Standards bodies

CEN-CENELEC JTC 21

AI Act harmonized standards under Standardisation Request M/593 (and Amendment M/613).

JTC 21 is the European committee delivering harmonized standards for AI Act presumption-of-conformity. Work is organised across five working groups; the most relevant to cryptographic attestation are WG2 (operational aspects, AI risk management systems) and WG3 (trustworthiness).

Posture: observer and prospective contributor via the Estonian national mirror committee at the Estonian Centre for Standardisation and Accreditation (Eesti Standardimis- ja Akrediteerimiskeskus, EVS).

Status: a brief derived from the survey paper and the companion mapping paper is in preparation as a possible input to JTC 21 workstreams on AI System Logging (prEN ISO/IEC 24970) and trustworthiness (WG3). At the time of writing no submission has been made.

ETSI TC ESI

Technical Committee on Electronic Signatures and Trust Infrastructures.

TC ESI maintains the ETSI EN 319 family — the technical backbone for eIDAS trust services — and has announced a trustworthy-AI workstream that sits at the eIDAS / AI Act interface.

Posture: prospective observer via national member channels and through TC ESI's public-comment mechanisms.

Status: on-site attendance is confirmed for the joint ETSI/CEN workshop on the EU Digital Identity Wallet in Sophia Antipolis. Tyche will show its MachineMandate research demonstrator at a table during workshop coffee breaks on 30 September and 1 October 2026. This is a demonstration table, not a programme talk, TC membership, standards submission, or ETSI/CEN endorsement. No standards submission has been made.

ISO/IEC JTC 1/SC 42

Artificial Intelligence.

SC 42 is the international counterpart to CEN-CENELEC JTC 21 and the upstream source for several harmonized standards being mirrored into the European program.

Posture: prospective observer, expected to follow rather than lead the European tracks. Engagement mediated through the same national body (EVS).

IETF SCITT

Supply Chain Integrity, Transparency, and Trust Working Group.

SCITT is the most relevant cryptographic-transparency forum for the patterns described in the survey paper. Its transparency-service abstractions overlap with the AAL-2 logging requirements specified by OVERT 1.0.

Posture: individual contributor. Anton Sokolov co-authors the individual Internet-Draft draft-mih-sokolov-scitt-payload-binding, “Canonical Payload Binding: A Signed Statement Construction Profile” (with Steven Mih, Action State Group; revision -01, July 2026). The draft profiles how independently written systems that anchor records to a SCITT transparency service derive a canonical form, a content-addressed identifier, and a receipt binding. It is an individual submission, not a working-group document; it has not been adopted by the SCITT WG.

IETF RATS

Remote ATtestation procedureS Working Group (RFC 9334).

RATS standardises how a Verifier appraises Evidence about a platform. Tyche's contribution sits at the layer above the hardware root of trust: attesting that an AI agent's governance controls actually executed, and composing that application-layer evidence with RATS platform attestation rather than replacing it.

Posture: active individual contributor. Anton Sokolov is subscribed to the RATS Working Group mailing list and engaged with the Veraison open-source verifier community.

Status: individual Internet-Draft draft-sokolov-rats-aep-composition, “Composing Application-Layer Action Evidence with Remote Attestation Procedures,” first published 25 June 2026 and since revised (revision -03, July 2026). This is an individual submission, not a working-group document; it has not been adopted by the RATS WG. The feasibility check uses an emulated software TPM (swtpm) and demonstrates the composition mechanics, not a hardware guarantee. See the announcement.

IEEE 8000 Working Group — Trustworthiness of Artificial Intelligence

IEEE SA entity-method working group; project P8000.1.

The IEEE 8000 working group develops standards on the trustworthiness of artificial intelligence — a body whose subject matter borders the governance-evidence questions Tyche works on.

Posture: prospective observer; no meeting attended. The IEEE SA Standards Board Bylaws (§5.2.1.2, entity method) let any entity that is not an IEEE SA Entity Member observe working-group meetings, obtain meeting-related documentation other than draft standards, and speak at the chair's discretion. Tyche is not an IEEE SA Entity Member, is not a working-group member, and has no vote or ballot. If IEEE SA opens a public review of P8000.1, Tyche may comment there.

PKI Consortium

Industry consortium on PKI operations, certificate transparency, and post-quantum migration.

The PKI Consortium convenes certificate authorities, vendors, and relying parties around operational PKI questions. Its Post-Quantum Cryptography Working Group and the certificate lifecycle and transparency tracks intersect the root-of-trust assumptions that AAL-2 attestation logging inherits from the Web PKI.

Status: Tyche Institute's organisational membership was approved by PKIC on 16 June 2026. We are now listed as a member of the PKI Consortium and participate in bi-weekly meetings and working group discussions.

W3C Credentials Community Group

Verifiable credentials and decentralized identifiers at the W3C.

The Credentials Community Group incubates the verifiable-credential and decentralized-identifier specifications that underpin much of the attestation patterns in the survey — the closest W3C venue to Tyche's subject matter.

Posture: participant. Tyche Institute has joined the group under the W3C Community Contributor License Agreement. Community Group participation is open to anyone and is not W3C Membership; it confers no vote in W3C's formal standards process.

Decentralized Identity Foundation (DIF)

Interoperable specifications for decentralized identity and verifiable credentials.

DIF develops the decentralized-identity and verifiable-credential specifications most directly adjacent to the offline-verifiable attestation artifacts Tyche works on.

Posture: Contributor. Tyche Institute joined DIF as a Contributor organisation in June 2026, which admits the institute to DIF Working Groups under the Contributor agreement.

OpenID Foundation — DCP Working Group

Digital Credentials Protocols: OpenID4VCI, OpenID4VP, HAIP, and SIOPv2.

The Digital Credentials Protocols Working Group develops the issuance and presentation protocols — OpenID4VCI and OpenID4VP — and the High Assurance Interoperability Profile (HAIP) that shape EUDI Wallet interoperability and certification. It is the standards venue closest to Tyche's EUDI wallet and verifiable-presentation research.

Posture: Contributor. Tyche Institute has signed the OpenID Foundation contribution and IPR agreements, which admit participation in the DCP Working Group. This is participation under the contribution agreements, not OpenID Foundation membership.

Status: contribution and IPR agreements signed in July 2026, which under the OpenID Foundation's own process admit participation in the Working Group. A first interop note to OpenID4VP — a worked, recomputable transaction_data / KB-JWT example the specification could carry, plus one multi-credential question — is filed as OpenID4VP issue #754. It is an interop report and offer; no specification text has been contributed or adopted yet.

Open standards and implementation contributions

Tyche also contributes through public issue trackers and reviewable pull requests. These records are open contributions, not adopted standards or organisational endorsements:

• Eclipse ORC Working Group: CRA FAQ pull request #353 adds six draft questions on AI systems, AI agents, and the AI Act. The pull request remains open and unmerged.
• Composable trust: composable-trust-specs issue #1 records deterministic-CBOR profile, exceptional-value, and test-vector questions for byte-stable trust objects.
• Digital credentials: a technical comment in OpenID DCHP issue #18 identifies the float-width consequence of selecting RFC 8949 deterministic encoding for signed transcript bytes.
• SCITT payload binding: issue #17 asks that a registry summary avoid silently pre-deciding the canonical CBOR profile before the normative choice is made.

What this means

The industry and community groups Tyche has joined are the PKI Consortium (industry consortium), the W3C Credentials Community Group (open participation), the Decentralized Identity Foundation (Contributor), and the OpenID Foundation DCP Working Group (contribution agreements signed; a first OpenID4VP interop note filed). The other channels above are observer-level, named here so a reader can locate them.

Tyche has also made individual contributions to the IETF RATS and SCITT ecosystems — a published Internet-Draft on composing action evidence with remote attestation (announcement) and a co-authored Internet-Draft on canonical payload binding for SCITT transparency services. Both are individual submissions that have not been adopted as working-group documents.

Public issue and pull-request contributions also cover CRA guidance for AI agents, deterministic CBOR for signed trust objects, OpenID digital credentials, and SCITT registry semantics. Their state is shown above; open proposals are not described as adopted work.

PKI Consortium membership is an industry-consortium affiliation, not an endorsement of Tyche Institute's publications, tools, or positions.

This page is the status; it will be updated when a submission is made or a posture changes. See the Research page for the underlying papers.