AI transparency, evaluations and incidents

Three more records complete an agent's governance file, beside its inventory profile and impact assessment (AI system inventory and impact assessments). As there, Zynth records and governs them; it never judges an agent itself.

Transparency disclosures

What an agent's users are told, where, and in which language: the evidence for EU AI Act Article 50 (and Article 26(11) for a person a high-risk system decides about).

One per agent, obligation and language. Obligations: art50_1_interaction (the person is talking to an AI), the other Article 50 obligations (art50_2_synthetic_marking, art50_3_emotion_biometric, art50_4_deepfake, art50_4_public_text), art26_11_decision_subject, other. Each states the audience, the channel (a UI notice, a chat preamble, an email footer, API metadata, a watermark, the terms), the text and where it is shown.
Two people. A disclosure is drafted by one person (aigov:write) and put in force by another (aigov:approve); the author is refused. The approver sends back the content_digest of the disclosure they read, so what is put in force is exactly the disclosure they reviewed (its text, where it is shown and its evidence): if the author edits the draft in between, the approval is refused and the approver reviews it again.
Versioned. A disclosure in force is never edited: draft a new version, and approving it retires the one it replaces, so you can always show what users were told on a given date. Only one version is ever in force, and an older version cannot be put in force over a newer one. Retiring one in force raises a warning. Reviewed yearly.
Watched. Every agent whose inventory profile says it interacts with people needs an art50_1_interaction disclosure in force; Zynth raises a detection for one that has none.
GET /api/v1/aigov/disclosures/report: per agent, the disclosures in force and their history.

Evaluation records

The evaluations you run, recorded with a gate the platform computes.

What you submit: the agent and/or the model (provider, name, version), the suite and its version, the kind (accuracy, robustness, safety, red_team, prompt_injection, fairness, regression, other), when it ran, the dataset, up to 50 named metrics, and for any metric a threshold (min, max or both). An evidence link is optional.
The gate: Zynth compares your metrics with your thresholds: passed, failed (naming the metrics outside their bounds) or no_gate when you declared none (metrics and bounds are finite numbers). A failed gate raises a warning; it blocks nothing.
Append-only. To correct a record, submit a new one naming the record it supersedes and why. A record is corrected once; correct the correction after that.
From CI. POST /api/v1/aigov/evaluations needs aigov:evaluations:submit, which you can delegate to the agent your pipeline runs as. An agent can never submit an evaluation of itself; that is refused and raised.
Watched. An agent whose current approved assessment is high-risk needs a passing evaluation within the last 90 days; Zynth raises a detection when it has none.

Shell

curl -X POST "$ZYNTH/api/v1/aigov/evaluations" -H "Authorization: Bearer $CI_AGENT_TOKEN" \
  -H "Content-Type: application/json" -d '{
    "agent_id": "<the agent under test>", "suite": "claims-triage-regression", "kind": "accuracy",
    "run_at": "2026-10-11T08:00:00Z",
    "metrics": {"accuracy": 0.93, "false_negative_rate": 0.04},
    "thresholds": {"accuracy": {"min": 0.9}, "false_negative_rate": {"max": 0.05}}}'

AI incidents

Linked agents. PUT /api/v1/command/incidents/{id}/agents with agent_ids sets the agents an incident concerns (agents of your organization only). GET /api/v1/command/incidents?agent_id=… lists an agent's incidents.
Serious incidents (Article 73). POST /api/v1/command/incidents/{id}/serious with a category and when you became aware (aware_at, default now) sets the date your report to the market surveillance authority is due: 2 days for a widespread infringement or a serious and irreversible disruption of critical infrastructure (widespread_or_critical_infrastructure), 10 days for a death (death), 15 days otherwise (serious_harm). It raises a critical detection.
The report. POST /api/v1/command/incidents/{id}/regulator-report with reported_at and your report_ref stops the clock; the incident keeps whether it was late (reported_late). Times carry a timezone (a time without one is refused rather than guessed), and a report cannot be dated before you became aware. Until then, Zynth raises a critical detection every day the report is overdue. Filing the report is yours; Zynth tracks the date.
These three acts are for people only, with command:operate.
GET /api/v1/command/detections?family=agents lists only the detections raised by the agent, approval and AI-governance rules.

In the console

AI Governance → Transparency lists disclosures with what is in force and what was; Put in force sends the digest of the disclosure on your screen (its text, where it is shown and its evidence), so an edit made meanwhile is refused and you review it again. Model evaluations lists records with their gate and the metrics outside their bounds, and shows the CI request. AI incidents lists the incidents that concern an agent and the Art 73 clock, and records the agents, the serious declaration and the filed report.