Summary

  • The EU rule sets the obligation; Rüdiger Martin’s Forum is building the operating instructions. It says it will not write new standards.
  • As of RIPE 93, the four workstreams had drafts at versions 0.5–0.6. A public consultation was planned after a complete draft set, but Martin could not give a date.

The boundary is the assignment

At RIPE 93, Rüdiger Martin drew a useful line around the Multi-Stakeholder Forum on Internet Standards Deployment: it is not a standards body. Its job is to translate legal objectives into steps that network and service operators can actually deploy, using standards and operational experience that already exist.

That distinction sounds modest. It decides whether the Forum produces a usable map or another layer of paperwork.

The legal starting point is Commission Implementing Regulation (EU) 2024/2690. Annex point 6.7.2(j) requires entities in scope to adopt a secure, appropriate and gradual plan for a full transition to the latest network-layer protocols, with measures to accelerate it. Point (k) does the same for modern, internationally agreed and interoperable email standards. Point (l) requires DNS-security and Internet-routing-security practices. These are different jobs: the first two require plans for deployment; the third calls for applying best practices.

The Forum’s published mandate is to identify the relevant standards and practices, explain deployment techniques and propose suitable timeframes. Its guidance is intended for the organisations covered by the Regulation, while the Commission also expects it to help voluntary deployment elsewhere. The law supplies the requirement. The Forum is trying to make the route through it legible.

Four drafts, one coordination problem

Martin’s 28 October update described four workstreams: network-layer protocols, email, DNS, and routing. Each has a chair and technical editorial group. Members comment on drafts in writing; unresolved points go to meetings, where alternatives are recorded rather than quietly ironed flat. A coordination group is meant to stop one stream from contradicting another. Martin said more than 100 people were participating across the workstreams, and that the call to join remained open.

By October the Forum had met in January, March, June and October and was in phase A3, analysing deployment challenges, techniques and timeframes. Drafts across the streams were at versions 0.5 and 0.6. Martin expected a complete set to go to public consultation in 2027, followed by final guidance tentatively planned for the fourth quarter of that year. Asked when consultation would begin, he said the date could not yet be forecast: it would follow the drafting work.

That is the live accountability point. Forum members can comment while the material is being written; the public consultation is a later checkpoint. The Commission’s overview page still carried a 3 August update when checked on 31 October, so Martin’s RIPE talk supplied the newer account of October’s work.

IPv6 without the theatrical switch-off

The IPv6 draft shows why a translation layer matters. Martin described an operational target of being IPv6-ready, not a universal order to shut down IPv4. IPv4-only, dual-stack and IPv6-only environments do not all move on one clock. Operators still need to keep IPv4 destinations reachable during transition, and the draft allows documented, time-limited exceptions.

The Forum’s wider task is similarly practical. It is comparing standards and deployment experience, then asking what a plan should contain, how an organisation can assess its current state, and what evidence can show progress. Martin said the group is pointing readers toward maintained sources such as RFCs, BCPs and IANA registries rather than rewriting them. That keeps the guidance closer to the material engineers already use.

The test is whether the final documents make duties easier to carry out without blurring who set them. The Regulation remains the rule for covered entities; the Forum’s guidance is the translation layer. If its drafts name workable stages, roles, evidence and reviewable exceptions, operators get something they can use. If the four streams leave those choices vague, “multi-stakeholder” will describe who attended, not what a network can do on Monday morning.

Primary documents