Metraipolis › archive › dc_caac612b35fc

Open Source as Regulatory Infrastructure: Where the Open/Closed Line Should Sit for AI Governance Tooling (2026) · DOI 10.31219/osf.io/u9jgk_v1

Source: Metraipolis archive
Original: https://doi.org/10.31219/osf.io/u9jgk_v1
License (as archived): CC-BY-4.0
Archived: 2026-10-24T00:37:32.324Z
SHA-256 of the archived text: 5ecc889f386f04c75afc372d96f6ff8ffc4d762cb1fa9b769b29fb68e882c277
Stable URL of this page: https://metraipolis.com/documento/dc_caac612b35fc

How to cite

Open Source as Regulatory Infrastructure: Where the Open/Closed Line Should Sit for AI Governance Tooling (2026) · DOI 10.31219/osf.io/u9jgk_v1 — Metraipolis archive, https://doi.org/10.31219/osf.io/u9jgk_v1 (CC-BY-4.0); archived copy: https://metraipolis.com/documento/dc_caac612b35fc (Metraipolis archive dc_caac612b35fc, sha256 5ecc889f386f04c75afc372d96f6ff8ffc4d762cb1fa9b769b29fb68e882c277)

BibTeX

@misc{dccaac612b35fc,
  title = {Open Source as Regulatory Infrastructure: Where the Open/Closed Line Should Sit for AI Governance Tooling (2026) · DOI 10.31219/osf.io/u9jgk_v1},
  howpublished = {Metraipolis archive},
  url = {https://doi.org/10.31219/osf.io/u9jgk_v1},
  note = {License CC-BY-4.0; archived copy https://metraipolis.com/documento/dc_caac612b35fc; sha256 5ecc889f386f04c75afc372d96f6ff8ffc4d762cb1fa9b769b29fb68e882c277},
  year = {2026}
}

Archived text

Reproduced under CC-BY-4.0. Attribution: Metraipolis archive, https://doi.org/10.31219/osf.io/u9jgk_v1. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Articolo recente con licenza aperta: scheda dai metadati Crossref (posted-content).
Titolo: Open Source as Regulatory Infrastructure: Where the Open/Closed Line Should Sit for AI Governance Tooling
Autori: Harish Kumar
Pubblicato: 2026-10-22 · editore: Center for Open Science
DOI: https://doi.org/10.31219/osf.io/u9jgk_v1
Licenza dell'articolo: CC-BY-4.0

Abstract (testo degli autori, CC-BY-4.0):
The EU Artificial Intelligence Act obliges providers and deployers of high-risk AI systems to generate, keep and hand over records: automatically generated logs, technical documentation, and information supplied to authorities on request. A market of "AI governance tooling" is forming to produce those records. This paper asks a narrow question that the Act does not answer: who can check such a record, and with what? If the only software able to read and verify an evidence record is sold by the party whose customer produced it, then regulators, notified bodies and affected persons depend on that vendor's goodwill, pricing and survival. We call this the verification asymmetry.We first set out, cautiously and from the primary texts, how EU law treats open source today: the AI Act's exclusions and carve-outs (Article 2(12), Article 25(4) as amended by Regulation (EU) 2026/1744, Article 53(2), recitals 89 and 102-104); the Cyber Resilience Act's definition of free and open-source software and its "open-source software steward" regime (Articles 3(14), 3(48), 24, 25 and 64(10)); and the one place we found where Union law requires open-source licensing of trust-critical software, the European Digital Identity Wallet (Article 5a(3) of Regulation (EU) No 910/2014 as amended). We then examine four precedents in which open verification became shared infrastructure - Certificate Transparency, ACME and Let's Encrypt, Sigstore, and reproducible builds - and identify what made them work, including the parts that have nothing to do with licensing.We compare three places a vendor could draw the line - everything open; open verification with commercial operation; closed with escrow and authority access - and their consequences for regulators, deployers, affected persons and vendors. We argue that the verification side (format specifications, verifier implementations, test vectors) has the economic character of infrastructure and should be open, while value-added operation can remain commercial, and we make recommendations to policymakers and standardisation bodies. The paper is conceptual: it reports no measurements and takes no position on any particular company's licensing decisions.---

Fonte: https://api.crossref.org/works/10.31219%2Fosf.io%2Fu9jgk_v1 — metadati Crossref, consultati il 2026-10-24. Interrogazione: «open science infrastructure».