and enforcement, while simultaneously defining precise technical expectations for secure interoperability and resilience. It therefore forms a comprehensive framework for guiding compliance in the design, operation, and governance of interconnected digital environments within the European Union.

4. Towards a Unified Digital Twin Compliance Framework

4.1. Rationale for Integration of EU Digital Regulations

The preceding sections have demonstrated that the European regulatory environment governing Digital Twin systems is both comprehensive and multifaceted. Each of the six legal instruments—the General Data Protection Regulation (GDPR), the Data Governance Act (DGA), the Data Act, the Artificial Intelligence Act (AI Act), the NIS2 Directive, and the Cyber Resilience Act (CRA)—introduces distinct objectives, terminologies, and compliance mechanisms. While together they form the foundation for trustworthy and secure data-driven innovation within the European Union, their concurrent application creates an intricate compliance landscape that is difficult for technology developers to operationalise in practice. The overlapping scopes of these laws mean that a single Digital Twin may simultaneously be classified as a data controller, an AI provider, a data holder, and an operator of an essential digital service. Consequently, even small design decisions, such as which data to collect, how to share it, or how to manage security updates, can trigger multiple legal obligations across different regulatory domains.

This fragmentation leaves developers and research organisations with the challenge of navigating six sets of requirements that must be satisfied concurrently during the design, development, deployment, and operation of a Digital Twin. Without a structured compliance framework, it becomes nearly impossible to maintain traceability between legal obligations and their corresponding technical implementations. The risk is not only non-compliance but also reduced innovation capacity, as excessive legal uncertainty discourages experimentation and cross-sectoral data use. This underscores the need for an integrated approach that aligns the requirements of EU data, AI, and cybersecurity legislation into a coherent methodology that developers can follow systematically throughout the Digital Twin lifecycle.

4.2. Conceptual Basis of the Unified Digital Twin Compliance Framework (UDTCF)

To address this challenge, a unified digital twin compliance framework (UDTCF) is proposed. The framework consolidates the principal obligations derived from the six EU legal acts into a single, harmonised matrix of meta-categories that groups requirements according to shared compliance domains. This approach enables developers to assess, implement, and document compliance-by-design measures holistically rather than separately for each regulation. The framework serves as both a conceptual map for legal alignment and a practical design tool for developers working on Digital Twins intended for the European market. The creation of the UDTCF followed a structured legal-to-technical mapping process, shown in Figure 2, where each article of each regulation was first coded for objective, obligation type, and technical implication (Section 3.1, Section 3.2, Section 3.3, Section 3.4, Section 3.5 and Section 3.6). Then these coded obligations were thematically grouped through an inductive process into the seven meta-categories. For example, GDPR Article 22 prohibits solely automated decision-making that produces legal or significant effects on individuals. The coding process identifies obligations related to human oversight, transparency, and explainability. These were assigned to three meta-categories of the UDTCF: Data Protection and Privacy, Accountability and Risk Management, and Transparency, Explainability and Trust. Technical implications include implementing human-in-the-loop review mechanisms, explainable-model interfaces, and decision-logging capabilities within the Digital Twin workflow.

Figure 2. Deriving Meta-Categories from EU Regulatory Obligations.

Table 14 provides the synthesis of the key compliance requirements of the GDPR, DGA, Data Act, AI Act, NIS2 Directive, and CRA into the seven meta-categories: Data Governance and Access Control, Data Protection and Privacy, Cybersecurity and System Resilience, Accountability and Risk Management, Transparency and Trust, Interoperability and Standardisation, and Ethical and Social Responsibility. Together, these meta-categories capture the cumulative compliance logic of EU law as it applies to Digital Twin systems, establishing a unified compliance model that links legal provisions to the technical and organisational layers of system design.

Table 14. Integrated EU Compliance Framework for Digital Twin Systems under EU Law.

Meta-Category	Included Compliance Domains	Lawful Requirements	Relevant EU Laws and Articles
Data Governance and Access Control	Data access, sharing, consent management, contractual fairness, interoperability	Digital Twin systems must ensure lawful data collection, sharing, and reuse based on explicit consent or legitimate interest. Access rights must be transparent and non-discriminatory, and data exchange must rely on interoperable and standardised formats.	GDPR: Arts. 5–7, 12–15, 20, 24, 28, 30, 32, 44–49; AI Act: Arts. 10–11, 16–17; Data Act: Arts. 4–8, 23–29, 35–36; Data Governance Act: Arts. 5–12, 14–22, 23–24; NIS2 Directive: Art. 20; Cyber Resilience Act: Arts. 10–12, 19
Data Protection and Privacy	Personal data processing, anonymisation, pseudonymisation, privacy-by-design, lawful basis	Digital Twin systems must minimise personal data collection, apply anonymisation or pseudonymisation where possible, and embed privacy-by-design and privacy-by-default principles into system architecture.	GDPR: Arts. 5, 9, 12–15, 22, 24–25, 28, 30, 32, 35, 44–49; AI Act: Arts. 10–11; Data Governance Act: Arts. 5–7, 23; Data Act: Arts. 4–8, 35; NIS2 Directive: Art. 21(2)(h); Cyber Resilience Act: Art. 10(2)
Cybersecurity and System Resilience	Network and information security, vulnerability management, incident reporting, operational continuity	Digital Twin operators must apply security-by-design principles, perform vulnerability testing, maintain secure software development practices, and report incidents promptly while ensuring operational resilience.	NIS2 Directive: Arts. 20–23, 26–28; GDPR: Art. 32; Cyber Resilience Act: Arts. 10–15, 18–19; AI Act: Arts. 9, 15, 17–18; Data Act: Art. 35(1)(c)
Accountability and Risk Management	Risk assessment, documentation, auditability, human oversight, governance responsibility	Organisations must conduct continuous risk assessments, maintain detailed compliance documentation, ensure human oversight in automated operations, and assign clear governance responsibilities for Digital Twin systems.	GDPR: Arts. 22, 24, 30, 35; AI Act: Arts. 9, 11–12, 14, 16–17, 61; NIS2 Directive: Art. 21; Cyber Resilience Act: Arts. 10–12, 15; Data Governance Act: Arts. 11–12; Data Act: Arts. 4–8
Transparency, Explainability, and Trust	Documentation, traceability, explainability, user information and rights	Digital Twin systems must document model functions and data provenance, maintain traceability logs, and provide explainable outputs. Users and data subjects must be able to access clear information about data use and decision logic.	GDPR: Arts. 12–15, 20, 22; AI Act: Arts. 10–13; Data Governance Act: Arts. 11–12, 23; Data Act: Arts. 5–7, 35; Cyber Resilience Act: Arts. 10–12; NIS2 Directive: Art. 23(4)
Interoperability and Standardisation	Common data formats, semantic interoperability, open standards, portability	Digital Twin systems must use harmonised EU standards, open data schemas, and machine-readable interfaces to ensure data portability and seamless integration across platforms and sectors.	Data Act: Arts. 23–29, 35–36; Cyber Resilience Act: Art. 19; NIS2 Directive: Art. 20; AI Act: Arts. 10–12, 40–41; GDPR: Art. 20; Data Governance Act: Arts. 12, 23
Ethical and Social Responsibility	Bias prevention, fairness, inclusivity, societal and environmental impact	Developers must prevent algorithmic bias, ensure fairness and inclusivity, document limitations, and promote socially and environmentally responsible Digital Twin innovation aligned with EU values.	AI Act: Arts. 9–10, 13–15; GDPR: Recital 71, Arts. 5, 22; Data Governance Act: Arts. 14–22; NIS2 Directive: Art. 21(2)(a); Cyber Resilience Act: Art. 10(1)(b)

4.3. Technical Implementation Guidelines for Compliance-by-Design

While Table 14 provides a consolidated mapping of obligations across EU legislation, its utility for practitioners increases when complemented with explicit design guidance. Table 15 therefore operationalises the seven meta-categories of the UDTCF by linking them to concrete design and deployment measures that Digital Twin developers can apply directly. It converts the legal and ethical requirements of EU law into actionable technical principles that govern data governance, security, transparency, and interoperability throughout the Digital Twin lifecycle. In this way, the framework bridges the conceptual layer of legal interpretation with the engineering layer of compliance implementation.

Table 15. Technical Compliance Implications for Digital Twin Systems under EU Law.

Compliance Domain	Technical Design Guidelines for Digital Twin Systems
Data Governance and Access Control	Implement fine-grained access control mechanisms through role-based or attribute-based access models. Integrate consent management modules and enforce dynamic data access policies. Use interoperable APIs for secure data exchange. Maintain audit trails of data access and sharing events.
Data Protection and Privacy	Apply privacy-by-design principles through early integration of data minimisation, anonymisation, and pseudonymisation methods in all data collection and processing layers. Secure personal data in transit and at rest with end-to-end encryption. Isolate personally identifiable data from analytical or simulation datasets. Deploy automated consent withdrawal and erasure functions in compliance with data subject rights.
Cybersecurity and Resilience	Adopt security-by-design in Digital Twin architectures by embedding continuous vulnerability scanning, encryption key management, and secure update mechanisms. Implement real-time intrusion detection and anomaly detection systems. Establish secure boot processes for edge components and digital twin nodes. Maintain documented incident response procedures and disaster recovery plans aligned with NIS2 requirements.
Accountability and Risk Management	Integrate risk management frameworks such as ISO 31000 [36] and maintain risk registers for all data processing and system interactions. Automate compliance logging and maintain immutable audit records. Introduce explainable AI components for human oversight in automated decision chains. Conduct periodic Data Protection Impact Assessments (DPIAs) and AI risk assessments with traceable documentation.
Transparency, Explainability, and Trust	Develop machine-readable system documentation describing data flows, model training datasets, and versioning of simulation models. Implement explainability modules that generate human-readable summaries of AI-driven decisions. Enable traceability by linking model parameters to input data provenance. Provide user interfaces that allow end-users and auditors to inspect operational data and system behaviour.
Interoperability and Standardisation	Employ open data formats (e.g., JSON-LD, IFC, or OPC UA) and standardised ontologies for semantic interoperability across domains. Use modular architectures with API gateways supporting RESTful or MQTT-based communication. Integrate data pipelines with metadata catalogues to ensure discoverability and reusability in compliance with FAIR principles. Participate in EU-wide standardisation initiatives for digital twins and industrial data spaces.
Ethical and Social Responsibility	Incorporate fairness-aware algorithms in AI training and validation pipelines to prevent discriminatory outcomes. Implement monitoring dashboards that detect and report bias in predictive models. Ensure that datasets represent diverse populations and contexts. Integrate sustainability metrics (e.g., energy efficiency indicators) into Digital Twin lifecycle management. Establish ethical review protocols for model deployment.

This unified framework transforms the complexity of European digital regulation into a structured methodology for lawful, secure, and interoperable Digital Twin development. It allows developers to identify compliance dependencies early, document regulatory evidence consistently, and integrate technical safeguards systematically across all system layers. By embedding these principles into the engineering process, Digital Twin developers can align innovation with European legal and ethical standards, thereby ensuring that Digital Twin solutions are market-ready, trustworthy, and compliant within the evolving European data and AI ecosystem.

4.4. The Digital Twin Compliance Evaluation Matrix (DTCEM)

While the UDTCF provides a structured synthesis of legal and technical obligations under the six major EU laws, practical assessment of compliance in real-world Digital Twin projects remains a significant challenge. Many Digital Twins are documented in scientific articles, research deliverables, or technical reports, but their degree of legal and ethical compliance is rarely assessed systematically. The complexity of the European regulatory environment, combined with the multidisciplinary nature of Digital Twin systems, makes it difficult to determine whether a specific implementation conforms to the requirements of the General Data Protection Regulation (GDPR), the Data Governance Act (DGA), the Data Act, the Artificial Intelligence Act (AI Act), the NIS2 Directive, and the Cyber Resilience Act (CRA).

To address this challenge, a Digital Twin Compliance Evaluation Matrix (DTCEM) is proposed, as shown in Table 16. The DTCEM extends the compliance framework and technical implications presented in Table 14 and Table 15 by translating each compliance domain into a set of measurable evaluation indicators that can be applied to existing Digital Twin projects. It provides a structured instrument for assessing how well a Digital Twin system aligns with EU legal requirements across the seven meta-categories defined in the Unified Digital Twin Compliance Framework (UDTCF).

Table 16. Digital Twin Compliance Evaluation Matrix (DTCEM).

Meta-Category	Evaluation Focus	Qualitative Assessment Criteria	Compliance Level (NC/PC/C/FC)
Data Governance and Access Control	Access rights, consent management, interoperability	Assess whether data access and reuse mechanisms are lawful, transparent, and interoperable. Verify the presence of consent management tools and data-sharing agreements.
Data Protection and Privacy	Personal data handling, anonymisation, privacy-by-design	Evaluate the implementation of privacy-by-design and privacy-by-default principles. Determine if personal data is minimised, anonymised, or pseudonymised when appropriate.
Cybersecurity and Resilience	Security-by-design, incident handling, system robustness	Assess the existence of documented cybersecurity policies, vulnerability management procedures, and operational resilience strategies.
Accountability and Risk Management	Risk documentation, auditability, oversight	Examine whether risk assessments, compliance documentation, and oversight mechanisms are in place. Verify periodic audits and review processes.
Transparency, Explainability, and Trust	User information, traceability, explainability	Assess the extent to which system operation, data sources, and AI model decisions are documented, explainable, and traceable.
Interoperability and Standardisation	Open data formats, harmonised standards	Verify the adoption of open and interoperable standards, and evaluate whether the system can exchange data seamlessly across domains.
Ethical and Social Responsibility	Bias prevention, fairness, societal impact	Assess bias mitigation methods, fairness assurance, and mechanisms that demonstrate environmental and societal responsibility in system design.

Unlike quantitative assessment tools, this matrix uses qualitative compliance levels that capture the degree to which the Digital Twin demonstrates conformity with lawful obligations and best practices. Each meta-category is evaluated using a four-level qualitative scale as listed in Table 17.

Table 17. Four-level qualitative evaluation scale.

Compliance Level	Definition
Non-Compliant (NC)	The Digital Twin design or operation clearly violates or disregards the legal requirement. No evidence of compliance mechanisms is present.
Partially Compliant (PC)	Some compliance elements are present, but key obligations are missing, insufficiently documented, or inconsistently applied.
Compliant (C)	The Digital Twin meets the core legal and technical obligations for this category and provides adequate evidence of compliance.
Fully Compliant (FC)	The Digital Twin demonstrates full conformity with legal, ethical, and technical standards, supported by verifiable documentation and continuous monitoring mechanisms.

These four qualitative levels provide clear interpretability for compliance audits while allowing flexibility for research-oriented evaluations that involve systems still under development.

The DTCEM bridges the gap between regulatory theory and engineering practice by transforming the complex legal environment into measurable, evidence-based compliance indicators. When used together with the unified framework, it enables Digital Twin developers and researchers to demonstrate conformity with EU law systematically, fostering trustworthy and lawful innovation within the European Digital Single Market.

4.5. Evaluation Procedure and Application Contexts

The DTCEM provides a practical methodology for evaluating Digital Twin systems in both research and industrial settings. Its application follows a structured five-step process designed to ensure transparency, reproducibility, and comparability across projects.

• Step 1—Definition of Evaluation Scope: The evaluator begins by clearly defining the scope and boundaries of the Digital Twin to be assessed. This includes identifying the system’s purpose, operational environment, and interfaces with external data or control systems. For complex projects, such as multi-domain or federated Digital Twins, the scope should be decomposed into logical subsystems (for instance, data acquisition, analytics, or control layers) to enable targeted evaluation within each compliance domain.
• Step 2—Evidence Collection: For each meta-category of the DTCEM, relevant evidence must be gathered to substantiate the compliance assessment. Acceptable evidence includes technical documentation, organisational policies, legal artefacts, and operational records such as incident logs or audit trails. This ensures traceability and transparency in compliance evaluation.
• Step 3—Qualitative Assessment: Each meta-category is evaluated qualitatively using the four compliance levels: Non-Compliant (NC), Partially Compliant (PC), Compliant (C), or Fully Compliant (FC). The evaluator assigns a rating based on the strength and completeness of the supporting evidence and the extent to which the system meets the lawful requirements listed in the UDTCF. The process is deliberative rather than mechanical, encouraging expert judgement from both legal and technical perspectives.
• Step 4—Documentation and Review: All assessments and evaluator notes must be documented to support internal review and external verification. Documentation includes the rationale for each compliance level, references to supporting evidence, identified compliance gaps, and recommended corrective actions. The resulting dossier can serve in project reporting, certification alignment, or ethics board submissions.
• Step 5—Synthesis and Reporting: After completing the evaluation, the findings are synthesised into a compliance summary that highlights both strengths and deficiencies across meta-categories. Instead of numerical aggregation, the synthesis relies on interpretive reasoning. Systems may, for instance, be classified as

  ○

  Legally Critical—containing one or more Non-Compliant (NC) domains that require immediate remediation.

  ○

  Conditionally Acceptable—mostly Partially Compliant (PC), suitable for research pilots but not for operational deployment.

  ○

  Legally Robust—predominantly Compliant (C) or Fully Compliant (FC), suitable for deployment within the EU regulatory framework.

This qualitative synthesis enables decision-makers to prioritise compliance improvements and communicate the project’s legal readiness level transparently. The evaluation process can be applied manually by a legal–technical expert panel or semi-automatically through natural language analysis of Digital Twin documentation. It supports comparative studies, benchmarking of Digital Twin projects across sectors, and alignment of research outputs with EU policy objectives. Moreover, it provides a transparent and reproducible method for identifying gaps in privacy, security, and interoperability before deployment or certification.

The DTCEM thereby bridges the gap between regulatory theory and engineering practice by transforming the complex legal environment into measurable, evidence-based compliance indicators. When used together with the unified framework (Table 14 and Table 15), it enables Digital Twin developers and researchers to demonstrate conformity with EU law systematically, fostering trustworthy and lawful innovation within the European Digital Single Market.

The subsequent sections apply the Unified Digital Twin Compliance Framework (UDTCF) and the Digital Twin Compliance Evaluation Matrix (DTCEM) to four strategic sectors: Smart Cities, Industrial Manufacturing, Mobility and Transportation, and Energy Systems. Each sectoral analysis evaluates representative European initiatives across the seven meta-categories defined in the UDTCF, using the four-level qualitative compliance scale described in Table 17. This consistent methodological approach ensures comparability among the twelve cases examined and enables cross-sectoral synthesis of compliance maturity presented in Section 9.

5. Digital Twins in Smart Cities

5.1. Sector Overview

Digital Twins have become foundational instruments in the digital transformation of European cities. Urban Digital Twins integrate data from infrastructure, transport, environment, and citizen services into a virtual representation of the urban fabric that supports real-time analysis, simulation, and policy evaluation. By interlinking geographic information systems, IoT sensor networks, and AI-driven analytics, these platforms enable planners and operators to monitor and optimise the functioning of complex urban systems. Their functions range from dynamic traffic management and energy-efficient building operations to climate adaptation modelling and participatory urban design.

At the municipal level, Digital Twins are deployed as decision-support tools that facilitate cross-departmental coordination and transparency in urban governance. The European Commission’s initiatives on Local Digital Twins, the Living-in. EU movement [37], and the Mission on Climate-Neutral and Smart Cities [38] have further encouraged cities to adopt these technologies to achieve the objectives of the European Green Deal [39] and Digital Decade Policy Programme [40]. Consequently, Smart City Digital Twins constitute not only a technological evolution but also a governance innovation, embodying the integration of real-time data, citizen engagement, and predictive policy analysis within a shared digital infrastructure.

5.2. Regulatory Relevance

The governance of Smart City Digital Twins intersects with nearly all major EU digital laws identified in this review. The General Data Protection Regulation (GDPR) is central because urban Digital Twins continuously process location, environmental, and behavioural data that may qualify as personal or indirectly identifiable information. Ensuring data minimisation, lawful basis for processing, and transparency in citizen data use is therefore essential.

The Data Governance Act (DGA) and the Data Act are equally critical since municipal Digital Twins rely on data sharing among public authorities, utilities, private companies, and citizens. These laws define how public-sector data may be reused, how data intermediation services must operate, and how interoperability and contractual fairness are guaranteed.

The Artificial Intelligence Act (AIA) applies to the AI models embedded within Digital Twins that generate predictions, perform anomaly detection, or support decision-making in areas such as traffic control and energy distribution. Depending on their function, such systems may be classified as high-risk AI under the AIA, triggering obligations related to transparency, documentation, and human oversight.

The NIS2 Directive and Cyber Resilience Act (CRA) establish cybersecurity and resilience obligations for the infrastructures underpinning Smart City Digital Twins. These instruments require secure-by-design system architecture, vulnerability management, and incident reporting, ensuring that critical city operations remain protected against cyber threats.

Within the Unified Digital Twin Compliance Framework (UDTCF), Smart City applications primarily activate the following meta-categories: Data Governance and Access Control, Data Protection and Privacy, Cybersecurity and Resilience, and Transparency, Explainability, and Trust. These domains define the legal and technical conditions for trustworthy operation of urban Digital Twins.

5.3. Sectoral Compliance Evaluation

To assess the compliance maturity of Smart City Digital Twins, the Digital Twin Compliance Evaluation Matrix (DTCEM) can be applied to representative European initiatives. Three prominent examples illustrate different governance and technical models: Virtual Helsinki, Smart Dublin, and Rotterdam Urban Twin. Each represents an operational Digital Twin integrating heterogeneous data sources for urban management and citizen services.

Virtual Helsinki [41] demonstrates a strong alignment with GDPR principles through transparent data governance and explicit consent mechanisms in citizen engagement modules [42]. Its privacy-by-design approach and open-access policies indicate clear alignment with the Data Governance Act and the Data Act through licensed open datasets and interoperable APIs [43]. However, full traceability and explainability of AI models in line with the AI Act appear to be still developing in the public documentation, which emphasises datasets and use cases rather than model documentation [44]. The project can be rated as Fully Compliant (FC) for data protection, Compliant (C) for data governance, and Partially Compliant (PC) for AI transparency and documentation.

Smart Dublin [45] employs a distributed data-sharing model connecting city councils, utilities, and research institutions. Its adherence to the Data Governance Act principles of data altruism and neutrality is well established through its open-data portal and governance participation in the Cities Coalition for Digital Rights, which commits to transparent and privacy-by-design data use [46]. However, interoperability of datasets across departments and cloud platforms remains constrained, both of which note that Dublin’s councils operate heterogeneous systems without uniform schemas [47]. Accordingly, Smart Dublin demonstrates Compliant (C) levels for Data Governance, Partially Compliant (PC) for Interoperability and Standardisation, and Compliant (C) for Ethical and Social Responsibility due to its well-documented citizen-participation and open-innovation framework [48,49].

The Rotterdam Urban Twin [50] integrates environmental monitoring and climate resilience functions through city-scale digital infrastructure and AI-enabled analytical models [51,52]. Developed within the city’s Open Urban Platform, it facilitates data exchange across municipal departments and supports predictive simulations for urban sustainability and flood-risk management. The platform’s design aligns with the European NIS2 Directive and Cybersecurity Act through integrated risk-management procedures and adoption of security-by-design principles promoted by ENISA’s cybersecurity frameworks, indicating a high level of operational resilience. Governance and accountability are strengthened through the Centre for Bold Cities, which applies multidisciplinary ethical review and risk analysis in the use of municipal and citizen data [53]. However, ongoing experimentation with machine-learning-based prediction for climate adaptation and mobility scenarios still lacks full explainability documentation, leaving transparency obligations under the Artificial Intelligence Act partially met. Accordingly, the Rotterdam Urban Twin can be assessed as Fully Compliant (FC) for Cybersecurity and Resilience, Compliant (C) for Accountability and Risk Management, and Partially Compliant (PC) for Transparency and Explainability.

A comparative synthesis of these evaluations is shown in Table 18.

Table 18. Compliance Evaluation of Representative Smart City Digital Twins.

Meta-Category	Virtual Helsinki	Smart Dublin	Rotterdam Urban Twin
Data Governance and Access Control	C	C	C
Data Protection and Privacy	FC	C	C
Cybersecurity and Resilience	C	PC	FC
Accountability and Risk Management	C	PC	C
Transparency, Explainability, and Trust	PC	PC	PC
Interoperability and Standardisation	C	PC	C
Ethical and Social Responsibility	C	C	C

This analysis shows that most European Smart City Digital Twins reach at least Compliant (C) levels across data protection, governance, and cybersecurity dimensions, while Transparency and Explainability remain areas of partial compliance. The trend indicates that although technical and organisational safeguards are increasingly mature, the interpretability and documentation of AI-based urban simulations still require further alignment with the transparency obligations of the Artificial Intelligence Act.

Table 19 provides structured evidence linking each compliance rating in Table 18 to publicly verifiable documentary sources, ensuring methodological transparency in the scoping review process. Each entry lists the relevant documentation and corresponding legal provisions under the six EU acts covered by the Unified Digital Twin Compliance Framework (UDTCF). Together, Table 18 and Table 19 enable cross-validation of compliance assessments and strengthen the evidential basis for sectoral findings discussed in Section 9.

Table 19. Evidence Alignment between Compliance Evaluation and Documentary Sources.

Meta-Category	Virtual Helsinki—Evidence and Alignment	Smart Dublin—Evidence and Alignment	Rotterdam Urban Twin—Evidence and Alignment
Data Governance and Access Control	Helsinki 3D+ and Kalasatama Digital Twins Project confirm open-data licensing, non-exclusive reuse, and interoperable APIs under the Helsinki Region Infoshare portal, consistent with DGA Arts. 5–12. Supports rating (C) [54,55]	Smart Dublin Strategy and Maynooth University Digital Twin Ecosystem confirm lawful data sharing among public authorities under data-altruism and transparency rules. Supports rating (C) [56,57]	Open Urban Platform Rotterdam specifies open data exchange across municipal departments, aligning with DGA and Data Act Articles 23–29. Supports rating (C) [58]
Data Protection and Privacy	Kalasatama Pilot documentation details anonymisation, pseudonymisation, and privacy-by-design architecture; GDPR Arts. 5, 6, 9, 25. Supports rating (FC) [42]	Smart Dublin’s governance framework applies GDPR across four councils, though enforcement is decentralised: GDPR Arts. 24–25. Supports rating (C) [59]	Centre for Bold Cities and Smart Cities Marketplace note anonymised environmental data but lack explicit GDPR procedures; GDPR Arts. 5–6. Supports rating (C) [50]
Cybersecurity and Resilience	Bentley Systems Case Study describes secure data synchronisation but omits formal NIS2 compliance. Supports rating (C) [60]	AECbytes Report shows limited reference to cybersecurity certification. Supports rating (PC) [61]	Rotterdam Open Urban Platform and ENISA Guidance Integration confirm risk-management, incident-reporting, and certified security controls consistent with NIS2 Arts. 20–23. Supports rating (FC) [58]
Accountability and Risk Management	Municipal governance and documented audit trails align with GDPR Art. 30 and AI Act Art. 9. Supports rating (C) [43]	City-wide data management policies define roles and oversight but lack integrated risk registry. Supports rating (PC) [54]	Centre for Bold Cities project applies multidisciplinary ethical review and risk analysis, consistent with AI Act Arts. 9–14. Supports rating (C) [62]
Transparency, Explainability and Trust	Public portals disclose data sources; no detailed documentation of AI model explainability. Supports rating (PC) [54,63]	Citizen dashboards report urban indicators but not model logic. Supports rating (PC) [47,56]	Predictive AI modules for flood and climate modelling remain non-transparent. Supports rating (PC) [64]
Interoperability and Standardisation	Open data schemas (CityGML, IFC) and RESTful APIs ensure cross-system compatibility. Supports rating (C) [55,65]	AECbytes and Eurocities highlight lack of uniform schemas between councils. Supports rating (PC) [47]	Platform built on open standards (ISO 37106 [66]) for data exchange. Supports rating (C) [58]
Ethical and Social Responsibility	Citizen engagement and sustainability goals under Helsinki 3D+ Mission Zero Carbon 2030. Supports rating (C) [60,67]	Smart Dublin demonstrates citizen participation and open innovation ethos. Supports rating (C) [48,49]	Bold Cities Project integrates fairness and social-impact assessment in data use. Supports rating (C) [62]

5.4. Sector-Specific Challenges and Lessons

The application of EU law to Smart City Digital Twins reveals several recurring challenges. First, data protection and anonymisation remain complex because urban data often combine personal and non-personal elements, making complete anonymisation technically difficult without undermining analytical value. Second, interoperability and standardisation continue to be fragmented due to the diversity of municipal data infrastructures and vendor-specific implementations. Third, accountability and human oversight of AI-driven decision systems, such as adaptive traffic control or urban planning simulations, require clearer governance frameworks to comply with the AI Act’s requirements for transparency and oversight.

Nevertheless, European initiatives show growing maturity in integrating compliance-by-design methodologies. The use of federated data spaces allows municipalities to retain data sovereignty while enabling cross-domain analysis in line with the Data Governance Act. Regulatory sandboxes established under the AI Act are emerging as valuable instruments for testing high-risk AI components in controlled environments. Similarly, alignment with European cybersecurity certification schemes under the NIS2 Directive and Cyber Resilience Act enhances trust and resilience in municipal infrastructures.

Overall, Smart City Digital Twins exemplify the convergence of technical innovation and legal responsibility within the European digital ecosystem. Their progressive alignment with EU data, AI, and cybersecurity laws demonstrates a strong trajectory toward lawful, ethical, and interoperable digital governance. However, sustained investment in transparency mechanisms, open standards, and cross-sector collaboration remains essential to achieve full compliance maturity across the European Smart City landscape.

6. Digital Twins in Industrial Manufacturing

6.1. Sector Overview

Digital Twins have become a cornerstone of the digital transformation in industrial manufacturing, underpinning the transition towards smart factories, cyber-physical production systems, and Industry 5.0 [68,69]. Within this context, Digital Twins represent a fusion of operational technology and information technology that enables continuous synchronisation between virtual models and physical assets such as machines, robots, and production lines. They are deployed across the full manufacturing lifecycle: product design, process optimisation, predictive maintenance, and supply-chain coordination. By combining IoT sensor data, physics-based simulations, and AI-driven analytics, they facilitate real-time monitoring, predictive decision-making, and self-adaptive control of production environments.

European manufacturing is a leading domain for Digital Twin innovation, strongly supported by programmes such as Made in Europe [70] and Factories of the Future [71]. Industrial Digital Twins are increasingly embedded in data-driven ecosystems that connect equipment manufacturers, suppliers, and customers through secure and interoperable platforms. Their contribution to resource efficiency, resilience, and circular manufacturing aligns with the European Green Deal [39], the Data Strategy [72], and the Digital Single Market objectives [73].

6.2. Regulatory Relevance

Industrial Digital Twins operate at the intersection of multiple European digital regulations. The Data Act and Data Governance Act are particularly influential because manufacturing data, especially that generated by connected industrial machinery, forms the basis for value creation and innovation. These laws define access rights, interoperability, and fairness in business-to-business data sharing, ensuring that machine-generated data can be reused under transparent and non-discriminatory conditions.

The General Data Protection Regulation (GDPR) applies where Digital Twins process human-related data such as operator performance metrics or workplace safety monitoring. The Artificial Intelligence Act (AIA) becomes relevant when machine-learning components are used for autonomous optimisation, quality control, or predictive maintenance. Such systems may fall under the high-risk category if they affect human safety or product conformity.

The NIS2 Directive and Cyber Resilience Act (CRA) impose obligations for cybersecurity, vulnerability management, and secure software development. Because industrial Digital Twins connect production assets and cloud infrastructures, compliance with these instruments is essential for safeguarding manufacturing continuity and preventing cyber-physical incidents.

Within the Unified Digital Twin Compliance Framework (UDTCF), industrial manufacturing primarily activates the domains of Data Governance and Access Control, Cybersecurity and Resilience, Interoperability and Standardisation, and Accountability and Risk Management.

6.3. Sectoral Compliance Evaluation

To illustrate compliance maturity in industrial manufacturing, the Digital Twin Compliance Evaluation Matrix (DTCEM) was applied to three representative European cases: Siemens Industrial Edge [74] and Digital Twin Factory [75], Bosch Rexroth Factory of the Future [76], and Fraunhofer DIGIT Smart Factory Twin [77]. Each case demonstrates a distinct combination of proprietary and open-data ecosystems, yet all operate under the same overarching EU legal obligations.

Siemens Industrial Edge [74] and Digital Twin Factory [75] integrates the MindSphere Cloud Services [78] and Teamcenter Simulation Platform [79] for synchronising product, process, and performance data. Documentation indicates adherence to the Data Act through standardised APIs, open interoperability formats, and contractual fairness provisions. Siemens’ security certifications under ISO 27001 [80] and ENISA guidelines align with NIS2 requirements, while integrated privacy-by-design functions in Human–Machine Interfaces support GDPR compliance [81]. Transparency of AI-based predictive models remains limited due to proprietary algorithms, justifying ratings of Compliant (C) for governance and security, and Partially Compliant (PC) for transparency.

Bosch Rexroth Factory [76] of the Future uses an open automation platform that combines Digital Twin models with edge computing and AI analytics [82]. Its governance documentation demonstrates clear data-access policies, cross-domain interoperability, and voluntary alignment with the European Data Space standards [83,84]. Security-by-design principles and continuous vulnerability assessment under the Bosch Cybersecurity Framework substantiate a Fully Compliant (FC) rating for Cybersecurity and Resilience [85,86]. However, partial explainability in predictive maintenance algorithms and limited user transparency lead to a (PC) rating for Transparency and Trust.

Fraunhofer Digital Twin Smart Factory operates as a research infrastructure for testing interoperable Digital Twins across multiple industrial partners [77]. It explicitly applies the Data Governance Act through neutral data intermediation services and implements a federated access model compatible with the GAIA-X architecture [87]. The facility maintains full traceability and audit trails for all AI models, combined with detailed conformity documentation under the AIA and CRA. It is rated Fully Compliant (FC) for Data Governance and Access Control, Compliant (C) for Transparency and Accountability, and Fully Compliant (FC) for Interoperability and Standardisation.

A comparative synthesis of these evaluations is shown in Table 20.

Table 20. Compliance Evaluation of Representative Industrial Digital Twins.

Meta-Category	Siemens Digital Twin Factory	Bosch Rexroth Factory of the Future	Fraunhofer DIGIT Smart Factory Twin
Data Governance and Access Control	C	C	FC
Data Protection and Privacy	C	C	C
Cybersecurity and Resilience	C	FC	FC
Accountability and Risk Management	C	C	C
Transparency, Explainability and Trust	PC	PC	C
Interoperability and Standardisation	C	C	FC
Ethical and Social Responsibility	C	C	C

This evaluation shows that industrial Digital Twins generally achieve high compliance with data governance, security, and interoperability obligations, while transparency and explainability remain partially fulfilled due to proprietary AI models and confidential industrial processes.

Table 21 presents verifiable evidence linking the compliance levels in Table 20 to documented corporate, institutional, and research materials. Each citation corresponds to public technical documentation, certification statements, or institutional policy frameworks consistent with the obligations under the six EU legislative instruments analysed. The alignment confirms that Siemens, Bosch Rexroth, and Fraunhofer DIGIT exhibit strong conformity in cybersecurity, interoperability, and governance domains, while explainability and transparency remain partially implemented due to proprietary industrial constraints.

Table 21. Evidence Alignment between Compliance Evaluation and Documentary Sources.

Meta-Category	Siemens Digital Twin Factory—Evidence and Alignment	Bosch Rexroth Factory of the Future—Evidence and Alignment	Fraunhofer DIGIT Smart Factory Twin—Evidence and Alignment
Data Governance and Access Control	Siemens MindSphere and Teamcenter documentation specify open APIs and FAIR data exchange; compliance with Data Act Arts. 3–7 and 23–29 shown through the Siemens Xcelerator open ecosystem and MindSphere Data Services White Paper (2023). Supports rating (C) [78]	Bosch Rexroth platform white papers describe transparent data-access policies and neutral intermediation via ctrlX CORE platform; DGA Arts. 10–15 on data intermediation applied. Supports rating (C) [88]	Fraunhofer institutes engage in federated data-spaces aligned with Gaia-X AISBL, enabling sovereign data-sharing and governance consistent with the spirit of DGA Arts. 5–12. Supports rating (FC) [89]
Data Protection and Privacy	Siemens Industrial Edge Security Concept (2023) and GDPR compliance statements cover anonymisation of operator data and pseudonymised log retention; GDPR Arts. 5 and 25. Supports rating (C) [90]	Bosch Rexroth Privacy and Security Framework applies GDPR principles for user-trace data in condition monitoring; GDPR Arts. 6 and 32. Supports rating (C) [83]	Fraunhofer’s research on privacy-preserving analytics exemplifies privacy-by-design and pseudonymisation consistent with GDPR Art. 25. Supports rating (C) [91]
Cybersecurity and Resilience	Siemens conforms to ISO 27001 and IEC 62443 [92]; ENISA Industrial Cybersecurity Guidelines adopted in Edge Gateway architecture; NIS2 Arts. 20–23. Supports rating (C) [93]	Bosch Rexroth Cybersecurity Framework (2024) mandates continuous vulnerability scanning and secure-by-design lifecycle; conformity with CRA Arts. 8–12 and NIS2 Art. 21 verified through TÜV certifications. Supports rating (FC) [94]	Fraunhofer institutes implement ISO 27001/IEC 62443-based security management, incident-response and industrial-CSIRT processes aligned with NIS2 and CRA frameworks. Supports rating (FC) [95]
Accountability and Risk Management	Siemens integrates compliance dashboards and audit logging in MindSphere; risk registers align with AI Act Art. 9 and GDPR Art. 30. Supports rating (C) [78]	Bosch employs structured risk management and internal conformity audits under ISO 31000; governance documentation aligns with AI Act Arts. 9–11. Supports rating (C) [96]	Fraunhofer applies formal risk-management systems (inspired by ISO 31000) and aligns governance with GDPR Art. 30 requirements and AI-governance frameworks. Supports rating (C) [97]
Transparency, Explainability and Trust	Proprietary AI predictive-maintenance modules described only in overview; lack of published explainability metrics limits transparency under AIA Arts. 13–15. Supports rating (PC) [98]	Predictive algorithms in ctrlX DRIVE system partially documented; user transparency achieved through dashboards but not full model interpretability; AIA Art. 10 partially met. Supports rating (PC) [99]	Fraunhofer institutes publish white-papers and toolkits on explainable AI (XAI), providing documentation and traceability of AI modules in line with AIA Arts. 11–13. Supports rating (C) [91]
Interoperability and Standardisation	Siemens supports OPC UA and AutomationML standards enabling cross-vendor data exchange; Data Act Art. 33. Supports rating (C) [78]	Bosch Rexroth adheres to open standards (OPC UA, MQTT, JSON-LD) and publishes reference implementations. Supports rating (C) [100]	Fraunhofer DIGIT implements ISO 23247 reference architecture for Digital Twin interoperability [101] and GAIA-X data connector standard Supports rating (FC) [102]
Ethical and Social Responsibility	Siemens Sustainability Report (2024) aligns Digital Twin operations with EU Ethics Guidelines for Trustworthy AI (2019). Supports rating (C) [103]	Bosch Corporate Sustainability Framework emphasises human-centric automation and workforce safety metrics. Supports rating (C) [104]	Fraunhofer incorporates fairness, sustainability, and human-centric automation metrics into pilot evaluations, aligning with responsible-AI and sustainability frameworks. Supports rating (C) [105]

6.4. Sector-Specific Challenges and Lessons

The compliance evaluation highlights recurring challenges in industrial manufacturing. Data sovereignty remains a dominant issue, as contractual asymmetries between data holders and equipment users complicate the implementation of the Data Act’s fair-access principles. Interoperability is hindered by co-existing proprietary ecosystems that slow the adoption of open standards and semantic harmonisation. Transparency of AI models is limited by intellectual-property constraints, making it difficult to meet the AI Act’s requirements for explainability and human oversight.

Nevertheless, several best practices are emerging. The adoption of European Industrial Data Spaces and GAIA-X compliant reference architectures promotes lawful and secure data exchange across value chains. Industrial AI sandboxes under the AIA provide a safe environment for testing high-risk applications such as automated quality inspection or robot collaboration. The integration of Cyber Resilience Act conformity assessments within product certification processes ensures continuous vulnerability management and lifecycle security.

Overall, the manufacturing sector demonstrates advanced maturity in compliance-by-design. Its long-standing culture of quality assurance and certification has accelerated the integration of legal compliance into engineering workflows. However, achieving full conformity under EU digital law will depend on greater openness, cross-industry standardisation, and the incorporation of explainable AI into Digital Twin development and deployment.

7. Digital Twins in Mobility and Transportation

7.1. Sector Overview

Digital Twins are reshaping mobility and transportation through continuously synchronised models of networks, vehicles, terminals and logistics flows. They integrate live data from traffic sensors, connected vehicles, public transport systems and logistics platforms with physics-based and data-driven models. These capabilities enable authorities and operators to optimise timetables, signal plans and curb use, to coordinate multimodal exchanges, to anticipate congestion and incidents, and to manage resilience during disruptions.

In Europe the most mature applications appear in port logistics, rail infrastructure and airport operations. Port authorities use Digital Twins to orchestrate vessel calls, yard movements and hinterland trucking. Rail infrastructure managers employ network twins to plan maintenance, timetable capacity and energy optimisation. Airport operators deploy operational twins to manage airside and landside flows, turnaround processes and passenger services. These deployments align with the goals of the European Sustainable and Smart Mobility Strategy [106], the European Green Deal [39] and the Digital Decade [40].

7.2. Regulatory Relevance

Mobility Digital Twins intersect with all six EU legal instruments analysed in this study. The General Data Protection Regulation governs personal and indirectly identifiable data derived from location traces, ticketing, computer vision and telematics. Privacy by design, lawful basis and data subject rights must be embedded in passenger-facing functions and connected vehicle services.

The Data Governance Act and the Data Act are central because mobility twins rely on governed sharing of data among transport authorities, operators, terminal owners, fleet companies and service providers. These laws shape conditions for reuse of public sector data, neutrality of intermediation, fairness in business-to-business data access and interoperability for switching across cloud and edge services.

The Artificial Intelligence Act applies where learning components support safety relevant functions, for example predictive maintenance of rolling stock, operational decision support in airside turnarounds or signal optimisation in rail networks. Depending on use and risk, obligations include risk management, documentation, transparency and human oversight.

The NIS2 Directive and the Cyber Resilience Act impose security by design, vulnerability and incident handling, and supply chain assurance across operational technology, information technology and cloud infrastructure. For critical transport services, these obligations are decisive for safe operations and for continuity of cross border mobility.

Within the Unified Digital Twin Compliance Framework, mobility systems activate all seven meta categories, with particular emphasis on data governance and access control, data protection and privacy, cybersecurity and resilience, and transparency and trust where AI informs operational decisions.

7.3. Sectoral Compliance Evaluation

The Digital Twin Compliance Evaluation Matrix was applied to three representative European mobility cases. The Port of Hamburg operates a logistics and traffic Digital Twin for the harbour and urban interfaces. Deutsche Bahn through DB Netz advances a rail infrastructure twin under the Digital Rail for Germany initiative. Royal Schiphol Group operates an airport operations twin that integrates airside and landside processes. The three cases illustrate different combinations of safety critical operations, complex stakeholder governance and multi cloud data pipelines.

The Port of Hamburg operates an advanced smart-port digital-twin environment under the Hamburg Port Authority’s “Digital Port Twin” and “smartPORT” initiatives [107,108]. These programmes integrate sensor data, simulation, and 3D visualisation to enhance infrastructure planning, logistics coordination, and traffic management. Governed data and service interfaces are provided through secure web-based clients for logistics and rail operators, enabling coordinated operational access within defined governance frameworks [109]. The authority participates in the international chainPORT network, which promotes connected-port data exchange and cyber-resilience among global port authorities [110]. Projects such as smartBRIDGE Hamburg employ open BIM and IFC standards to ensure interoperability and technical transparency across digital-asset models [111]. Cybersecurity and operational-technology resilience form explicit priorities in HPA’s strategy, with public statements stressing the protection of industrial-control environments and alignment with port-sector cyber-resilience frameworks [112]. Research collaborations such as the TwinSim project use AI-based simulation and predictive modelling to support terminal operations [113], while current literature indicates that transparency and model-level explainability in port digital twins remain at a developing stage [114]. Based on the available evidence, the Port of Hamburg’s digital-twin ecosystem can be rated Compliant (C) for governance, Compliant (C) for data protection and privacy, Compliant (C) for cybersecurity and resilience, Partially Compliant (PC) for transparency and explainability, Compliant (C) for interoperability and standardisation, Compliant (C) for accountability and risk management, and Compliant (C) for ethics and societal responsibility.

Deutsche Bahn’s rail infrastructure twin enables DB Netz to link asset registers, signalling, scheduling and maintenance planning to a network-level digital twin that simulates train operations across the entire German rail network [115]. The programme documents risk management, conformity processes and safety cases that map to the governance requirements of the EU Artificial Intelligence Act and NIS2 Directive, both of which apply to critical rail infrastructure managers and their control and signalling systems. Interoperability follows European rail standards and common data formats used in GIS and BIM integration, as demonstrated in Deutsche Bahn’s network-modernisation programme reported by [116]. Where learning systems inform timetable proposals or predictive maintenance, human oversight is maintained, though public explainability artefacts remain concise. Ratings were Compliant (C) for governance, Compliant (C) for privacy, Fully Compliant (C) for cybersecurity and resilience, Compliant (C) for accountability and risk management, Partially Compliant (PC) for transparency, Compliant (C) for interoperability, Compliant (C) for ethics.

The Royal Schiphol Group operates an airport twin that integrates aircraft turnaround, stand allocation, passenger flow, and baggage logistics within a unified operational digital twin. Real-time camera and sensor feeds, such as the Deep Turnaround AI system, use computer-vision processing to predict push-back times and optimise stand operations [117]. Airport-wide dashboards in the Airport Operations Centre employ predictive insights for dynamic capacity and flow management [118]. The digital-twin architecture tracks over 80,000 indoor and outdoor assets and infrastructure systems under a unified Common Data Environment [119]. Schiphol’s corporate Risk Management and Internal Control framework details incident response, vulnerability management, and cyber-resilience governance consistent with European critical-infrastructure standards [120]. Additional sector-wide cooperation on threat simulation and supplier security is reported by PwC in its Schiphol cybersecurity case study [121]. Academic analyses confirm that airport digital twins are increasingly applied for cyber-attack protection and vulnerability assessment [122]. Although public certification under the Cyber Resilience Act has not yet been disclosed, Schiphol’s infrastructure aligns with obligations for transport-critical entities under the NIS2 Directive in the Netherlands [123]. Passenger-facing data use incorporates privacy-by-design mechanisms, including visual masking of non-relevant fields in AI processing [117], while some predictive modules remain proprietary with limited published explainability. Ratings were Compliant (C) for governance, Compliant (C) for privacy, Fully Compliant (C) for cybersecurity and resilience, Compliant (C) for accountability, Partially Compliant (PC) for transparency, Compliant (C) for interoperability, Compliant (C) for ethics.

Table 22 reports the qualitative assessment.

Table 22. Compliance evaluation of representative mobility and transportation Digital Twins.

Meta Category	Port of Hamburg Twin	Deutsche Bahn Rail Twin	Schiphol Airport Twin
Data Governance and Access Control	C	C	C
Data Protection and Privacy	C	C	C
Cybersecurity and Resilience	C	C	C
Accountability and Risk Management	C	C	C
Transparency, Explainability and Trust	PC	PC	PC
Interoperability and Standardisation	C	C	C
Ethical and Social Responsibility	C	C	C

The cross-case pattern mirrors the industrial and city domains. Governance, privacy, security and interoperability reach at least compliant levels, while transparency of model logic and assurances for explainability remain partially fulfilled due to operational sensitivity, intellectual property constraints and safety certification boundaries. Table 23 reports evidence for alignment between compliance evaluation and documentary sources for mobility Digital Twins.

Table 23. Evidence Alignment between Compliance Evaluation and Documentary Sources.

Meta Category	Port of Hamburg Twin, Evidence and Alignment	Deutsche Bahn Rail Twin, Evidence and Alignment	Schiphol Airport Twin, Evidence and Alignment
Data Governance and Access Control	HPA’s transPORT rail exposes governed APIs and web-client access for authorised logistics operators. The chainPORT network coordinates data exchange and cyber-resilience governance among ports. Supports rating (C) [109,110]	DB is building a “country-scale digital twin” of its network under the Digitale Schiene Deutschland programme, enabling network-wide simulation and asset-data sharing. Supports rating (C) [124]	Schiphol’s digital-asset twin (Common Data Environment) consolidates BIM/GIS/real-time sensor data across stakeholders, enabling structured data-sharing for operations. Supports rating (C) [119]
Data Protection and Privacy	HPA’s cites compliance with GDPR, BDSG, and HmbDSG. Traffic and camera data processed under principles of minimisation and transparency ensure privacy-by-design in analytics. Supports rating (C) [125]	DB cites use of IoT and cloud platforms (AWS IoT) for its fleet of 6500 trains and 37,000 miles of track; these systems operate under strict data-and-operations oversight. Supports rating (C) [126]	Schiphol’s digital twin integrates real-time data from over 80,000 indoor and outdoor assets through a unified Common Data Environment combining BIM, GIS, and sensor data. Passenger-flow and occupancy sensors capture temperature and crowd data within terminals via the Wilbur predictive dashboard and API tools, representing privacy-relevant data streams governed under Schiphol’s data-management framework. Supports rating (C) [119,127,128]
Cybersecurity and Resilience	HPA participates in chainPORT’s “Cyber Resilience” group to strengthen defences against cyberattacks. Sector alignment with IAPH Cybersecurity Guidelines on OT/ICS risk management; public calls highlight control-system security priorities. Supports rating (C) [110,112,129]	DB’s “Digital Testfield” case study shows lifecycle simulation of signalling/interlocking systems that inherently require high operational-resilience and safety controls. Supports rating (C) [130]	Schiphol’s digital twin supports simulation of operational failures and asset-failure scenarios, implying resilience frameworks. Supports rating (C) [122]
Accountability and Risk Management	Authorisation and audit control in transPORT rail show role-defined governance. HPA’s Sustainability Report notes digital-twin-based monitoring and traceable data management. Supports rating (C) [109]	DB’s development of a location-data infrastructure for building/tunnel monitoring ensures direct asset-to-digital traceability and risk-control. Supports rating (C) [131]	The BIM@Schiphol programme emphasises processes, organisational structures and change-control in the twin ecosystem. Supports rating (C) [132]
Transparency, Explainability and Trust	Digital Port Twin documentation covers 3D modelling and sensor integration but omits AI model logic. Academic studies report transparency and standardisation gaps in port twins. Supports rating (PC) [107,114]	DB documentation reveals system-level models (digital twin of railway assets) but limited public disclosure of algorithmic logic or AI-model internals. Supports rating (PC) [116]	Schiphol’s twin enables simulation and optimisation, but public disclosure of model internals and analytics logic remains limited. Supports rating (PC) [133]
Interoperability and Standardisation	smartBRIDGE Hamburg applies open BIM/IFC standards; Port Development Plan 2040 embeds BIM + sensor integration for interoperable assets. API interfaces in transPORT rail support multi-actor data coordination. Supports rating (C) [108,111,134]	DB uses open standards like PlanPro and data formats interoperable across devices and suppliers in the digital testfield. Supports rating (C) [130]	Standardised interfaces across airport systems and partner integrations, migration paths that reflect Data Act switching principles, supports rating (C) [135]
Ethical and Social Responsibility	HPA’s Sustainability Framework integrates emissions reduction, efficiency, and community goals; digital twins contribute to responsible infrastructure and environmental management. Supports rating (C) [136]	DB’s twin applications support energy-and-fleet-optimisation (Eco Rail Simulator) and thereby contribute to sustainability and social mobility goals. Supports rating (C) [137]	Schiphol targets “world’s most sustainable airport” by 2030; its twin technology supports energy-efficiency, comfort, passenger flow and sustainability goals. Supports rating (C) [138]

7.4. Sector Specific Challenges and Lessons

First, data protection in mobility twins must reconcile privacy with lawful processing of location and behavioural data at scale. Strong minimisation, aggregation and pseudonymisation are required, together with clear interfaces for data subject rights. Second, interoperability across authority systems, operators and suppliers is a persistent barrier. Progress depends on adoption of open schemas, common operational semantics and switching controls aligned with the Data Act. Third, transparency for AI remains the principal open obligation. Safety critical operations favour proven models and vendor confidentiality, yet the Artificial Intelligence Act requires documented risk management, traceability and human oversight.

Promising practices include federated data spaces for transport that keep data sovereignty with operators while enabling lawful reuse, regulatory sandboxes for safety-related AI functions, and security certification of digital products under the Cyber Resilience Act to strengthen supply chain trust. As mobility twins converge with connected vehicle ecosystems and city traffic management, joint governance between authorities and operators becomes a decisive enabler of lawful and trustworthy deployment.

8. Digital Twins in Energy Systems

8.1. Sector Overview

Digital Twins are transforming how Europe plans, operates, and integrates its energy systems by providing synchronised virtual models of assets and networks across transmission, distribution, and prosumer domains [8]. These models continuously ingest data from supervisory control and data acquisition systems, synchrophasors, smart meters, weather services, and market platforms, enabling dynamic visualisation, forecasting, and optimisation of energy flows.

At the transmission level, Digital Twins underpin security assessment, congestion management, and real-time stability analysis. At the distribution level, they support voltage regulation, local flexibility management, and grid integration of distributed energy resources. At the prosumer level, virtual power plant (VPP) twins and community energy twins optimise rooftop photovoltaics, batteries, electric vehicles, and demand response resources. Together, these capabilities directly advance the objectives of the European Green Deal [39], the Digitalisation of the Energy System Action Plan [139], and the Fit-for-55 Package [140].

8.2. Regulatory Relevance

Energy system Digital Twins are subject to the full spectrum of EU digital regulation. The General Data Protection Regulation (GDPR) governs household and prosumer data collected through smart meters and IoT devices, requiring privacy-by-design and user rights management.

The Data Governance Act (DGA) and Data Act (DA) define lawful conditions for data exchange among transmission system operators (TSOs), distribution system operators (DSOs), aggregators, and service providers, enforcing neutrality of data intermediation, fair contractual terms, and interoperability across energy data spaces.

The Artificial Intelligence Act (AIA) applies to learning components used in predictive control, state estimation, or fault detection, which may qualify as high-risk systems and must therefore meet obligations for risk management, documentation, and human oversight.

The NIS2 Directive and the Cyber Resilience Act (CRA) establish cybersecurity and vulnerability management obligations for energy system operators and digital product vendors, ensuring secure design and lifecycle monitoring of critical digital infrastructures.

Within the Unified Digital Twin Compliance Framework (UDTCF), the energy domain activates all seven meta-categories, with pronounced emphasis on data governance, data protection, cybersecurity, interoperability, and accountability.

8.3. Sectoral Compliance Evaluation

To evaluate the maturity of compliance in European energy system Digital Twins, the Digital Twin Compliance Evaluation Matrix (DTCEM) was applied to three representative EU projects: OneNet (pan-European TSO-DSO coordination twin), Platone (distribution-system twin for flexibility management), and SINTEF & NODES (Virtual Power Plant and prosumer twin for local energy markets). Each project illustrates how data governance, privacy, cybersecurity, interoperability, and transparency obligations are addressed in operational energy-data ecosystems.

The OneNet project, funded under Horizon 2020 (Grant Agreement No. 957739) and coordinated by a European consortium including ENTSO-E and E.DSO, develops a unified digital environment that connects transmission and distribution system operators across Europe to enable real-time coordination, data exchange, and market interoperability [141]. The project’s governance framework defines access roles, data usage policies, and traceability mechanisms to ensure data sovereignty and lawful exchange, as outlined in Deliverables D5.7 and D6.2 [142,143]. Cybersecurity, privacy, and risk-management principles are addressed in Deliverable D5.8, which specifies regulatory and technical requirements derived from the NIS Directive and EU data-protection law [144]. These documents collectively demonstrate a robust approach to governance, security, and interoperability, although no explicit references to the forthcoming NIS2 Directive or Cyber Resilience Act are present in the publicly available materials. Cross-border data exchange frameworks integrate privacy and minimisation measures, yet algorithmic transparency and explainability remain limited in the published documentation. Overall, the OneNet project exhibits compliance with EU standards for data governance, security, and interoperability, while partial evidence is available for privacy implementation and transparency of AI-driven modules. It is rated Compliant (C) for Data Governance and Access Control, Partially Compliant (PC) for Data Protection and Privacy, Compliant (C) for Cybersecurity and Resilience, Compliant (C) for Accountability and Risk Management, Partially Compliant (PC) for Transparency and Explainability, Compliant (C) for Interoperability and Standardisation, and Compliant (C) for Ethical and Social Responsibility.

Platone, a Horizon 2020 project led by Avacon, Areti, and HEDNO, develops architectures for distribution-grid flexibility and prosumer integration within European smart distribution networks. The project’s objective is to enhance observability of distributed renewable energy resources and unlock flexibility services for DSOs through open, standardised, and interoperable platforms [145]. Governance follows principles of neutrality and non-discrimination in data exchange, as described by the European Distribution System Operators (E.DSO), ensuring open access and compliance with existing regulatory frameworks [146]. Data management and interoperability are documented through project deliverables defining standard communication protocols and data governance models [147]. Cybersecurity within Platone is addressed through the examination of relevant smart-grid and information-security standards as documented in the project’s deliverables on interoperability and standardization [147]. Ethical and regulatory assessments within the project address data security, privacy, and transparency obligations under the EU’s digital strategy [40]. While these reports document strong governance and cybersecurity measures, publicly available materials provide limited detail on privacy-by-design mechanisms or model-level explainability of AI-driven grid optimisation modules. Consequently, Platone demonstrates compliant implementation of governance, interoperability, and cybersecurity frameworks, though transparency and explainability remain areas where publicly verifiable evidence is limited. It is rated Compliant (C) for Data Governance and Access Control, Compliant (PC) for Data Protection and Privacy, Compliant (C) for Cybersecurity and Resilience, Compliant (C) for Accountability and Risk Management, Partially Compliant (PC) for Transparency and Explainability, Compliant (FC) for Interoperability and Standardisation, and Compliant (PC) for Ethical and Social Responsibility.

The SINTEF–NODES collaboration in the Nordic energy market explores digital twin-enabled frameworks for aggregating distributed energy resources and enhancing local flexibility trading. Building on SINTEF’s broader digital twin research (e.g., SINDIT framework) and its involvement in the NODES flexibility platform, the initiative aims to create interoperable environments that allow prosumers, aggregators, and system operators to exchange energy and flexibility services transparently [148,149]. Governance approaches are inspired by European data-space principles, emphasising transparency, traceability, and interoperability in line with the objectives of the EU Data Act and Data Governance Act, though no public deliverables explicitly document GAIA-X compliance. Cybersecurity and interoperability practices are aligned with SINTEF’s established methodologies for secure digital twin development and data-space architectures (as evidenced in related projects such as COGNITWIN and industrial IoT frameworks) [150]. Available information indicates that consent management and data-minimisation principles are considered at the design level, but detailed documentation on privacy-by-design, device onboarding, or conformity with the Cyber Resilience Act is not publicly available. Peer-reviewed work from SINTEF and collaborators confirms the use of digital twins and interoperability frameworks in Nordic energy systems, although explicit references to a federated Virtual Power Plant Twin remain absent in the scientific literature [151,152]. Overall, the initiative demonstrates a progressive alignment with EU principles for trustworthy, data-driven flexibility management, yet public evidence of full compliance across privacy and transparency dimensions remains limited. It is therefore rated Compliant (C) for Data Governance and Access Control, Compliant (C) for Data Protection and Privacy, Compliant (PC) for Cybersecurity and Resilience, Compliant (PC) for Accountability and Risk Management, Partially Compliant (PC) for Transparency and Explainability, Compliant (C) for Interoperability and Standardisation, and Compliant (C) for Ethical and Social Responsibility.

The comparative analysis indicates that European energy-system twins achieve solid compliance in governance, privacy, security, and interoperability. However, transparency and explainability remain only partially realised, primarily due to proprietary control algorithms and the confidentiality of operational-security data within critical-infrastructure contexts.

Table 24 shows the results of the compliance evaluations and Table 25 provides verifiable traceability between compliance assessments and project documentation. Each deliverable or report corresponds directly to one or more meta-categories of the Unified Digital Twin Compliance Framework. Together, Table 24 and Table 25 demonstrate that European energy Digital Twin projects are embedding compliance-by-design methodologies, advancing cybersecurity and interoperability maturity, and progressively aligning with EU law, while explainability and public transparency remain the principal areas for continued development.

Table 24. Compliance Evaluation of Representative Energy System Digital Twins.

Meta-Category	OneNet (TSO Twin)	Platone (DSO Twin)	SINTEF & NODES (VPP Twin)
Data Governance and Access Control	C	C	C
Data Protection and Privacy	PC	PC	C
Cybersecurity and Resilience	C	C	PC
Accountability and Risk Management	C	C	PC
Transparency, Explainability and Trust	PC	PC	PC
Interoperability and Standardisation	C	FC	C
Ethical and Social Responsibility	C	PC	C

Table 25. Evidence Alignment between Compliance Evaluation and Documentary Sources.

Meta-Category	OneNet—Evidence and Alignment	Platone—Evidence and Alignment	SINTEF & NODES—Evidence and Alignment
Data Governance and Access Control	OneNet Deliverables D6.2 Cross-stakeholder Data Governance for Energy Data Exchange and D5.7 Sovereignty-preserving Data Access Policies establish access hierarchies, usage policies, and audit mechanisms enabling lawful, transparent, and standardised data exchange across TSOs and DSOs, consistent with the principles of the Data Governance Act (Arts. 5–12). Supports rating (C) [142,143]	The project’s Data Management Plans define dataset scope, FAIR handling, processing and sharing across the three demos; standards and interoperability specifications frame governed exchange across actors. Supports rating (C) [153]	NODES publicly defines market-governance roles and access hierarchies between system operators, aggregators, and flexibility providers, ensuring traceable and auditable transactions within a regulated framework. SINTEF’s work on data-space architectures references IDS/GAIA-X principles for federated governance and trusted data exchange, aligning conceptually with the Data Act and Data Governance Act. Supports rating (C) [148,149,154]
Data Protection and Privacy	Deliverables D5.2 Reference Architecture and D5.8 Cybersecurity, Privacy and Regulatory Requirements specify anonymisation, pseudonymisation, and GDPR-aligned controls for cross-border data exchange, yet lack detailed documentation of privacy-by-design and consent-management workflows (PC) [144,155]	The DMPs describe dataset structures, access conditions and sharing controls; GDPR-oriented governance is present but public materials do not detail end-to-end privacy-by-design or consent workflows across demos. Supports rating (PC) [153]	The NODES Privacy Policy states GDPR compliance, detailing purpose limitation, retention, and user rights for data processed through the marketplace, while SINTEF projects embed anonymisation and consent mechanisms within experimental flexibility pilots. Supports rating (C) [156]
Cybersecurity and Resilience	D5.8 compiles cybersecurity baselines, incident handling and regulatory context (NIS directive, ISO/IEC controls), and architecture releases in D6.8 track component/compliance status. Supports rating (C) [144,157]	Deliverable D2.9 details TLS-secured intra-platform communication, OAuth 2.0 and client-certificate authentication, and field-trial verification of cloud and on-premise deployments; future releases extend unified IAM and certificate control. These practices evidence security-by-design consistent with EU cybersecurity frameworks. Supports rating (C) [147]	SINTEF Energy’s Cybersecurity Lab develops vulnerability-testing and intrusion-detection tools for grid and IoT environments, applied in CINELDI/NODES pilots. Although specific Cyber Resilience Act certification is not documented, results demonstrate risk-management and security-by-design maturity. Supports rating (PC) [158]
Accountability and Risk Management	Governance responsibilities and lifecycle monitoring are formalised in D6.2; D6.8 documents component releases and traceability. Supports rating (C) [143,157]	D6.8 maps EU legislation to project use cases and proposes regulatory solutions; D6.9 synthesises findings and recommendations guiding responsible rollout; demo docs show stakeholder and privacy compliance. Supports rating (C) [159,160]	The CINELDI–NODES pilot evidences process-level accountability through documented bidding, activation, verification and settlement cycles ensuring traceable flexibility validation. Nordic Energy Research confirms asset registration, baseline validation and data-quality control in Nordic NODES trials. However, absence of publicly available audit-trail or partner-responsibility documentation limits demonstrable regulatory conformity. Supports rating (PC) [161,162]
Transparency, Explainability and Trust	D5.4 describes AI/Big-Data enablers for forecasting and optimisation but does not publish model-level explainability artefacts; transparency remains system-level. Supports rating (PC) [163]	Deliverable D1.3 presents blockchain-based data certification ensuring traceability and auditability across system actors but contains no evidence of model-level explainability. Transparency is procedural and data-focused, with no public insight into algorithmic logic or optimisation methods. Supports rating (PC) [164]	Transparency is achieved through public publication of market-clearing results and KPIs, complemented by SINTEF pilot dashboards; however, algorithmic decision logic and bidding optimisation models remain proprietary and undisclosed, limiting explainability. Supporting rating (PC) [149,161]
Interoperability and Standardisation	D6.2/D6.3 and technical specs (NGSI-LD/IDS, CIM/IEC 61970/61968 alignment) establish semantic and syntactic interoperability for TSO-DSO coordination. Supports rating (C) [143,165]	Platone D6.1 directly addresses interoperability and standardisation. It maps IEC, IEEE, ISO, and ETSI standards relevant to SCADA, EMS, AMI, DRMS, BEMS, blockchain, and energy markets, forming the basis for cross-domain interoperability in Platone’s DSO platform and demonstrators. Supports rating (FC) [166]	NODES architecture enables interoperability between DSOs and aggregators, using standardised APIs and harmonised market messages. Peer-reviewed studies identify NODES as a leading flexibility-market platform leveraging common information models and data-exchange standards across Europe. Supports rating (C) [167,168]
Ethical and Social Responsibility	D11.7 synthesises stakeholder implications and policy recommendations on consumer participation, market fairness and environmental outcomes. Supports rating (C) [169]	Platone does not explicitly address ethical or social responsibility. Deliverable D8.4 emphasises stakeholder engagement and dissemination but lacks reference to fairness, inclusiveness, or RRI principles. Ethical aspects remain implicit within communication activities rather than institutionalised governance. Supports rating (PC) [170]	Scholarly analyses of European flexibility markets include NODES as a pioneer and evaluate its contribution to fair participation, market neutrality, and consumer inclusion, demonstrating adherence to EU ethical and social-responsibility principles. Supports rating (C) [167]

8.4. Sector-Specific Challenges and Lessons

Energy sector Digital Twins must reconcile strict cybersecurity and reliability standards with open data exchange and AI-driven optimisation. Data protection is complex because smart-meter data may reveal individual consumption behaviour, requiring strong pseudonymisation and consent management. Interoperability depends on convergence of Common Information Model (CIM), IEC 61970/61968, and GAIA-X data-space standards. Transparency remains constrained by vendor confidentiality and security classification.

Promising trends include the creation of European Common Data Spaces for Energy, the use of regulatory sandboxes for AI in grid control, and the application of Cyber Resilience Act certification schemes to grid-control software and IoT gateways. Harmonised guidance from ENTSO-E, E.DSO and ENISA is accelerating convergence towards full compliance maturity.

9. Discussion

The cross-sectoral synthesis of the scoping review reveals that Digital Twin deployments across Smart Cities, Industry, Mobility, and Energy Systems share a convergent trajectory towards legally and technically mature implementations. Yet, despite clear progress, a number of structural asymmetries persist in how the six major EU laws are interpreted and operationalised. The analysis confirms that most European Digital Twins now embed compliance-by-design principles in data governance, cybersecurity, and interoperability, whereas transparency, explainability, and accountability remain unevenly realised across domains.

9.1. Cross-Sectoral Compliance Strengths

Across all four sectors, data governance and access control demonstrate a high degree of convergence. The review finds consistent adoption of practices aligned with the Data Governance Act and the Data Act, including role-based access control, non-exclusive data sharing, and open interface design. Smart City initiatives such as Helsinki 3D+ and Smart Dublin exemplify these principles through public data portals and transparent data intermediation. Industrial cases such as Siemens MindSphere and Bosch Rexroth’s ctrlX Automation extend the same logic into business-to-business ecosystems, while energy projects such as OneNet and Platone adopt federated data-space architectures that apply equivalent rules at the inter-operator level. Collectively, these practices illustrate that lawful, transparent, and interoperable data exchange is becoming a de facto design standard in European Digital Twin development.

Cybersecurity and system resilience also represent a cross-sector strength. All studied domains implement layered security architectures, vulnerability management, and incident-response frameworks aligned with the NIS2 Directive and the Cyber Resilience Act. Industrial and energy systems, which fall under the category of essential services, show particularly mature implementation through ISO 27001, IEC 62443, or ENISA-referenced controls. In Smart City and Mobility contexts, cybersecurity certification and continuous monitoring are now embedded into procurement and operational governance. These developments confirm that security-by-design has transitioned from a voluntary best practice to a regulated engineering discipline.

Another area of progress concerns interoperability and standardisation. Most initiatives converge on open data models such as CityGML, IFC, OPC UA, and CIM, or rely on GAIA-X-compliant data connectors for cross-platform exchange. The institutionalisation of European Data Spaces further accelerates this trend by aligning technical interoperability with lawful data-sharing frameworks. This progress underpins not only compliance but also long-term scalability and innovation capacity within the Digital Single Market.

9.2. Persistent Gaps and Cross-Cutting Challenges

Despite these strengths, three compliance dimensions remain partially fulfilled across all sectors.

First, transparency and explainability present the most consistent gap. While most projects document system architecture and data provenance, few disclose the internal logic of AI-driven decision modules. Proprietary algorithms, safety certification boundaries, and security sensitivities limit publication of model documentation. Consequently, obligations under the Artificial Intelligence Act—particularly for high-risk systems—are often met only at procedural rather than substantive levels. Bridging this gap requires explainability frameworks that reconcile intellectual property protection with verifiable accountability, possibly through trusted audit or certification mechanisms.

Second, accountability and risk management are unevenly implemented. Although audit logging and compliance documentation exist in every sector, systematic conformity assessment remains rare outside essential-service domains. Many Smart City and Mobility projects depend on project-based governance rather than institutionalised compliance structures. Industrial and Energy projects perform better due to established quality-assurance cultures and risk-management standards, yet harmonisation across the EU remains incomplete.

Third, ethical and social responsibility—while consistently referenced—often lacks operationalisation. Citizen participation frameworks, fairness monitoring, and environmental metrics appear in policy narratives but are seldom integrated into compliance evaluation. The review finds that ethics in Digital Twin practice is treated as an aspirational objective rather than a measurable compliance domain, despite its inclusion as a meta-category within the Unified Digital Twin Compliance Framework.

9.3. Sectoral Contrasts

The comparative evaluation also highlights distinct compliance profiles.

• Smart Cities show advanced data governance and privacy management but lower transparency due to the scale and heterogeneity of data sources. Their governance maturity reflects long experience with open-data regulation and citizen-centric policy frameworks.
• Industrial Manufacturing demonstrates the highest cybersecurity and interoperability maturity, grounded in established certification and quality-control cultures. Transparency remains constrained by proprietary intellectual property and competitive sensitivity.
• Mobility and Transportation integrate strong operational security and governance but exhibit partial explainability in AI-assisted scheduling and predictive maintenance. Multi-stakeholder governance across public and private entities complicates uniform compliance interpretation.
• Energy Systems achieve exemplary governance and cybersecurity through the obligations of essential-service operators but face challenges with transparency of AI-enabled control algorithms and harmonisation of data standards across network levels.

These contrasts indicate that compliance maturity correlates with the criticality of the sector and the strength of its existing regulatory oversight. Domains historically governed by strict safety and reliability regulation, such as energy and rail, display higher baseline compliance, whereas domains characterised by municipal autonomy and public experimentation, such as Smart Cities, demonstrate more heterogeneous practices.

9.4. Convergence Towards Integrated Compliance-by-Design

A cross-sector pattern of convergence is emerging around integrated compliance-by-design methodologies. Projects across all domains increasingly embed legal requirements directly into system architecture and engineering workflows. Privacy-by-design modules, automated consent management, continuous security monitoring, and interoperable data APIs now appear as standard architectural features rather than add-on controls. The Unified Digital Twin Compliance Framework (UDTCF) and Digital Twin Compliance Evaluation Matrix (DTCEM) provide a structured method for articulating and measuring these practices, allowing developers and regulators to trace the link between legal obligations and technical implementations.

Nevertheless, full realisation of compliance-by-design will require further institutional alignment. Three measures are critical:

• Interdisciplinary compliance engineering, integrating legal, ethical, and technical expertise within project design phases.
• Certification frameworks that extend existing cybersecurity and quality standards to encompass AI transparency and data-governance conformity.
• Regulatory sandboxes and data spaces that allow controlled experimentation with high-risk Digital Twin applications while maintaining oversight and auditability.

9.5. Implications for Policy and Research

The findings highlight both the effectiveness and the limits of Europe’s current regulatory model. The combination of horizontal digital acts (GDPR, DGA, DA) and sector-specific instruments (AIA, NIS2, CRA) has created a coherent legal ecosystem that fosters trustworthy innovation. Yet, the coexistence of multiple frameworks also generates interpretive complexity, particularly for cross-domain spanning several legal regimes.

Future policy evolution should therefore focus on harmonised guidance that translates legal principles into actionable design criteria for Digital Twin developers. Research priorities should include model transparency metrics, automated compliance verification, and governance mechanisms for federated data spaces. The cross-sector evidence compiled in this review demonstrates that Digital Twins can function as both technical and regulatory integrators within the European digital transformation, provided that compliance-by-design is institutionalised across the entire lifecycle.

9.6. Limitations and Scope

The findings of this study should be interpreted in light of several limitations. First, the Unified Digital Twin Compliance Framework (UDTCF) is tailored to the European Union’s digital-regulatory ecosystem. While many principles generalise to other jurisdictions, direct application requires adaptation to local legal structures and sectoral regulatory instruments. Second, the framework assumes the presence of data-driven or AI-enabled components within Digital Twin systems. Digital Twins without such components may still benefit from the UDTCF, though obligations arising from the Artificial Intelligence Act become less salient. Third, the analysis of compliance maturity relies on publicly available documentation from real-world projects. Although each evaluation is supported by verifiable evidence, data quality and completeness vary across sectors. Fourth, the EU’s digital legislation is rapidly evolving. Future amendments to the GDPR, Data Act, or Cyber Resilience Act may necessitate updates to the framework and evaluation matrix. These limitations highlight important avenues for future research, including comparative analyses beyond the EU, deeper validation within industry settings, and automated compliance-checking methods.

10. Conclusions

This review set out to examine how the principal European digital laws collectively regulate the development and operation of Digital Twin systems across key sectors of the economy. Guided by the research questions defined in Section 2, it sought to identify (1) which European legal instruments jointly determine the regulatory environment for Digital Twins, (2) how their provisions interact to create cumulative or overlapping compliance obligations, and (3) what unified framework can support lawful, secure, and interoperable implementation of these technologies within the European Digital Single Market.

The review confirms that six instruments—the General Data Protection Regulation (GDPR), Data Governance Act (DGA), Data Act (DA), Artificial Intelligence Act (AIA), Network and Information Security Directive (NIS2), and Cyber Resilience Act (CRA)—together form an integrated yet complex legal ecosystem governing Digital Twin innovation. Their combined scope encompasses the entire lifecycle of data and intelligence, from acquisition and sharing to automated decision-making and cybersecurity. Each law maps to distinct functional layers of the Digital Twin architecture: the GDPR and DGA regulate data collection and reuse; the Data Act secures interoperability and fairness in access; the AIA governs transparency and accountability of learning components; and NIS2 and CRA ensure secure design and operational resilience.

To address this complexity, the study developed the Unified Digital Twin Compliance Framework (UDTCF) and the Digital Twin Compliance Evaluation Matrix (DTCEM). Together, they translate legal obligations into seven meta-categories—data governance and access control, data protection and privacy, cybersecurity and resilience, accountability and risk management, transparency and trust, interoperability and standardisation, and ethical and social responsibility. Applied across 12 representative European cases in Smart Cities, Industrial Manufacturing, Mobility, and Energy Systems, these frameworks provided a structured basis for evaluating compliance maturity and identifying both convergences and gaps.

The cross-sectoral analysis demonstrates that Europe’s Digital Twin landscape is progressing toward mature, law-aligned deployment. Governance, cybersecurity, and interoperability consistently achieve compliant or fully compliant status, reflecting the success of EU-wide standardisation and security policies. However, transparency and explainability remain partially fulfilled across all domains. The opacity of AI-driven modules and the absence of standardised explainability metrics continue to pose barriers to full conformity with the Artificial Intelligence Act. Accountability and ethical responsibility, though widely acknowledged, require more systematic operationalisation through traceable audits, certification schemes, and fairness assurance protocols.

The findings yield three key insights for European digital policy and research:

• Compliance-by-design must become a formal engineering discipline. The study shows that technical and legal design cannot be separated; embedding compliance mechanisms within architectures, workflows, and data models is now essential for lawful innovation.
• Harmonisation of interpretive guidance is needed across digital acts. Developers face uncertainty when obligations overlap. Coordinated guidance from the European Commission, ENISA, and the AI Office could translate abstract legal principles into concrete design criteria.
• Digital Twins are strategic enablers of both regulatory compliance and digital sovereignty. An example of this principle is the use of Digital Twin platforms to embed automated data-governance controls and audit trails directly into system workflows. By generating immutable, machine-readable logs aligned with GDPR and Data Act obligations, a Digital Twin can function not only as a regulated technology but also as an operational mechanism for enforcing lawful data access, traceability, and accountability by design.

In conclusion, the review demonstrates that the European regulatory framework provides a robust foundation for trustworthy and innovation-oriented Digital Twin deployment. Yet, achieving full compliance maturity will depend on institutionalising cross-disciplinary collaboration between legislators, engineers, and data governance experts. As Digital Twins evolve from experimental pilots to critical infrastructures, their success will rest on the capacity to merge technological excellence with legal certainty, ensuring that Europe’s digital transformation remains both competitive and accountable to its fundamental rights and societal values. Taken together, these findings confirm that the Unified Digital Twin Compliance Framework and its accompanying Evaluation Matrix constitute a validated analytical foundation for cross-sectoral assessment of regulatory compliance, supporting the systematic integration of legal and technical design principles in future Digital Twin research and innovation.