An open IR for AI Systems Programs.
Compile a signed, regulator-ready AIS Program from telemetry. Not a checklist. Not a chatbot. Deterministic template renderer. Bounded LLM. Verifiable artifacts.
What it is
Three properties. One IR.
Deterministic generator
Same IR + same template hash + same regulation_version_hash produces byte-reproducible output. The control plane is the template, not the model.
Telemetry-grounded
Every field carries an evidence type — doc_hash, telemetry_ref, signed_attestation, auto_derived. Stale telemetry refuses to publish. The document tracks reality.
Signed artifacts
Every published document carries content_hash, regulation_version_hash, ir_hash, template_hash, signing_key_id, timestamp. Verification is single-step.
Regulatory Surface
What the IR compiles against.
Every regulation is compiled into a versioned rule-IR with a regulation_version_hash. When the rule set changes, the gap report regenerates.
NAIC Model Bulletin on Use of AI by Insurers
AIS Program — governance, risk mgmt, lifecycle, third-party, documentation
NAIC AI Systems Evaluation Tool
Exhibits A (inventory) · B (governance risk) · C (high-risk systems) · D (data details)
Colorado Amended Reg 10-1-1
Life · auto · health · ECDIS · four-fifths · proxy · intersectional · counterfactual
NY DFS Circular Letter No. 7
Adverse-effect / business-necessity / less-discriminatory-alternative · 15-day notice
California Bulletin 2022-5
Proxy discrimination · actuarial nexus · adverse-decision explanation
IR Overview
Eight sections. One signed document.
governance
11 fieldsBoard oversight, AI committee, accountable officer, policies. RACI per system.
inventory
10 fieldsEvery AI system in use. Risk tier, deployment status, model card, last-validated, decisions/month.
lifecycle
18 fieldsDesign → development → validation → deployment → monitoring → retirement. Per system.
data
7 fieldsSources, lineage, ECDIS flag, third-party flag, retention, consent basis.
fairness_testing
12 fieldsProtected classes. Four-fifths, proxy, intersectional, counterfactual. Signed bias reports.
vendor_management
8 fieldsThird-party AI providers, contractual controls, SOC2/ISO27001 evidence, audit rights.
incident_log
9 fieldsAI-incident definitions, reporting protocol, severity, adverse-outcome flag, remediation.
consumer_disclosures
6 fieldsPer-jurisdiction notice templates, delivery channels, adverse-decision SLA, opt-out.
Generator Outputs
One IR. Six signed artifacts.
The IR feeds a deterministic template renderer. Each output carries the signing envelope. Bounded LLM polishes designated narrative slots through a diff-review gate — never the control plane.
AIS Program — PDF + HTML
Signed; content-hashed; carries regulation_version_hash
NAIC Evaluation Tool — Exhibits A/B/C/D
Canonical pack; <72hr response to state inquiry
Colorado annual compliance report
Reg 10-1-1; quantitative bias-test artifacts attached
NY DFS adverse-effects pack
Three-step assessment + less-discriminatory-alt search log
Per-state addendum packs
State-specific deltas keyed to regulation_version_hash
Gap report
Missing-telemetry diagnostic + stale-evidence list + threshold exceedances
v0.1 — draft.
Spec text is CC-BY-4.0. Reference code is Apache-2.0. The IR will reach v1.0 once a pilot carrier files the Colorado Reg 10-1-1 annual report and a NAIC AI Evaluation Tool exhibit pack generated from it.