One declaration of criteria instead of an answer per provision
Audits, procurement, and regulatory questionnaires all ask by what criteria an organization's AI is set up to judge. A hierarchy declaration states those criteria once, and each regulatory answer is derived from public provision mappings that AIO maintains as free, non-profit infrastructure.
Three conditions under which per-provision answers are the right choice
Answering question X with answer X is traceable, easy to review, and needs no new vocabulary. If all three of the following hold, hardcoding is the right call and the approach on this page is not needed.
- 1. The organization answers to exactly one regulation or questionnaire.
- 2. Neither that regulation nor the organization's model is going to change.
- 3. AI is managed as paperwork, and its actual behavior is never checked against the filing.
The problem: for any organization actually operating AI, these three conditions almost never hold together.
The three failure points of hardcoding
1. Frameworks × amendments
After the EU AI Act come national implementations, then sector guidelines and customer questionnaires. Hardcoded answers are rewritten each time. The organization maintains one declaration, and AIO maintains the per-regulation translations (standards packs) through public RFC. The N × M cost moves from every organization separately to the commons, once.
2. The document–behavior gap
A hardcoded answer set is a claim: it cannot be loaded into the model or measured against it. The worst audit outcome is not a missing answer but a filed answer the system contradicts. At that point the whole filing turns false. A declaration is one artifact that is injected as configuration, fills the documents, and is verified by measurement.
3. Silence at conflicts
Incidents and regulatory scrutiny concentrate at value conflicts (transparency vs. privacy, safety warning vs. alarm), precisely what no questionnaire enumerates. Hardcoding is silent at conflicts it did not anticipate; a hierarchy is, by definition, the rule for what prevails. And the familiar legal risk of contradictory filings written by different teams disappears structurally when every answer derives from one declaration.
In short, per-provision answers are a cheat sheet and a declared hierarchy is competence. A cheat sheet dies with the next exam, while competence generates answers for exams that do not exist yet. AIO maintains the per-exam translation tables for free.
Documentation requirements the declaration fills (v0.1)
| Requirement (summarized) | What it asks for | What the declaration supplies |
|---|---|---|
| EU AI Act, Annex IV §2(b): technical documentation | The general logic, key design choices with rationale, and what the system is designed to optimise for | The declared hierarchy is the reviewable statement of what the system is set up to optimise for |
| EU AI Act, Art. 9: risk management | Identification and mitigation of risks, including foreseeable misuse | Red lines define the excluded region; the direction defines judgment under residual trade-offs |
| EU AI Act, Art. 13: transparency to deployers | Information enabling deployers to understand and use the system appropriately | The declaration is the deployer-readable statement of judgment priorities |
| EU AI Act, Art. 14: human oversight | Measures enabling humans to understand limits and intervene | Red lines mark the intervention boundary: where the system does not decide alone |
| EU AI Act, Art. 53 / Annex XI: GPAI documentation | Model policy and intended-behavior description | The declaration, plus (where measured) a signed Tier 0 score report as behavioral evidence |
| NIST AI RMF: Govern, Map | Articulated organizational values and context of use | The declaration is the articulated-values artifact |
| ISO/IEC 42001: AI policy | An AI policy governing the management system | The declaration serves as the policy's operative annex |
Requirement texts are summaries, not legal advice. Official provision-level mappings live in the standards packs, pass public RFC review, and are marked draft until they do. One point runs through the table: regulations ask for criteria, not case answers, and a hierarchy is the minimal complete format for criteria.
Begin where the need is, and add the rest when it is called for
- Adoption starts from the questionnaire, audit, or guideline mandate at hand. The 30-minute setting workshop turns direction and red lines into a declaration. No AI expertise is required, and it is free.
- Answers for the frameworks the organization is exposed to are derived via the pack mappings. Every derived answer carries provenance to a declaration clause and a pack provision.
- Sooner or later the question comes: how do we know the system behaves as declared? That is when measurement (Tier 0) and logging enter. The stack is not a bundle to accept but a ladder climbed one question at a time.
- The packs each sector needs are co-authored in the public RFC. A standard lasts when its users become its co-authors.