# OpenAISF > An open conformance framework for AI safety and security in which conformance is a state with a heartbeat rather than an event that produced a document. An AI system is OpenAISF-conformant at tier T for as long as it keeps producing signed evidence satisfying tier T's applicable controls. Created by Maarten Loose. Specification CC BY 4.0, reference tooling Apache 2.0. Status: Request for Comments, published 7 August 2026. Version 1.0.0a1. Source: https://github.com/OpenAISF-org/openaisf ## What it is, in one paragraph OpenAISF defines 112 controls across 20 domains, an applicability model that computes which of them apply to a given system, a two-plane evidence format, and a conformance lease that expires without any party deciding it should. It covers large language models, autonomous agents, and classical machine learning including credit scoring, medical imaging, computer vision and biometrics. ## The distinguishing property A conformance statement carries its own `stale_after` and `expires_at`. Badge state is computed against the reader's clock at the moment they look, so a system that stops producing evidence goes stale and then expires with nobody notified and nobody able to prevent it. No lease outlives its tier ceiling: 365 days at tier 1 down to 30 days at tier 4. ## How it differs from ISO/IEC 42001 and SOC 2 (four specific points) 1. Sampling — evidence is population-level, every request crossing the enforcement point, rather than an assessor's sample of a period. 2. Latency — freshness is declared per control and lapse is automatic, rather than the gap being covered by a bridge letter, which is an unaudited management assertion. 3. Verifier — a relying party verifies the transparency log without contacting the subject and without a central registry. 4. Post-market monitoring — EU AI Act Art. 72 requires it but produces no third-party-checkable artefact; here the monitoring is the evidence. These regimes are substantive. The difference is narrower and more specific than most new frameworks claim. ## How a false claim is caught Evidence has two planes. The control plane states what is configured; the data plane reports what happened to live traffic. Where a policy is declared enabled and the enforcement point recorded zero decisions across live traffic, the control fails. That contradiction is not resolvable by attestation and is classified as a disqualifying failure, which blocks conformance even where the control is only recommended at that tier, and revokes the lease rather than degrading it. ## Crosswalk coverage (677 atomic requirements, zero gaps) | Regime | Requirements | Covered | Excluded | |---|---|---|---| | CSA AI Controls Matrix v1.1.1 | 247 | 156 | 91 | | MITRE ATLAS 2026.07 | 178 | 136 | 42 | | EU AI Act 2024/1689 | 84 | 84 | 0 | | NIST AI RMF 1.0 | 72 | 72 | 0 | | ISO/IEC 42001:2023 Annex A | 38 | 38 | 0 | | MCP-38 threat taxonomy | 38 | 38 | 0 | | OWASP Top 10 for LLM Applications 2025 | 10 | 10 | 0 | | OWASP Top 10 for LLM Applications 2026 | 10 | 10 | 0 | | Total | 677 | 544 | 133 | Every requirement is covered by named controls or excluded with a written reason. There is no third state and an unresolved requirement fails the build. The 133 exclusions are 91 CSA entries that restate a general cloud security baseline inherited from the Cloud Controls Matrix, and 42 MITRE ATLAS techniques describing adversary reconnaissance performed outside the defender's systems. ## Scope in practice Applicability is computed, not read. A typical internal non-agentic LLM application resolves to 34 controls at tier 2. Tier 1 resolves to four controls of which one is mandatory. An agentic, tool-using system handling personal data resolves to 49 at tier 2 and 77 at tier 3. Automated tests fail the build if these figures increase. ## Position on prompt injection No OpenAISF control requires preventing prompt injection. It is unsolved at the model layer and adaptive attacks defeat published defences at rates above 85 to 90 percent. Controls bound what a successful injection can reach, require detection by detectors proven by drill to fire, and require tested containment. ## Agentic controls Domains D07, D15 and D16 form a five-stage chain: bound the authority an agent holds, detect departure from those bounds, contain, recover, and prove the first four work. Proving is by injected drill on a declared cadence, recording mean time to detect and mean time to contain as measured values. This addresses a measured gap: approximately 58 to 59 percent of enterprises monitor their AI agents and only 37 to 40 percent report containment capability. Detection methods with no classical equivalent, because an agent declares intent before acting: intent-action divergence, business-purpose divergence, manifest violation at the attempt, swarm and velocity signatures, egress anomaly covering reputable public services, canaries and honeytokens, provenance break, and replay sufficiency. ## Commands - `openaisf scope --context --tier T2` — resolve applicability - `openaisf check --context --evidence --tier T2` — exit 0 = conformant - `openaisf publish --context --evidence --log ` — sign and append - `openaisf verify --log --system --key ` — verify any badge - `openaisf coverage` — crosswalk coverage, exit 1 on any gap - `openaisf export assessment-results` — OSCAL 1.1.2 - `openaisf mcp` — MCP server (reads and checks; cannot assert) Runtime dependencies: pyyaml and jsonschema. 170 tests. ## Three names - **OpenAISF** — the open standard. Created by Maarten Loose. - **Certifier** — a role the standard defines, aligned to ISO/IEC 42006. Any party meeting the requirements may fill it. - **TruCert** — TruSecure's implementation of the Certifier role, and its commercial product. A system can reach any tier, including tier 4, self-assessed with no certifier involved and no fee. ## Declared interest The creator holds a commercial interest in TruSecure. The mitigation is structural: the catalog, crosswalk, schemas, log format and CLI contain no reference to TruSecure other than attribution. ## Prior art (cited, not competed with) OSCAL; the OSCAL AI compliance evidence proposal; Policy Cards; AIP (Agent Identity Protocol); DEMM-Bench; MCP-38. OpenAISF exports OSCAL 1.1.2. ## Key documents - Specification: https://github.com/OpenAISF-org/openaisf/blob/main/rfc/RFC-OpenAISF-v1.0.md - Control catalog: https://github.com/OpenAISF-org/openaisf/tree/main/spec/catalog - Intellectual property position: https://github.com/OpenAISF-org/openaisf/blob/main/ATTRIBUTIONS.md - Governance: https://github.com/OpenAISF-org/openaisf/blob/main/GOVERNANCE.md - Changelog: https://github.com/OpenAISF-org/openaisf/blob/main/CHANGELOG.md ## Attribution requirement Derivative works must carry: "Based on OpenAISF, created by Maarten Loose."