ai-disclosure.json — Site-Level AI Transparency Manifest

Spec version: 0.1 (draft) — Status: open proposal, seeking implementations

A machine-readable, site-level declaration of the AI systems a website operates or publishes content from, the disclosure and marking methods in use, and where compliance evidence lives. Designed as the operational companion to EU AI Act Article 50 (Regulation (EU) 2024/1689) and aligned with the Commission's draft Code of Practice on Transparency of AI-Generated Content (2nd draft, March 2026).

Pattern precedents: robots.txt, security.txt (RFC 9116), /.well-known/gpc.json (Global Privacy Control). Namespace check (July 2026): ai-plugin.json (deprecated OpenAI plugins), agent.json, mcp.json / mcp/server-card.json, ai-catalog.json, and the ai-manifest.json IETF draft all serve agent discovery/automation — none declares transparency compliance. This spec occupies the compliance slot.

1. Discovery

• Canonical location: https://<domain>/.well-known/ai-disclosure.json
• MUST return HTTP 200 (no redirect chains beyond same-origin), Content-Type: application/json; charset=utf-8
• Each subdomain operating distinct AI systems SHOULD serve its own manifest
• Pages MAY additionally declare: <link rel="ai-disclosure" href="/.well-known/ai-disclosure.json">
• IANA well-known URI registration (RFC 8615) is intended once ≥2 independent implementations exist

2. Design principles

1. Declares, never detects. The manifest is a publisher's self-declaration; it makes no claim about content it does not list. Scanners audit marking coverage, not "AI-ness."
2. Maps 1:1 to Article 50 paragraphs. Every AI system entry cites which obligation(s) it addresses: 50(1) interaction disclosure, 50(2) machine-readable marking, 50(3) emotion recognition / biometric categorisation notice, 50(4) deepfake & public-interest-text labelling.
3. Assembles existing standards. Machine-readable marking references C2PA Content Credentials, IPTC DigitalSourceType, and schema.org — it does not invent a watermark.
4. Code-of-Practice-aligned. Reflects the 2nd draft: the "AI" acronym label (localized — KI/IA/etc.) with minimum design standards (prominence, contrast, visibility from first exposure) is the central visible-disclosure tool; the fully-generated/AI-assisted taxonomy was removed and is therefore OPTIONAL metadata here, not a required field.
5. Accessible and multilingual by construction (Article 50(5)): disclosure texts carry BCP-47 language tags; implementations MUST support all official EU languages of the audiences served.

3. Schema (normative summary — full JSON Schema in /schema)

{
  "specVersion": "0.1",                    // REQUIRED
  "publisher": {                           // REQUIRED
    "name": "Acme GmbH",
    "domain": "acme.example",
    "contact": "mailto:ai-transparency@acme.example",
    "euRepresentative": "…"                // OPTIONAL (non-EU providers, Art. 22)
  },
  "lastUpdated": "2026-07-02",             // REQUIRED, ISO 8601
  "languages": ["en", "fr", "de"],         // REQUIRED, BCP-47
  "aiSystems": [                           // REQUIRED, may be empty array
    {
      "id": "support-bot",                 // REQUIRED, unique slug
      "name": "Acme Support Assistant",
      "role": "deployer",                  // "provider" | "deployer" | "both"
      "kind": "conversational",            // conversational | content-generation |
                                           // emotion-recognition | biometric-categorisation | other
      "vendor": "…", "model": "…",         // OPTIONAL
      "purpose": "Customer support chat",
      "article50": ["50(1)"],              // REQUIRED, ⊆ {50(1),50(2),50(3),50(4)}
      "disclosure": {
        "methods": ["banner"],             // banner | inline-label | icon | audio-notice | metadata
        "placement": "chat-widget, first interaction",
        "texts": { "en": "You are chatting with an AI system.", "fr": "…" }
      },
      "agentInteractionPolicy": "always"   // OPTIONAL; "always" implements the draft-Guidelines
                                           // rule for agents where human interaction is plausible
    }
  ],
  "contentMarking": {                      // REQUIRED if any system cites 50(2) or 50(4)
    "machineReadable": [
      { "standard": "C2PA", "scope": "images,video" },
      { "standard": "IPTC-DigitalSourceType", "scope": "images" },
      { "standard": "schema.org", "scope": "text" }
    ],
    "visibleLabel": { "style": "AI-acronym", "localized": true }
  },
  "editorialResponsibility": {             // OPTIONAL — the 50(4) text exemption basis
    "humanReview": true,
    "statementUrl": "https://acme.example/editorial-policy"
  },
  "evidence": {                            // REQUIRED
    "retentionMonths": 6,                  // ≥ 6
    "registerUrl": "…"                     // OPTIONAL (may be private)
  },
  "exemptions": [                          // OPTIONAL, documented per system
    { "systemId": "…", "basis": "obviousness | artistic | law-enforcement", "rationale": "…" }
  ]
}

4. Conformance levels

• L1 Declared: valid manifest served at the well-known path.
• L2 Rendered: L1 + visible disclosures/labels present at declared placements (verifiable by crawler screenshot).
• L3 Evidenced: L2 + evidence register with ≥6-month retention and per-item records (tool, version, reviewer, date).

5. Versioning & governance

Semver on specVersion; breaking changes bump minor pre-1.0. Spec text CC-BY-4.0; reference implementation MIT. Changes via public issues; the goal is a multi-implementer convention, not a proprietary format.

6. Explicit non-goals

No AI-content detection claims; no legal advice; no training-data opt-out semantics (that is ai.txt/TDM-reservation territory); no agent task automation (that is agent.json/MCP territory).