Trustparency

Evidence-based transparency for the AI era.

Privacy policies are not transparency. Transparency Lab researches and assesses what services actually disclose, and publishes the evidence. Check your own service with the free self-assessment, work with us on transparency and consent, or commission an independent assessment of a third party you are evaluating.

How we work together → The standards work →
How we work together

Consulting, assessments and research

Check your own service for free, work with us to make transparency and consent operational, or commission an independent assessment of someone else. The Lab never advises and assesses the same organisation.

Check · Free

Transparency Self-Assessment

No charge · reviewed by the Lab

Check your own service against the ANCR transparency performance indicators, with a module for AI. Submissions are reviewed privately, held in Montreal, and not published unless you ask to be listed.

  • Assessed against standards as published, not against work in progress
  • Indicators drawn from ISO/IEC 29184, ISO/IEC TS 27560:2023 and the ANCR Extension
  • A receipt for your submission, and withdrawal by receipt
  • Not a certification, an audit opinion or advice
Start the self-assessment →
Advise · Fixed fee

Transparency and Consent Consulting

From CAD 3,500 · readiness briefing and written memo

Where your organisation stands under PIPEDA, Quebec's Law 25, Bill C-36 and Bill C-22, and how to make notice and consent work in operation rather than on a policy page.

  • Machine-readable transparency notices and notice receipts
  • Consent and authorisation records a regulator can inspect
  • Disclosures before personal information or identifiers cross a border
  • A four to six page memo you can put in front of a board
Book a briefing →
Advise · AI systems

Operational Transparency for Security and Privacy in AI Systems

Scoped engagement · fixed fee on proposal

Who stands behind an AI system or agent, what it is authorised to do, and what record the person it acts on can keep. Security and privacy built from records, not assertions.

  • Accountable party and authority published before anyone is identified
  • Notice through the chain: designer, developer, trainer and deployer
  • Access to AI systems and their data that is credentialed, logged, approved and bounded
  • AI Undermark and a machine-readable reservation for published work
Discuss an engagement →
Assess · Evidence

Digital Trust Assessment

CAD 2,750 focused · CAD 4,500 standard

For parties assessing someone else. What a named service actually discloses, assessed against the requirement rather than against its own account of itself, with the evidence attached.

  • Commissioned by regulators, procurement teams, investors conducting diligence, and litigation funders
  • Scored assessment using the published TPI method
  • Evidence pack, so every finding points at something observable
  • An assessment, not a certification
Commission an assessment →

Independence. Transparency Lab advises and assesses, but never the same organisation. It does not assess an organisation it has advised in the previous 8 months, it does not advise an organisation on a finding it has made, and it does not sell remediation to an organisation it has assessed. Standards participation is disclosed below and is never sold: no engagement is available in respect of a work item under development, and no engagement carries influence over the content of any standard. A full impartiality and recusal policy is in preparation and will be published here.

The idea

Trustparency

Claimed transparency is worthless. Evidence-based, inspectable transparency is the only kind that supports trust or enforcement.

The world needs a visible signal for data, the way a sign on the land tells you where you stand. The analogy is the Forest Charter: a public, legible mark that told you the boundary of what was private.

What we call Trustparency is that signal for digital systems. Not a privacy policy. Not a checkbox. A machine-readable, independently verifiable record that a notice was issued, at this version, at this time, and that the data was collected under a declared legal basis.

The difference between clean AI and dirty AI is whether that record exists.

AI transparency

Who stands behind the AI?

AI systems now generate content and act for people. The questions are the old ones, asked at machine speed: who is accountable, what was disclosed, on what authority, and what evidence remains afterwards. We assess AI services against those questions and publish what we find.

Research

Who stands behind the agent?

Accountable agents are being designed for the systems that receive their requests. The person the agent acts on needs a record too, before they are identified.

Read the article → Self-assessment

AI transparency module

Check your own service against the ANCR transparency indicators, with a module for AI: who is identified as accountable, what is disclosed about AI use, and what record the person keeps.

Start the self-assessment → Assessment

Assessing an AI service

For regulators, procurement teams and investors: what an AI service actually discloses about its accountable party, its use of AI and the records it leaves, assessed with evidence attached.

Commission an assessment →
In development

Also being built

A Canadian digital privacy officer course. It is not open for enrolment. Dates and pricing will be announced here when they are. Tell us you are interested →

Twenty years in the making

Standards Work

The transparency and consent standard at the heart of this work has been in development for roughly twenty years, through ISO/IEC processes, Council of Europe liaison roles, and interoperability standards bodies.

These standards are not separate. They are layers of one Internet Transparency Stack, from OECD principles and Convention 108+ through ISO/IEC TS 27560 and its ANCR Extension to a proposed Internet Transparency Code of Practice. Each layer makes the one above it inspectable rather than asserted. Read the stack → · CPDP 108+ panel →

This is not theoretical. CAN/DGSI 133, Canada's national consent standard, references ISO/IEC 29184 and ISO/IEC TS 27560 and is built to work hand-in-hand with them, the same layers at the heart of this work.

ISO/IEC TS 27560:2023

Consent record standard. The technical anchor for machine-readable notice and consent.

ISO/IEC PWI 26689

Preliminary work item at ISO/IEC JTC 1/SC 27/WG 5: gap analysis for standards on privacy notices and consent, and ways to address potential gaps.

Council of Europe ยท Convention 108+

Contributing on codes of practice and notice records to the Committee's work on transborder data flows.

Where this work is being written

  • Editor, ISO/IEC preliminary work item on an internet transparency code of practice profile, ISO/IEC JTC 1/SC 44/WG 1
  • Project editor, ISO/IEC PWI 26689, notice and consent records, ISO/IEC JTC 1/SC 27/WG 5
  • Editor, ANCR Extension for ISO/IEC TS 27560:2023, Kantara Initiative · Release 1, free to read →
  • Member, Canadian mirror committee to ISO/IEC JTC 1/SC 27/WG 5

Standards work by Transparency Lab

Research & Writing

From the Lab

The standards work, in the open: research and writing on transparency, consent, and AI governance, published by Global Privacy Rights.

Work with us

Get in touch

For regulators, procurement teams and investors who need to know where someone else stands. Evidence-based assessments, with research published by Global Privacy Rights.

Start a conversation

[email protected] →