Open and free to adopt
- The specification
- The reference gateway
- The verifier
- The test vectors
SOC 2AICPA Trust Services CriteriaAbout · Investors
AI systems are starting to act on their own: they call tools, move data and trigger payments. qodiqa is the open layer that decides before they act, and proves afterwards what was allowed.
Most controls around AI sit beside the model and report after the fact. qodiqa sits on the path itself. A request carries signed, time-limited consent, a policy decides, and only then is the provider called. Every outcome, allowed or refused, becomes a signed receipt that anyone can check offline, without an account and without trusting us.
It is built, not promised. The standard is published as 32 open documents, the reference gateway and verifiers are public, and 797 documented functions run behind one execution path. Independent verifiers in JavaScript and Python check the same public test vectors.
Whoever runs AI in regulated or high-stakes settings will need evidence they can hand to a customer, an auditor or a regulator. The open standard earns that trust. The business is the commercial layer on top: enterprise identity, data-loss prevention, integration and support.
We are opening conversations with investors who back open infrastructure.
The thesis
Models now call tools, move data and trigger actions on their own, so approval given once is not enough.
How a request is checkedPromises and after-the-fact logs do not stop an action; control has to exist where execution happens.
See the reference gatewayThe EU AI Act asks for record-keeping and human oversight of high-risk systems, and ISO/IEC 42001 sets out an AI management system.
See how qodiqa maps to themWhat exists today
A corpus of documents, from the core standard to conformance, with a CC BY 4.0 licence as stated by the repository.
Read the specificationOpen code under Apache-2.0. What is built and what is not yet is stated on the gateway page.
The gatewayThe verifierSigned receipt cases made with published test keys, so any implementation can be checked against them. They are test data, not production receipts.
Open the test vectorsHow it becomes a business
The standard and the reference code stay open. The business is built around them.

An enforcement layer between applications and AI providers: authorize first, execute second.
PDF · 1 page · 92 KB · QODIQA-OP-1.0 · one page · v1.0 · 2026-10-29
Download PDF
A strategic atlas of pre-execution authorization across industries: 450 potential applications, not implementation status.
PDF · 52 pages · 3.3 MB · Edition 2026
Download PDFMaterials and contact