SANDBOX DEMO · illustrative worked example on sandbox.0pn.org · not a certification, not adopted ISO text
0PN Lab · Demo P2.4 · Idea #8

AI training-data consent, proven before use.

An AI system's data use disclosed before secondary or unexpected use, across lawful bases and jurisdictions, carried as an inspectable receipt rather than an asserted policy. Two panels: the AI-required-information receipt it issues, and how the governing instrument scores.

Transparency by default: proven and inspectable, not asserted.
Panel A

The AI-required-information receipt (1FN / 2FN)

A single notice-and-consent receipt carrying the AI-required information set I1 to I16. The AI-specific fields are marked AI. Illustrative example system; the resolvable fields below reference the live TCIEG UK worked example served from the 0PN registry.

Aperture Vision Model v3
General-purpose vision model · example AI system
Notice receipt 2FN 1FN disclosure + returned consent
Active state: VALID · live at source (I15)
I1 · I14
Accountable party & issuing authority
Controller: TCIEG UK · did:web:0pn.org:registry:tcieg.org
Issuing authority: 0PN (operated by Global Privacy Rights) · did:web:0pn.org
Registry id: tcieg.org · jurisdiction United Kingdom
Anchor: Convention 108+ Art 8; CIR · resolvable before collection
I2 · I4
Lawful basis per purpose
Service delivery, contract Model training, compatible use (Art 5.4) Safety evaluation, legitimate interest
Anchor: Convention 108+ Art 5; explicit DPV legal-basis code per purpose
I3 AI
Secondary-purpose basis for model training
Training on collected data is an explicitly authorised secondary purpose, evidenced under the compatible-use test, not inherited or assumed.
Anchor: Convention 108+ Art 5.4 (compatible use)
I5 AI
Training-data provenance
Licensed image corpus (contracted) Consented contributor uploads Public-domain sets
Each contribution carries a receipt id (I13) back to its notice.
Anchor: AI Act 53(1)(d); provenance carried with the contribution
I7 AI
Personal-data categories in training data
Facial images Location metadata Device identifiers No special-category data
Anchor: Convention 108+ Art 5 to 6
I8 AI
Processing & destination jurisdictions
Training: United Kingdom Inference: Canada (PIPEDA) Art 14 safeguard: adequacy + SCC
Anchor: Convention 108+ Art 14; resolvable in advance
I9 AI
Automated-decision / inference scope
Model performs automated visual classification. No solely-automated decision with legal or similarly significant effect; human review on flagged outputs.
Anchor: Convention 108+ Art 9.1.c
I10
Rights & withdrawal route
Access, rectification, objection, and withdrawal of the training authorisation at:
uk1.0pn.org/listing/tcieg.org/rights
Anchor: Convention 108+ Art 9; withdrawal bound to this receipt
I16 AI
Chain of notice, a notice per participant, bound to ISO/IEC 22989 roles
Designer
22989: AI system designer
Aperture Labs
Developer
22989: AI developer
Aperture Labs
Trainer
22989: AI system operator (training)
TCIEG UK
Deployer
22989: AI system operator (deploy)
TCIEG UK
Anchor: chain-of-notice; each participant's notice tested by the next stakeholder

Verify this receipt (I11 · I12 · I13 · I15)

I13 Receipt id 0pn:rcpt:tcieg.org:av3-2026-08-20-0001
I12 Notice version hash f2ad0963…ca2810af
I11 Machine-readable record CIR + status.json, dual-held (controller + individual)
CIR pin (sha256) 0262a98dc36471ec459ddb8b2eaef53c2148405c37526c8c7fb9bbcac1b7f6c9
I15 Active state valid · issuer 0PN
Open live CIR Open active-state
Pin matches: CIR sha256 0262a98d…f6c9 · active_state valid · issuer 0PN. Proven, not asserted.
Panel B

TPI v2 governance-instrument comparison

A Regulatory Capacity Audit of the two instruments that govern the receipt above, scored on the four Layer-A indicators. Each indicator is −1 / 0 / +1 against the baseline. The instrument, not a single system, is under audit.

EU AI Act Art 53 approachas read by the AIAL GPAI recommendations
−2
aggregate, 4 indicators
0PN / ANCR DPV Convention 108+ extensionreceipt-oriented, evidence-first
+4
aggregate, 4 indicators
Layer-A indicator EU AI Act Art 53 DPV Conv 108+ Evidence
TPI-1 Controller identification timing −1 +1 Art 53: summary is retrospective, no controller-id before processing. Ours: notice before identification, synchronic (I1).
TPI-2 Controller identification completeness 0 +1 Art 53: narrative summary, provider-held, no resolvable record. Ours: resolvable CIR + machine-readable record (I11, I14).
TPI-3 Rights-access mechanisms 0 +1 Art 53: defers to GDPR, no receipt-bound route. Ours: rights-access reference + withdrawal in the receipt (I10).
TPI-4 Cross-border transfer transparency −1 +1 Art 53: template silent on transborder. Ours: jurisdiction-scoped identifier + Art 14 safeguard (I8, I14).
Aggregate −2 +4 Draft Layer-A scorecard, expert-authored, for ratification.

Baseline: Convention 108+ Art 8.2 · method_version v2.0 · analytical expert judgment, not an automated probe. Source: AI-required-information comparison report, Part 5.

Honesty flag. TPI v2 (Regulatory Capacity Audit) is a 0PN / ANCR method that is in development and not adopted ISO text. The scores above are a draft, expert-authored scaffold pending Mark's ratification. TPI v3 conformity tiers are also in development. Assurance is not certification.