Your compliance
has a TTL.
An open conformance framework for AI safety and security. Being compliant is something you are, continuously — not something you were, on the day somebody checked.
- evidence age
- 0 days
- stale after
- 30 days · freshness window
- expires
- 44 days · window + grace
- verdict
- asserts conformance
Drag it. Nobody revokes this badge — the evidence stops arriving and the lease runs out. That is the whole standard.
Definition
What OpenAISF is
OpenAISF is an open conformance framework for AI safety and security. It defines 112 controls across 20 domains and decides mechanically whether an organisation is operating them. An AI system is OpenAISF-conformant at tier T for as long as it keeps producing signed evidence satisfying tier T's applicable controls.
It covers large language models, autonomous agents, and classical machine learning including credit scoring, medical imaging, computer vision and biometrics. The specification is CC BY 4.0; the reference tooling is Apache 2.0. Both are free, and a system can reach any tier without a certifier or a fee.
Sampling
Population-level. Every request crossing the enforcement point, not a sample of the period.
Latency
Freshness declared per control. No bridge letter — the industry's own unaudited patch for stale reports.
Verifier
A relying party checks the badge without contacting the subject, and without a registry that could be pressured.
Monitoring
EU AI Act Art. 72 requires post-market monitoring. Here the monitoring is the conformance evidence.
Control plane · Data plane
How a false claim gets caught
Evidence has two planes. The control plane states what is configured. The data plane reports what happened to live traffic. Tier 3 and above require both.
A team declares their agent's permission policy is switched on. Their gateway reports 184,203 requests that day, and that the policy made zero decisions about any of them:
$ openaisf check --context system.yaml --evidence ./evidence --tier T3
D07-C01 [fail] declared enabled, but 184203 requests crossed the
enforcement point with 0 decisions recorded. A policy
that never fired under live traffic was not operating.
lease: revoked exit 1No assessor was involved. Two numbers disagreed and the disagreement settled it. That contradiction is not resolvable by attestation — a signed statement from an accountable person does not override telemetry.
It is classified as a disqualifying failure, which blocks conformance even where the control is only recommended at that tier. Obligation level governs whether a shortfall affects conformance. It does not govern the treatment of a false statement.
Transparency log
Verification without the subject's cooperation
Statements are signed and published to an append-only, hash-chained log. Verification needs the statement, a public key, and a clock. No account, no relationship with the vendor, no permission.
$ openaisf verify --log vendor.jsonl --system urn:… --key vendor.pub
chain intact
signature valid
expires 2025-08-16T12:14:04Z
checked at 2026-08-07T12:14:05Z
state EXPIRED
This badge no longer asserts conformance. Nobody revoked it;
the lease simply ran out. exit 1Modifying a past log entry invalidates every entry after it. The operator cannot forge history or make an expired statement appear current; refusing to publish is their only move, and it is visible.
Assurance decay propagates downstream
A control inherited from an upstream model provider resolves against that provider's lease. When theirs goes stale, yours degrades within one freshness window. Assurance cannot be inherited above the upstream's verified tier. No other framework models this — and it is what makes conformance affordable, because you import what your provider already proved instead of re-proving it.
Crosswalk
677 requirements. Zero gaps.
Mapping outward from your own controls shows what you found and can never show what you missed. OpenAISF inverts it: each regime is inventoried to its atomic requirements, and every one must be covered by named controls or excluded with a written reason. There is no third state, and an unresolved requirement fails the build.
| Regime | Reqs | Covered / excluded | Gap |
|---|---|---|---|
| CSA AI Controls Matrix v1.1.1 | 247 | 0 | |
| MITRE ATLAS 2026.07 | 178 | 0 | |
| EU AI Act 2024/1689 | 84 | 0 | |
| NIST AI RMF 1.0 | 72 | 0 | |
| ISO/IEC 42001:2023 Annex A | 38 | 0 | |
| MCP-38 threat taxonomy | 38 | 0 | |
| OWASP LLM Top 10 · 2025 | 10 | 0 | |
| OWASP LLM Top 10 · 2026 | 10 | 0 | |
| Total | 677 | 544 covered · 133 excluded | 0 |
covered by named controls excluded, with a written reason
The exclusions, and why they are the part to argue with
Ninety-one CSA entries are general cloud security — datacentre access, endpoint management, cryptography, HR screening — inherited from the Cloud Controls Matrix. Restating a full cloud security baseline inside an AI framework would be the bureaucracy this exists to remove. Forty-two MITRE ATLAS entries are adversary reconnaissance performed outside your systems: no implementable control stops someone reading public research.
Nothing was excluded to produce a complete report, and control D19-C05 fails the conformance run where an exclusion is contradicted by the subject's own telemetry.
Applicability
112 controls exist. You will read 34.
Controls carry a machine-evaluable scope predicate, so the framework works out which apply to you rather than making you read all of them and decide.
| System | T1 | T2 | T3 |
|---|---|---|---|
| Internal non-agentic LLM application | 4 | 34 | — |
| Agentic, tool-using, handling personal data | 4 | 49 | 77 |
Tier 1 is four controls, of which exactly one is mandatory. These are not aspirations: automated tests fail the build if the numbers increase.
No control claims to prevent prompt injection
It is unsolved at the model layer, and adaptive attacks defeat published defences at rates above 85–90%. A control demanding prevention could not be satisfied. Controls instead bound what a successful injection reaches, require detection by detectors proven by drill to fire, and require tested containment — because 58–59% of enterprises monitor their agents and only 37–40% can stop one.
Reference implementation
Start
pip install -e .
openaisf scope --context system.yaml --tier T2 what applies to you
openaisf check --context system.yaml --evidence ./ exit 0 = conformant
openaisf publish --context system.yaml --log log.jsonl
openaisf verify --log log.jsonl --system urn:… --key k.pub
openaisf coverage the table above
openaisf export assessment-results OSCAL 1.1.2
openaisf mcp MCP server for agentsRuntime dependencies are pyyaml and jsonschema. That is the whole list, because this runs inside other people's CI. 170 tests. The MCP server lets an agent read the catalog and check its own conformance — but it deliberately cannot submit evidence, sign, or publish. An agent asserting its own compliance is a claim, not evidence.
Structure
Three names, and they must not blur
| Name | Definition | Held by |
|---|---|---|
| OpenAISF | The open standard: catalog, applicability model, evidence interface, lease format, crosswalk | Open. Created by Maarten Loose |
| Certifier | A role the standard defines — independence, signing duties, public disclosure. Aligned to ISO/IEC 42006 | Any party meeting the requirements |
| TruCert | TruSecure's implementation of the Certifier role, and its commercial product | TruSecure |
The creator holds a commercial interest in TruSecure, stated here rather than discovered later. The mitigation is structural: the catalog, crosswalk, schemas, log format and CLI contain no reference to TruSecure other than attribution. A dependency of any specification artefact on TruSecure would be a defect.
Questions
Frequently asked
How is this different from ISO 42001 or SOC 2?
Four differences. Evidence is population-level rather than sampled. Freshness is declared per control so lapse is automatic rather than covered by a bridge letter. A relying party verifies without contacting the subject. And post-market monitoring becomes the conformance evidence itself rather than an obligation with no checkable artefact. Those regimes are substantive; the difference is narrower and more specific than most new frameworks claim.
Is this the first machine-readable AI compliance work?
No. OSCAL, the OSCAL AI compliance evidence proposal, Policy Cards, AIP and DEMM-Bench are prior art and are cited in the specification. The distinguishing property is narrower: a conformance state that expires without intervention.
Does it guarantee no AI agent behaves adversarially?
No framework can. OpenAISF requires that agent authority is bounded, that departure from those bounds is detected by detectors proven by drill to fire, that a departure can be contained by an exercised and timed kill-switch, that damage is recoverable, and that all four are proven on a defined cadence.
What does it cost?
Nothing. A system can reach any tier, including tier 4, self-assessed with no certifier involved. The specification is CC BY 4.0 and the tooling Apache 2.0. TruCert sells an independent counter-signature and the work of running the machinery — it sells nothing that gates access to the standard.
How do I comment on it?
This is a Request for Comments. Open an issue on GitHub. The most useful submissions, in order: an exclusion that should not be excluded; a control that requires an unachievable outcome or is not falsifiable; a factual error in any published figure.