W3C Council Report on the Formal Objection to the use of Normative References to ISO/IEC 18013-7 Annex C in the Digital Credentials API specification

Council Report,


1. Introduction

The objection concerns the use of a specification with associated financial barriers to reading and using as a normative dependency in a W3C Recommendation-track deliverable. The objection also noted tension with the Normative References entry in [Guidebook], particularly where referenced material is not "available on the Web at no cost and without limitation".

As detailed by the W3C Team in the report they prepared for this Council, there are many factors to be considered when evaluating a normative reference. The Team considered those factors and found that, in their judgment, retaining this normative reference is the best way forward. This Council, formed to rule on this objection, thanks the Team for their diligence in preparing their report for our consideration.

This Council Report documents the conclusions of this Council.

1.1. Objection

The [FormalObjection] concerns the decision to allow [DIGITAL-CREDENTIALS] to include a normative reference to Annex C of [ISO18013-7].

The Objector raised concerns that ISO/IEC 18013-7:2025 ISO-compliant driving licence, Part 7: Mobile driving licence (mDL) add-on functions is not freely available, and that a normative reference to a fee-gated specification creates barriers to review, implementation, and adoption. The Objector also argued that the Digital Credentials specification represents one of the few meaningful leverage points available to encourage broader access to the referenced specification, and that relying on possible future availability of [ISO18013-7] is not a sufficient basis for proceeding. [FormalObjection]

The Objection further questioned whether the reference satisfies [NormRef] (the Normative References entry in [Guidebook]) particularly with respect to alignment with [OpenStand], given that [ISO18013-7] is not available on the Web at no cost and without limitation. [FormalObjection]

The Objection was not resolved by consensus, so a Council was convened to make a decision.

2. Decision

The Council resolved to overrule the Formal Objection, allowing the normative reference to [ISO18013-7] to stand.

The Council treats this as an exception to our general preference, which is justified by the particular circumstances of this specification, this reference, and the deployment reality that [DIGITAL-CREDENTIALS] is intended to address.

This Council is therefore not calling for changes to [DIGITAL-CREDENTIALS].

3. Rationale

The Council agrees with the Objector that normative references to specifications that are not freely available raise serious concerns for W3C. W3C Recommendations are intended to support broad review, implementation, and deployment. When a W3C specification depends normatively on a specification that is not freely readable, that dependency can make the resulting W3C work harder to review, harder to implement, and less accessible to all. [OpenStand]

The Council also agrees that W3C should not treat such references as routine. Open access to standards ties closely to transparency, independent implementation, public review, and the ability of the Web community to evaluate the technology it is being asked to adopt.

However, the Council does not find that these concerns require upholding the Formal Objection in this case.

[DIGITAL-CREDENTIALS] is intended to provide browser-mediated mechanisms for presenting digital credentials. One of the relevant deployment environments includes credentials issued by governments using [ISO18013-7]. Excluding that reference would not merely avoid a dependency with restricted access; it would also exclude an important class of existing and emerging government-issued digital credential use cases from the W3C specification.

That result would create its own architectural and interoperability cost. If the W3C specification cannot convey government-issued credentials that already rely on [ISO18013-7], developers may continue to depend on less desirable mechanisms, including custom URI schemes, app-to-app handoffs, or other approaches outside a consistent and secure browser-mediated model. The Council considers that outcome potentially harmful to the Web’s role in digital credential presentation.

The Council therefore finds that this reference may stand as a narrow exception: the referenced material supports critical functionality for an important deployment case that cannot currently be achieved by referencing a freely accessible specification.

The Council does not conclude that this exception eliminates the underlying concern. It does not. A normative reference with restricted access remains a problem for reviewability, implementation, and accessibility. The Council’s decision is that, in this specific case, the cost of excluding the reference outweighs the cost of allowing it. The Council emphasizes that this should not be read as a general weakening of W3C’s commitment to freely accessible standards.

4. Recommendations

The Council recommends that the Advisory Board and Team consider whether [W3C-PROCESS] and/or [Guidebook] should be revised to provide more explicit guidance on normative references to specifications that are not freely available.

Such guidance should recognize that W3C’s preference should remain strongly in favor of normative references to freely accessible specifications and continue its commitment to the OpenStand Principles. At the same time, the Process may need to acknowledge that exceptional cases can arise, particularly where an external specification is already central to existing deployment or broad interoperability requirements.

The Council recommends that any future Process language distinguish between ordinary normative references and exceptional normative references to specifications that are not freely available. In particular, the Advisory Board should consider language along the following lines:

Normative references should be freely accessible to anyone. Any exception should be justified on a case-by-case basis and should be limited to situations where the referenced specification contributes critical functionality to the W3C specification that cannot reasonably be achieved by referencing a freely accessible alternative.

The Council further recommends that Working Groups seeking such an exception be asked to document:

  1. why the referenced specification is necessary;

  2. whether a freely accessible alternative exists;

  3. what functionality would be lost if the reference were removed;

  4. who would be unable to review or implement the W3C specification because of the reference;

  5. what mitigation steps are available, including informative summaries, liaison work, requests for public availability, or narrower references to only the required portions of the external specification.

The Council also recommends that the Team consider revising [NormRef] to provide more nuance for specifications with restricted access. The current guidance identifies relevant considerations, and the Team correctly applied this guidance to the case before us. Whether the referenced document is available on the Web at no cost and without limitation remains the right question. However, we recommend strengthening the guidance to more clearly explain how the Team evaluates cases where the answer to this question is no. It should define what level of justification is expected from a Working Group before such a reference is accepted.

In order to strengthen the legitimacy of the normative reference policy, the Council asks the Advisory Board to consider elevating Normative References out from the The Art of Consensus (Guidebook) as a standalone W3C policy document, maintained by the Advisory Board and subject to Advisory Committee Review, adding it to the list of such documents in W3C Process Document §  10. Process Evolution.

The Council further recommends that the following issue should be raised with the Process CG: [This council] feels that it may be beneficial to require periodic review of exceptional normative references to specifications that are not freely accessible. Some of this may be for the Working Group, e.g., to verify at each subsequent maturity stage whether the exceptional circumstances still hold, and to update the reference if a freely accessible alternative exists or the referenced specification becomes freely accessible. Some of this may be for the Team, e.g., to separately engage with the relevant standards body to seek free availability of the referenced specification.

Finally, the Council agrees with the Team Report’s recommendation that the Team continue working with ISO/IEC to make [ISO18013-7] freely available, and more generally, to engage with ISO/IEC and other relevant standards bodies to improve access to specifications that are necessary for interoperable implementation of Web technologies. Where W3C specifications depend on externally developed standards, especially in areas of public infrastructure such as digital credentials, broad accessibility should remain an active goal.

Appendix A: Council Participation

The Council was formed on from the members of the TAG and the AB, plus the CEO. Marcos Cáceres renounced his seat on the Council; no one was dismissed. Therefore, the actual membership of this council was:

Brent Zundel was appointed as chair.

Of those qualified to serve, the following participated in the final decision:

The decision was unanimous.

Appendix B: Minority Report

While the decision to overrule the Formal Objection was unanimous, a subset would have preferred to do so simply by endorsing the Team Report. They believe that the Team diligently considered the issue before this Council, weighed the different considerations appropriately, and identified the correct way forward.

Index

Terms defined by reference

References

Normative References

[NormRef]
Normative References. October 2023. URL: https://www.w3.org/guide/process/tilt/normative-references.html
[TeamReport]
Yves Lafon. Team report on the Formal Objection to the use of Normative References to ISO/IEC 18013-7 Annex C in the Digital Credentials specification. April 2026. URL: https://www.w3.org/2026/03/team-report-digital-credentials.html
[W3C-PROCESS]
Elika J. Etemad (fantasai); Florian Rivoal. W3C Process Document. 18 August 2025. URL: https://www.w3.org/policies/process/

Non-Normative References

[DIGITAL-CREDENTIALS]
Marcos Caceres; Tim Cappalli; Mohamed Amir Yosef. Digital Credentials. 14 May 2026. WD. URL: https://www.w3.org/TR/digital-credentials/
[FormalObjection]
Formal Objection. February 2026. URL: https://lists.w3.org/Archives/Public/public-review-comments/2026Feb/0001.html
[Guidebook]
The Art of Consensus (Guidebook). URL: https://www.w3.org/guide/
[ISO18013-7]
ISO/IEC JTC 1/SC 17. ISO/IEC 18013-7:2025 ISO-compliant driving licence, Part 7: Mobile driving licence (mDL) add-on functions. May 2025. URL: https://www.iso.org/standard/91154.html
[OpenStand]
OpenStand Principles. August 2012. URL: https://open-stand.org/about-us/principles/