EAASD-JWT VC

Attestation Rulebook for attestations of type Proof of Work Notification

Category: non-qualified EAA

• Author(s):
• Jo Antoons Fragomen Belgium
• Reviewer(s):
• Philipp Friedl, DRV Bund
• Laurent Loup, SICPA

• Florin Coptil, Robert Bosch GmbH

• Contact:

• Jo Antoons, Fragomen Belgium, jantoons@fragomen.com

• Feedback:

Written against: ARF version 3.0.0, WE BUILD template version 1.0 (generic)

Feedback: GitHub issues

1 Introduction

This attestation addresses the following question:

**Has a company fulfilled its legal obligation to notify the host EU Member State authorities prior to sending workers to provide cross-border services within the EU?

The Posted Worker Notification (PWN) Attestation provides a verifiable digital representation of the Posted Worker Notification, enabling structured exchange of posting information for use in cross-border labour compliance verification, supplier onboarding, and regulatory audit processes by host Member State authorities, procurers, and labour inspectorates.

The PWN is an administrative requirement for companies (legal employers) that provide intra-EU cross-border services with their employees, both EU and non-EU nationals, either to a customer or into another group entity. The notification must be filed with the authorities of the host EU Member State (usually on a government portal) prior to the start of the delivery of the service.

The PWN was introduced pursuant to EU Directive 2014/67/EU to enable EU Member States to monitor that Posted Workers are protected by the salary and labour conditions set out in host legislation and generally binding collective labour agreements, and therefore do not undercut local labour force. More or less half of the EU Member States have extended the scope of the PWN also to employers based outside the EU providing services with their personnel into the EU.

The labour law protection of posted workers is set out in the Posting of Workers Directive (PWD), which was adopted in 1996 and revised in 2018: EUR-Lex - 01996L0071-20200730 - EN - EUR-Lex

The Know Your Employee (KYE) scenario (Scenario 5) is part of BU1 and will lead to MVP and MVP+ implementations using both Natural Person Wallets and Legal Person Wallets. The high-level scenario is:

"A company A in a country A would like to send one of their employees to work and provide a service to company B in country B."

This scenario requires the issuance of three main credentials: - Employee Credentials - Portable Document (PD) A1 - Posted Worker Notification (PWN)

1.1 Document scope and purpose

The PWN Attestation provides a verifiable digital representation of the Posted Worker Notification. It enables structured exchange of posting information for use in cross-border labour compliance verification, supplier onboarding, and regulatory audit processes by host Member State authorities, procurers, and labour inspectorates.

The PWN Attestation captures all key attributes required by national host country authorities, including: - Subject (posted worker) identity attributes - Assignment-related information (start/end dates, work place(s)) - Home employer details - Host company details - Employee job duties abroad representing the services justifying the posting

The attestation schema is designed to be sufficiently generic to cover national PWN requirements across EU Member States, verified against the requirements of Spain and Netherlands as representative examples.

Design Decisions

This PWN Attestation Rulebook is based on: - EU Directive 2014/67/EU, Posted Workers Enforcement Directive - Posting of Workers Directive (PWD) 96/71/EC as revised in 2018 - National PWN portal requirements (Spain, Netherlands as reference implementations) - EUDI Wallet / eIDAS 2.0 framework for digital identity and verifiable attestations - ISO 3166-1 alpha-2 for country codes - ISO 8601 for date formatting - SD-JWT VC format for selective disclosure

1.2 Document structure

This Rulebook follows the generic WE BUILD attestation rulebook template. Chapter 2 states how it complies with the ARF and the applicable Regulations. Chapters 3 and 4 define the attributes and metadata in an encoding-independent manner. Chapter 5 states the formats in which this attestation is issued. Chapters 6 to 9 cover protocols, issuance, revocation and presentation. Chapter 10 sets out the trust framework, and chapter 11 lists references.

1.3 Key words

This document uses the capitalised key words 'SHALL', 'SHOULD' and 'MAY' as specified in [RFC 2119], to indicate requirements, recommendations and options.

In addition, 'must' (non-capitalised) indicates an external constraint, a requirement not mandated by this document but by an external document. The word 'can' indicates a capability. Other words such as 'will', 'is' and 'are' are statements of fact.

1.4 Terminology

Additional terminology specific to this attestation:

2 Compliance

2.1 Compliance statement

This Rulebook complies with the applicable requirements of Topic 12, Attestation Rulebooks, in Annex 2 of the Architecture and Reference Framework, version 3.0.0. It uses the terminology of Annex 1 of the ARF.

2.2 Regulatory basis

This attestation is not a qualified electronic attestation of attributes. The data described in Annex V points b, c and e of Regulation (EU) 2024/1183 is addressed as required by EW-DM-12-018 and as recommended by EW-DM-12-020 and EW-DM-12-022. Where a recommendation is not followed, the reason is stated below.

2.3 Traceability

Every applicable requirement mapped to the section that satisfies it. Requirements marked not applicable carry a stated reason.

3 Attestation attributes

Attributes are defined here in an encoding-independent manner (EW-DM-12-007). The encoding of each attribute is given in chapter 5.

3.1 Introduction

The PWN Attestation is designed to provide a verifiable digital representation of the Posted Worker Notification. It captures all key attributes required by host Member State authorities for compliance verification, including subject identity, assignment details, home employer information, host company details, and employee job duties.

Data Model of the PWN in The Netherlands:

PWN Credential
├── Subject [1:1], mandatory
│ ├── pin (String), mandatory
│ ├── family_name (String), mandatory
│ ├── forename (String), mandatory
│ ├── date_of_birth (date), mandatory
│ ├── nationality (Code [1:n], ISO 3166-1 alpha-2), mandatory
│ ├── job_title_home_country (String), optional
│ ├── gender (String/Code), optional
│ ├── surname_at_birth (String), optional
│ ├── forename_at_birth (String), optional
│ ├── place_of_birth [1:1], optional
│ │ ├── town (String)
│ │ └── country_code (Code, ISO 3166-1 alpha-2)
│ └── address [1:n], optional
│ ├── address_residence [0:1], optional
│ │ ├── street_nr (String)
│ │ ├── town (String)
│ │ ├── post_code (String)
│ │ └── country_code (Code, ISO 3166-1 alpha-2)
│ └── address_stay [0:n], optional
│ ├── street_nr (String)
│ ├── town (String)
│ ├── post_code (String)
│ └── country_code (Code, ISO 3166-1 alpha-2)
 │
├── Assignment Related Information [1:1], mandatory
│ ├── home_member_state (Code, ISO 3166-1 alpha-2), optional 
│ ├── starting_date (date), mandatory
│ ├── ending_date (date), mandatory
│ ├── applies_for_duration (boolean), optional
│ ├── determination_provisional (boolean), optional
│ └── transitional_rules (boolean), optional

    Project Sector : mandatory
    Project Subsector : mandatory
    Project SBI Code : mandatory
│
├── Details of Home Employer(s)/Self-employment [1:1], mandatory
│ ├── company_name (String), mandatory
│ ├── industry_sector_nace (String), optional
│ ├── construction_sector (boolean), optional
      Chamber of Commerce registration number - mandatory
│ ├── vat_id (String), mandatory
│ ├── address_line_1 (String), mandatory
│ ├── address_line_2 (String), optional
│ ├── postal_code (String), mandatory
│ ├── city (String), mandatory
│ ├── municipality (String), optional
│ ├── state (String), optional
│ ├── country (Code, ISO 3166-1 alpha-2), mandatory
  _ Legal representative - mandatory
    last_name (string), mandatory
│ ├── first_name (String), mandatory
│ ├── date_of_birth (date), mandatory
│ ├── nationality (Code [1:n], ISO 3166-1 alpha-2), mandatory
│ ├── phone (String), mandatory
│ ├── email (String), mandatory
│ ├── administrative_representative [1:1], mandatory
│ │ ├── last_name (String) - mandatory
│ │ ├── first_name (String) - mandatory
│ │ ├── date_of_birth (date), mandatory
│ ├── nationality (Code [1:n], ISO 3166-1 alpha-2), mandatory
│ ├── phone (String), mandatory
│ ├── email (String), mandatory
│ │ ├── address_line_1 (String) - mandatory
│ │ ├── address_line_2 (String)
│ │ ├── postal_code (String) - mandatory
│ │ ├── city (String) - mandatory
│ │ ├── municipality (String)
│ │ ├── state (String)
│ │ └── country (Code, ISO 3166-1 alpha-2) : mandatory
│ └── Host company [1:1], mandatory
      Type - mandatory
│ ├── ─ company_name (String), mandatory
      country of establishment - mandatory
│ ├── Chamber of Commerce registration number - mandatory
   _ Location number - mandatory 
│ ├── vat_id (String), mandatory
│ ├── address_line_1 (String), mandatory
│ ├── address_line_2 (String), optional
│ ├── postal_code (String), mandatory
│ ├── city (String), mandatory
│ ├── municipality (String), optional
│ ├── state (String), optional
│ ├── country (Code, ISO 3166-1 alpha-2), mandatory
 Contact person host company - mandatory
      last_name (String) : mandatory
│ ├── first_name (String) : mandatory
│ ├── telephone (String) : mandatory
│ ├── email (String) : mandatory
│ ├── 
│── │
├── Place(s) of Work [1:n], mandatory
│ ├── address_line_1 (String), mandatory
│ ├── address_line_2 (String), optional
│ ├── postal_code (String), mandatory
│ ├── city (String), mandatory
│ ├── municipality (String), optional
│ ├── state (String), optional
│ ├── country (Code, ISO 3166-1 alpha-2), mandatory
      telephone (String) : mandatory
│ ├── email (String) : mandatory
 │ 
│Employee : Mandatory
  Permanent work permit issued by sending member state : mandatory
  End date of work permit issued by the sending member state : mandatory
  A1 Certificate of Coverage (Y/N): mandatory
  Country of issuance of A1 Certificate : mandatory
  Application for A1 Certificate of coverage (Y/N) : mandatory
  Country of payment of social contributions : mandatory
  Evidence of payment of social contributions (Y/N) : mandatory 
└──PW Notifier : mandatory 
├── last_name (String) - mandatory
│ ─ first_name (String) - mandatory
│ ─ phone (String), mandatory
│ ─ email (String), mandatory
│ │ ├──

Explanation:

• Section 1 (Subject) contains personal identity attributes of the posted worker.

• Section 2 (Assignment Related Information) mirrors the PD A1 member state legislation section, providing assignment start and end dates but also project information.

• Section 3 (Home Employer Details) provides comprehensive information about the sending employer, Chamber of Commerce and VAT ID, address, and designated legal and administrative representatives.
• Section 4 (Host Company) identifies the receiving entity in the host member state, including the contact person of that entity.
• Section 5 (Places of Work) requires information on place(s) of work.
• Section 6 (Employee) contains information on the work and social insurance status in the home country.
• Section 7 (PW Notifier) identifies the PW notifier.

Attestation Classification:

This attestation type MAY be classified as: - "EAA" when self-issued by the home employer filing the PWN on behalf of their posted worker(s). - "QEAA" when issued by a competent national authority (e.g., labour inspectorate) confirming receipt and acceptance of the PWN.

Top-Level Data Identifiers:

3.2 Mandatory attributes

Section 1, Subject Attributes

Section 2, Assignment Related Information Attributes

Section 3, Home Employer Attributes

Section 4, Host Company Attributes

Section 5, Employee Attributes

Section 6, Place(s) of Work Mandatory Fields

Section 7, Competent Institution Mandatory Attributes

3.3 Optional attributes

Subject Optional Attributes

Assignment Related Information Optional Attributes

Home Employer Optional Attributes

Host Company Optional Attributes

Place of Work Optional Attributes

Competent Institution Optional Attributes

National-Specific Optional Attributes (Netherlands PWN)

3.4 Conditional attributes

4 Metadata

Metadata describes the attestation rather than its subject.

4.1 Mandatory metadata

Legal category. This Rulebook retains the attestation_legal_category attribute. Section 4.1 of the generic template replaces it with the category attribute of [ETSI TS 119 472-1], whose value for this category is eaa:eu:non-qualified. EW-DM-12-029, legacy ARB_25, of ARF version 3.0.0 is a SHALL that still requires attestation_legal_category, so the template and the ARF disagree. The attribute is left as written and the deviation is recorded for the rulebook quality assurance group.

4.2 Optional metadata

4.3 Conditional metadata

No conditional metadata elements are defined for this attestation type.

4.4 Code lists

4.4.1 Country Codes

All country code attributes SHALL use ISO 3166-1 alpha-2 codes:

For the full list of applicable EU/EFTA country codes, refer to the EESSI country code reference list.

4.4.2 Construction Sector Flag

4.4.3 Employment Type Codes (for Place of Work section)

The id_type attribute for company identifiers at places of work SHALL use one of the following standardized values (per EESSI, tbd):

4.4.4 National PWN Context Codes

The PWN attestation SHOULD include a host_country_context indicator to enable country-specific validation logic:

4.5 Integrity rules

The following integrity rules SHALL be enforced:

• The subject section SHALL be present and SHALL contain at minimum pin, family_name, forename, date_of_birth, nationality, and job_title_home_country.
• nationality SHALL be an array of one or more valid ISO 3166-1 alpha-2 country codes.
• The assignment_info section SHALL be present and SHALL contain home_member_state, starting_date, and ending_date.
• assignment_info.home_member_state SHALL be a valid ISO 3166-1 alpha-2 country code.
• starting_date and ending_date SHALL be valid ISO 8601 dates (YYYY-MM-DD).
• ending_date SHALL be equal to or later than starting_date.
• The home_employer section SHALL be present and SHALL contain company_name, industry_sector_nace, construction_sector, vat_id, address_line_1, postal_code, city, country, phone, email, administrative_representative, and social_representative.
• home_employer.country SHALL be a valid ISO 3166-1 alpha-2 country code.
• home_employer.construction_sector SHALL be a boolean value (true or false).
• administrative_representative SHALL contain at minimum last_name, first_name, telephone, email, city, and country.
• social_representative SHALL contain at minimum last_name, first_name, telephone, email, city, and country.
• The host_company section SHALL be present and SHALL contain company_name, email, telephone, industry_sector, vat_id, address_line_1, postal_code, city, and country.
• host_company.country SHALL be a valid ISO 3166-1 alpha-2 country code.
• The employee section SHALL be present and SHALL contain job_duties_abroad.
• places_of_work SHALL contain at least one entry (either no_fixed_place_of_work or one or more place_of_work entries).
• Each place_of_work entry SHALL contain company_name, town, and country_code.
• All country codes SHALL be valid ISO 3166-1 alpha-2 codes.
• issuance_date and expiry_date SHALL be valid ISO 8601 DateTimes.
• expiry_date SHALL be later than issuance_date.
• issuance_date SHALL be in the past.
• attestation_legal_category SHALL be one of "EAA" or "QEAA".
• vct SHALL be "PWNCredential".
• Each attribute SHALL appear at most once within its respective object scope.
• For Netherlands PWN: administrative_representative.country SHALL be NL.
• For Netherlands PWN: employee.a1_certificate_applied SHALL be present.

5 Formats

5.1 SD-JWT VC-based encoding

The PWN Attestation uses the SD-JWT VC format to allow for selective disclosure of posting and employer attributes.

Selective Disclosure: Top-level claims (e.g., subject, home_employer, host_company, places_of_work) SHALL be individually selectively disclosable, enabling disclosure of only the attributes requested by a Relying Party. Attributes nested within sub-objects MAY be individually selectively disclosable.

The . notation is used to indicate the nesting of attributes.

Verifiable Credential Type (vct): vct: PWNCredential

5.1.1 Attribute Encoding Table

Notes:

• MUST: The claim SHALL be selectively disclosable, the holder MAY choose to disclose or withhold this claim when presenting the credential to a Relying Party.
• MAY: The claim MAY be selectively disclosable if the issuer supports it.
• MUST NOT: The claim SHALL NOT be selectively disclosable, it is always present in plain text in the JWT header/payload.
• iat, exp, and iss follow RFC 7519 standard JWT claim naming conventions.
• Home employer blocks SHALL be disclosed as a whole when requested.

5.1.2 Status Claim

For SD-JWT VC-compliant PWN Attestations, the attestation MUST include a status claim if the technical validity period is greater than 24 hours.

The status claim SHALL be a JSON object with the following members:

• type (string): SHALL be "status-list".
• status_list_credential (string, URI): The URI of the Status List Credential document.
• status_list_index (integer, >= 0): The zero-based index into the status list bitstring.
• status_purpose (string): SHALL be "revocation" for this attestation.

Example:

{
  "status": {
 "type": "status-list",
 "status_list_credential": "https://issuer.example.com/status/pwn/2025",
 "status_list_index": 321,
 "status_purpose": "revocation"
  }
}

3.2.3 Example Payload

The following is a non-normative example of a PWN SD-JWT VC payload (Spain PWN):

{
  "vct": "PWNCredential",
  "attestation_legal_category": "EAA",
  "iss": "did:example:example-gmbh-de",
  "iat": 1746000000,
  "exp": 1777536000,
  "jti": "pwn-attestation-20260501-001",
  "binding": "PID binding",
  "subject": {
    "pin": "12345678A",
    "family_name": "Müller",
    "forename": "Hans",
    "date_of_birth": "1985-06-15",
    "nationality": ["DE"],
    "job_title_home_country": "Software Engineer",
    "address_residence": {
      "street_nr": "Hauptstrasse 5",
      "town": "Berlin",
      "post_code": "10115",
      "country_code": "DE"
    }
  },
  "assignment_info": {
    "home_member_state": "DE",
    "starting_date": "2026-06-01",
    "ending_date": "2026-12-31",
    "applies_for_duration": false,
    "determination_provisional": false,
    "transitional_rules": false
  },
  "home_employer": {
    "company_name": "Example GmbH",
    "industry_sector_nace": "J62.01",
    "construction_sector": false,
    "vat_id": "DE123456789",
    "address_line_1": "Industriestrasse 20",
    "postal_code": "60311",
    "city": "Frankfurt",
    "country": "DE",
    "phone": "+49 69 123456",
    "email": "hr@example-gmbh.de",
    "administrative_representative": {
      "last_name": "Schmidt",
      "first_name": "Anna",
      "telephone": "+49 69 123457",
      "email": "anna.schmidt@example-gmbh.de",
      "city": "Frankfurt",
      "country": "DE"
    },
    "social_representative": {
      "last_name": "Weber",
      "first_name": "Klaus",
      "telephone": "+49 69 123458",
      "email": "klaus.weber@example-gmbh.de",
      "city": "Frankfurt",
      "country": "DE"
    }
  },
  "host_company": {
    "company_name": "Client SA",
    "email": "contact@client-sa.es",
    "telephone": "+34 91 123456",
    "industry_sector": "IT Services",
    "vat_id": "ES-B12345678",
    "address_line_1": "Calle Mayor 10",
    "postal_code": "28001",
    "city": "Madrid",
    "country": "ES"
  },
  "employee": {
    "job_duties_abroad": "Software development and technical consulting for client project"
  },
  "places_of_work": [
    {
      "place_of_work": {
        "company_name": "Client SA",
        "street_nr": "Calle Mayor 10",
        "town": "Madrid",
        "postal_code": "28001",
        "country_code": "ES"
      }
    }
  ],
  "institution": {
    "institution_id": "DE-DRV-001",
    "institution_name": "Deutsche Rentenversicherung Bund",
    "country_code": "DE"
  },
  "status": {
    "type": "status-list",
    "status_list_credential": "https://example.com/status/pwn-list-1",
    "status_list_index": 321,
    "status_purpose": "revocation"
  },
  "trust_anchor_url": "https://trust.webuildconsortium.eu/anchors/eidas-tl",
  "schema_version": "0.1.0",
  "cnf": {
    "jwk": {
      "kty": "EC",
      "crv": "P-256",
      "x": "abc-123_def-456_ghi-789_jkl-012",
      "y": "mno-345_pqr-678_stu-901_vwx-234"
    }
  }
}

Sample payloads are provided under ../data-schemas/sd-jwt/sample-data/pwn-sd-jwt-sample.json

5.2 ISO/IEC 18013-5-compliant encoding

ISO/IEC 18013-5 (also called mdoc) is out of scope for this Rulebook, as offline proximity presentation is not a current requirement for the PWN attestation.

5.3 W3C Verifiable Credentials Data Model-based encoding

@TODO, To be discussed: which stakeholders will support this format and which use cases require it.

6 Protocols

This attestation is issued using OpenID for Verifiable Credential Issuance [OpenID4VCI] and presented using OpenID for Verifiable Presentations [OpenID4VP], both as profiled by [HAIP].

7 Issuance

7.1 Binding

7.2 Issuance Policy

7.3 Lifecycle management

The issuer sets the validity period of the attestation and reissues it when the underlying facts change, revoking the superseded attestation as described in chapter 8.

7.4 Embedded disclosure policy

This attestation defines no embedded disclosure policy.

8 Revocation

This chapter will be completed in a future version of this Rulebook.

9 Presentation

Base Verification Process

The Relying Party SHALL perform the base attestation verification process as defined in the Base Verification specification: https://github.com/webuild-consortium/webuild-attestation-rulebooks-catalog/blob/main/rulebooks/rb-base/verifier-base-verification.md

9.1 Presentation Policy

To verify and validate a received presentation of an attestation of this type, the following steps SHALL be performed:

1. verify the signature over the attestation using a trust anchor obtained as described in chapter 10;
2. verify that the attestation is within its validity period;
3. check revocation status as described in chapter 8, unless the attestation is short-lived, or its remaining lifetime is below the revocation time threshold;
4. verify device binding where section 7.1 records the attestation as device-bound;
5. request only those attributes that are necessary for the stated purpose of the transaction, and, where the trust model for this attestation requires Relying Party registration, only those attributes it is registered and authorised to request.

Obligations specific to this attestation type, carried over from the previous version of this Rulebook:

When receiving and processing an attestation, the Relying Party SHALL perform the following verification obligations.

9.2 Presentation modes

Remote presentation is in scope. Proximity presentation is in scope only where chapter 5 records an mdoc encoding.

9.3 Transactional data

This Rulebook defines no transactional data.

10 Trust Framework

This chapter will be completed in a future version of this Rulebook.

Trust anchor location

The attribute or metadata carrying the trust anchor location contains at least the URL at which a machine-readable version can be found or looked up.

11 References

This chapter will be completed in a future version of this Rulebook.