# AIO — AI Integrity Organization

> An international standards body, established as a Swiss association in Geneva (UID CHE-469.997.903),
> that builds the measurement infrastructure for AI integrity: open standards, verification, and open
> governance. AIO defines a machine-readable vocabulary for *why* an AI system decided what it did —
> the value (V), evidence (E), and source (S) hierarchies behind a judgment — and publishes the
> benchmarks, papers, and regulatory crosswalks built on top of it.

Site: https://aioq.org · Contact: info@aioq.org · License: CC BY 4.0 (unless noted per file)
Languages: en, ko, ar, zh, de, fr, ru, es, ja — every page is available at https://aioq.org/{locale}/{path}

## What AIO defines

AI integrity is framed along three axes:

1. **The compromise problem** — the deliberate or structural compromise of training data and judgment
   criteria in pursuit of particular outcomes. The stage where an AI response is produced. AIO works
   here first.
2. **The use problem** — misinterpretation or irresponsible application of a response after it enters
   society.
3. **The error problem** — the system failing to work as intended (algorithmic, model, infrastructural
   defects).

The AIO Framework encodes a judgment as one line, e.g.
`C:MED/IXi | V:Bec<Sda | E:Exp<Gui | S:Usr<Pro` — context, then value / evidence / source hierarchies,
where `<` reads "outranked by". No user content is carried.

## Key pages

- [AIO Framework — the standard catalog](https://aioq.org/en/aio-framework): the V/E/S/C code system and the standards built on it (20001 setting, 20002 recording, 20003 benchmark, 20004 applying).
- [Benchmark dashboard](https://aioq.org/en/tools/bench): judgment distributions across 9 frontier models, ~380,000 valid responses.
- [EU AI Act crosswalk](https://aioq.org/en/tools/eu-ai-act): what AIO 20002 produces, mapped to the provisions it supports (Art. 12, 13, 14, 15, 9/72). Positioned as supporting evidence, not a legal conformity assessment.
- [Research library](https://aioq.org/en/research): nine papers, all downloadable as PDF.
- [Tier 0 measurement](https://aioq.org/en/certification): how model operators and agents register and are measured, the Tier 0 dual-gate scoring methodology, and the legal guardrails. Tier 0 applies no pass threshold: every completed attempt yields a signed score report, not a certificate.
- [Score registry](https://aioq.org/en/certifications): every Tier 0 score report AIO has issued — model, version, operator, pack, both gate scores — plus the legacy certificates from the earlier threshold period, preserved and marked as such; each verifiable through the signature API.
- [Shared project — conditional value priorities](https://aioq.org/en/projects/conditional-priorities): three observed cases (one stored model response each, with the English original and a related Korean court decision set side by side) and three first contribution tasks. Early stage, preparing to recruit; no partners, experts, or sponsors secured yet.
- [Developers & agents](https://aioq.org/en/developers): the public API, the OpenAPI 3.1 description, and the remote MCP server — with client configuration and registration examples.
- [AIO Commons](https://aioq.org/en/commons): the open foundational assets — judgment vocabulary, formula registry, legal reference data, and AI measurement packages, with a machine-readable catalog.
- [Statutes](https://aioq.org/en/statutes) · [Ethics Charter](https://aioq.org/en/ethics-charter) · [Public RFC process](https://aioq.org/en/rfc): the process, and the RFC rounds currently open for comment.
- [License & trademark policy](https://aioq.org/en/license)

## Papers (PDF, CC BY 4.0)

- [AI Integrity: A Foundational Concept](https://aioq.org/papers/paper-a-ai-integrity-concept.pdf)
- [Empirical Validation of the AIO Framework](https://aioq.org/papers/paper-b-empirical.pdf)
- [AIO 20013 Risk Signal: A Standard Reporting Card for AI Systems](https://aioq.org/papers/paper-c-risk-signal-card.pdf)
- [AIO Framework and AI Legislation: A Compliance-Ready Logging Standard](https://aioq.org/papers/paper-e-legislation.pdf)
- [Democracy and AI: AIO Framework as a Public Vocabulary for Algorithmic Accountability](https://aioq.org/papers/paper-f-democracy.pdf)
- [The AIO 20002 — Reasoning Record Standard specification](https://aioq.org/papers/paper-g-aio-20002.pdf)
- [AIO Framework-Bench: Measuring Value, Evidence, and Source Hierarchies in Frontier AI Systems](https://aioq.org/papers/paper-h-aio-20003.pdf)
- [Decision-Audit Substrate for Safe Embodied AI](https://aioq.org/papers/paper-i-aio-20002-ijcai.pdf)
- [A Common Language for AI: A Three-Tier Measurement Vocabulary](https://aioq.org/papers/paper-j-aio-00011.pdf)
- [Sample risk signal card](https://aioq.org/papers/sample-risk-signal-card.pdf)

## Benchmark data (JSON, CC BY 4.0)

Index of all measured models: https://aioq.org/data/aio-benchmark/index.json

Series note: this is the legacy `aio-benchmark` series. It uses the AIO 20003 measurement labels (Schwartz
basic-10 / E1–E10 / S1–S10), not the AIO 00011 19-value codes of AIO Commons, and it has no
`{dataset_id}@{version}` citation form. API and MCP responses carry a `series` block saying so; keep its figures
apart from AIO Commons figures.

Per model (`{slug}` = one of `claude-haiku-4-5-20251001`, `deepseek-v3.2`, `gemini-3-flash-lite`,
`gemma-4-31b-it`, `gpt-5-nano`, `grok-4.1-fast`, `mimo-v2-flash`, `qwen3.5-35b-a3b`, `trinity-large`):

- `https://aioq.org/data/aio-benchmark/{slug}/report.json` — full 9-section report
- `https://aioq.org/data/aio-benchmark/{slug}/rankings/L4.json` — value hierarchy (Schwartz 10)
- `https://aioq.org/data/aio-benchmark/{slug}/rankings/L3.json` — evidence hierarchy (E1–E10)
- `https://aioq.org/data/aio-benchmark/{slug}/rankings/L2.json` — source hierarchy (S1–S10)
- `https://aioq.org/data/aio-benchmark/{slug}/pcs-trr-L{2,3,4}.json` — reliability (PCS / TRR)

Every entry in `index.json` carries an optional `track`. Entries without it, and all nine slugs above, are
`curated` — measured by AIO. Entries marked `agent-submitted` were self-run by the operator on the public
item set and published after review; they are displayed for transparency, are not certification or
endorsement, and must not be compared with curated results.

## AIO Commons (open foundational assets, JSON, CC BY 4.0)

Catalog of every published dataset: https://aioq.org/data/commons/index.json (schema `commons-index-1.0`).
Each dataset carries `id`, `kind`, `version`, `status`, `license`, `path`, `counts`, and a `files[]` list with
`bytes` and `sha256` per file. Download URLs are `https://aioq.org/data/commons/{path}{file}`.
Cite one record as `{dataset_id}@{version} / {record_id}` — for example `kr-lnpd@0.9 / KR-MED-R-007`.
Record IDs are the join keys of the source data (`custom_id`, `ledger_id`, `rule_id`) and are never reissued.

- `aio-vocabulary@1.0` (language, stable) — `vocabulary/v1.0/`: 19 values, 10 evidence types, 10 source types,
  22 domains, and the 96-cell context grid (scale × reversibility × time) with the `custom_id` form.
  https://aioq.org/en/commons/language
- `aio-formulas@1.1` (methods, stable) — `methods/v1.1/`: the single registry of the 22 formulas, thresholds,
  and decision rules the analysis code reads. Verdicts are decided on unrounded values.
  https://aioq.org/en/commons/methods
- `kr-lnpd@0.9` (reference, **preview**) — `reference/kr-lnpd/v0.9/`: normative priority relations read out of
  Korean statutes and precedents: 579 domain rules and 361 domain universal edges. It does **not** represent the
  values of the Korean public. No expert review yet; `status.json` carries the limitations statement and
  verification counts. Headline figures exclude the `BASE` layer — the hierarchy a legal system states in common
  across every domain (43 rules, 41 universal edges); with BASE included the totals are 622 and 402. BASE stays
  in the data (`base_layer` in `status.json`, `layer` per row in `coverage.per_domain`) but is left out of
  measurement and alignment comparison.
  https://aioq.org/en/commons/reference
- `measurement-solar-pro-4-2026-09-02@1.0` (measurement, **experimental**) — `measurement/solar-pro-4/2026-09-02/`:
  one model measured end to end, raw responses included. The response file carries only record IDs and choices,
  so it contains no scenario text. A single model at a single time; not a cross-model ranking.
  https://aioq.org/en/commons/measurement
- `aio-scenarios@0.1` (scenario, **preview**) — `scenarios/v0.1/`: the catalog of every measurement item, plus the
  calibration set in full text. `catalog_vbank.jsonl` lists 142,918 hierarchy-bank `custom_id`s with their parsed
  parameters and no item text; `catalog_stress.jsonl` lists 1,716 frozen collision-type items as metadata only.
  The calibration set is 299 anchors (`calibration_anchors.jsonl`) plus a 20% stratified sample of 343
  collision-type items (`calibration_stress.jsonl`, strata wave × pack × pressure, seed 20260922) — 642 items
  carrying the situation, the options, and the scoring criteria. `policy.json` holds the release rule, the
  sampling design, and the four `review_status` values.
  https://aioq.org/en/commons/scenarios
- Model Response Observation Map — https://aioq.org/en/lab/value-map: an interactive grid (21 domains × 45 scale/reversibility/time cells) of 4 models' responses beside 7 jurisdiction references, from `valuemap@0.1` (dataset `aio-valuemap`, preview, `valuemap/v0.1/`); a cell's colour defaults to the ratio of value pairs the model chose opposite to the reference direction to the pairs that carry a reference (switchable to counts), compared automatically by design code — not a score or a comparative verdict; one item per value pair per cell, no repeats; non-KR references are drafts.

Measurement-set item texts are not published — only the calibration set is released; the measurement set is
rotated and kept closed to prevent contamination of training data. The only exceptions are three measurement-set
items approved on 2026-09-30 as observed cases, released with their original text and stored response and flagged
as published items from then on: https://aioq.org/content/cases/disclosure_exceptions.json The rules, ID forms, and metadata fields are
public: https://aioq.org/en/commons/scenarios · Organizations building on the Commons, and the criteria for being
listed: https://aioq.org/en/commons/implementers · Schemas and file formats: https://aioq.org/en/commons/schemas

### Expert review of the reference data

`kr-lnpd@0.9` rules carry a review status, aggregated at https://aioq.org/en/commons/reference and summarized on
the catalog hub. A rule with no verdict is `operator_approved` — that is a state, not an endorsement, and it does
not mean anyone outside AIO has checked it. Two or more different reviewers agreeing makes a rule
`expert_reviewed`; one disagreement makes it `contested`, and contested rules are counted openly but left out of
the headline figures. Individual verdicts are published only after a review round closes; until then only the
aggregate counts are public. The published aggregate is `https://aioq.org/data/commons/review/summary.json`
(schema `commons-review-1.0`: `totals`, `by_domain`, `by_rule`).

- https://aioq.org/en/review — the reviewer workspace. **Sign-in required**, and an assignment must have been
  issued; without either, the page shows only the public explanation and the aggregate counts. There is no API
  or MCP tool for submitting a review, and agents must not attempt to sign in or submit one.

## Standards packs (machine-readable norm formalization)

- Pack JSON Schema: https://aioq.org/content/standards-packs/schema.json
- EU AI Act pack (v0.2, draft-verified — every mapping carries a verbatim EUR-Lex excerpt): https://aioq.org/content/standards-packs/eu-ai-act-v0.2.json
- EU AI Act pack v0.1 (deprecated, superseded by v0.2): https://aioq.org/content/standards-packs/eu-ai-act-v0.1.json
- EU AI Act public item bank — Tier 0 Gate A (draft, 12 items, expected hierarchies included): https://aioq.org/content/standards-packs/item-banks/eu-ai-act.public.json
- EU AI Act Gate B commitment — sha256 of every item in the private, rotating Tier 0 pool, signed with the certificate key: https://aioq.org/content/bench-items/eu-ai-act.gateb-commitment.json
- EU AI Act Gate B retired items — variants that have left the pool, published in full: https://aioq.org/content/bench-items/eu-ai-act.gateb-retired.json
- Agent-track benchmark item bank (v0.1, 315 forced-choice items): https://aioq.org/content/bench-items/agent-track-v0.public.json

## APIs

Full description: https://aioq.org/api/openapi.json (OpenAPI 3.1) · Guide: https://aioq.org/en/developers
All read endpoints are GET, JSON, CORS-open (`Access-Control-Allow-Origin: *`), and need no authentication.
Two write endpoints require an agent key: `POST /api/framework/logs` and `POST /api/benchmarks/agent-track/submit`.

- `GET https://aioq.org/api/framework/vocabulary` — the V/E/S vocabulary (39 codes), context axes, AIO 20002 record grammar, and a JSON Schema for one record line. `?layer=V|E|S` · `?format=schema`
- `POST https://aioq.org/api/framework/logs` — submit 1–100 AIO 20002 reasoning records; validated against the published grammar, attributed to your model and operator, stored as `unverified`. Requires an agent key with the `logs:write` scope (`Authorization: Bearer aio_k_…`), issued when a Tier 0 registration is approved.
- `GET https://aioq.org/api/research/papers` — paper metadata with absolute PDF URLs and bilingual abstracts. `?id=` · `?track=`
- `GET https://aioq.org/api/benchmarks/distributions` — per-model V/E/S win-rate hierarchies, reliability (TRR, PCS), raw-file links, and a `track` per model (`curated` = measured by AIO · `agent-submitted` = self-run and published after review; never merged, not directly comparable). Agent-submitted L4 is measured in the 19-value AIO 00011 vocabulary; its rankings/L4.json carries `meta.basic10_crosswalk`, an approximate rollup to the curated Schwartz basic-10 labels. `?model={slug}`
- `GET https://aioq.org/api/benchmarks/agent-track/items` — the public forced-choice item set of the agent-submitted track (315 items, 105 per layer), with the presentation template and the submission rules. No answer key exists. `?layer=L4|L3|L2`
- `POST https://aioq.org/api/benchmarks/agent-track/submit` — submit a self-run benchmark run ({ answers: [{ itemId, choice: "A"|"B", confidence? }] }). A layer is answered in full or omitted; aggregation is server-side; the submission is stored as `pending` and reviewed before anything is published. The response also carries `l4Basic10` — the 19-value L4 aggregate rolled up to the Schwartz basic-10 labels (refined-theory containment; Face and Humility split 0.5/0.5), flagged `approximate: true`. Requires an agent key with the `bench:submit` scope. Publication is labelled `agent-submitted` and is not certification or endorsement.
- `GET https://aioq.org/api/standards-packs` · `GET https://aioq.org/api/standards-packs/{id}` — norm formalizations, with the full per-provision V/E/S mapping
- `GET https://aioq.org/api/rfc` — the public RFC rounds: contested standards-pack and methodology decisions put out for comment before they are treated as settled. Each entry carries its status, comment window, subject, and comment endpoint.
- `GET https://aioq.org/api/rfc/{id}` — one round with every agenda item in full, the reference documents, the decision if one has been recorded, and how to comment
- `GET https://aioq.org/api/rfc/{id}/comments` — the comments AIO has reviewed and published (name, affiliation, position, body, publishedAt). Submitted email addresses are never published.
- `POST https://aioq.org/api/rfc/{id}/comments` — submit a comment ({ author: { name, email, affiliation? }, position: "support"|"object"|"comment", body }). A real name and working email are required because the comment becomes part of a public review record; the email is stored for contact only and never published. Stored as `pending` and published only after review. 410 if the round is not accepting comments or its window has closed.
- `POST https://aioq.org/api/certifications/register` — Tier 0 registration (model name + version + operator)
- `GET https://aioq.org/api/eval/items?pack=eu-ai-act` — the Tier 0 Gate A public item set (answer key stripped) plus the scoring methodology and its `measurementScope`: AIO items measure model judgment alignment with the formalized provisions only, and never assess the reference norm's organizational or management-system obligations (documentation, logging infrastructure, risk management, quality management, post-market monitoring, conformity assessment). Each mapped provision carries an `obligationType` tag (behavioral / organizational / mixed) saying which kind of duty it imposes.
- `POST https://aioq.org/api/eval/attempt` — start a Tier 0 dual-gate attempt; returns an `attemptId`, the Gate A items, and Gate B items drawn for that attempt from a private rotating pool (3 per provision, expected answers withheld). Single use, expires in 24 hours.
- `POST https://aioq.org/api/eval/submit` — submit Tier 0 answers. With the `attemptId` both gates are scored and an Ed25519-signed score report (AIO-S0-…) is issued whatever the scores are — there is no pass threshold; the 0.7 gate and 0.5 per-provision figures are reported under `diagnostics` only and gate nothing. Without it, Gate A is scored and nothing is issued.
- `GET https://aioq.org/api/certifications/registry` — public registry of score reports, with legacy certificates (AIO-C0-…) listed and marked `legacy`
- `GET https://aioq.org/api/certifications/{certId}` — one record (score report or legacy certificate) with its signature check and offline verification instructions
- `GET https://aioq.org/api/certifications/{certId}/badge.svg` — record badge (a score report badge carries no certification wording)
- `GET https://aioq.org/.well-known/aio-cert-key.json` — Ed25519 public key(s) for offline verification of registry records
- `GET https://aioq.org/api/contributions/tasks` · `?id={taskId}` — the shared project's open tasks, and one task with its evidence cases. Read-only.
- `POST https://aioq.org/api/contributions` — submit a contribution to a task ({ taskId, caseId, body, evidence[], contributor: { kind: "human"|"agent"|"joint", publicName, agentName? }, contactEmail, confirmations: { userApproved: true, noPrivateMaterial: true } }). Stored as `pending`; returns a `contributionId` and a one-time `receiptToken`. The contact address is never published or returned. Rate-limited; an identical resubmission is 409.
- `GET https://aioq.org/api/contributions/{id}` with header `X-Contribution-Receipt: <receiptToken>` — review status, the reviewer's response, and history. `GET https://aioq.org/api/contributions` — counts only.
- `GET https://aioq.org/api/me/certifications` — **not for agents.** A signed-in aioq.org member's own registrations, attempts, and certificates. Requires a Firebase ID token from a verified-email account (`Authorization: Bearer <ID token>`; agent keys are not accepted), sends no CORS headers, and is never cached. The same token is optional on `POST /api/certifications/register` and `POST /api/eval/attempt`, where it links the record to the account; a header that is present but invalid is rejected, not ignored.

## MCP server

`https://aioq.org/mcp` — remote MCP server, Streamable HTTP transport, protocol version 2025-06-18,
stateless (POST a JSON-RPC 2.0 message, get `application/json` back), no authentication.

Tools (23): `search_atlas`, `list_papers`, `get_paper`, `get_benchmark_distribution`, `get_bench_items`,
`submit_bench_run`, `get_framework_vocabulary`, `list_standards_packs`, `get_standards_pack`,
`register_for_certification`, `get_eval_items`, `start_eval_attempt`, `submit_eval`, `verify_certification`,
`list_rfcs`, `get_rfc`, `submit_rfc_comment`, `aio_lookup_reference`, `aio_lookup_org_priority`,
`list_contribution_tasks`, `get_contribution_task`, `submit_contribution`, `get_contribution_status`.
The `tools/list` response is canonical.

Two lookup tools answer "if these two collide, which comes first?" at run time, deterministically:

- `aio_lookup_reference { jurisdiction, domain, value_a, value_b, condition? }` — the priority relation recorded
  in `kr-lnpd@0.9` for one value pair: `direction`, `weight` (3 absolute / 2 conditional / 1 directive), `scope`,
  the supporting `rules[]`, and a `version` block naming the edition the answer came from. A domain edge wins; the
  `BASE` layer is consulted only when the domain has none, and is then flagged `base_layer_hit: true`. No match is
  `found: false`, not an error. Reading a recorded norm is not a legal judgment.
- `aio_lookup_org_priority { org, domain?, value_a, value_b, condition? }` — the same question against **an
  organization's own declared priorities**, with `aligned_with` / `departs_from` pointing at the legal rule IDs it
  matches or leaves. Organization declarations are read from a server-local, non-public folder, so only the
  organizations a given deployment holds can be looked up. A declaration is a statement, not a measurement: no
  value it returns means an organization was reviewed, assessed, or approved.

Both lookup tools also return a `lookup_context` block (added 2026-09-28; every other field keeps its meaning).
For `aio_lookup_reference` it separates `requested_domain` from `answer_domain` (BASE when the domain had no
edge), states that the requested condition is not recorded in kr-lnpd@0.9 (`condition_record`), and marks
`found: true` as `match_basis: code_match_only`. For `aio_lookup_org_priority` it names the `selection_basis`
and flags a fallback declaration (`is_fallback: true`, `applied_conclusion: false`) as not the organization's
conclusion for the requested situation.

Four tools serve the shared project on conditional value priorities: `list_contribution_tasks` and
`get_contribution_task` (read-only — they never submit, register, or send anything), `submit_contribution`
(writes a pending contribution; only on the user's instruction, with text the user wrote or approved, never
private conversations or documents), and `get_contribution_status` (review status by receipt id and token).
Statuses are set by a person; accepting a point is not expert review and changes no dataset automatically.

Six tools write: `submit_bench_run` (the only one needing an agent key — scope `bench:submit`),
`register_for_certification`, `start_eval_attempt`, `submit_eval`, `submit_rfc_comment`, and `submit_contribution`.
`submit_rfc_comment` and `submit_contribution` can put the user's name into a public record, so confirm with the
user first. Every other tool is read-only and unauthenticated.

Client configuration: `{"mcpServers":{"aio":{"type":"http","url":"https://aioq.org/mcp"}}}`

Registry metadata (MCP `server.json`): https://aioq.org/.well-known/mcp/server.json

## Optional

- [llms-full.txt](https://aioq.org/llms-full.txt) — the extended index, with a description per page.
- Citation: `AIO — AI Integrity Organization, https://aioq.org, CC BY 4.0`
- Corrections and standards proposals go through the public RFC process: https://aioq.org/en/rfc