Skip to main content
Jira progress: loading…

AIIL-PKG

Disclosure Packaging & Exchange Protocols

1. The AI Compliance Boundary​

1.1. Overview — The AI Compliance Boundary​

This chapter defines how ZAYAZ converts AI-generated, citation-anchored answers into formal disclosure artifacts that are regulator-ready, verifier-traceable, and immutable.

Why this matters for AI governance:

  • AI Output → Regulator Input: AI answers cannot remain in free text. They must be serialized into schemas aligned with ESRS, IPCC factors, and XBRL taxonomies.
  • Trustability: Each package carries provenance (citations, dataset hashes, method IDs) so verifiers and regulators can independently re-check AI-derived disclosures.
  • Consistency: Packaging ensures all outputs follow the same structure and tone, no matter which AI model or RAG path generated them.
  • Enforcement: By pushing AI through strict JSON schemas and export rules, ZAYAZ guarantees that disclosure outputs remain compliant, reproducible, and auditable.

1.2. Disclosure Artifacts​

ZAYAZ produces two primary artifact types:

Artifact TypePurposeAI Relevance
Internal JSONMachine-readable format for AI ↔ API handoff, validated against schemas.Ensures AI output conforms to expected fields, not free text.
External XBRLRegulator-facing format aligned with ESRS datapoint taxonomy.Guarantees disclosures can be submitted without manual rework.
Verifier PackageImmutable bundle: JSON disclosure, evidence hashes, provenance, logs.Locks AI outputs into a tamper-proof audit trail for assurance partners.

1.3. JSON Schema (Internal API)​

AI responses are first serialized into ZAYAZ JSON payloads. Example schema:

payload-example.json
{
  "disclosure_id": "E1_GHG_Intensity_2025",
  "framework": "ESRS",
  "datapoint_ref": "E1-6-1",
  "method_id": "GHG.intensity",
  "version": "1.0.0",
  "inputs": {
    "scope1": 100,
    "scope2": 200,
    "revenue": 50
  },
  "output": {
    "value": 6,
    "unit": "tCO2e/€m"
  },
  "provenance": {
    "citations": ["ESRS E1:L12-L18"],
    "datasets": ["IPCC-EFDB:v2023.1"],
    "model_trace": "zayaz-ai-run-20250915-xyz"
  }
}

AI governance link:

  • Schema-enforced → AI cannot hallucinate extra fields.
  • Provenance required → ensures outputs are evidence-backed.

1.4. XBRL Export (Regulator-Facing)​

From JSON, ZAYAZ transforms disclosures into XBRL instance documents aligned with ESRS taxonomy.

Example fragment:

example-fragment.xml
<esrs:E1-6-1 contextRef="FY2025" unitRef="tCO2ePerEURm" decimals="2">
  6.00
</esrs:E1-6-1>
  • contextRef = period + entity.
  • unitRef = derived from schema.
  • decimals = from JSON output precision.

AI governance link:

  • Prevents free-text answers from leaking to regulators.
  • Ensures AI is constrained to standards-defined datapoints.

1.5. Verifier Exchange Package​

Verifiers need tamper-proof bundles that capture not only the disclosure, but the AI path that led to it.

A package includes:

ComponentDescription
JSON DisclosureNormalized output as in §27.3.
Evidence HashesSHA-256 of datasets, citations, NACE mappings.
Compute LogMethod ID, version, input/output hashes, latency.
AI TraceModel ID, retrieval context, refusal gates triggered.
SignatureZAYAZ digital signature (tenant + timestamp).

AI governance link:

  • Locks AI provenance into an immutable chain verifiers can trust.

1.6. Exchange Flows​

ZAYAZ supports three flows:

  • AI → JSON

    • RAG + Behavioral Layer produces structured JSON output.
    • Enforced against schema (rejects invalid AI).

  • JSON → XBRL

    • Schema-driven transformation into regulator-accepted filings.

  • JSON → Verifier Package

    • Bundle with provenance, signed for assurance partners.

Sequence Diagram (simplified):

AI → JSON Schema → [Validator] → Internal API
                        ↓
               [XBRL Transformer] → Regulator
                        ↓
              [Verifier Packager] → Assurance

1.7. Enforcement & Controls​

Controls that keep AI packaging safe:

ControlEnforcement Point
Schema validationEvery AI output must pass JSON schema.
Provenance requiredMissing citations/dataset = hard refusal.
Dataset hashesMust match registered dataset versions.
Digital signaturesAll exchange packages signed.
ACL enforcementExports restricted by jurisdiction.

1.8. Example Flow: Scope 3 Emissions per Revenue​

Worked example:

AI Query:

“How do our Scope 3 Category 1 emissions compare to revenue?”

AI Output (JSON):

query-output.json
{
  "disclosure_id": "E1_Scope3_Intensity_2025",
  "framework": "ESRS",
  "datapoint_ref": "E1-9-2",
  "method_id": "GHG.intensity",
  "version": "1.0.0",
  "inputs": {
    "scope3_cat1": 500,
    "revenue": 100
  },
  "output": {
    "value": 5,
    "unit": "tCO2e/€m"
  },
  "provenance": {
    "citations": ["IPCC EFDB:L45-L52"],
    "datasets": ["IPCC-EFDB:v2023.1"],
    "model_trace": "zayaz-ai-run-20250915-abcd"
  }
}

XBRL Export:

emission-per-rev-op.xml
<esrs:E1-9-2 contextRef="FY2025" unitRef="tCO2ePerEURm" decimals="2">
  5.00
</esrs:E1-9-2>

Verifier Package

- disclosure.json
- evidence_hashes.json
- compute_log.json
- ai_trace.json
- signature.asc

AI governance link:

  • Ensures that forward-looking or speculative AI answers cannot bypass schema gates.
  • Keeps regulators, verifiers, and customers aligned with standardized, reproducible disclosures.

1.8. Closing Notes — Linking Packaging to AI Governance​

Disclosure Packaging & Exchange Protocols form the final compliance boundary in the ZAYAZ AI lifecycle. They ensure that every AI-derived output:

  • Passes from unstructured → structured → regulator-grade formats (free text → JSON schema → XBRL/verifier bundle).
  • Remains reproducible and auditable through deterministic method/version references, dataset hashes, and digital signatures.
  • Aligns with governance controls introduced in earlier chapters:
    • AI Lifecycle & Governance (Ch. T–W): Packaging enforces the Go/No-Go gates by rejecting invalid or non-compliant AI responses.
    • Standards Packs & Jurisdiction Routing (Ch. K): Packaging ensures outputs respect jurisdiction-specific allowlists and export controls.
    • Observability & SLOs (Ch. 14): Packaging provides the logs and provenance IDs required for SLO verification.

Key takeaway:

Packaging is not just a serialization step — it is the compliance seal that turns AI behavior into regulator-ready evidence. Without it, AI could drift into non-standard, unverifiable outputs. With it, ZAYAZ guarantees that every AI interaction produces disclosure artifacts that are standardized, validated, and assurance-ready.



GitHub RepoRequest for Change (RFC)