How to Register a Conformity Scheme

This guide walks conformity scheme owners through the steps required to get a scheme listed in the UNTP Conformity Vocabulary Catalogue (CVC) Register.

If you want to understand how the registry itself is governed (registrar role, agent operation, dispute and retention policy), see the Governance document. If you simply want to browse already-registered schemes, see the register itself.

Who should register

You are a candidate scheme owner if your organisation operates an audit, assessment, certification, or attestation programme whose criteria are referenced by Verifiable Credentials in transparent supply chains. Typical scheme owners include:

• Standards bodies
• Industry associations
• Certification programmes
• Accreditation bodies
• Intergovernmental bodies
• Regulators (where the regulator publishes machine-readable conformity criteria)

What you'll get when you're done

• An entry in the CVC Register at https://registers.uncefact.org/untp/cvc/{your-scheme-slug}.
• A UNECE-issued Digital Identity Anchor (DIA) credential about your scheme owner DID, hosted on your register entry.
• Continuous, automated conformity observation by the UNTP registrar agent — your register status reflects observed reality without requiring you to re-submit anything.
• Discoverability for Conformity Assessment Bodies (CABs), implementers, verifiers, and regulators looking for trusted assurance frameworks to reference.

Quick summary

The full process boils down to three things:

1. Publish a DID at a domain you control (typically did:web:yourdomain.org).
2. Publish a UNTP-conformant CVC vocabulary at a stable URL (the vocabularyURL) — your scheme, profiles, and criteria as machine-readable linked data.
3. Issue a registration Verifiable Credential signed by your DID, pointing at the vocabularyURL, and notify UNECE.

The registrar agent does the rest: crawls your vocabulary, validates it, indexes per-profile metadata (topics, alignments, validity, criterion counts), and writes signed observations against your entry.

Prerequisites

Before you start, you'll need:

Item	Notes
A web domain you control	Required for did:web and for hosting your vocabulary.
Ability to host static or dynamically-served linked data documents	JSON-LD, Turtle, or content-negotiated.
An understanding of the UNTP CVC specification	This is the schema your published vocabulary must conform to.
The UNTP conformity topics SKOS scheme	You'll classify your criteria against these topics.
A representative who can liaise with UNECE	For initial onboarding and any future disputes.

You do not need:

• Bespoke software to manage the vocabulary (static files on a CDN are fine).
• Pre-existing UNTP credentials of your own — only the published vocabulary itself.
• A test deployment certified before production — the agent observes your live vocabulary.

Step-by-step

Step 1 — Get in touch with UNECE

Tell UNECE you intend to publish a UNTP-conformant scheme vocabulary. UNECE will create a proposed register entry as a placeholder while you set up your DID and vocabulary. There is no review or approval gate at this stage — proposals are accepted on intent.

You'll receive a placeholder DID and a slug for your scheme entry; both will be replaced once you publish your real DID and registration VC.

Step 2 — Publish your owner DID

Stand up did:web:yourdomain.org (or another DID method you prefer). Your DID Document must include at least one assertionMethod verification method usable to sign Verifiable Credentials.

Notify UNECE of your DID URL. UNECE will replace the placeholder DID on your entry, and shortly after will issue a UNECE-signed DIA credential about your DID — this is the trust anchor that downstream verifiers use to confirm your scheme is duly registered. The DIA is hosted on your register entry.

Step 3 — Develop your CVC vocabulary

Author your scheme as machine-readable linked data, conformant with the UNTP CVC schema. The vocabulary roots a hierarchy of:

• One scheme — top-level metadata: owner, endorsement, scoring framework, scope.
• One or more profiles — versioned subsets of the scheme; each profile composes one or more versioned criteria.
• Versioned criteria — the auditable requirements with topic classifications and (optionally) performance thresholds.

For every scheme version, profile, profile version, and criterion, mint a stable, version-embedded URI on your domain (e.g. https://vocab.yourdomain.org/yourscheme/profile-name/1.0.0). Once a versioned URI is published, never edit its content — mint a new version instead.

Step 4 — Choose your maturity level

The CVC specification supports three maturity levels. Your register status reflects the level you've reached:

Level	Description	Register status when achieved
Level 1 — Scheme only	Stable URIs per scheme version + top-level metadata (owner, endorsement, assessment level).	pilot once the agent successfully crawls your scheme.
Level 2 — Scheme + criteria	Versioned schemes + versioned criteria as permanent URLs; each criterion classified by topic code.	active once topic classifications populate.
Level 3 — Full vocabulary	Schemes + criteria + standard/regulatory alignments + performance thresholds.	conformant once all alignments and thresholds resolve.

You can publish at Level 1 and advance later. Most owners find Level 2 hits the cost/value sweet spot.

Step 5 — Classify your criteria against UNTP topics

Every criterion (and ideally every profile) should carry one or more topic URIs from the UNTP conformity topics SKOS scheme at https://vocabulary.uncefact.org/conformity-topics/. Topic classifications are what make claims and assessments comparable across schemes — without them, your scheme is registered but not cross-comparable.

Pick the most specific applicable topic when one exists; fall back to a top-level topic when not.

Step 6 — Declare your alignments (optional but recommended)

For each profile, declare the voluntary standards and national regulations the profile is designed to align with, and at what level (partial, meets, or exceeds). For example, a supply-chain due diligence profile might declare alignment with the OECD Due Diligence Guidance and the UN Guiding Principles on Business and Human Rights — each with its own alignment level.

These declarations are owner assertions, not registrar attestations. They help verifiers compute regulatory sufficiency programmatically; they don't constitute registry endorsement of the alignment claim itself.

Step 7 — Issue your registration VC

Sign a Verifiable Credential whose credentialSubject matches the ConformityVocabularyCatalogueEntry shape (per register-schema.json) including:

• Your scheme name, statement, industry sector, geographic scope.
• Your vocabularyURL (the root of the published vocabulary from step 3).
• Endorsement metadata (where applicable).
• License type, established date, trust mark URL.

Host the VC at a stable URI you control (e.g. https://yourdomain.org/.well-known/untp/cvc/registration-vc.json). Notify UNECE of the URI.

Step 8 — First crawl

The registrar agent fetches your registration VC, verifies the signature, fetches your vocabularyURL, runs the validation checks below, indexes profiles and per-version metadata. If everything passes, status moves to pilot (or higher depending on your maturity level).

You can ask UNECE for a faster-than-cyclical first observation; otherwise it runs at the next scheduled cycle (typically within 24 hours).

What gets verified

These are the conformance checks the agent runs on every cycle. Pass these and your status holds.

Check	What you need to do to pass
Registration VC signature valid	Keep your DID Document's verification methods current; re-sign and re-publish your VC after any key rotation.
vocabularyURL resolves	Use stable hosting; consider a CDN or content-addressed mirror for resilience.
CVC schema conformant	Validate your vocabulary locally against ConformityScheme.json v0.7.0 before publishing.
Schema hash drift detection	Treat published vocabulary documents as immutable. Edits = new versions, never overwrites.
Profile URIs stable	Every profile and profile-version URI must dereference to content. 404 = check failure.
Versioned URIs immutable	Once a profile-version URI is published, its content hash must not change.
Topic URIs resolve	Reference real concepts in vocabulary.uncefact.org/conformity-topics/. Don't invent topics.
Standard / regulation references resolve	If you declare an alignment, the standard/regulation URL must be reachable.
Endorsement evidence resolves	If you declare an endorsement, the evidence URL must be reachable.

A small failure (e.g. one broken evidence link) yields partially-conformant. A fatal failure (signature, schema, profile URI not resolving) yields non-conformant. The agent always records exactly which checks failed, so you can fix exactly the broken ones.

After registration: the lifecycle

After your initial registration:

• The agent crawls daily for active schemes and writes signed observations on every cycle.
• Drift in your published documents (changes to a versioned URI's content, broken topic references, etc.) is detected automatically and surfaces as observation failures.
• Your status reflects the latest observation — no human review or re-submission is required.

Maintaining your registration

Publishing a new profile version

1. Mint a new versionLabel using SemVer (e.g. 8.1.0).
2. Mint a new stable profileVersionId URI that embeds the version (e.g. …/yourscheme/yourprofile/8.1.0). Do not edit the previous version's URI content — CABs and verifiers must continue to resolve old hashes for historical assessments.
3. Update the criterion list and topic classifications as needed.
4. Publish the new version at the new URI.
5. Optionally update standard/regulatory alignments if relevant.
6. Notify UNECE if you want a faster-than-cyclical update; otherwise the next crawl picks it up.

The agent treats each profile version independently — an old version remaining conformant does not depend on the new version passing.

Rotating keys

If you need to rotate the signing key your DID controls:

1. Update your DID Document's verification methods.
2. Re-sign your registration VC with the new key.
3. Re-publish the VC at the same URI.

The agent re-verifies the registration VC on every cycle. There is a brief window where an in-flight observation may fail signature validation; the next cycle will succeed.

Withdrawing

You may exit at any time. Tell UNECE; your entry is marked withdrawn. Historical observations are retained for audit. Your published vocabulary URIs should remain reachable for a reasonable transition period to avoid breaking historical DCCs that reference your profile-version URIs.

Disputes

If you disagree with an observation about your scheme:

1. Fetch the registrarAttestation linked from the observation. It points to a signed VC the agent issued, with all check details.
2. If you can demonstrate the check was incorrect (e.g. transient fetch failure, clock-skew issue, misinterpretation of the CVC schema), file a dispute with UNECE.
3. UNECE re-runs the relevant validation independently. If your dispute is upheld, the observation is amended; the original is retained, marked retracted, and the new observation links back to it.
4. If the disagreement concerns interpretation of a CVC schema rule (rather than the data), the change goes through the formal change-control process described in the Governance document.

Common questions

Do I need to start at Level 3? No. Level 1 is enough to be listed as pilot. Most schemes start at Level 1 and advance to Level 2 within a few months.

Do I need a DID for every profile? No. Your DID identifies the scheme owner (you). Profiles and criteria are URIs, not DIDs.

What if my scheme has multiple owners (e.g. a joint initiative)? One owner DID is the registration signer. Co-owners can be referenced in the registration VC as contributors but don't sign. If governance is genuinely shared, consider standing up a joint-venture DID at a domain controlled by both parties.

My scheme references criteria from another organisation's standards. Do I need their permission? Aligning to (referencing) an external standard does not require permission — your declaration is a public claim about your scheme. Republishing or copying the external standard's content does require permission per that standard's licensing terms.

Can two schemes use the same criterion URI? No. Each criterion URI is owned by exactly one scheme. If two schemes share substantively identical criteria, each publishes its own URI and the cross-reference is documented in metadata (e.g. via skos:exactMatch in your vocabulary).

What happens if my hosting goes down? The next agent crawl records the failure as an observation; your status drops to non-conformant for the duration. Restoring hosting and waiting for the next crawl restores your status. Persistent outages (multiple cycles) trigger a contact from UNECE.

Is there a fee? There is likely to be a minimal registration fee that is used to maintain register integrity on a non-for-profit basis. The actual fee structure will be determined before UNTP version 1.0 release.

Where to get help

• The CVC specification itself: https://untp.unece.org/docs/specification/ConformityVocabularyCatalog
• Sample registered schemes: see the register itself.
• The conformity topics taxonomy: https://vocabulary.uncefact.org/conformity-topics/
• Direct contact: raise an issue on the UNTP specification repository, or reach out via the UNTP mailing list or UNTP slack channel (join via the links on the home page).