About This Project

Instead of waiting for jurisdictions to harmonize law, build a voluntary technical exchange layer — modeled on how STIX/TAXII standardized cyber threat sharing without changing any country's cybersecurity statutes. AIX would define: (1) a minimal common incident record (system identifier, deployment context, harm category, severity band, causal factor taxonomy) published as an open schema; (2) deterministic mappings from each existing template — the EU Article 73 reporting template, US sectoral filings (FDA, NHTSA, banking SRs), and the OECD Common Reporting Framework — so a single internal report can be machine-translated into every required format; (3) a globally unique incident identifier (like CVE for vulnerabilities) so registries can deduplicate and researchers can link records across jurisdictions; and (4) a privacy/confidentiality profile distinguishing public statistical fields from regulator-only fields, enabling aggregate learning without exposing trade secrets. Governance sits with a neutral standards body (OECD.AI or a joint ISO/IEC working group) with the schema versioned in the open. Adoption incentive: compliance cost reduction — vendors of GRC software implement AIX once and every regulated provider gets multi-jurisdiction filing nearly free, which makes disclosure cheaper rather than more punitive. This is evolutionary, voluntary, and compatible with existing institutions; it strengthens each regulator's regime while creating the shared evidence base none of them can build alone.

Timeline