This document constitutes the Residual Risk and Assumption Disclosure Annex for QODIQA - the deterministic runtime consent enforcement standard for artificial intelligence systems. It is a structural integrity document, not a marketing instrument.
The Annex enumerates all operational assumptions required for QODIQA to function as specified, identifies residual risk surfaces that persist under conditions of perfect conformance, declares the explicit non-coverage domains of the standard, and imposes formal constraints on how QODIQA may be characterised by implementors and regulators.
This document reduces reputational, regulatory, and legal exposure for all parties operating under or referencing the QODIQA standard. It is issued alongside the Core specification and is a normative component of the QODIQA corpus. No deployment may represent itself as QODIQA-conformant without acknowledgement of the disclosures herein.
#Executive Disclosure Statement
QODIQA is a deterministic runtime consent boundary enforcement layer for artificial intelligence systems. The following declarations constitute the authoritative characterisation of the standard and supersede any contrary representation in promotional, marketing, or secondary materials.
0.1Affirmative Scope
- QODIQA enforces consent policy at the API gateway and execution boundary layer.
- QODIQA produces deterministic permit/deny decisions based on encoded policy and verified principal identity.
- QODIQA generates tamper-evident, auditable enforcement logs.
- QODIQA provides a conformance framework against which implementations may be assessed.
- QODIQA aligns its control architecture with the requirements of GDPR, the EU AI Act, and NIST AI RMF as documented in the Regulatory Alignment Matrix.
- QODIQA defines cryptographic attestation mechanisms for principal identity binding and policy integrity.
0.2Negative Scope - Formal Exclusions
| Excluded Domain | Scope Boundary Statement |
|---|---|
| AI Safety | QODIQA does not constitute an AI safety framework. Enforcement of consent boundaries does not prevent unsafe model outputs within those boundaries. |
| Model Alignment | QODIQA does not verify, assess, or enforce alignment of model behaviour to human values or intent. |
| Hallucination Elimination | QODIQA does not inspect model outputs for factual accuracy. Hallucinated outputs within a permitted execution context are not subject to QODIQA enforcement. |
| Model Weight Regulation | QODIQA operates at the inference boundary. It has no access to, and does not regulate, model weights, training procedures, or fine-tuning processes. |
| Latent Representation Inspection | QODIQA does not inspect internal model states, attention patterns, or embedding spaces. |
| Universal Harm Prevention | QODIQA prevents execution outside of consented scope. It does not prevent harm that occurs within consented scope. |
This annex is issued as a normative component of the QODIQA corpus. Implementors who represent QODIQA as providing guarantees beyond those enumerated above are in breach of this disclosure. Regulatory submissions citing QODIQA conformance must reproduce or reference this annex.
#Foundational Assumptions Register
QODIQA's deterministic enforcement properties hold only when the following assumptions are satisfied. Each assumption is accompanied by its failure mode and systemic consequence. Implementors bear responsibility for ensuring these assumptions hold within their operational environment.
1.1Assumption Register
#Deterministic Scope Boundary
The term deterministic runtime consent enforcement as used in the QODIQA standard has a precise and bounded meaning. This section defines that meaning and explicitly delineates what it does not encompass.
2.1What Deterministic Runtime Consent Enforcement Means
2.2What Deterministic Runtime Consent Enforcement Does Not Mean
| Assertion | Boundary Clarification |
|---|---|
| Does not mean the permitted action is safe | A request may be permitted by QODIQA and still produce harmful outputs within the consented scope. |
| Does not mean the policy reflects genuine consent | Determinism applies to policy evaluation, not to the quality of the underlying policy. Incorrectly configured policy is evaluated deterministically. |
| Does not mean the enforcement perimeter is complete | Determinism holds only within the deployed enforcement boundary. Actions taken outside that boundary are not subject to QODIQA evaluation. |
| Does not mean the model is aligned | QODIQA governs access to model execution. It has no visibility into model behaviour during execution. |
| Does not mean the system is compliant | QODIQA provides controls relevant to certain regulatory requirements. Legal compliance requires additional measures and legal assessment. |
| Does not mean all risks are mitigated | Deterministic boundary enforcement is one layer in a defence-in-depth architecture. Residual risk surfaces enumerated in Section 3 persist regardless of QODIQA deployment. |
All representations of QODIQA in regulatory submissions, marketing materials, procurement documentation, and technical specifications must respect the boundary defined in this section. Representations that conflate boundary enforcement with AI safety, alignment, or harm elimination are inaccurate and are prohibited under this annex.
2.3Formal Enforcement Perimeter Definition
The QODIQA enforcement perimeter is defined as the set of components, interfaces, and processing steps over which the deterministic enforcement guarantee holds. Deterministic guarantees hold exclusively within this defined perimeter. Any execution occurring outside this perimeter is not governed by QODIQA and is not subject to any enforcement, audit, or conformance claim under this standard.
2.3.1Components Explicitly Outside the Enforcement Perimeter
| Component | Perimeter Exclusion Statement |
|---|---|
| AI model weights, architecture, and runtime | The model execution environment, including all inference operations, is outside the QODIQA perimeter. |
| Model output handling and downstream systems | Any system that receives, processes, stores, or acts upon model outputs is outside the perimeter. |
| Identity provider infrastructure | Certificate authorities, identity providers, and key management systems that support principal credential issuance are outside the perimeter. |
| Consent registry infrastructure | The physical and logical infrastructure hosting the consent registry, including its database engine, replication systems, and access control layer, is outside the perimeter. |
| Audit store infrastructure | The storage infrastructure, backup systems, and access control layer of the audit log store are outside the perimeter. |
| Network transport layer | The network infrastructure over which requests and responses transit between clients and the enforcement gateway ingress interface is outside the perimeter. |
| Client-side request construction | The process by which a requesting principal constructs a request, including all client-side software, is outside the perimeter. |
#Residual Technical Risk Surfaces
The following risk surfaces persist under conditions of perfect QODIQA implementation, perfect conformance, and perfect policy encoding. They are structural properties of the threat environment that QODIQA does not and cannot address.
Risk bands are assigned as follows: Critical - systemic failure with no internal mitigation pathway; High - significant impact, partial mitigation possible through external controls; Medium - meaningful but contained impact; Low - limited scope.
| Risk ID | Description | Band |
|---|---|---|
| RT-01 | Model weight bias producing skewed or harmful outputs within permitted execution scope | HIGH |
| RT-02 | Training data poisoning contaminating model behaviour prior to deployment | HIGH |
| RT-03 | Upstream training corpus contamination by adversarial third-party data | HIGH |
| RT-04 | Prompt injection attacks originating within the permitted execution context | CRITICAL |
| RT-05 | Adversarial input generation that produces harmful model outputs within consented scope | HIGH |
| RT-06 | Zero-day runtime exploits targeting the enforcement gateway process itself | CRITICAL |
| RT-07 | Cryptographic primitive compromise through mathematical advancement or implementation flaw | CRITICAL |
| RT-08 | Infrastructure-level compromise (hypervisor, network fabric, storage layer) below the enforcement boundary | CRITICAL |
| RT-09 | Hallucination of false information within permitted execution scope causing downstream harm | HIGH |
| RT-10 | Model capability overhang - capabilities not known at policy encoding time operating within permitted scope | HIGH |
| RT-11 | Policy staleness - consent records that no longer reflect principal intent due to changed circumstances | MEDIUM |
| RT-12 | Cross-context inference attacks using permitted outputs to reconstruct protected information | MEDIUM |
3.1Prompt Injection Within Boundary (RT-04)
Prompt injection represents a residual risk surface of particular structural significance. QODIQA evaluates whether a request is permitted based on its metadata, scope parameters, and principal consent record. The content of permitted prompts is not inspected by the enforcement layer. A permitted prompt containing adversarial instructions directed at the model is evaluated by QODIQA as a valid request if it falls within the consented scope. The model's response to such instructions is not within QODIQA's governance perimeter.
3.2Infrastructure Compromise (RT-08)
An adversary with access at the infrastructure layer - including hypervisor access, network interception capabilities, or storage layer access - may observe, modify, or suppress enforcement operations without QODIQA being able to detect or prevent such interference. This risk surface is acknowledged but not addressed by QODIQA. Mitigations at the infrastructure layer, including hardware-based attestation and network segmentation, are the responsibility of the deploying organisation.
3.3Model Capability Overhang (RT-10)
Consent policies are encoded against a model's known or anticipated capabilities at the time of policy creation. AI models may exhibit capabilities that were not known, anticipated, or accounted for during policy encoding. Such unanticipated capabilities may operate within the consented scope while producing effects that were not contemplated when consent was obtained. This is a structural limitation of any consent framework applied to systems whose capability boundaries are not fully characterised.
3.4Risk Interdependency and Compounded Failure
The risk surfaces enumerated in this section and the foundational assumptions enumerated in Section 1 are not independent. Simultaneous failure of multiple assumptions, or concurrent realisation of multiple risk surfaces, compounds the systemic impact beyond the severity classification assigned to any individual risk. The classifications in Table 3-A reflect the impact of each surface in isolation; compounded failure scenarios may exceed those classifications.
QODIQA does not model probabilistic compounding risk internally. The following scenarios are provided to illustrate the structural nature of risk interdependency. They are not exhaustive.
QODIQA does not assign a single severity band to compounded failure scenarios. Compounded failures involving two or more Critical-band individual risks should be treated as exceeding the Critical classification for purposes of risk treatment planning. Organisations are responsible for performing their own compounded risk analysis in the context of their specific deployment architecture and threat model.
#Regulatory Interpretation Risk
QODIQA maintains a Regulatory Alignment Matrix that maps control points to provisions of GDPR, the EU AI Act, NIST AI RMF, and other frameworks. The following disclosures govern how that alignment matrix must and must not be interpreted.
4.1QODIQA Does Not Constitute Legal Compliance
The QODIQA Regulatory Alignment Matrix maps technical controls to regulatory provisions. This mapping does not constitute a legal determination that an organisation implementing QODIQA is compliant with any cited regulation. Legal compliance requires assessment by qualified legal counsel with jurisdiction-specific expertise. The alignment matrix is a technical reference instrument, not a legal opinion.
4.2QODIQA Does Not Substitute for Legal Counsel
No provision of the QODIQA standard, including this annex, constitutes legal advice. Organisations using QODIQA alignment documentation in regulatory submissions, compliance certifications, or legal proceedings do so at their own risk and must obtain independent legal review of such submissions.
4.3Jurisdictional Divergence
The regulatory landscape for AI governance is evolving at different rates across jurisdictions. Requirements under the EU AI Act do not necessarily correspond to requirements under US federal frameworks, national UK regulations, or emerging frameworks in other jurisdictions. The QODIQA alignment matrix reflects the state of regulation as understood at the time of document issuance. It does not predict, anticipate, or account for regulatory amendments, new guidance documents, or enforcement decisions issued after the document date.
4.4Regulatory Interpretation Variance
Regulatory authorities may interpret the provisions of AI governance frameworks differently from the interpretations reflected in the QODIQA alignment matrix. Enforcement actions, supervisory guidance, and judicial decisions may clarify or alter the requirements attributed to specific provisions. QODIQA alignment with a regulatory provision as documented does not guarantee that a supervising authority will reach the same interpretive conclusion.
Organisations subject to regulatory enforcement who rely on QODIQA conformance as a compliance argument must independently validate that the technical controls provided by QODIQA satisfy the specific requirements of the applicable regulatory authority in the relevant jurisdiction.
#Organizational Risk Dependencies
QODIQA's technical controls are necessary but not sufficient conditions for effective consent enforcement. The following organisational capabilities must be maintained by the deploying entity. Absence or degradation of these capabilities constitutes residual risk that QODIQA cannot compensate for at the technical layer.
5.1Governance Maturity
Effective deployment of QODIQA requires a functioning governance structure capable of making, recording, and communicating policy decisions. Organisations with immature governance - undefined ownership, inconsistent approval processes, or absent policy review cycles - will produce unreliable consent policies regardless of the technical enforcement precision of the QODIQA layer.
5.2Internal Policy Hygiene
Consent policies must be reviewed on a defined cycle to remain current with changing operational requirements, regulatory developments, and model capability changes. Policy rot - the accumulation of stale, contradictory, or abandoned consent records - creates a surface for both unintended permissions and unintended restrictions. QODIQA enforces policy as encoded; it does not identify policy that has become obsolete.
5.3Incident Response Capability
Detection and response to enforcement anomalies, suspected bypass events, and audit log integrity failures require a functioning incident response capability. QODIQA generates the audit record and enforcement signals. Acting on those signals, investigating anomalies, and executing remediation procedures are organisational responsibilities.
5.4Audit Discipline
The value of QODIQA's tamper-evident logging is realised only if logs are reviewed on a defined schedule by personnel with the authority and competence to act on their findings. An unread audit log provides no protective value.
5.5Key Rotation Practices
Cryptographic key material used in QODIQA enforcement flows must be rotated at defined intervals and immediately upon any suspected compromise. Organisations that do not maintain a documented and practiced key rotation programme degrade the cryptographic assurance of the enforcement layer over time.
5.6Personnel Competence and Continuity
Correct configuration, maintenance, and operation of QODIQA deployments requires personnel with appropriate technical competence. Staff turnover, knowledge transfer failures, and inadequate training create operational risk that manifests as misconfiguration, policy errors, or delayed incident response.
#Non-Coverage Declaration
The following domains are explicitly and entirely outside the scope of QODIQA. No provision of the QODIQA standard, and no implementation conformant with it, provides coverage in these areas. This declaration is not a statement of future roadmap. These domains are structurally distinct from boundary enforcement and are not subject to expansion into QODIQA scope.
| Excluded Domain | Non-Coverage Statement |
|---|---|
| General AI Alignment | The alignment of AI model behaviour with human values, intent, or ethical principles is not addressed by QODIQA. QODIQA governs access to model execution; it does not govern what the model does during execution. |
| Model Interpretability | QODIQA provides no tools, mechanisms, or standards for understanding model internal states, attention distributions, reasoning chains, or decision processes. |
| AGI Containment | QODIQA does not address the containment of artificial general intelligence systems, their capability trajectories, or the prevention of capability elicitation beyond intended design. |
| Economic Displacement Mitigation | QODIQA has no provisions relating to the economic effects of AI deployment, including workforce displacement, market concentration, or distributional impacts. |
| Ethical Theory Arbitration | QODIQA does not adjudicate between competing ethical frameworks, moral positions, or value systems. It does not encode any ethical position beyond the procedural requirement that specified consent boundaries be enforced as specified. |
| Human Oversight Frameworks | QODIQA provides technical enforcement of consent boundaries. It does not design, certify, or enforce broader human oversight structures, board-level governance requirements, or accountability frameworks beyond its defined control points. |
| Model Architecture Design | QODIQA makes no requirements on model architecture, training methodology, data provenance, or evaluation procedures. These remain outside the scope of the standard. |
| Content Moderation | QODIQA does not evaluate the content of model outputs for harmful, offensive, or illegal material. Enforcement of content standards within a permitted execution context is not a QODIQA function. |
| Bias Detection and Mitigation | QODIQA provides no assessment of, or mitigation for, systematic biases in model outputs, including demographic bias, representational harm, or distributional unfairness. |
| Privacy-Preserving Computation | QODIQA governs consent to execute. It does not implement differential privacy, federated learning, homomorphic encryption, or other privacy-preserving computation techniques. |
The non-coverage domains listed above represent areas of genuine and significant concern in AI governance. Their exclusion from QODIQA scope is a consequence of the standard's deliberate focus on a well-defined technical function. Organisations addressing these domains must employ additional frameworks appropriate to each area.
#Cryptographic Assumption Disclosure
QODIQA's enforcement integrity depends on cryptographic primitives. The security of the standard is computationally bounded, not unconditional. The following disclosures govern the cryptographic trust basis of QODIQA.
7.1Dependence on Cryptographic Primitives
QODIQA relies on hash functions, digital signature algorithms, and authenticated encryption schemes as specified in the Security and Cryptographic Profile. The integrity guarantees provided by QODIQA - including consent attestation, token non-repudiation, and log tamper evidence - are conditional on these primitives remaining computationally infeasible to break under current and near-term adversary capabilities.
7.2Risk of Future Cryptanalytic Breakthrough
Mathematical advances may render currently approved cryptographic primitives insecure before end-of-life dates assigned by standards bodies. Such advances may occur without warning and may pre-date their public announcement by adversaries with classified research capabilities. QODIQA does not provide a mechanism for detecting cryptographic compromise after the fact; the audit record itself would be untrustworthy if the underlying cryptographic primitives were broken.
7.3Quantum Threat Exposure
Current QODIQA cryptographic specifications use algorithms based on the hardness of problems assumed to be computationally infeasible for classical computers. Sufficiently capable quantum computing systems would break widely deployed asymmetric cryptographic algorithms including RSA and elliptic curve schemes. The timeline for such capability remains uncertain. Organisations operating under long-term security requirements should monitor NIST Post-Quantum Cryptography standardisation outputs and assess migration requirements accordingly. QODIQA will issue post-quantum migration guidance under formal change control when relevant standards are ratified.
7.4Key Custody Exposure
The security of QODIQA's cryptographic layer is bounded by the security of key management practices. Keys held in software-only key stores, shared across environment boundaries, or managed without hardware security module controls are materially more exposed than keys managed under high-assurance key custody procedures. QODIQA specifies minimum key management requirements; organisations that fail to implement them degrade the cryptographic assurance of their deployment below the standard's stated security model.
7.5Implementation Flaw Exposure
Correct selection of cryptographic algorithms does not ensure correct implementation. Side-channel vulnerabilities, padding oracle attacks, timing attacks, and random number generator weaknesses have historically compromised otherwise sound cryptographic designs in their implementation. QODIQA does not certify the implementation quality of cryptographic libraries used by conformant deployments.
#Operational Misuse Risk
QODIQA may be misconfigured, partially deployed, or misrepresented in ways that produce either inadequate enforcement or false confidence in enforcement coverage. The following misuse scenarios are identified as material risks arising from operational rather than adversarial sources.
8.1Improper Policy Configuration
Consent policies encoded with ambiguous scope parameters, incorrect principal bindings, or missing temporal constraints may produce enforcement decisions that do not reflect the intent of the consenting principal. QODIQA enforces policy as encoded. Garbage-in-garbage-out failure modes apply: technically correct enforcement of incorrect policy produces incorrect outcomes.
8.2Over-Restrictive Enforcement Blocking
Overly conservative policy encoding may block legitimate requests and create operational friction that incentivises bypass, shadow deployment, or informal workarounds. Organisations that respond to over-restrictive enforcement by routing around the QODIQA layer create the very bypass surfaces that enforcement is intended to prevent.
8.3Under-Restrictive Enforcement
Permissive policy encoding, broad scope parameters, or absent expiry controls may result in consent records that provide effective permission to all requests. An enforcement layer that permits everything provides no enforcement value and creates false confidence in governance coverage.
8.4Shadow Deployments
Organisational units or teams that deploy AI capabilities outside the QODIQA enforcement perimeter create unmonitored execution surfaces. Such deployments may occur deliberately, through ignorance of the enforcement requirement, or through procurement of third-party AI services that bypass the enforcement gateway. Shadow deployments are not detectable by QODIQA; they require organisational controls including procurement governance and network access controls.
8.5Partial Implementation Represented as Full Conformance
Implementation of a subset of QODIQA control points, followed by public representation as QODIQA-conformant, constitutes a misuse of the standard. Partial conformance provides partial protection and partial compliance evidence. It does not constitute the assurance level associated with full conformance. The QODIQA Certification Framework specifies conformance tiers; representations must accurately reflect the tier achieved.
8.6Delegation Misuse
Delegation chains in QODIQA allow principals to delegate enforcement authority to agents. Improperly scoped delegations, expired delegations not removed from the registry, or delegation to untrusted agents create authority transfer paths that were not intended by the original principal.
#Abuse and Adversarial Exploitation Scenarios
The following scenarios represent deliberate attempts to defeat or circumvent QODIQA enforcement. Detection limits are noted where relevant.
9.1Direct Model Access Bypass
An adversary with credentials or network access sufficient to reach the AI execution environment directly - bypassing the QODIQA enforcement gateway - may interact with the model without any consent evaluation occurring. This attack surface requires operational controls at the infrastructure layer. QODIQA cannot detect bypass events that do not traverse the enforcement boundary; no log entry is generated for requests that circumvent the enforcement layer entirely.
9.2Token Replay
A valid, unexpired enforcement token that was legitimately issued for one purpose may be replayed by an adversary for a different purpose if token scope binding is insufficiently specific or if token revocation is not enforced at verification time. Token replay attacks result in QODIQA treating replayed requests as legitimate. Detection requires log analysis to identify statistically anomalous token usage patterns; QODIQA does not implement automated replay detection as a default control point.
9.3Registry Tampering
An adversary with write access to the consent registry may modify, delete, or insert consent records to expand or restrict permitted execution scope. Such tampering would cause subsequent enforcement decisions to be made against altered policy, with no indication at the enforcement layer that the registry has been modified. Log immutability and registry integrity monitoring are required compensating controls.
9.4Log Suppression
An adversary with access to the logging pipeline may suppress, delete, or alter enforcement log records. If log suppression is achieved before cryptographic commitment of log entries, the tamper-evidence property of the audit trail is defeated. Post-commitment suppression is detectable through log gap analysis if an independent record of expected log entry volume is maintained. QODIQA specifies log integrity requirements; their effectiveness depends on implementation and monitoring discipline.
9.5Cross-Domain Request Smuggling
An adversary may craft requests that are evaluated by the enforcement layer as belonging to a permitted scope category while being processed by the model as belonging to a different category. This attack exploits differences between the metadata evaluated by the enforcement layer and the semantic content interpreted by the model. QODIQA evaluates consent based on request metadata and scope parameters; it does not perform semantic analysis of request content.
9.6Identity Claim Forgery
Forgery of principal identity claims at the enforcement boundary results in consent evaluation being performed against the wrong principal's consent record. Effective detection requires cryptographic identity binding and the integrity of the key management infrastructure. An adversary able to forge valid cryptographic credentials defeats identity binding entirely.
9.7Detection Limits
QODIQA's detection capabilities are bounded by the enforcement boundary. Events that occur outside that boundary, attacks that achieve access below the enforcement layer, and bypass events that produce no enforcement-layer artefacts are not detectable by QODIQA. External monitoring, network anomaly detection, and independent audit of AI system usage patterns are required to identify exploitation scenarios that operate outside QODIQA's observation horizon.
#Residual Societal Risk
This section addresses the scope of risk that persists at a societal level even under conditions of universal QODIQA adoption with full conformance.
Universal adoption of QODIQA would represent universal deployment of a deterministic consent boundary enforcement layer across AI execution environments. It would not represent the resolution of the broader challenges posed by AI systems to society, democratic institutions, or individual welfare. These disclosures are required to prevent QODIQA from being characterised as a solution to problems it does not address.
10.1AI Misuse Risk Persists
AI systems may be misused within the scope of consent that has been granted. A principal who consents to broad AI-enabled processing retains the ability to direct that processing toward harmful ends. QODIQA enforces that the processing occurred within consented scope; it does not evaluate whether the consented scope was appropriate or whether the consented use is harmful.
10.2Model Misuse Risk Persists
AI models with the capacity to produce harmful outputs - disinformation, manipulation, dual-use content - retain that capacity when operated within QODIQA-enforced consent boundaries. The enforcement layer governs access; it does not govern capability. Harmful outputs produced within consented scope are not addressed by QODIQA.
10.3Strategic AI Competition Risk Persists
The deployment of AI systems in strategic competition between state and non-state actors involves risk surfaces - capability asymmetry, surveillance infrastructure, autonomous decision systems, information operations - that are not addressed by consent boundary enforcement. These risks require responses at levels of governance, international coordination, and policy that are beyond the scope of any technical standard.
10.4Consent Framework Limitations at Scale
Consent as a governance mechanism has known limitations at population scale. Informed consent requires genuine understanding of the consequences of the decision being made. At scale, the cognitive demands of evaluating AI consent decisions may exceed practical human capacity, consent may be aggregated and transferred in ways that no longer reflect individual intent, and the power asymmetry between consent-requesting entities and consenting individuals may render consent formally valid but substantively non-autonomous. QODIQA enforces the technical expression of consent; it does not resolve these structural challenges in consent theory.
10.5Coordination Failure Risk
Jurisdictions, organisations, and actors that do not adopt QODIQA or equivalent standards create unmonitored AI execution environments that represent potential competitive advantages for actors willing to operate without consent boundaries. Partial adoption of consent enforcement standards does not eliminate the incentive for non-adopting actors to exploit the absence of constraints.
#No Guarantee Clause
11.1Scope of the No Guarantee Clause
The no guarantee clause applies to all representations of QODIQA made by: the issuing authority; implementing organisations; certification bodies issuing QODIQA conformance certificates; regulatory bodies citing QODIQA conformance as evidence of compliance; and any third party characterising QODIQA capabilities in any medium.
11.2What QODIQA Does Provide
QODIQA provides a structured, auditable, cryptographically attested boundary enforcement mechanism. Within the scope of that mechanism - and subject to the assumptions enumerated in Section 1 - QODIQA provides deterministic enforcement decisions, tamper-evident audit records, and a conformance framework for third-party assessment. These properties are bounded by the technical and operational conditions set forth in this annex.
11.3Liability Disclaimer
The QODIQA standard is issued as a technical reference framework. The issuing authority makes no warranty, express or implied, regarding the fitness of QODIQA for any particular purpose, its effectiveness against any specific threat, or its sufficiency for any regulatory requirement. Organisations implementing QODIQA bear full responsibility for the adequacy of their implementation, the correctness of their policy configuration, and the completeness of their governance arrangements.
#Transparency Commitment Statement
The QODIQA issuing authority commits to the following transparency obligations with respect to the disclosures contained in this annex. These commitments are normative and are subject to oversight under the QODIQA Governance Charter.
12.1Periodic Risk Re-Evaluation
The assumption register, residual risk surfaces, and non-coverage declarations in this annex will be reviewed at intervals not exceeding twelve months from the date of issuance, and additionally upon: any material change to the QODIQA core specification; any significant development in the AI threat landscape that materially alters the risk assessment; any cryptographic standard deprecation affecting the primitives used in QODIQA deployments; and any regulatory development that materially alters the interpretive risk described in Section 4.
12.2Versioned Disclosure Updates
All revisions to this annex will be issued as versioned documents under the QODIQA document identifier scheme. Revision history will be maintained and publicly accessible. Prior versions will be retained in the document archive. No version of this annex will be suppressed, and no revision will reduce the scope or rigor of the disclosures without publication of a formal rationale under the Governance Charter change process.
12.3Formal Change Control
Amendments to this annex are subject to the change control procedures defined in the QODIQA Governance Charter v2.0. All proposed revisions must pass the designated review process. Emergency revisions - required in response to a critical security finding - follow the expedited process defined in the Governance Charter and are subject to retroactive formal review.
12.4Publicly Documented Assumption Revisions
If a foundational assumption in Section 1 is revised - whether because the assumption has been strengthened by new technical controls, weakened by new threat intelligence, or determined to be invalid in specific deployment contexts - the revision will be publicly documented with a rationale explaining the change and its implications for existing QODIQA conformant deployments.
12.5Disclosure of Known Limitation Instances
If the QODIQA issuing authority becomes aware of a confirmed exploitation of a residual risk surface identified in this annex, or a failure mode in a foundational assumption that has materially impacted a conformant deployment, the issuing authority will issue a formal advisory under the QODIQA advisory process. Such advisories will not identify affected organisations without consent but will provide sufficient technical detail for the broader implementing community to assess their own exposure.
#Closing Statement
The QODIQA standard is a technical instrument of bounded scope. Its value lies in what it precisely and reliably delivers: deterministic, auditable, cryptographically attested consent boundary enforcement at the AI execution layer. That value is best protected by accurate characterisation of its limits.
Organisations, regulators, and auditors who treat this annex as a constraint on QODIQA's utility misunderstand the function of disclosure. Accurate scope definition does not diminish the value of deterministic enforcement; it locates that value correctly within a broader architecture of AI governance in which QODIQA is one necessary component among several.
- QODIQA enforces consent boundaries. It does not resolve the harder problems of AI governance.
- The harder problems of AI governance remain open. They require different instruments.
- This annex documents both what QODIQA addresses and what it does not. Both are required for honest assessment.
#Document Status and Classification
This document constitutes the normative Residual Risk and Assumption Disclosure Annex for QODIQA - the deterministic runtime consent enforcement standard for artificial intelligence systems. It is a structural integrity document issued as a normative component of the QODIQA corpus. No deployment may represent itself as QODIQA-conformant without acknowledgement of the disclosures herein.
It is issued alongside the Core specification and is not a marketing instrument, a product specification, or a legal instrument. All technical principles described in this document are designed to be production-oriented, cryptographically anchored, and architected for integration within large-scale AI ecosystems.
The material contained herein is intended for:
- Systems architects and infrastructure engineers
- Enterprise AI platform designers
- Security and governance officers
- Regulatory and policy stakeholders
- Organizations building or operating autonomous AI systems
- Legal and compliance professionals engaged in AI governance
This document should be read together with the following related specifications:
- QODIQA — Consent as Infrastructure for Artificial Intelligence Technical Whitepaper — Version 1.0
- QODIQA — Core Standard for Deterministic Runtime Consent Enforcement — Version 1.0
- QODIQA — 68-Point Enforcement Framework for Deterministic Runtime Consent Enforcement — Version 1.0
- QODIQA — Certification Framework for Deterministic Runtime Consent Enforcement — Version 1.0
- QODIQA — Threat Model and Abuse Case Specification — Version 1.0
- QODIQA — Regulatory Alignment Matrix for Deterministic Runtime Consent Enforcement — Version 1.0
- QODIQA — Security and Cryptographic Profile for Runtime Consent Enforcement — Version 1.0
- QODIQA — Governance Charter for the QODIQA Standard Corpus — Version 1.0
Version 1.0 represents the initial formal release of this document as part of the QODIQA standard corpus.
For strategic inquiries, architectural discussions, or partnership exploration:
Bogdan Duţescu
0040.724.218.572