]> American Civil Liberties Union

dkg@fifthhorseman.net

American Civil Liberties Union

mgerchick@aclu.org

int intarea Internet-Draft This document describes a mechanism that an organization can use to enable automatic discovery of documents associated with regulatory compliance. It is motivated by regulations that require, for example, publicly accessible audits of automated decision-making processes in hiring. The latest revision of this draft can be found at . Status information for this document may be found at . Source for this draft and an issue tracker can be found at .

Introduction An increasing number of regulatory regimes require organizations involved in certain business practices to provide a degree of transparency in their business operations by posting reports of audits in an accessible location. For example, New York City's 2021 Local Law 144 () established auditing requirements for employers who use automated decision-making tools in the employment process, but it has proved challenging to even find these audits effectively (see ). For a business that has a website, the natural place to provide access to the audit is on that website. This document describes a standard mechanism that can be used to point to any audit posted associated with regulatory compliance. The mechanism is an audits.json summary document, found at a well-known URL, which allows the hosting domain to refer to specific business operations, relevant regulatory regimes, and their associated audit reports. Adoption of this mechanism should make it easier for businesses to comply with these requirements, while also making it easier for researchers, analysts, and regulators to assess compliance and evaluate the overall effectiveness of the regulations.

Requirements Language The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.

Terminology An "audit report" is a document produced by an organization or an independent entity commissioned by the organization to describe -- according to some kind of regulatory compliance -- a part of the organization's business operations.

Goals Provide a standardized way for an organization to publicize audit reports associated with given regulatory requirements. Provide a standardized way for a reviewer of audit reports associated with a regulatory requirement to find those audit reports.

Non-Goals Discovering an audit report is merely the first step in a process of having an effective regulatory regime based on audits. This specification is focused merely on this satisfying this necessary but insufficient stage of larger work. This specification makes no attempt to describe the syntax or semantics of any particular audit report. The underlying assumption is that the audit reports for different regulations or compliance measures will have different requirements for content, structure, syntax, and so on. This specification also does not associate a real-world organization with a particular domain name. If a researcher wants to find the audits associated with Example Corp, they need to associate Example Corp with the example.com domain name independently in order to use this specification. Likewise, any regulation making use of this mechanism needs to explicitly describe the link between the regulated entity and the domain name or domain names on which it is expected to publish this summary. This specification does not describe a way for a casual visitor to a given website to find these audit reports. A regulation that requires easy public accessibility of a report may need to offer additional user interface or user experience guidance in addition to requiring the use of this mechanism.

Locating The audits.json Summary This specification uses the .well-known URL space defined by . A given domain hosts the audits.json summary in /.well-known/audits.json within the website operated by the organization. If Example Corporation operats https://example.com/, then the summary report would be found at https://example.com/.well-known/audits.json.

audits.json Structure The object served from the URL described in will have Content-Type: application/json, and will consist of a single dictionary object with at least two top-level keys: operations and audits. The overall object relationship looks like this:

| audits | +------------+ | +--------+ | urls | | | title | | regs | | | urls | | audits +-' +--------+ +------------+ ]]>

audits Content The audits member is an object where each member is an object with: title, simple textual string describing the audit, and date, date object describing the calendar date (year, month, and day) of the audit's publication, and urls, an array of URLs that point to the relevant materials for the audit

operations Content The operations member is a list of objects, each of which describes some set of business operations, via the following members: urls, an array of URLs, each of which describes a business operation covered by this object (for example, a job listing), regs, an array of URLs, each of which refers to a piece of regulatory guidance, and audits, an array of keys which can be used to point to specific audits

IANA Considerations IANA should register audits.json in the "Well-Known URIs" registry, with the following values: URI suffix: audits.json Change controller: IETF (is this the right choice, if this is an informational draft? is there a better group to control updates to this specification?) Specification document(s): This document Status: provisional (unless we see wider adoption, in which case we should ask for permanent) Related information: Any other examples we want to point to?

In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements. RFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings. This memo defines a path prefix for "well-known locations", "/.well-known/", in selected Uniform Resource Identifier (URI) schemes. In doing so, it obsoletes RFC 5785 and updates the URI schemes defined in RFC 7230 to reserve that space. It also updates RFC 7595 to track URI schemes that support well-known URIs in their registry. American Civil Liberties Union, New York, NY, USA University of Pennsylvania, Philadelphia, PA, USA Political Science, Stanford University, Stanford, CA, USA Harvard University, Cambridge, MA, USA American Civil Liberties Union, San Francisco, CA, USA University of Pennsylvania, Philadelphia, PA, USA ACM Postman JSON Schema defines the media type "application/schema+json", a JSON- based format for describing the structure of JSON data. JSON Schema asserts what a JSON document must look like, ways to extract information from it, and how to interact with it. The "application/ schema-instance+json" media type provides additional feature-rich integration with "application/schema+json" beyond what can be offered for "application/json" documents.

Test Vectors

Example audits.json

JSON Schema For audits.json The following JSON Schema (see ) can be used to validate an audits.json summary file.

For example, you can validate this using with : jv audits-schema.json audits.json Note that JSON Schema cannot represent foreign key constraints, so the fact that each /operations/*/audits must reference a named member of /audits needs to be enforced separately.

Examples of Regulatory Regimes Please propose more pointers for this subsection! established requirements for employers in New York City to publish audits of automated decision-making tools used for hiring Colorado's SB 205 requires developers of some artificial intelligence systems to publish reports about the design and deployment of such systems on their websites The California Consumer Privacy Act requires businesses to create "Risk Assessment Reports" about their use of Automated Decision-Making Technology (ADMT) as well as pre-use notices about ADMT use and regular cybersecurity audits.

Example Regulatory Text A regulation or law that relies on this mechanism to point toward relevant audits can cite it using text similar to the following:

• Any Covered Organization that has a public website shall publicly point to the Required Audits associated with each position using a widely understood mechanism such as the audits.json specification. The Required Audits associated with this act shall refer to the act as https://springfield.example/citycouncil/acts/2025/114

(note that this text presumes that the regulation has defined the terms "Covered Organization" and "Required Audits")

Acknowledgements

Document History

Changes between -00 and -01 added references to CCPA align schema test for jv CLI API 0.7