The AI controls
nobody else requires.
OpenAISF covers every requirement of ISO 42001, NIST AI RMF and the EU AI Act, and maps ISO/IEC 23894's risk-management clauses. Then it adds 36 controls none of them have — for the agent, data and assurance risks the incumbent frameworks were written too early to see.
And unlike a certificate, its conformance expires on its own. Watch:
- evidence age
- 0 days
- verdict
- asserts conformance
Nobody revokes this. The evidence stops arriving and the lease runs out.
Adopt it if
- You run agents in production and cannot currently prove you could stop one.
- You are asked for AI assurance by customers and have only a policy document to send.
- You are in EU AI Act scope and want Art. 72 monitoring to produce something checkable.
- You buy AI from other people and have no way to tell whether their assurance is still true.
- You already run ISO 42001, ISO/IEC 23894 or SOC 2 and want the AI-specific controls they do not contain.
The problem
Every AI framework was written before agents shipped.
Three gaps follow from that, and they are the reason organisations pass audits and still get hurt.
They govern models. You run agents.
An agent holds credentials, calls tools and acts. No incumbent framework asks what it is permitted to reach, how you would notice it going outside that, or whether you can actually stop it.
They govern databases. AI makes new data.
Prompt logs, embeddings, semantic caches, fine-tuning corpora. Your data map has none of them, and your deletion process cannot reach them.
They certify a moment. Systems change hourly.
A prompt edit or an upstream model update can invalidate a control within the hour. The certificate stays valid for a year.
The differentiator
36 of 118 controls have no incumbent equivalent.
That figure is computed, not claimed. A control counts as original only when it maps to zero requirements at full strength across ISO 42001, NIST AI RMF, the EU AI Act, the CSA AI Controls Matrix and ISO/IEC 23894. Here is what they buy you.
| The risk | ISO / NIST / AI Act / AICM | OpenAISF requires |
|---|---|---|
| An agent doing work nobody authorised — inside its permissions the whole time | nothing | Detect activity outside the recorded business purpose D15-C07 |
| An agent whose actions stop matching the plan it announced | nothing | Compare declared intent against actions taken D15-C01 |
| A kill switch nobody has ever pulled | nothing | Exercise containment on a cadence, record the time it took D16-C02 |
| Detectors that have never fired, so nobody knows if they can | nothing | Inject a simulated rogue agent, measure time to detect D16-C03 |
| An agent spending without limit until the invoice arrives | nothing | Per-session budget for calls, tokens, spend and egress D07-C02 |
| An agent that spawns another with privileges it never had | nothing | Bounded delegation depth, no escalation on spawn D07-C03 |
| An irreversible action taken autonomously | nothing | Classify every action by reversibility, gate the irreversible D07-C04 |
| Your prompt log — the largest sensitive store you own, on no data map | nothing | Inventory prompts and completions as a data store D03-C11 |
| Deletion that removes the record and leaves the embedding | nothing | Prove deletion by attempted retrieval, semantic queries included D03-C13 |
| A supplier's assurance quietly going stale under you | nothing | Inherited controls degrade when the upstream lease does D17-C02 |
| A policy declared on that never actually ran | nothing | Check declared configuration against observed enforcement D19-C03 |
| Approving everything because you approve everything | nothing | Monitor the oversight acceptance rate; near-total is a finding D10-C03 |
Twelve of thirty-six shown. The full set spans agent authority, detection, incident containment, identity delegation, data governance and the integrity of conformance evidence itself — and each carries the real failure it exists to prevent, with a named incident where one exists.
controls with no incumbent equivalent, out of 118
of the 20 domains contain at least one original control
hand-maintained originality claims. The figure is computed from the crosswalk and a declared value that disagrees is an error
Data governance
AI risk is data risk. Your data map does not know that yet.
Sixteen data controls, seven of them original. Existing data governance was built for records in databases. An AI system creates stores nobody inventories and derives artefacts that silently lose their classification.
| What actually happens | OpenAISF requires |
|---|---|
| The prompt log becomes the largest unstructured store of sensitive data you hold. It was built as telemetry, so it inherited a logging retention policy, sits outside DLP, and is not searched when a subject access request arrives. | Prompts, completions and tool I/O appear in the data inventory with an owner, a classification and a retention period. They must not be treated as application logs. D03-C11 no incumbent equivalent |
| An embedding of a confidential contract is treated as a float array. Classification is applied to the source and lost at the moment of derivation, so the derived store ends up in another region under another retention policy. | Embeddings, indexes, caches and fine-tuning corpora inherit the classification and residency of their most sensitive source. D03-C12 no incumbent equivalent |
| Deletion succeeds against the record and the embedding survives, so the content stays semantically retrievable while every artefact an auditor inspects says it is gone. | Verify deletion by attempting retrieval through the system's own paths, including semantically equivalent queries. A completed deletion job is not evidence. D03-C13 no incumbent equivalent |
| A prompt is a join, executed thousands of times a second, with no schema and no reviewer. Content at three classifications is concatenated and the output inherits the highest while being handled as the lowest. | Combining data classes in one context requires a declared policy, and the output takes the classification of the most sensitive contributor. D03-X01 no incumbent equivalent |
| Support transcripts collected to answer a customer's question become a fine-tuning corpus because they were available. No boundary was crossed, no copy left — and the model cannot be untrained later. | Operational data may not be used for training outside its collection purpose without a recorded decision naming the data and the model. D03-X02 no incumbent equivalent |
| A semantic cache returns one customer's answer to another customer's question, because the two were close in embedding space and the cache key never encoded the boundary. | Verify isolation in shared retrieval and cache layers by attempting cross-boundary retrieval. The attempt must fail. D03-X03 no incumbent equivalent |
The seventh requires your AI data classification to be inherited from the scheme you already run rather than invented alongside it — because two taxonomies diverge within months and then neither is applied.
Control plane · Data plane
A policy that never fired was not operating.
Evidence has two planes. The control plane states what is configured. The data plane reports what happened to live traffic. They have to agree.
$ openaisf check --context system.yaml --evidence ./evidence --tier T3
D07-C01 [fail] declared enabled, but 184203 requests crossed the
enforcement point with 0 decisions recorded. A policy
that never fired under live traffic was not operating.
lease: revoked exit 1No assessor was involved. Two numbers disagreed and the disagreement settled it — and an attestation cannot resolve it. A signed statement from an accountable person does not override telemetry. It cuts both ways: decisions recorded with no traffic to have produced them are fabrication, and fail the same way.
This is classified as a disqualifying failure: it blocks conformance even where the control is only recommended at that tier. Obligation level governs whether a shortfall affects conformance. It does not govern the treatment of a false statement.
Transparency log
Check a supplier without asking their permission.
Statements are signed and published to a hash-chained log. Verification needs the statement, a public key and a clock. No account, no relationship, no registry that could be leaned on.
$ openaisf verify --log vendor.jsonl --system urn:… --key vendor.pub
chain intact
signature valid
expires 2025-08-16T12:14:04Z
checked at 2026-08-07T12:14:05Z
state EXPIRED
This badge no longer asserts conformance. Nobody revoked it;
the lease simply ran out. exit 1Modifying a past log entry breaks every hash after it. The operator cannot forge history or make an expired statement look current.
And decay propagates. A control you inherit from an upstream model provider resolves against their lease. When theirs goes stale, yours degrades within one freshness window. That is what makes conformance affordable — you import what your provider already proved instead of re-proving it — and it means a provider who lets their badge lapse hears about it from every customer that week.
Crosswalk
Everything they require. Then the part they don't.
Each regime is inventoried to its atomic requirements, and every one must be covered by named controls or excluded with a written reason. No third state. An unresolved requirement fails the build.
| Regime | Reqs | Covered / excluded | Gap |
|---|---|---|---|
| CSA AI Controls Matrix v1.1.1 | 247 | 0 | |
| MITRE ATLAS 2026.07 | 178 | 0 | |
| EU AI Act 2024/1689 | 84 | 0 | |
| NIST AI RMF 1.0 | 72 | 0 | |
| ISO/IEC 42001:2023 Annex A | 38 | 0 | |
| ISO/IEC 23894:2023 | 13 | 0 | |
| MCP-38 threat taxonomy | 38 | 0 | |
| OWASP LLM Top 10 · 2025 | 10 | 0 | |
| OWASP LLM Top 10 · 2026 | 10 | 0 | |
| Total | 690 | 557 covered · 133 excluded | 0 |
covered by named controls excluded, with a written reason
Mapping outward from your own controls shows what you found and never what you missed. This inverts it — which is also how the 36 original controls are identified: they are the ones that map to nothing. ISO/IEC 23894 is inventoried as what it is — guidance: all 13 risk-management clauses are covered, each mapping deliberately at partial strength.
The 133 exclusions are the part to argue with. Ninety-one CSA entries are general cloud security inherited from the Cloud Controls Matrix; forty-two ATLAS entries are adversary reconnaissance performed outside your systems. Nothing was excluded to produce a complete report, and a control fails your run if an exclusion is contradicted by your own telemetry.
Applicability
118 controls exist. You will read 35.
Controls carry a machine-evaluable scope predicate, so the framework works out which apply to you rather than making you read all of them and decide.
| System | T1 | T2 | T3 |
|---|---|---|---|
| Internal non-agentic LLM application | 3 | 35 | 54 |
| Agentic, tool-using, handling personal data | 4 | 51 | 82 |
Tier 1 is three controls for the typical system — one of them mandatory — and four for the agentic one. The test suite pins these numbers: the build fails if any of them rises — the no-bureaucracy promise is enforced, not asserted.
No control claims to prevent prompt injection
It is unsolved at the model layer, and adaptive attacks defeat published defences at rates above 85–90%. A control demanding prevention could not be satisfied. Controls bound what a successful injection reaches, require detection by detectors proven by drill to fire, and require tested containment — because 58–59% of enterprises monitor their agents and only 37–40% can stop one.
Reference implementation
Free, open, and installable in a minute.
Specification CC BY 4.0. Tooling Apache 2.0. Any tier reachable self-assessed, with no certifier and no fee.
pip install -e .
openaisf scope --context system.yaml --tier T2 what applies to you
openaisf check --context system.yaml --evidence ./ exit 0 = conformant
openaisf publish --context system.yaml --log log.jsonl
openaisf verify --log log.jsonl --system urn:… --key k.pub
openaisf coverage the table above
openaisf export assessment-results OSCAL 1.1.2
openaisf mcp MCP server for agentsRuntime dependencies are pyyaml and jsonschema — the whole list, because this runs in your CI. 181 tests, and both release gates run on every push and pull request. The MCP server lets an agent read the catalog and check its own conformance, but it deliberately cannot submit evidence, sign or publish. An agent asserting its own compliance is a claim, not evidence.
This page is the case for adopting it. The repository README is the reasoning behind each decision and a walkthrough of using it — including the design choices most likely to be argued with.
Questions
Frequently asked
Is this just a mapping of existing frameworks?
No. 36 of 118 controls map to zero requirements at full strength in ISO 42001, NIST AI RMF, the EU AI Act, the CSA AI Controls Matrix or ISO/IEC 23894. The figure is computed from the crosswalk rather than asserted, and a hand-written originality claim that disagrees with the computation is treated as an error.
How is this different from ISO 42001 or SOC 2?
Two ways. It covers risks they do not — see the table above. And its conformance expires: evidence is population-level rather than sampled, freshness is declared per control so lapse is automatic rather than covered by a bridge letter, and a relying party verifies without contacting the subject. Those regimes are substantive; the difference is specific rather than rhetorical.
Is this the first machine-readable AI compliance work?
No. OSCAL, the OSCAL AI compliance evidence proposal, Policy Cards, AIP and DEMM-Bench are prior art and are cited in the specification. OpenAISF exports OSCAL rather than competing with it. The distinguishing properties are the original control set and a conformance state that expires without intervention.
Does it guarantee no AI agent behaves adversarially?
No framework can. OpenAISF requires that agent authority is bounded, that departure from those bounds is detected by detectors proven by drill to fire, that a departure can be contained by an exercised and timed kill-switch, that damage is recoverable, and that all four are proven on a cadence.
What does it cost?
Nothing. Any tier, including tier 4, is reachable self-assessed with no certifier involved. Specification CC BY 4.0, tooling Apache 2.0. TruCert sells an independent counter-signature and the work of running the machinery — it sells nothing that gates access to the standard.
How do I comment on it?
This is a Request for Comments. Open an issue on GitHub. Most useful, in order: an exclusion that should not be excluded; a control that requires an unachievable outcome or is not falsifiable; a factual error in any published figure.