diff --git a/lib/composer/composer/autoload_classmap.php b/lib/composer/composer/autoload_classmap.php
index b3e8e07652c47..1872528333937 100644
--- a/lib/composer/composer/autoload_classmap.php
+++ b/lib/composer/composer/autoload_classmap.php
@@ -18,6 +18,17 @@
     'NCU\\Config\\Lexicon\\Preset' => $baseDir . '/lib/unstable/Config/Lexicon/Preset.php',
     'NCU\\Config\\ValueType' => $baseDir . '/lib/unstable/Config/ValueType.php',
     'NCU\\Federation\\ISignedCloudFederationProvider' => $baseDir . '/lib/unstable/Federation/ISignedCloudFederationProvider.php',
+    'NCU\\Governance\\Events\\LabelAssignedEvent' => $baseDir . '/lib/unstable/Governance/Events/LabelAssignedEvent.php',
+    'NCU\\Governance\\Events\\LabelRemovedEvent' => $baseDir . '/lib/unstable/Governance/Events/LabelRemovedEvent.php',
+    'NCU\\Governance\\Exception\\GovernanceException' => $baseDir . '/lib/unstable/Governance/Exception/GovernanceException.php',
+    'NCU\\Governance\\Exception\\GovernanceUnavailableException' => $baseDir . '/lib/unstable/Governance/Exception/GovernanceUnavailableException.php',
+    'NCU\\Governance\\Exception\\LabelNotFoundException' => $baseDir . '/lib/unstable/Governance/Exception/LabelNotFoundException.php',
+    'NCU\\Governance\\Exception\\LabelPermissionException' => $baseDir . '/lib/unstable/Governance/Exception/LabelPermissionException.php',
+    'NCU\\Governance\\Exception\\ResourceNotFoundException' => $baseDir . '/lib/unstable/Governance/Exception/ResourceNotFoundException.php',
+    'NCU\\Governance\\ILabelManager' => $baseDir . '/lib/unstable/Governance/ILabelManager.php',
+    'NCU\\Governance\\LabelModification' => $baseDir . '/lib/unstable/Governance/LabelModification.php',
+    'NCU\\Governance\\LabelType' => $baseDir . '/lib/unstable/Governance/LabelType.php',
+    'NCU\\Governance\\ResourceLabel' => $baseDir . '/lib/unstable/Governance/ResourceLabel.php',
     'NCU\\Resource\\IResourceType' => $baseDir . '/lib/unstable/Resource/IResourceType.php',
     'NCU\\Resource\\Permission\\APermission' => $baseDir . '/lib/unstable/Resource/Permission/APermission.php',
     'NCU\\Resource\\Permission\\AccessEntry' => $baseDir . '/lib/unstable/Resource/Permission/AccessEntry.php',
@@ -2069,6 +2080,7 @@
     'OC\\FullTextSearch\\Model\\SearchRequestSimpleQuery' => $baseDir . '/lib/private/FullTextSearch/Model/SearchRequestSimpleQuery.php',
     'OC\\FullTextSearch\\Model\\SearchTemplate' => $baseDir . '/lib/private/FullTextSearch/Model/SearchTemplate.php',
     'OC\\GlobalScale\\Config' => $baseDir . '/lib/private/GlobalScale/Config.php',
+    'OC\\Governance\\LabelManager' => $baseDir . '/lib/private/Governance/LabelManager.php',
     'OC\\Group\\Backend' => $baseDir . '/lib/private/Group/Backend.php',
     'OC\\Group\\Database' => $baseDir . '/lib/private/Group/Database.php',
     'OC\\Group\\DisplayNameCache' => $baseDir . '/lib/private/Group/DisplayNameCache.php',
diff --git a/lib/composer/composer/autoload_static.php b/lib/composer/composer/autoload_static.php
index 113654baeef47..8d1635270d1fd 100644
--- a/lib/composer/composer/autoload_static.php
+++ b/lib/composer/composer/autoload_static.php
@@ -59,6 +59,17 @@ class ComposerStaticInit749170dad3f5e7f9ca158f5a9f04f6a2
         'NCU\\Config\\Lexicon\\Preset' => __DIR__ . '/../../..' . '/lib/unstable/Config/Lexicon/Preset.php',
         'NCU\\Config\\ValueType' => __DIR__ . '/../../..' . '/lib/unstable/Config/ValueType.php',
         'NCU\\Federation\\ISignedCloudFederationProvider' => __DIR__ . '/../../..' . '/lib/unstable/Federation/ISignedCloudFederationProvider.php',
+        'NCU\\Governance\\Events\\LabelAssignedEvent' => __DIR__ . '/../../..' . '/lib/unstable/Governance/Events/LabelAssignedEvent.php',
+        'NCU\\Governance\\Events\\LabelRemovedEvent' => __DIR__ . '/../../..' . '/lib/unstable/Governance/Events/LabelRemovedEvent.php',
+        'NCU\\Governance\\Exception\\GovernanceException' => __DIR__ . '/../../..' . '/lib/unstable/Governance/Exception/GovernanceException.php',
+        'NCU\\Governance\\Exception\\GovernanceUnavailableException' => __DIR__ . '/../../..' . '/lib/unstable/Governance/Exception/GovernanceUnavailableException.php',
+        'NCU\\Governance\\Exception\\LabelNotFoundException' => __DIR__ . '/../../..' . '/lib/unstable/Governance/Exception/LabelNotFoundException.php',
+        'NCU\\Governance\\Exception\\LabelPermissionException' => __DIR__ . '/../../..' . '/lib/unstable/Governance/Exception/LabelPermissionException.php',
+        'NCU\\Governance\\Exception\\ResourceNotFoundException' => __DIR__ . '/../../..' . '/lib/unstable/Governance/Exception/ResourceNotFoundException.php',
+        'NCU\\Governance\\ILabelManager' => __DIR__ . '/../../..' . '/lib/unstable/Governance/ILabelManager.php',
+        'NCU\\Governance\\LabelModification' => __DIR__ . '/../../..' . '/lib/unstable/Governance/LabelModification.php',
+        'NCU\\Governance\\LabelType' => __DIR__ . '/../../..' . '/lib/unstable/Governance/LabelType.php',
+        'NCU\\Governance\\ResourceLabel' => __DIR__ . '/../../..' . '/lib/unstable/Governance/ResourceLabel.php',
         'NCU\\Resource\\IResourceType' => __DIR__ . '/../../..' . '/lib/unstable/Resource/IResourceType.php',
         'NCU\\Resource\\Permission\\APermission' => __DIR__ . '/../../..' . '/lib/unstable/Resource/Permission/APermission.php',
         'NCU\\Resource\\Permission\\AccessEntry' => __DIR__ . '/../../..' . '/lib/unstable/Resource/Permission/AccessEntry.php',
@@ -2110,6 +2121,7 @@ class ComposerStaticInit749170dad3f5e7f9ca158f5a9f04f6a2
         'OC\\FullTextSearch\\Model\\SearchRequestSimpleQuery' => __DIR__ . '/../../..' . '/lib/private/FullTextSearch/Model/SearchRequestSimpleQuery.php',
         'OC\\FullTextSearch\\Model\\SearchTemplate' => __DIR__ . '/../../..' . '/lib/private/FullTextSearch/Model/SearchTemplate.php',
         'OC\\GlobalScale\\Config' => __DIR__ . '/../../..' . '/lib/private/GlobalScale/Config.php',
+        'OC\\Governance\\LabelManager' => __DIR__ . '/../../..' . '/lib/private/Governance/LabelManager.php',
         'OC\\Group\\Backend' => __DIR__ . '/../../..' . '/lib/private/Group/Backend.php',
         'OC\\Group\\Database' => __DIR__ . '/../../..' . '/lib/private/Group/Database.php',
         'OC\\Group\\DisplayNameCache' => __DIR__ . '/../../..' . '/lib/private/Group/DisplayNameCache.php',
diff --git a/lib/private/Governance/LabelManager.php b/lib/private/Governance/LabelManager.php
new file mode 100644
index 0000000000000..01833cd8f34e8
--- /dev/null
+++ b/lib/private/Governance/LabelManager.php
@@ -0,0 +1,135 @@
+<?php
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+declare(strict_types=1);
+
+namespace OC\Governance;
+
+use InvalidArgumentException;
+use NCU\Governance\Exception\GovernanceUnavailableException;
+use NCU\Governance\ILabelManager;
+use NCU\Governance\LabelType;
+use NCU\Resource\Permission\IPermissionManager;
+use NCU\Resource\ResourceReference;
+use OCP\Actor\Actor;
+use OCP\App\IAppManager;
+use Psr\Container\ContainerInterface;
+use Psr\Log\LoggerInterface;
+use Throwable;
+
+/**
+ * Passes everything on to the governance app, which decides who may see and change a label.
+ */
+final class LabelManager implements ILabelManager {
+	public const string APP_ID = 'governance';
+	public const string BACKEND = 'OCA\\Governance\\Service\\LabelManager';
+
+	private ?ILabelManager $backend = null;
+
+	public function __construct(
+		private readonly IAppManager $appManager,
+		private readonly ContainerInterface $container,
+		private readonly IPermissionManager $permissionManager,
+		private readonly LoggerInterface $logger,
+	) {
+	}
+
+	#[\Override]
+	public function isAvailable(): bool {
+		return $this->getBackend()?->isAvailable() ?? false;
+	}
+
+	#[\Override]
+	public function getAssignedLabelsForResources(Actor $actor, array $resources): array {
+		$this->assertRegistered($resources);
+
+		$labels = [];
+		foreach ($resources as $resource) {
+			$labels[$resource->key()] = [];
+		}
+
+		$backend = $this->getBackend();
+		if ($backend === null || $resources === []) {
+			return $labels;
+		}
+
+		foreach ($backend->getAssignedLabelsForResources($actor, $resources) as $resourceKey => $resourceLabels) {
+			if (isset($labels[$resourceKey])) {
+				$labels[$resourceKey] = array_values($resourceLabels);
+			}
+		}
+
+		return $labels;
+	}
+
+	#[\Override]
+	public function getAssignedLabels(Actor $actor, ResourceReference $resource): array {
+		return $this->getAssignedLabelsForResources($actor, [$resource])[$resource->key()];
+	}
+
+	#[\Override]
+	public function getAssignableLabels(Actor $actor, ResourceReference $resource, ?LabelType $type = null): array {
+		$this->assertRegistered([$resource]);
+
+		return $this->getBackend()?->getAssignableLabels($actor, $resource, $type) ?? [];
+	}
+
+	#[\Override]
+	public function assignLabel(Actor $actor, ResourceReference $resource, string $labelId, ?string $reason = null): void {
+		$this->assertRegistered([$resource]);
+		$this->getBackendOrThrow()->assignLabel($actor, $resource, $labelId, $reason);
+	}
+
+	#[\Override]
+	public function removeLabel(Actor $actor, ResourceReference $resource, string $labelId, ?string $reason = null): void {
+		$this->assertRegistered([$resource]);
+		$this->getBackendOrThrow()->removeLabel($actor, $resource, $labelId, $reason);
+	}
+
+	/**
+	 * @param list<ResourceReference> $resources
+	 * @throws InvalidArgumentException if a resource type is not registered
+	 */
+	private function assertRegistered(array $resources): void {
+		foreach ($resources as $resource) {
+			if ($this->permissionManager->getResourceType($resource->type) === null) {
+				throw new InvalidArgumentException('The resource type ' . $resource->type . ' is not registered');
+			}
+		}
+	}
+
+	/**
+	 * @throws GovernanceUnavailableException
+	 */
+	private function getBackendOrThrow(): ILabelManager {
+		return $this->getBackend() ?? throw new GovernanceUnavailableException('The governance app is not enabled');
+	}
+
+	private function getBackend(): ?ILabelManager {
+		if ($this->backend !== null) {
+			return $this->backend;
+		}
+		if (!$this->appManager->isEnabledForAnyone(self::APP_ID)) {
+			return null;
+		}
+
+		try {
+			$backend = $this->container->get(self::BACKEND);
+		} catch (Throwable $e) {
+			$this->logger->error('Could not load the label manager of the governance app', ['exception' => $e]);
+			return null;
+		}
+		if (!$backend instanceof ILabelManager) {
+			$this->logger->error('{class} does not implement {interface}', ['class' => self::BACKEND, 'interface' => ILabelManager::class]);
+			return null;
+		}
+
+		$this->backend = $backend;
+
+		return $backend;
+	}
+}
diff --git a/lib/private/Server.php b/lib/private/Server.php
index 8676dfae26bd7..c8984442b2a2f 100644
--- a/lib/private/Server.php
+++ b/lib/private/Server.php
@@ -1119,6 +1119,7 @@ public function runInitialRegistrations(): void {
 
 		$this->registerAlias(\NCU\Resource\Permission\IPermissionManager::class, \OC\Resource\Permission\PermissionManager::class);
 		$this->registerAlias(\NCU\Resource\Permission\IAccessManager::class, \OC\Resource\Permission\AccessManager::class);
+		$this->registerAlias(\NCU\Governance\ILabelManager::class, \OC\Governance\LabelManager::class);
 
 		$this->registerService(IGlobalScaleService::class, static function (ContainerInterface $c): IGlobalScaleService {
 			/** @var Coordinator $coordinator */
diff --git a/lib/unstable/Governance/Events/LabelAssignedEvent.php b/lib/unstable/Governance/Events/LabelAssignedEvent.php
new file mode 100644
index 0000000000000..35df240440e73
--- /dev/null
+++ b/lib/unstable/Governance/Events/LabelAssignedEvent.php
@@ -0,0 +1,39 @@
+<?php
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+declare(strict_types=1);
+
+namespace NCU\Governance\Events;
+
+use NCU\Governance\LabelType;
+use NCU\Resource\ResourceReference;
+use OCP\Actor\Actor;
+use OCP\AppFramework\Attribute\ExceptionalImplementable;
+use OCP\AppFramework\Attribute\Listenable;
+use OCP\EventDispatcher\Event;
+
+/**
+ * Dispatched by the governance app after a label was assigned to a resource.
+ *
+ * @experimental 36.0.0
+ */
+#[Listenable(since: '36.0.0')]
+#[ExceptionalImplementable(app: 'governance')]
+final class LabelAssignedEvent extends Event {
+	/**
+	 * @param non-empty-string $labelId
+	 * @experimental 36.0.0
+	 */
+	public function __construct(
+		public readonly Actor $actor,
+		public readonly ResourceReference $resource,
+		public readonly string $labelId,
+		public readonly LabelType $labelType,
+	) {
+		parent::__construct();
+	}
+}
diff --git a/lib/unstable/Governance/Events/LabelRemovedEvent.php b/lib/unstable/Governance/Events/LabelRemovedEvent.php
new file mode 100644
index 0000000000000..fd4019f501d25
--- /dev/null
+++ b/lib/unstable/Governance/Events/LabelRemovedEvent.php
@@ -0,0 +1,40 @@
+<?php
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+declare(strict_types=1);
+
+namespace NCU\Governance\Events;
+
+use NCU\Governance\LabelType;
+use NCU\Resource\ResourceReference;
+use OCP\Actor\Actor;
+use OCP\AppFramework\Attribute\ExceptionalImplementable;
+use OCP\AppFramework\Attribute\Listenable;
+use OCP\EventDispatcher\Event;
+
+/**
+ * Dispatched by the governance app after a label was removed from a resource, also when another label replaced it.
+ * It is not dispatched when the label or the resource is deleted.
+ *
+ * @experimental 36.0.0
+ */
+#[Listenable(since: '36.0.0')]
+#[ExceptionalImplementable(app: 'governance')]
+final class LabelRemovedEvent extends Event {
+	/**
+	 * @param non-empty-string $labelId
+	 * @experimental 36.0.0
+	 */
+	public function __construct(
+		public readonly Actor $actor,
+		public readonly ResourceReference $resource,
+		public readonly string $labelId,
+		public readonly LabelType $labelType,
+	) {
+		parent::__construct();
+	}
+}
diff --git a/lib/unstable/Governance/Exception/GovernanceException.php b/lib/unstable/Governance/Exception/GovernanceException.php
new file mode 100644
index 0000000000000..e9c029aab8658
--- /dev/null
+++ b/lib/unstable/Governance/Exception/GovernanceException.php
@@ -0,0 +1,23 @@
+<?php
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+declare(strict_types=1);
+
+namespace NCU\Governance\Exception;
+
+use OCP\AppFramework\Attribute\Catchable;
+use OCP\AppFramework\Attribute\ExceptionalImplementable;
+
+/**
+ * Base of the exceptions thrown when changing the labels of a resource.
+ *
+ * @experimental 36.0.0
+ */
+#[Catchable(since: '36.0.0')]
+#[ExceptionalImplementable(app: 'governance')]
+class GovernanceException extends \Exception {
+}
diff --git a/lib/unstable/Governance/Exception/GovernanceUnavailableException.php b/lib/unstable/Governance/Exception/GovernanceUnavailableException.php
new file mode 100644
index 0000000000000..5b9f37a052767
--- /dev/null
+++ b/lib/unstable/Governance/Exception/GovernanceUnavailableException.php
@@ -0,0 +1,23 @@
+<?php
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+declare(strict_types=1);
+
+namespace NCU\Governance\Exception;
+
+use OCP\AppFramework\Attribute\Catchable;
+use OCP\AppFramework\Attribute\ExceptionalImplementable;
+
+/**
+ * Labels cannot be changed because the governance app is not enabled.
+ *
+ * @experimental 36.0.0
+ */
+#[Catchable(since: '36.0.0')]
+#[ExceptionalImplementable(app: 'governance')]
+final class GovernanceUnavailableException extends GovernanceException {
+}
diff --git a/lib/unstable/Governance/Exception/LabelNotFoundException.php b/lib/unstable/Governance/Exception/LabelNotFoundException.php
new file mode 100644
index 0000000000000..71f1539a216cb
--- /dev/null
+++ b/lib/unstable/Governance/Exception/LabelNotFoundException.php
@@ -0,0 +1,23 @@
+<?php
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+declare(strict_types=1);
+
+namespace NCU\Governance\Exception;
+
+use OCP\AppFramework\Attribute\Catchable;
+use OCP\AppFramework\Attribute\ExceptionalImplementable;
+
+/**
+ * The label does not exist or does not apply to the resource.
+ *
+ * @experimental 36.0.0
+ */
+#[Catchable(since: '36.0.0')]
+#[ExceptionalImplementable(app: 'governance')]
+final class LabelNotFoundException extends GovernanceException {
+}
diff --git a/lib/unstable/Governance/Exception/LabelPermissionException.php b/lib/unstable/Governance/Exception/LabelPermissionException.php
new file mode 100644
index 0000000000000..6a45edc1bf4e8
--- /dev/null
+++ b/lib/unstable/Governance/Exception/LabelPermissionException.php
@@ -0,0 +1,23 @@
+<?php
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+declare(strict_types=1);
+
+namespace NCU\Governance\Exception;
+
+use OCP\AppFramework\Attribute\Catchable;
+use OCP\AppFramework\Attribute\ExceptionalImplementable;
+
+/**
+ * The actor is not allowed to assign or remove the label, or a required reason is missing.
+ *
+ * @experimental 36.0.0
+ */
+#[Catchable(since: '36.0.0')]
+#[ExceptionalImplementable(app: 'governance')]
+final class LabelPermissionException extends GovernanceException {
+}
diff --git a/lib/unstable/Governance/Exception/ResourceNotFoundException.php b/lib/unstable/Governance/Exception/ResourceNotFoundException.php
new file mode 100644
index 0000000000000..34ab43d8e1cbd
--- /dev/null
+++ b/lib/unstable/Governance/Exception/ResourceNotFoundException.php
@@ -0,0 +1,23 @@
+<?php
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+declare(strict_types=1);
+
+namespace NCU\Governance\Exception;
+
+use OCP\AppFramework\Attribute\Catchable;
+use OCP\AppFramework\Attribute\ExceptionalImplementable;
+
+/**
+ * The resource does not exist or the actor may not label it for lack of access.
+ *
+ * @experimental 36.0.0
+ */
+#[Catchable(since: '36.0.0')]
+#[ExceptionalImplementable(app: 'governance')]
+final class ResourceNotFoundException extends GovernanceException {
+}
diff --git a/lib/unstable/Governance/ILabelManager.php b/lib/unstable/Governance/ILabelManager.php
new file mode 100644
index 0000000000000..adcebc76b3653
--- /dev/null
+++ b/lib/unstable/Governance/ILabelManager.php
@@ -0,0 +1,108 @@
+<?php
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+declare(strict_types=1);
+
+namespace NCU\Governance;
+
+use NCU\Governance\Exception\GovernanceUnavailableException;
+use NCU\Governance\Exception\LabelNotFoundException;
+use NCU\Governance\Exception\LabelPermissionException;
+use NCU\Governance\Exception\ResourceNotFoundException;
+use NCU\Resource\ResourceReference;
+use OCP\Actor\Actor;
+use OCP\AppFramework\Attribute\Consumable;
+use OCP\AppFramework\Attribute\ExceptionalImplementable;
+
+/**
+ * Reads and changes the labels assigned to resources.
+ *
+ * The labels are managed by the governance app. Without it no labels are returned and they cannot be changed.
+ * This is not an extension point, only the governance app implements it.
+ *
+ * The governance app decides which labels an actor sees and may change. This usually requires access
+ * to the resource, but not always, e.g. a legal hold is placed by someone the resource is not shared with.
+ *
+ * Only labels assigned to the resource itself are returned,
+ * e.g. not the ones a file inherits from its parent folders.
+ *
+ * @experimental 36.0.0
+ */
+#[Consumable(since: '36.0.0')]
+#[ExceptionalImplementable(app: 'governance')]
+interface ILabelManager {
+	/**
+	 * Whether labels can be read and changed.
+	 *
+	 * @experimental 36.0.0
+	 */
+	public function isAvailable(): bool;
+
+	/**
+	 * Get the labels assigned to the resources, the resources can be of different types.
+	 *
+	 * The labels can be of any type. A resource has no labels if the actor may not see any of them.
+	 *
+	 * @param list<ResourceReference> $resources
+	 * @return array<non-empty-string, list<ResourceLabel>> keyed by {@see ResourceReference::key}, with an entry for every resource
+	 * @throws \InvalidArgumentException if a resource type is not registered
+	 * @experimental 36.0.0
+	 */
+	public function getAssignedLabelsForResources(Actor $actor, array $resources): array;
+
+	/**
+	 * Same as {@see self::getAssignedLabelsForResources} for a single resource.
+	 *
+	 * @return list<ResourceLabel>
+	 * @throws \InvalidArgumentException if the resource type is not registered
+	 * @experimental 36.0.0
+	 */
+	public function getAssignedLabels(Actor $actor, ResourceReference $resource): array;
+
+	/**
+	 * Get the labels that apply to the resource, including the ones already assigned.
+	 *
+	 * Whether the actor may assign or remove a label is part of the label.
+	 * No labels are returned if the actor may not label the resource.
+	 *
+	 * @param ?LabelType $type Only return labels of this type
+	 * @return list<ResourceLabel>
+	 * @throws \InvalidArgumentException if the resource type is not registered
+	 * @experimental 36.0.0
+	 */
+	public function getAssignableLabels(Actor $actor, ResourceReference $resource, ?LabelType $type = null): array;
+
+	/**
+	 * Assign the label to the resource.
+	 *
+	 * A sensitivity label replaces the one currently assigned.
+	 *
+	 * @param non-empty-string $labelId
+	 * @param ?string $reason Required if the label can only be assigned with a reason, see {@see ResourceLabel::$canAssign}
+	 * @throws \InvalidArgumentException if the resource type is not registered
+	 * @throws GovernanceUnavailableException
+	 * @throws ResourceNotFoundException
+	 * @throws LabelNotFoundException
+	 * @throws LabelPermissionException
+	 * @experimental 36.0.0
+	 */
+	public function assignLabel(Actor $actor, ResourceReference $resource, string $labelId, ?string $reason = null): void;
+
+	/**
+	 * Remove the label from the resource.
+	 *
+	 * @param non-empty-string $labelId
+	 * @param ?string $reason Required if the label can only be removed with a reason, see {@see ResourceLabel::$canRemove}
+	 * @throws \InvalidArgumentException if the resource type is not registered
+	 * @throws GovernanceUnavailableException
+	 * @throws ResourceNotFoundException
+	 * @throws LabelNotFoundException
+	 * @throws LabelPermissionException
+	 * @experimental 36.0.0
+	 */
+	public function removeLabel(Actor $actor, ResourceReference $resource, string $labelId, ?string $reason = null): void;
+}
diff --git a/lib/unstable/Governance/LabelModification.php b/lib/unstable/Governance/LabelModification.php
new file mode 100644
index 0000000000000..a01f1aa6a8337
--- /dev/null
+++ b/lib/unstable/Governance/LabelModification.php
@@ -0,0 +1,39 @@
+<?php
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+declare(strict_types=1);
+
+namespace NCU\Governance;
+
+use OCP\AppFramework\Attribute\Consumable;
+
+/**
+ * Whether an actor may assign or remove a label.
+ *
+ * New cases may be added in future versions, treat unknown ones as {@see self::No}.
+ *
+ * @experimental 36.0.0
+ */
+#[Consumable(since: '36.0.0')]
+enum LabelModification: string {
+	/**
+	 * @experimental 36.0.0
+	 */
+	case No = 'no';
+
+	/**
+	 * @experimental 36.0.0
+	 */
+	case Yes = 'yes';
+
+	/**
+	 * Allowed, but a reason has to be passed which is recorded.
+	 *
+	 * @experimental 36.0.0
+	 */
+	case WithReason = 'with-reason';
+}
diff --git a/lib/unstable/Governance/LabelType.php b/lib/unstable/Governance/LabelType.php
new file mode 100644
index 0000000000000..79dda380c65eb
--- /dev/null
+++ b/lib/unstable/Governance/LabelType.php
@@ -0,0 +1,41 @@
+<?php
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+declare(strict_types=1);
+
+namespace NCU\Governance;
+
+use OCP\AppFramework\Attribute\Consumable;
+
+/**
+ * The kinds of labels, they differ in what they express:
+ *
+ * - Sensitivity: what may be done with a resource. A resource has at most one.
+ * - Retention: how long a resource is kept and what happens afterwards.
+ * - Hold: a legal freeze, changes are denied while one is assigned.
+ *
+ * Every resource type supports sensitivity labels, the other kinds only apply to some of them.
+ *
+ * @experimental 36.0.0
+ */
+#[Consumable(since: '36.0.0')]
+enum LabelType: string {
+	/**
+	 * @experimental 36.0.0
+	 */
+	case Sensitivity = 'sensitivity';
+
+	/**
+	 * @experimental 36.0.0
+	 */
+	case Retention = 'retention';
+
+	/**
+	 * @experimental 36.0.0
+	 */
+	case Hold = 'hold';
+}
diff --git a/lib/unstable/Governance/ResourceLabel.php b/lib/unstable/Governance/ResourceLabel.php
new file mode 100644
index 0000000000000..eae1c89d1cc68
--- /dev/null
+++ b/lib/unstable/Governance/ResourceLabel.php
@@ -0,0 +1,44 @@
+<?php
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+declare(strict_types=1);
+
+namespace NCU\Governance;
+
+use OCP\AppFramework\Attribute\Consumable;
+
+/**
+ * A label as it applies to one resource for one actor.
+ *
+ * @psalm-immutable
+ * @experimental 36.0.0
+ */
+#[Consumable(since: '36.0.0')]
+final readonly class ResourceLabel {
+	/**
+	 * @param non-empty-string $id
+	 * @param string $displayName Name to show to the user
+	 * @param ?string $color Color in hex format, e.g. `#0082c9`
+	 * @param int $priority Order of the label within its type
+	 * @param bool $assigned Whether the label is assigned to the resource
+	 * @param LabelModification $canAssign Whether the actor may assign the label to the resource
+	 * @param LabelModification $canRemove Whether the actor may remove the label from the resource
+	 * @experimental 36.0.0
+	 */
+	public function __construct(
+		public string $id,
+		public LabelType $type,
+		public string $displayName,
+		public ?string $description,
+		public ?string $color,
+		public int $priority,
+		public bool $assigned,
+		public LabelModification $canAssign,
+		public LabelModification $canRemove,
+	) {
+	}
+}
diff --git a/tests/lib/Governance/LabelManagerTest.php b/tests/lib/Governance/LabelManagerTest.php
new file mode 100644
index 0000000000000..a2a65382a1619
--- /dev/null
+++ b/tests/lib/Governance/LabelManagerTest.php
@@ -0,0 +1,210 @@
+<?php
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+declare(strict_types=1);
+
+namespace Test\Governance;
+
+use NCU\Governance\Exception\GovernanceUnavailableException;
+use NCU\Governance\Exception\LabelPermissionException;
+use NCU\Governance\Exception\ResourceNotFoundException;
+use NCU\Governance\ILabelManager;
+use NCU\Governance\LabelModification;
+use NCU\Governance\LabelType;
+use NCU\Governance\ResourceLabel;
+use NCU\Resource\IResourceType;
+use NCU\Resource\Permission\IPermissionManager;
+use NCU\Resource\ResourceReference;
+use OC\Governance\LabelManager;
+use OCP\Actor\Actor;
+use OCP\Actor\Principal;
+use OCP\App\IAppManager;
+use OCP\Server;
+use PHPUnit\Framework\MockObject\MockObject;
+use Psr\Container\ContainerInterface;
+use Psr\Log\LoggerInterface;
+use Test\TestCase;
+
+class LabelManagerTest extends TestCase {
+	private IAppManager&MockObject $appManager;
+	private ContainerInterface&MockObject $container;
+	private LoggerInterface&MockObject $logger;
+	private ILabelManager&MockObject $backend;
+	private LabelManager $manager;
+	private Actor $alice;
+	private ResourceReference $table;
+	private ResourceReference $otherTable;
+
+	/** @var object the service the container returns for the governance app */
+	private object $service;
+
+	protected function setUp(): void {
+		parent::setUp();
+
+		$this->alice = Actor::of(Principal::user('alice'));
+		$this->table = new ResourceReference('tables:table', '1');
+		$this->otherTable = new ResourceReference('tables:table', '2');
+
+		$this->backend = $this->createMock(ILabelManager::class);
+		$this->service = $this->backend;
+		$this->container = $this->createMock(ContainerInterface::class);
+		$this->container->method('get')->with(LabelManager::BACKEND)->willReturnCallback(fn (): object => $this->service);
+		$this->logger = $this->createMock(LoggerInterface::class);
+
+		$this->manager = $this->createManager(true);
+	}
+
+	private function createManager(bool $governanceEnabled): LabelManager {
+		$this->appManager = $this->createMock(IAppManager::class);
+		$this->appManager->method('isEnabledForAnyone')->with('governance')->willReturn($governanceEnabled);
+
+		$permissionManager = $this->createMock(IPermissionManager::class);
+		$permissionManager->method('getResourceType')->willReturnCallback(
+			fn (string $id): ?IResourceType => $id === 'tables:table' ? $this->createMock(IResourceType::class) : null,
+		);
+
+		return new LabelManager($this->appManager, $this->container, $permissionManager, $this->logger);
+	}
+
+	private function createLabel(string $id, LabelType $type = LabelType::Sensitivity): ResourceLabel {
+		return new ResourceLabel($id, $type, 'Label ' . $id, null, null, 0, true, LabelModification::Yes, LabelModification::Yes);
+	}
+
+	public function testIsRegistered(): void {
+		$manager = Server::get(ILabelManager::class);
+
+		$this->assertInstanceOf(LabelManager::class, $manager);
+		$this->assertFalse($manager->isAvailable());
+	}
+
+	public function testIsAvailable(): void {
+		$this->backend->method('isAvailable')->willReturn(true);
+
+		$this->assertTrue($this->manager->isAvailable());
+	}
+
+	public function testWithoutGovernanceNoLabelsAreReturned(): void {
+		$manager = $this->createManager(false);
+		$this->container->expects($this->never())->method('get');
+
+		$this->assertFalse($manager->isAvailable());
+		$this->assertSame(['tables:table/1' => [], 'tables:table/2' => []], $manager->getAssignedLabelsForResources($this->alice, [$this->table, $this->otherTable]));
+		$this->assertSame([], $manager->getAssignedLabels($this->alice, $this->table));
+		$this->assertSame([], $manager->getAssignableLabels($this->alice, $this->table));
+	}
+
+	public function testWithoutGovernanceLabelsCannotBeAssigned(): void {
+		$this->expectException(GovernanceUnavailableException::class);
+		$this->createManager(false)->assignLabel($this->alice, $this->table, '1');
+	}
+
+	public function testWithoutGovernanceLabelsCannotBeRemoved(): void {
+		$this->expectException(GovernanceUnavailableException::class);
+		$this->createManager(false)->removeLabel($this->alice, $this->table, '1');
+	}
+
+	public function testServiceThatIsNoLabelManagerIsUnavailable(): void {
+		$this->service = new \stdClass();
+		$this->logger->expects($this->atLeastOnce())->method('error');
+
+		$this->assertFalse($this->manager->isAvailable());
+		$this->assertSame([], $this->manager->getAssignedLabels($this->alice, $this->table));
+	}
+
+	public function testServiceIsLoadedOnce(): void {
+		$this->container->expects($this->once())->method('get');
+
+		$this->manager->isAvailable();
+		$this->manager->getAssignableLabels($this->alice, $this->table);
+	}
+
+	public function testUnregisteredResourceType(): void {
+		$this->backend->expects($this->never())->method('getAssignedLabelsForResources');
+
+		$this->expectException(\InvalidArgumentException::class);
+		$this->manager->getAssignedLabelsForResources($this->alice, [$this->table, new ResourceReference('forms:form', '1')]);
+	}
+
+	public function testUnregisteredResourceTypeWithoutGovernance(): void {
+		$this->expectException(\InvalidArgumentException::class);
+		$this->createManager(false)->getAssignableLabels($this->alice, new ResourceReference('forms:form', '1'));
+	}
+
+	public function testLabelsCannotBeAssignedToAnUnregisteredResourceType(): void {
+		$this->backend->expects($this->never())->method('assignLabel');
+
+		$this->expectException(\InvalidArgumentException::class);
+		$this->manager->assignLabel($this->alice, new ResourceReference('forms:form', '1'), '1');
+	}
+
+	/**
+	 * The governance app decides which labels the actor sees, every resource is passed on.
+	 */
+	public function testAssignedLabelsAreReadFromGovernance(): void {
+		$internal = $this->createLabel('1');
+		$hold = $this->createLabel('3', LabelType::Hold);
+		$this->backend->expects($this->once())->method('getAssignedLabelsForResources')
+			->with($this->alice, [$this->otherTable, $this->table])
+			->willReturn([
+				'tables:table/1' => [5 => $internal, 7 => $hold],
+				// A resource that was not asked for
+				'tables:table/99' => [$hold],
+			]);
+
+		$labels = $this->manager->getAssignedLabelsForResources($this->alice, [$this->otherTable, $this->table]);
+
+		$this->assertSame(['tables:table/2' => [], 'tables:table/1' => [$internal, $hold]], $labels);
+	}
+
+	public function testGovernanceIsNotAskedWithoutResources(): void {
+		$this->backend->expects($this->never())->method('getAssignedLabelsForResources');
+
+		$this->assertSame([], $this->manager->getAssignedLabelsForResources($this->alice, []));
+	}
+
+	public function testGetAssignedLabels(): void {
+		$internal = $this->createLabel('1');
+		$this->backend->method('getAssignedLabelsForResources')->willReturn(['tables:table/1' => [$internal]]);
+
+		$this->assertSame([$internal], $this->manager->getAssignedLabels($this->alice, $this->table));
+	}
+
+	public function testAssignableLabelsAreReadFromGovernance(): void {
+		$labels = [$this->createLabel('1'), $this->createLabel('2')];
+		$this->backend->expects($this->once())->method('getAssignableLabels')
+			->with($this->alice, $this->table, LabelType::Sensitivity)
+			->willReturn($labels);
+
+		$this->assertSame($labels, $this->manager->getAssignableLabels($this->alice, $this->table, LabelType::Sensitivity));
+	}
+
+	public function testAssignLabel(): void {
+		$this->backend->expects($this->once())->method('assignLabel')->with($this->alice, $this->table, '1', 'Contains salaries');
+
+		$this->manager->assignLabel($this->alice, $this->table, '1', 'Contains salaries');
+	}
+
+	public function testRemoveLabel(): void {
+		$this->backend->expects($this->once())->method('removeLabel')->with($this->alice, $this->table, '1', 'Outdated');
+
+		$this->manager->removeLabel($this->alice, $this->table, '1', 'Outdated');
+	}
+
+	public function testExceptionsOfGovernanceArePassedOn(): void {
+		$this->backend->method('assignLabel')->willThrowException(new ResourceNotFoundException());
+		$this->backend->method('removeLabel')->willThrowException(new LabelPermissionException());
+
+		try {
+			$this->manager->assignLabel($this->alice, $this->table, '1');
+			$this->fail('Expected a ResourceNotFoundException');
+		} catch (ResourceNotFoundException) {
+		}
+
+		$this->expectException(LabelPermissionException::class);
+		$this->manager->removeLabel($this->alice, $this->table, '1');
+	}
+}