Public Digital Infrastructure

Chapter Overview

1. Executive Summary

This chapter moves from state computing and AI capabilities to the question citizens face daily: how do they deal with the state? If every ministry has a separate application, database, payment system and account, digitalisation may increase complexity rather than reduce it. Iraq Vision 2045 therefore defines “public digital infrastructure” as a layer of shared capabilities used by many entities: identity proofing and authentication, trust and signature services, payments and collection, authorised data exchange, application management and notifications, and document verification. These capabilities resemble railways and roads: they do not deliver the final service alone, but prevent every institution from rebuilding the route from scratch.¹

Iraq does not start from nothing. Ur has become the official access point for government services. At the chapter’s evidence cut-off, its homepage displays more than 11.4 million registrants and 1,288 listed services, including 784 electronic services. But a service counter does not prove every journey is complete from start to finish. The National Centre for Digital Transformation’s electronic service creation platform lists 782 services, including 584 active services, and more than 19.8 million recorded applications. This establishes substantial operating capability while reinforcing the need to move from counting “forms” to measuring completion, time, visits and outcomes.²³

At the exchange layer, an update of 19 August 2026 states that X-Data includes 37 government institutions and 1,412 institutions and branches, around 48.3 million records, 1.93 million issued documents and 205 digital services. The project eliminating paper “issuance authenticity” checks offers a clearer example of friction reduction: 118 connected entities and more than 28.6 million documents processed through digital verification instead of paper correspondence. These are real national assets. The task for 2045 is not to replace them with a new platform, but to unify standards and connect them to services with clear outcomes.⁴⁵

In identity, Iraq has a substantial legal and civil base: the Ministry of Interior announced around 39 million national cards issued in July 2024, and National Card Law No. 3 of 2016 provides the legislative basis for the register and card. But the national card is not itself a digital identity usable for every service. In 2026, Ur Auth reached one million users as a two-factor authentication application for accessing Ur. These layers must be connected into a clear “trust chain”: legal identity → risk-appropriate authentication → signature or authorisation where needed → a reviewable audit log. No parallel population database should be created, and a login code must not be confused with proof of legal identity.⁶⁷⁸

Payments reveal a gap between existing infrastructure and public uptake. The Central Bank’s Financial Inclusion Strategy 2025–2029 uses a 2024 national diagnostic placing household bank or payment account ownership at 11% according to the demand-side survey. It targets 50% of adults by 2030, and 85% having sent or received digital payments. The same source reports 16.7 million bank and electronic accounts from provider data in the first quarter of 2024, explicitly warning of duplication and inactivity. “Accounts” must therefore not be equated with “people”. This methodological principle should govern the entire chapter: measure the outcome users experience, not merely administrative capacity.⁹

The implementation conclusion is that Iraq must move from “a government with platforms” to “a state with shared digital rails”. The proposed project does not abolish Ur, X-Data, the government network or Central Bank systems. It establishes a unified standard for services, identity, exchange and payments, selecting high-volume or high-impact journeys for end-to-end redesign. By 2045, citizens should not be asked again for verified information the state already holds without a legal reason, forced to pay cash for a service that can be paid electronically, or required to know which ministry “owns” each step. The state appears as one system, while responsibility and jurisdiction behind the interface remain clear and accountable.

2. The Central Question and the Chapter’s Scope

Central question: what legal, institutional, technical and operational infrastructure does Iraq need for identity, payments, data exchange and government services to become shared, reusable capabilities, completing transactions end to end with minimal friction, without creating a parallel identity, technological monopoly, exclusion of the unconnected or digitalisation turned into surveillance?

2.1 What the Chapter Resolves

• Define public digital infrastructure and distinguish it from portals, sectoral applications and data centres.

• The identity and trust chain: legal identity, authentication, signatures, authorisation and consent/purpose.

• Digital government payments as a complete cycle: application → amount due → payment → reconciliation → receipt → refund or settlement.

• Government data exchange and the “once-only” principle, with authority, purpose and audit.

• The end-to-end service standard and management of citizen and company journeys instead of platform counts.

• Reduce opportunities for petty corruption, intermediaries and procedural extortion by reducing contact points and undocumented discretion, without claiming that digitalisation eliminates corruption.

• Digital inclusion and assisted channels so that digital transformation does not become a new barrier.

2.2 What Is Left to Other Chapters

• Personal data protection, data classification, storage and processing sovereignty, incident management and detailed cybersecurity are passed to V3-D06-C06.

• Computing infrastructure, AI, model policy and talent are not redesigned here; they were addressed in V3-D06-C04.

• Physical internet, fibre, coverage and telecommunications infrastructure will be detailed in the infrastructure, energy and services part; here they are used insofar as they enable services.

• Banking-sector reform and monetary policy are not repeated; payments here are an operational function of public infrastructure, complementary to the Central Bank’s remit.

• Comprehensive anti-corruption, investigation and asset recovery are not repeated; the chapter discusses only how service design affects opportunities for procedural corruption.

3. Operational Vocabulary and Measurement Rules

3.1 Measurement Rules

• Service counters measure supply; end-to-end completion measures capability.

• Account counts do not equal person counts; administrative data are separated from population surveys.

• Successful payment is incomplete until transaction reconciliation, receipt issuance and refunds when due are possible.

• Fewer in-person visits count as success only if they do not result from excluding digitally disadvantaged groups.

• Data sharing is measured through lawful, completed requests, their speed and quality, not transferred-record volume alone.

• Corruption reduction is measured through friction, exceptions, complaints and audit indicators, not assumed automatic causation from digitalisation.

4. The Iraqi Baseline: Digital Assets Accelerating but Still Fragmented

The baseline shows Iraq has moved beyond “no platform” in several functions. The National Centre for Digital Transformation operates or presents Ur, the service creation platform, X-Data, the document-authenticity verification project, the national cloud, the secure government network, the Uboor platform, death-certificate digitalisation and the Tawtheeq system. Together they resemble the core of public digital infrastructure more than separate projects. But their national impact will remain less than their combined potential if identity, payments, data and journeys continue operating under different definitions across entities.¹⁰

The GovTech Maturity Index 2025 offers useful external validation, not a final judgement: the World Bank places Iraq in Group C, “medium GovTech maturity”. The index measures four areas: core government systems and shared infrastructure, digital public services, digital engagement and GovTech enablers. This grouping must not be turned into an “Iraq ranking”, nor every gap read as failure. Its value is confirming that progress in platforms needs complementary progress in services, engagement and enablers.¹¹

5. Legal Identity Is Not Digital Identity

National Card Law No. 3 of 2016 and the card’s widespread issuance give Iraq an asset that should not be duplicated. The Vision does not propose a new population register named “digital identity”. It builds a digital layer able — with permission and authority — to use the competent legal source to verify identity and attributes required for a transaction. The design rule is one register responsible for each item’s original truth, with other services querying or verifying rather than copying it into parallel databases.

This distinction matters because digital identity is more than a unified number. An information service may need simple authentication, while transferring ownership, undertaking a substantial financial obligation or making a sensitive decision requires stronger assurance and potentially a qualified electronic signature. Applying maximum verification to every service raises friction and cost; applying the weakest level increases fraud. The Vision therefore adopts risk-based “assurance levels”.

6. Authentication and Assurance Levels

Ur Auth reaching one million users during 2026 demonstrates that a government authentication factor can be deployed widely. Its significance is the function, not the application’s name: less reliance on SMS alone and a faster, more stable second factor. Expansion does not automatically make it comprehensive digital identity. It must fit an assurance framework specifying: who issued the credential? What data support it? How is access recovered if a phone is lost? How is a number change managed? What happens on suspicion? What transaction level does it permit?⁷

The Vision also needs an alternative pathway that does not discriminate against people without smartphones or stable connectivity. Users may access assisted channels or alternative verification while preserving the same rights and service time as far as possible. Security that blocks eligible people from their rights is not good security, just as ease that permits identity impersonation is not good service. Design must balance risk and friction.

6.1 Identity Lifecycle Management

• Issue/link a credential after legally valid verification with known provenance.

• Secure recovery after phone loss or number changes without opening the door to account takeover.

• Revoke or suspend credentials upon death, loss of legal capacity or suspicion under a lawful procedure.

• Manage user attributes and roles — parent/guardian, company director, agent, competent official — separately from core identity.

• Maintain access logs and notify users of sensitive operations, with a rapid challenge channel.

7. Electronic Signatures and Trust Services

Iraq has had a legal basis since Electronic Signature and Electronic Transactions Law No. 78 of 2012, followed by Instructions No. 1 of 2025 facilitating its implementation, published in Iraqi Gazette Issue 4826. This changes service logic: a digital transaction should not be printed merely for a handwritten signature where law and function permit a verifiable electronic signature. The task is not “adding a signature image”, but building verifiable trust services: personal signatures, institutional seals, timestamps, certificate verification and validity records.⁸¹²

The project eliminating paper document-authenticity checks shows that Iraq has already begun moving from “correspondence between two offices” to “direct verification”. The next stage is to make documents themselves ready for automated verification and reduce reliance on citizen-supplied copies where an entity can retrieve the fact from its source. This turns reform of a specific transaction into a reusable trust component across the state.

8. Government Data Exchange and the “Once-Only” Principle

X-Data offers a foundation, but 48.3 million records do not automatically mean “state integration”. Real integration appears when a service prevents repeated requests to citizens, each entity knows what it may retrieve and for what purpose, access is logged, and the originating entity remains responsible for data definitions and quality. Interoperability is not a data-copying project; it is a technical and institutional agreement among independent systems.⁴

8.1 The Once-Only Principle — An Implementable Iraqi Form

• If information is verified at its original government source and can lawfully be retrieved, citizens are not asked to bring another copy.

• The requesting entity receives only the data needed for the purpose, not the person’s entire file.

• Every exchange records the identity of the entity/official or system, purpose, time and query result.

• Data subjects can — under the framework detailed in C06 — learn of sensitive uses and challenge errors.

• Where records conflict, correction occurs at the authoritative source rather than sending citizens between entities.

Estonia’s X-Road experience is useful because the state did not combine all systems into a central database. Entities retained their systems, connected them through an encrypted, audited exchange layer and applied the once-only principle. The transferable lesson is “controlled exchange among independent sources”, not literal copying of architecture or law.¹³

9. Networks and Cloud as an Enabling Layer

The secure government network connects more than 500 entities following its launch in 2018 and supports government email, document-authenticity verification, Ur, data exchange and data-centre connections. The national cloud provides centralised, highly available government hosting with redundancy, failover and load balancing. These assets do not need another engineering chapter here. Their importance is making digital rails accessible and continuous, rather than leaving every project dependent on separate connectivity and hosting.¹⁰¹⁴

The Vision nevertheless rejects a simplistic definition of sovereignty as “all data inside Iraq”. The preceding chapter’s principle governs: technological sovereignty means control, audit, portability and exit from critical dependence. The national cloud is therefore used for suitable government workloads, complemented where necessary by other models subject to data classification, risk and contracts. Details and cyber resilience are passed to C06.

10. Digital Payments and Financial Inclusion

The largest mistake in government service design is assuming an “electronic payment” button solves the problem. Public payments need a regulated financial system, an instrument available to the user, a transaction reference, settlement and reconciliation, an official receipt, refund capability and links to the treasury and service provider. The state must not require a particular bank card to access a right, but should accept regulated interoperable channels wherever possible.

The Financial Inclusion Strategy 2025–2029 gives Iraq a starting point and an official target through 2030: raising formal account ownership to 50% of adults from a demand-side baseline of 11%, and raising the share sending or receiving digital payments to 85%. These are Central Bank strategy targets, not targets invented by Vision 2045. The Vision adopts them as a first-stage reference, then links them to quality of use rather than nominal account opening.⁹

Infrastructure partly exists: the Central Bank describes electronic collection as secure and transparent revenue collection through the national switch, banks and payment service providers. Its achievements presentation cited participation by 42 ministries and government bodies and the use of cards, points of sale and wallets, with entity transfers automated through payment systems instead of cheques and cash. The financial inclusion strategy also explicitly lists “interoperability” among its enablers.¹⁵¹⁶

11. Government Payments: From Collection to Reconciliation and Refunds

Government also needs to distinguish “government payments” conceptually from “financial inclusion”. Digitalising fees may increase financial instrument use, but does not by itself create real inclusion. Digital government fees must retain fair alternatives, transparent pricing, no undisclosed intermediary charges, consumer protection and traceable complaint procedures.

12. Government Services: The Portal Is Not the Service

Ur matters because it gives citizens a single access point. But the Vision’s standard goes beyond “where to find the service”. An application may be electronic and then printed inside the office; users may need paper authenticity confirmations, cash payment or an in-person signature, or be unable to know why an application stopped. The interface is then digital while the administration remains paper-based. Vision 2045 therefore adopts the “service journey” as the basic unit of reform.

12.1 The Real Digital Service Test

• Can users learn eligibility, requirements, fees and duration before starting?

• Is identity established once at a risk-appropriate level?

• Are verified government data retrieved instead of requiring users to upload them again?

• Are fees paid electronically and reconciled automatically?

• Can declarations or decisions be signed electronically where law permits?

• Can users see application status, the entity owning each step and the expected deadline?

• Is the decision/document delivered electronically in verifiable form?

• Is there a challenge or support route that does not send users back to the beginning?

13. The End-to-End Digital Service Standard

The Vision proposes a “National Digital Service Standard” as binding rules for priority services, not merely a visual design guide. The standard precedes the platform: processes are not digitalised before reviewing the underlying need for every document and approval; information the state holds is not requested again without justification; fees and deadlines are not concealed; and rejection always has an intelligible, reviewable reason.

14. Priority Life and Business Journeys

All 1,288 services cannot be reformed simultaneously to the same quality. The Vision begins with a portfolio of high-volume or high-impact journeys, grouping scattered services around an “event” citizens or business owners understand. Instead of knowing office names, users know their desired result: a child’s birth, starting university, establishing a company, hiring a worker, buying a home, retirement, death, transferring ownership or importing goods. Legal jurisdictions remain behind the interface, but the state coordinates them.

This list is neither legislation nor a final ranking. In 2027, the portfolio is selected according to transaction volume, friction costs, effects on rights and the economy, data readiness and reform feasibility within 12–24 months. Every journey passes a “quality gate” before funding and expansion.

15. Digital Documents and the Government Inbox

Friction recurs because citizens still carry documents between state bodies. The authenticity-verification project has removed a substantial part of this loop, but the Vision goes further: an original digital document or verified credential should be directly verifiable, accessible to citizens and shareable when needed, while government retrieves facts from their source where law permits.

The Vision proposes a “government document/credential wallet”, not as a new database but as a user interface to documents issued by their original sources, with verification codes/mechanisms and governed sharing. India’s DigiLocker illustrates the mechanism: a government platform enabling users to access and share verifiable original documents. According to its official page in October 2026, it had exceeded seven hundred million users and nine billion issued documents. Iraq should transfer not the figures but the issuer–wallet–verifier model.¹⁷

A “government inbox” within users’ accounts complements this: official notices, requests for additional information, decisions, appointments, receipts or document-expiry alerts. A unified inbox reduces scattered messages and informal contact and creates a retrievable record, but does not remove SMS, email or supporting notifications when necessary for access.

16. Reducing Corruption by Reducing Friction

Digitalisation does not “eliminate corruption”. A poor digital system can entrench monopoly, conceal decision criteria or expand surveillance. But service design can reduce some opportunities for petty corruption and intermediation by limiting compulsory contact, standardising conditions and fees, constraining unrecorded discretion and creating an audit trail. A United Nations study on the “integrity dividend” of digital government links digitalisation to reduced red tape and discretion and greater transparency, while stressing that impact requires integration with integrity strategy rather than isolated action.¹⁸

The most important measure is not “the percentage of electronic services”, but indicators such as required visits, applications needing manual intervention outside the workflow, override rates and reasons, time differences among similar users, complaints of unofficial payment demands, and cases exceeding deadlines without a reason code. These operational indicators let integrity and oversight bodies focus on patterns rather than await individual complaints.

17. Digital Inclusion and Assisted Channels

Digital government fails if it improves the national average while excluding older people, people with disabilities, residents of poorly connected areas or those without smartphones or financial accounts. The Vision therefore adopts “digital-first, not digital-only”: digital is the simplest default channel for suitable services, while assisted access provides the same outcome and challenge rights without an implicit penalty for needing support.

This is particularly important in payments. The financial inclusion strategy itself shows that accounts are unevenly distributed and that only 11% in the 2024 diagnostic represents households with a bank or payment account under the baseline used. Until inclusion expands, government services must offer payment or assistance options that do not turn account non-ownership into denial of service.⁹

18. Architecture, Interoperability and Procurement

Public digital infrastructure must prevent two monopolies: every ministry monopolising its own rails, and one supplier monopolising the entire state. The Vision therefore adopts modular architecture, standards, documented APIs and replaceable services. A shared layer defines a clear function — identity verification, payment, query or signature — without imposing one technology on every internal system if it meets the contract and safeguards.

The World Bank’s paper on DPI standards uses an “hourglass model”: a limited set of core standards in the middle permits wide diversity of applications and technologies above and below. Iraq’s lesson is that government need not specify every product; it must specify protocols, credentials, interfaces, user rights and conformance tests that allow competition without breaking integration.¹⁹

19. Resilience, Privacy and the Bridge to Data Sovereignty

Every success in C05 expands the risk surface: unified identity is easier for users and more valuable to attackers; faster data exchange improves services and increases risks of use beyond the purpose; digital payments reduce cash and create dependence on financial and communications infrastructure; a unified government inbox strengthens trust when messages are authentic and becomes a fraud point when they are not. Resilience and privacy are therefore designed from the outset, while detailed data and security policy belongs to the next chapter.

• Critical services have no single point of failure; redundancy, recovery and continuity tests are mandatory.

• Use the minimum data needed for the purpose, precise permissions, access logs and expiring authorisations where appropriate.

• Separate development and test environments from real data and prohibit copying entire databases merely for integration.

• Notify users of incidents or sensitive operations under law and the response plan.

• Allow fallback to assisted channels when a critical central service fails, without extinguishing citizens’ rights.

20. Comparative Lessons: Estonia, India and Singapore

In India, UPI reached around 24.5 billion monthly transactions in August 2026 across 752 participating banks. This demonstrates a shared payment standard’s ability to carry many applications, not a numerical target for Iraq. In Singapore, MyInfo enables forms to be populated with verified government data with user consent, while Singpass provides authentication and signatures. This illustrates combining trust functions without forcing every service to store a new data copy.²⁰²¹²²

21. Iraq’s Digital Landscape in 2045

In 2045, digital-state maturity is not measured by application counts. Citizens sign in using trusted identity appropriate to the transaction, see services organised around life events rather than office names, authorise retrieval of necessary verified data rather than upload images, pay or receive funds through regulated interoperable channels, sign where the action requires, receive decisions in a government inbox and know how to challenge them. Companies do the same through authorised representatives, handling licensing, taxes, social security and customs without re-entering core data each time.

Inside the state, there is no “copy and paste” between ministry systems. Every entity owns its data and jurisdiction, but publishes or consumes standard services through X-Data/the national architecture and uses cloud, networks, identity, payments and trust services instead of incompatible local alternatives. Critical platforms are measured by availability and recovery; services by outcome time, user satisfaction and first-time completion; integrity by exceptions, friction and audit trails.

22. Transition Stages, 2027–2045

23. Indicator and Target Dashboard

Established official baselines are used where available. Where absent — as with service time, end-to-end completion and repeated documents — the 2027 goal is to establish a baseline, not invent a 2026 figure. The following targets are Vision policy decisions, not automatic forecasts, and are reviewed after first-year measurement.

* The official 2030 target in the Central Bank’s Financial Inclusion Strategy 2025–2029, not a target derived by the Vision team. Other C05 targets are proposed policies subject to recalibration after the 2027 baseline.

24. The Implementation Programme Package

The package does not require a new digital ministry. It strengthens the National Centre for Digital Transformation as coordinator, standard setter and builder of shared rails, while outcome ownership remains with the legally competent ministry/authority, payments remain under Central Bank regulation and legal identity with the Ministry of Interior. This prevents a “parallel digital state” outside state institutions.

25. Implementation, Cost and Financing Matrix

25.1 Funding Rule

A major digital project is not funded because it is “modern”. Funding follows a journey or shared rail with a baseline, outcome owner and usage/completion indicator. Operation, maintenance, security, licensing, messages and support enter TCO from the outset. Projects building reusable shared functions receive higher priority than sectoral systems duplicating existing functions.

26. Risks and Safeguards

27. What Do We Not Do?

• We do not build a new “digital identity” separate from the register and national card; we build a trust layer over the legal reference.

• We do not turn Ur Auth into proof of legal identity merely because it is a successful authentication factor.

• We do not combine every database into a massive central repository; we connect sources of truth through permissions and standards.

• We do not require every ministry to have its own portal, app, payment wallet and login system where the function is shared.

• We do not count every published form as an end-to-end digital service.

• We do not regard payment as successful if an employee still reconciles it manually or requests a paper receipt.

• We do not replace the employee with an opaque interface; we remove unnecessary friction while retaining support and human responsibility.

• We do not use “reducing corruption” as a pretext to remove the right of appeal or introduce disproportionate surveillance.

• We do not make digital-only access a condition for basic services before effective digital inclusion is in place.

• We do not measure success solely by the number of systems or services; we measure time, completion, visits, cost and outcome.

• We do not bind the state to a closed supplier without an exit plan, data export and interoperability testing.

• We do not set a “100% digitisation” target for activities that require physical presence or legitimate human judgement; we digitise what can be digitised and coordinate what cannot.

28. Conclusion and the Bridge to Data Sovereignty and Cybersecurity

This chapter develops a simple but transformative argument: the citizen does not need a thousand separate services; the citizen needs a state that reuses its shared capabilities. When identity, trust, payment, exchange, notification and tracking become public rails, every sector can build its services faster, at lower cost and with measurable quality. When a journey is assessed by its outcome rather than its number of screens, the administrative question “Why do we require this step?” comes before the technical question “How do we program it?”.