On 6 October 2026, the European Commission registered a European citizens' initiative entitled 'Creation of a European Digital Space (.IA) for Sovereign AI Governance'. Its organisers want the Commission to propose a framework for high-trust digital spaces and to negotiate at European level with ISO and ICANN over the proposed .IA namespace.

The initiative links the proposed namespace to AI testing environments, European digital identity, algorithmic auditability and data protection. Those are the organisers' objectives. They are not Commission policy, an AI Act amendment or a new compliance framework.

The legal status matters. Registration means that the initiative met the formal admissibility conditions for entering the signature process. It does not mean that the Commission has approved the substance, reserved .IA or agreed to propose legislation.

What the Commission has done

The Commission has allowed the initiative to proceed under the European citizens' initiative procedure. The organisers now have six months to open a twelve-month period for collecting statements of support.

For a valid initiative, Regulation (EU) 2019/788 requires at least one million supporting EU citizens, with minimum thresholds reached in at least seven Member States. If those conditions are met and the statements are verified, the initiative can be submitted to the Commission for substantive consideration.

Even a successful initiative does not compel the Commission to draft a law. The Commission must examine it and explain what action, if any, it intends to take. Any legislative proposal would then have to follow the ordinary EU law-making process and be adopted by the relevant institutions before it could become binding.

Registration is therefore an agenda-setting event. It is not legislation, delegated legislation, regulatory guidance, an enforcement decision or a formal reservation of internet infrastructure.

What the organisers are proposing

The first objective is an EU framework for what the organisers call high-trust digital spaces, together with testing environments or sandboxes for ethical AI. The proposal does not yet define a legal category, eligibility rules, supervisory authority or the legal effect of participation.

The second objective is for the EU to engage with ISO and ICANN or IANA over reservation, protection and allocation of the .IA namespace as an asset of European digital sovereignty.

The third objective is to connect registration and resolution within that proposed namespace with European digital identity under eIDAS 2.0, transparent algorithmic auditing associated with the AI Act, and protection of personal data under the GDPR.

These concepts could eventually influence infrastructure, identity, assurance and procurement policy. At present, however, there is no published Commission proposal explaining how they would interact, who would operate the space or which organisations would be eligible to use it.

.IA is not an operational top-level domain

IANA describes its Root Zone Database as the authoritative record of delegated top-level domains. As at 7 October 2026, that database contains no .IA entry. The Commission's registration decision does not create one and does not give businesses a right to register .IA names.

The existing .ai domain is different. It is the country-code top-level domain for Anguilla and is already delegated to the Government of Anguilla. Nothing in the citizens' initiative registration changes the status, ownership or rules of .ai.

A future .IA namespace would therefore depend on technical and governance processes beyond collecting signatures. The organisers expressly envisage engagement with ISO and ICANN or IANA. The outcome, timetable and legal route cannot be assumed from the registration announcement.

What this means for AI founders and technology businesses

The immediate compliance effect is nil. Businesses must continue to apply the EU AI Act, GDPR, eIDAS rules and other relevant law as they stand. A citizens' initiative cannot create a safe harbour, certification mark, domain right or substitute for conformity, transparency, security or data-protection obligations.

The initiative is nevertheless a useful policy signal. It connects AI sovereignty with trusted digital identity, audit evidence, privacy and internet naming. That combination may become relevant to future public-sector infrastructure, assurance schemes or procurement, but this is an inference from the proposal, not an announced Commission programme.

  1. Do not change the legal register. Record this as a citizen-led policy proposal, not as binding law, Commission guidance or an implementation deadline.
  2. Do not market .IA addresses as available or officially European. There is no delegated .IA top-level domain in IANA's authoritative database.
  3. Keep .ai and .IA separate in brand and domain planning. The former is Anguilla's existing country-code domain; the latter is the proposed namespace in this initiative.
  4. Monitor the initiative's formal stages. Track when collection opens, whether it reaches the one-million and seven-country thresholds, and any later Commission response.
  5. Build portable trust evidence. Maintain clear identity and access controls, audit logs, model and data records, privacy assessments, security testing and human oversight that can support current law and future assurance schemes.
  6. Check external statements. Investor materials, sales decks and public policy commentary should not imply that the Commission endorses the initiative or that a European .IA space has been approved.
  7. Treat any future Commission action as a separate event. A response, consultation or legislative proposal would each have a different legal status and would need its own scope and impact assessment.

The compliance conclusion

The Commission's registration gives the proposed .IA concept a formal route into EU public debate. It does not give the concept legal or technical effect.

For technology businesses, the right response is proportionate: keep complying with the rules already in force, preserve evidence that can travel across future trust frameworks, and watch the initiative's milestones without presenting political ambition as present law.

The development is worth monitoring because it joins AI governance, identity, auditability and domain infrastructure in one sovereignty proposal. The line to preserve is equally important: registration permits campaigning; it does not create regulation.

This article provides general information and does not constitute legal advice on a specific matter. Legal obligations depend on the facts and the applicable law.